New Week, Same Actors
I cover a lot of topics in my reports, given that I write them every day. Sometimes I’m ahead of a trend, and end up having trouble picking a subject because I’ve already talked about it. But sometimes those subjects have new information or updates. Today is one of those days, with two updates regarding groups I’ve talked about in recent posts.
The first update is about the Handala Hack group. They are a pro-Iranian, pro-Palestinian hacktivist persona adopted by Iran's Ministry of Intelligence and Security (MOIS), containing several aliases that have been attributed to the group since 2022. They are responsible for the Stryker data breach earlier this month that resulted in numerous devices worldwide being rendered inoperable after a wiper attack. Their latest breach is a successful hack of FBI Director Kash Patel’s personal email account, according to The Hacker News’ report. No sensitive data of a governmental nature was stolen, but personal photos and other documents were released online, some dating back to 2010.
The hack is being considered retaliatory, since the FBI has worked hand in hand with other agencies to disrupt and/or seize the domains of the group over the last several years. Usually Handala’s targets are more IT based, in an effort to create scenarios like the Stryker attack where supply chain is affected. Campaigns targeting critical infrastructure are becoming a popular tactic of threat actors and the conflict with Iran has opened a floodgate of DDoS attacks, website defacements, and hack-and-leak operations against those involved in the war.
The second update, which was published over the weekend, is regarding TeamPCP. Just days after compromising LiteLLM, and less than two weeks after the initial Trivy compromise, the threat actor has struck again. This time its target is Telnyx, a telecommunications API software development kit. Versions 4.87.1 and 4.87.2 on PyPI contain malicious code that does not exist in the upstream GitHub repository, according to researchers from Socket and Endor Labs. Aikido also has a breakdown of the timeline of this actor or group, as well as details on how this latest attack executes itself.
An application programming interface (API) facilitates communication between devices or programs, hence the danger here of spreading compromise. Using the malicious versions of Telnyx downloads the injected code at the time of installation, meaning there is no hook to disable or post-install code to block. It’s essentially hardwired into the download and runs automatically. In Windows, it deploys an audio file (a .wav) that ends up in the start menu as an executable, then runs silently in the background of every login with a 12 hour interval to refresh into the system. In Linux/macOS, it runs a completely separate Python script that is hardcoded as a base64 blob in a specific line (459). Then it executes as an audio file like the Windows version. Both report to the same command-and-control for exfiltration of credentials and data.
This form of incursion is known as steganography, where a visual or audio file is used to obfuscate the presence of malicious code. I’ve written about it before in relation to an Android APK malvertising campaign. The use of it here is another example of how threat actors are not necessarily coming up with new ways to execute their campaigns, but are combining previously successful forms of attack into new iterations. The malware used here is identical to the key used in the LiteLLM attack, as is the exfiltration pattern, which is why it’s being attributed to TeamPCP.
We’re living in an age where digital landscapes are every bit as much of a battleground as nations. This isn’t the first time I’ve reported on an update (like my posts about Oracle, here and here) and I’m sure it won’t be the last. Happy Monday! 🙃