The Red Report 2024

The Top 10 MITRE ATT&CK Techniques Used by Adversaries

Welcome to Picus Security's monthly cyber threat intelligence roundup!

Each month, we aim to provide a comprehensive yet digestible analysis of the evolving threat landscape, including insights into the most targeted and at-risk sectors, industries, and regions by cybercriminals in the wild.

Our research is conducted throughout the entire month, utilizing a diverse range of resources that span across threat intelligence and malware dump platforms, blogs, exploit databases, sandboxes, and network data query results. We draw upon this wealth of information to provide you with a holistic understanding of the cyber threat environment, with a particular focus on dissecting malware campaigns, attack campaigns conducted by threat actors and advanced persistent threat (APT) groups, and new malware samples observed in the wild.

By following our monthly threat report, you'll be able to ascertain which threat actors or malware could potentially impact your sector, gauge if your country is being specifically targeted, and understand if there is a surge in threat activity correlated with geopolitical events or state-backed actions.

KNOW WHO IS TARGETING YOU: GET YOUR FREE THREAT INTELLIGENCE REPORT

Top Four Most Targeted Regions in July

Northern America (U.S) emerged as the foremost targeted region in July 2023, facing threats from multiple prominent threat actors like Storm-0558 ([1], [2]), ALPHV (BlackCat) ([3], [4], [5]), Cl0p [6] and NoEscape [7], Ransomware Gangs, and the SiegedSec Hacker Group, among others. The attackers leveraged various tools and malware such as backdoors or ransomware, which can be seen in Table 1.
Europe stood as the second most targeted region, witnessing attacks predominantly from actors like Storm-0978 [8], Lazarus APT [9], APT31 [10] and the Turla Hacking Group [11]. Notable malware in these campaigns included the Ursnif Banking Trojan [12] and the WikiLoader Downloader Malware [13], which mainly targeted Italian organizations
In East Asia, actors such as APT37 [14], LockBit 3.0 [15] Ransomware Gang, Storm-0558 [16] remained active. In addition, an emerging threat group called Mysterious Elephant [17] is targeting Asia-Pacific countries.
Government Agencies, Finance, Education, Energy, and Healthcare are the top five sectors under constant siege, predominantly from Cl0p Ransomware Gang, Lazarus APT, LockBit, BlackCat Ransomware Gang, and other varied threat actors. These sectors are prime targets due to their vast repositories of sensitive data, financial assets, and critical infrastructure, providing opportunities for ransom demands, data theft, and geopolitical disruption.
Lastly, South Asia encountered threats mainly from the Bahamut APT [18], DoNot APT [19], and ALPHV (BlackCat) Ransomware Gang. In addition, India's cybersecurity agency, CERT-In, has issued a warning about a newly identified ransomware called 'Akira' [20], which targets both Windows and Linux operating systems and compromises users through VPN services, deploying tools like AnyDesk, WinRAR, and PC Hunter.

	Most Targeted Region	Threat Actor	Malware and Tools
1	Northern America (U.S.)	RStorm-0558 ([1], [2]), ALPHV (BlackCat) Ransomware Gang ([3], [4], [5]), Cl0p Ransomware Gang [6], Storm-0978 [8], NoEscape Ransomware Gang [7], SiegedSec Hacker Group [21], Snatch Ransomware Gang [22], Midnight Blizzard [23]	SpyBoy Terminator [3], Cobalt Strike [3], LaZagne Tool [3], Cl0p Ransomware [6], LEMURLOOT Web Shell ([6], [24]), FlawedAmmyy / FlawedGrace RAT ([6], [24]), DBot RAT ([6], [24]), Truebot ([6], [24]), Cobalt Strike ([6], [24]), DEWMODE Web Shell ([6], [24]), BlackCat Ransomware [3], ExMatter Malware [5], Sphynx Ransomware [5], Impacket Toolkit ([8], [5]), Blackmoon Trojan (KRBanker) [25], Cigril Tool [2], SoftEther Proxy Software [2], RomCom Backdoor [8], Industrial Spy Ransomware [8], Trigona Ransomware [8], NoEscape Ransomware Gang ([7], [26]), Blackmoon Trojan (KRBanker) [25]
2	Europe	Storm-0978 [8], Lazarus APT [9], Unknown threat actors behind the attack on Recycling Giant Tombra [27], Turla Hacking Group [11], Midnight Blizzard [23], Rhysida Ransomware Gang ([28], [29]), Cl0p Ransomware Gang [30], APT31 [10]	RomCom Backdoor [8], Industrial Spy Ransomware [8], Trigona Ransomware [8], Ursnif Banking Trojan [12], WikiLoader Downloader Malware [13], Cl0p Ransomware ([6], [30]), LEMURLOOT Web Shell ([6], [24]), FlawedAmmyy / FlawedGrace RAT ([6], [24]), DBot RAT ([6], [24]), Truebot ([6], [24]), Cobalt Strike ([6], [24]), DEWMODE Web Shell ([6], [24])
3	East Asia	APT37 (STARK#MULE Attack Campaign) [14], LockBit 3.0 Ransomware Gang [15], Storm-0558 [16], Mysterious Elephant [17]	Cigril Tool [2], SoftEther Proxy Software [2], Payloads which are named lsasetup.tmp, winrar.exe and conshost.exe by APT37 [14]
4	South Asia	Bahamut APT [18], BlackCat Ransomware Gang, DoNot APT [19], Mysterious Elephant [17], Akira Ransomware Group [20]	BlackCat Ransomware, Akira Ransomware [20]

Table 1. Most Targeted Regions in July 2023

Top 5 Most Targeted Sectors in July

In July 2023, the government, healthcare, manufacturing, cryptocurrency and financial services, and education sectors emerged as the top five most targeted domains for cyber-attacks.

Governments

In July, governmental agencies surfaced as a prime target for cyber-attacks. The Norwegian Government fell victim to a significant breach, compromising software used across 12 vital ministries. This attack was distinct as it exploited a zero-day vulnerability. Among the notable threat actors targeting this sector were groups like Storm-0558, attributed to Chinese origins, and the North Korean-affiliated APT37 and Lazarus APT. SiegedSec Hacking Group also made its mark with the alleged NATO data theft. In the US, the City of Hayward, California wasn't spared either, illustrating that these attacks weren't confined to national governments alone.

Healthcare

The healthcare sector continued its trend as a desirable target for cybercriminals, especially in the backdrop of the pandemic. This vulnerability was underscored by the Maximum Data Breach, which compromised the details of over 8 million customers linked to healthcare programs. Prominent ransomware groups like Snatch and ALPHV (BlackCat) were particularly active, the latter of which was linked to a significant breach affecting Tampa General Hospital. The American hospital operator, HCA Healthcare, also fell prey to unidentified actors, potentially impacting 11 million patients.

Manufacture

Manufacturing entities weren't immune to the cyber onslaught. Major incidents included a targeted attack on the Taiwan Semiconductor Manufacturing Company, attributed to the LockBit 3.0 ransomware group. Notably recurrent in this domain were the Cl0p and ALPHV (BlackCat) ransomware gangs. The Yamaha breach brought to light the involvement of BlackByte and Akira Ransomware Gang, emphasizing the extensive nature of threats faced by this sector.

Cryptocurrency and Financial Services

Financial domains, inclusive of cryptocurrency, continued to be a gold mine for cyber-attackers. The North Korean hacking group Lazarus was particularly active, orchestrating an attack on CoinsPaid, leading to significant financial repercussions. New-age threats like open-source software supply chain attacks also came into focus, targeting banking systems. Key malware to watch out for in this domain includes the Ursnif Banking Trojan and WikiLoader downloader malware.

Education

The education sector, while always a target, saw increased activity in July. Institutions like Hawaii Community College found themselves at the mercy of ransomware groups like NoEscape, emphasizing the sector's vulnerabilities. The Cl0p Ransomware Gang, particularly through its MOVEit attack, targeted entities like Colorado State University. An interesting entrant in the threat landscape was Cyber Partisans, a hacktivist group from Belarus. Educational institutions need to be wary of malware such as the Eeamfo, and NoEscape Ransomware which have seen increased deployment.

	Targeted Sector	Threat Actors	Malware
1	Governments	Storm-0558 (Attributed to Chinese origin) [1], APT37, Lazarus APT, SiegedSec Hacking Group, Unknown (exploited a zero-day vulnerability in Ivanti’s EPMM) [31], Cl0p Ransomware Gang, SiegedSec Hacker Group [21], Turla Hacking Group [11], Unknown threat actors behind the City of Hayward, California [32]	Cigril Tool [2], SoftEther Proxy Software [2], LEMURLOOT Web Shell ([6], [24]), FlawedAmmyy / FlawedGrace RAT ([6], [24]), DBot RAT ([6], [24]), Truebot ([6], [24]), Cobalt Strike ([6], [24]), DEWMODE Web Shell ([6], [24])
2	Healthcare	Snatch Ransomware Group [22], LockBit 3.0 Ransomware Gang [33], ALPHV (a.k.a BlackCat) Ransomware Gang [34], Unknown threat actors behind the American hospital operator HCA Healthcare data breach [35], Crysis Threat Actors [36]	Snatch Ransomware [22], BlackCat Ransomware, Venus Ransomware [36]
3	Manufacture	LockBit Ransomware Gang, ALPHV (a.k.a BlackCat) Ransomware Gang [37], Cl0p Ransomware Gang ([37], [38]), BlackByte and Akira Ransomware Gang behind the Yamaha Breach [39], RedEnergy (SaaR) Operators [40]	BlackByte and Akira Ransomware [39], Cl0p Ransomware ([37], [38]), BlackCat Ransomware ([37], [40])
4	Cryptocurrency and Financial Services	Lazarus APT [9], Akira Ransomware Gang [23], Unknown threat actors behind the open-source software supply chain attacks on banking [41], ALPHV (a.k.a BlackCat) Ransomware Gang [42], Kanti Ransomware Operators [43]	Ursnif Banking Trojan [12], WikiLoader Downloader Malware [13], Akira Ransomware [23], BlackCat Ransomware [42], Kanti (NIM-based) Ransomware [43]
5	Education	ALPHV (a.k.a BlackCat) Ransomware Gang, Cl0p Ransomware Gang ([44]), NoEscape Ransomware Gang [7], Cyber Partisans, (a Belarusian hacktivist group) [45], Akira Ransomware Gang [23], Rhysida Ransomware Gang [28]	BlackCat Ransomware, ExMatter Tool, Eeamfo malware, NoEscape Ransomware

Table 2. Most Targeted Sectors in July 2023

Simulate real-world vulnerability exploitation attacks in minutes and gain a holistic view of your controls’ effectiveness against their cyber attacks at all times. Sign-up now!