The Good | Russian-Based APT28 & LockBit Developer Condemned and Charged by International Enforcement

International law enforcement agencies took a hard stance against GRU-linked threat actors this week with the official condemnation of APT28 (aka Strontium, Fancy Bear, Forest Blizzard) and identification and sanctioning of LockBit ransomware’s administrator and developer.

NATO and the EU, joined by the U.S. and U.K., formally condemned the Russian threat group known as APT 28 for a long-term cyber espionage campaign against various European countries. In particular, Germany and the Czech Republic highlighted an email-based attack last year on various government agencies as well as organizations across the military, air and space, and IT sectors in NATO member countries, NATO fast reaction corps, and Ukraine. APT 28 has also been known to target critical infrastructures in various other EU member states.

The 2023 attack leveraged CVE-2023-23397, a zero-day vulnerability in Microsoft Outlook, to steal credentials, perform lateral movement in victim networks, and exfiltrate sensitive emails from specific accounts. NATO called on the Russian state to “respect their international obligations and commitments to uphold international law and act within the framework for responsible state behavior in cyberspace.”

From the DoJ, the identity of the developer and administrator behind the notorious LockBit ransomware group has finally been unveiled. Russian national Dmitry Yuryevich Khoroshev (aka LockBitSupp and putinkrab) is also being sanctioned by various international enforcement agencies with the U.S. Department of State offering a reward up to $10 million for information leading to his arrest or conviction.

Khoroshev’s sanctioning follows the joint operation earlier this year disrupting LockBit ransomware infrastructure and operations. Before the seizure of its public-facing websites and servers, Khoroshev and his affiliates were instrumental in LockBit’s rise to one of the world’s most prolific ransomware variants and operations, worth billions of dollars in damages and loss.

The Federal Energy Management Program’s (FEMP’s) Data Center Program assists federal agencies and other organizations with optimizing the design and operation of energy and water systems in data centers. It also funds the work at the Center of Expertise for Energy Efficiency in Data Centers (CoE) at Lawrence Berkeley National Laboratory.
 

Infostealers targeting macOS devices have been on the rise for well over a year now, with variants such as Atomic Stealer (Amos), RealStealer (Realst), MetaStealer and others widely distributed in the wild through malicious websites, cracked applications and trojan installers. These past few weeks have seen a new macOS malware family appear that researchers have dubbed ‘Cuckoo Stealer’, drawing attention to its abilities to act both as an infostealer and as spyware.

In this post, we review Cuckoo Stealer’s main features and logic from a detection point of view and offer extended indicators of compromise to aid threat hunters and defenders. At the time of writing the latest version of XProtect, version 2194, does not block execution of Cuckoo Stealer malware. SentinelOne customers are protected from macOS Cuckoo Stealer.

More Cuckoo Stealers Appearing

Since the initial report on the emergence of this family of malware on April 30, we have seen a rise in new samples and trojanized applications from the four originally reported by Kandji to 18 unique trojanized applications at the time of writing, with new samples appearing daily.

The trojanized apps are various kinds of “potentially unwanted programs” offering dubious services such as PDF or music converters, cleaners and uninstallers (a full list appears in the IoCs at the end of this post) such as:

App Uninstaller.appDumpMedia Amazon Music Converter.appFoneDog Toolkit for Android on Mac.appiMyMac PDF Compressor.appPowerUninstall.appTuneSolo Apple Music Converter.app

As reported previously, these applications contain a malicious binary in the MacOS folder named upd. The most recent binaries – in ‘fat’ and ‘thin’ versions for both Intel x86 and arm64 architectures – are ad hoc codesigned and their parent applications all share the same bundle identifier, upd.upd.

Mission Critical is excited to introduce you to the 2024 Top 25 Women in Technology. Meet Julia Larikova.

The groundbreaking new iPad Pro features a stunningly thin and light design, taking portability and performance to the next level.

Apple today announced the redesigned 11-inch and all-new 13-inch iPad Air, supercharged by the M2 chip.

Apple today announced M4, the latest Apple-designed silicon chip delivering phenomenal performance to the all-new iPad Pro.

Apple today introduced Final Cut Pro for iPad 2, bringing huge updates that unleash the remarkable capabilities of the new iPad Pro.

Apple today unveiled the all-new Logic Pro for iPad 2 and Logic Pro for Mac 11, delivering breakthrough professional experiences.

Mission Critical is excited to introduce you to the 2024 Top 25 Women in Technology. Meet Alley LaBossiere.

In May and June, Apple Arcade adds five new titles, including Rabbids: Legends of the Multiverse and the spatial game Where Cards Fall.

Apple introduces a new Apple Watch Pride Edition Braided Solo Loop, and a matching watch face and dynamic iOS and iPadOS wallpapers.

This article is the third and final part of a series on the topic of solutions for always-on mission-critical microgrid applications. In our last installment, we discussed fuel cells as a fast-emerging solution for carbon-neutral, always-on applications.

AWS investments are estimated to create at least 1,000 jobs and support new workforce development training programs and local community projects in the state.

New Meta data center will join the company’s other Alabama data center campus, located in Huntsville, representing a total investment commitment of $1.5 billion.

Apple today announced financial results for its fiscal 2024 second quarter ended March 30, 2024.

Mission Critical is excited to introduce you to the 2024 Top 25 Women in Technology. Meet Ciarra Huhman.

It’s been little more than a week since Apple rolled out an unprecedented 74 new rules to its XProtect malware signature list in version 2192. A further 10 rules were appended in version 2193 on April 30th. Cupertino’s security team were clearly hoping that a concerted effort would serve to disrupt prolific adware distributor Adload’s assault on macOS devices. Those behind the adware, however, appear to have pivoted quickly as dozens of new Adload samples are already appearing that evade Apple’s new signatures.

In this post, we take a look at one variant of these new samples that is almost entirely undetected on VirusTotal at this time. We hope this exposure will both help inform security teams looking to keep adware nuisances out of their environment and serve to boost detection recognition across other vendor engines.

Apple’s Massive Adload Signature Update

With XProtect version 2192, Apple added 74 new rules to XProtect.yara. While a few of these were targeted at other malware and adware distributors, the vast majority targeted adware widely known as Adload.

Well, there are 74 new rules in XProtect v2192 , so it's going to take me a bit to update https://t.co/Fgr7MGgRL2 with sample hashes, but interesting to see Apple trying to disrupt Adload's entire codebase. pic.twitter.com/n0eX6FfSEh

— Phil Stokes ⫍⫎ (@philofishal) April 25, 2024

Meet Dezmond Blair, Elena Galluzzo, and Jawaher Shaman, three winners of Apple’s 2024 Swift Student Challenge.

Hydrogen has a role to play in delivering power with zero emissions at the point of use, including as part of mission critical and backup power systems.