Threat Intelligence Update: 9 November

Essential Insights

1. A compromised cPGuard update infected about 2,950 servers with a backdoor that stole credentials; a separate attack wiped data across Russian host Beget’s cloud infrastructure.
2. Criminals used AI-powered ARTEX to exploit exposed systems, steal more than 300 iOS signing certificates, and harvest roughly 190,000 gaming credentials.
3. Attackers actively exploited flaws in SonicWall SSL VPN, OpenSSH, and other products to bypass authentication or gain system access; OpenSSH exploitation included root access.

Threat, Attack Techniques, and Targets

• Queens Public Library faced ransomware that encrypted its systems and disrupted public computers, Wi-Fi, checkout equipment, digital media, and its mobile app. However, all 66 branches stayed open.
• On November 1, attackers wiped data across Russian host Beget’s cloud infrastructure. The attack disrupted hundreds of websites, and staff needed to inspect more than 1,000 servers before restoration. Attackers also destroyed some backup data.
• On November 2, attackers used compromised OPSSHIELD credentials to distribute a malicious update for cPGuard. About 2,950 customer servers ran a script that installed a backdoor and collected password hashes, credentials, and sensitive files.
• Attackers sent false radiation, chemical threat, and military alerts to Kyiv users through Ukraine’s Air Alert app. Developers suspended notifications temporarily. A separate attack targeted Russia’s emergency alert app, but both countries said their core warning systems remained operational.
• Check Point researchers found 1,608 public ARTEX instances. Cybercriminals used the AI framework to find and exploit vulnerable systems, collect more than 300 iOS signing certificates, and steal about 190,000 gaming credentials.
• Researchers found Haiou, a jailbreak bundle for OpenAI Codex. It weakens safeguards and changes agent instructions to promote an external AI gateway. However, researchers did not confirm criminal intent by its developers.
• India’s CERT identified Crafty Falcon targeting financial and cryptocurrency firms. The group exploited links between testing and production systems, abused payment APIs, and stole wallet credentials. It also used AI tools to create attack scripts and automate intrusions.
• In addition, researchers reported espionage campaigns. APT29 used compromised or imitation websites to target iPhone and Android users, especially in Ukraine. BITTER sent fake diplomatic and military files to government, energy, and engineering groups in South Asia to install PapRAT spyware. SlippyNunchucks abused Sogou Input Method updates and configuration to deliver DarkVigil malware in several countries.
• Researchers also tracked HYFLOCK ransomware, which added file encryption, scheduled task execution, and network share access. The group claimed eight victims in October.

Impact, Security Implications, and Remediation

• These attacks disrupted public services, websites, and emergency alerts. They also exposed credentials, server files, and mobile data. Meanwhile, ransomware and destructive attacks put systems and backups at risk.
• SonicWall released a fix for a high severity flaw in SonicOS SSL VPN services using SAML authentication. Attackers with valid credentials for another login method could bypass SAML controls, including multifactor authentication. Apply the vendor fix.
• Google’s November Android Security bulletin fixes vulnerabilities across Android components. It includes a critical flaw that could allow remote code execution without user action on Android versions 14 through 17. Apply the relevant Android security updates.
• Barracuda fixed two high severity Email Security Gateway flaws. Attackers with access to the administrative interface could combine authentication bypass and command injection to gain root control. Apply Barracuda’s updates.
• OpenSSH version 10.6p2 fixes a high severity flaw affecting some Linux systems that use the musl library without PAM authentication. Attackers exploited oversized passwords to bypass authentication, and researchers observed successful root access. Upgrade to the fixed version.
• Tencent addressed the Sogou Input Method delivery issue in version 16.10. Organizations using the affected software should obtain and apply the vendor’s update.
• Finally, the report gives no specific remediation for the other incidents or campaigns. Affected organizations should obtain guidance from the relevant vendor or authority.

Continue Your Tech Journey

Dive deeper into the world of Cryptocurrency and its impact on global finance.

Explore past and present digital transformations on the Internet Archive.

ThreatIntel-V1