SecuritySnacks

Executive Summary: 

• PRC cyber threat actors dubbed "Salt Typhoon" (as well as FamousSparrow and GhostEmperor) appear to be focused on infiltrating Internet Service Providers (ISPs) at this time.
  • Why is this important? “If hackers gained access to service providers’ core routers, it would leave them in a powerful position to steal information, redirect internet traffic, install malicious software or pivot to new attacks.”
• Unlike similar threat actor groups that include the name "Typhoon," Salt Typhoon looks to be geared towards intelligence collection as opposed to creating backdoors for the purpose of being an Advanced Persistent Threat (APT.)
• Suggestions for network defense include
  • Identify and mitigate living off the land techniques that could provide threat actors with an opportunity to infiltrate an enterprise network. (CISA resource)
  • Locate and remove or isolate unused and/or unpatchable legacy systems.
• Potential link to “shadow C2 infrastructure”
  • By having access to the Internet Service Provider of an enterprise network, a threat actor could manipulate the network from the inside.

Highlights:

- Binary Defense revealed details of how it uncovered PRC state-sponsored cyber actors inside a global aerospace engineering firm's network where they had been snooping around for four months. 

- "I can't really comment on the connection between the incidents, but I can say that given the uptick in Chinese-linked attacks against critical infrastructure supply chains, ISPs, and core internet devices there is a clear strategy at play where attackers are aiming to identity and exploit logical choke points in our society to take control of the flow of information and supplies," Binary Defense Director of Security Research John Dwyer told The Register today when asked about a possible Salt Typhoon connection.

- As recently as August, another Typhoon gang — Volt Typhoon — was accused of hiding in American networks after exploiting a high-severity bug in Versa's SD-WAN software.

- WSJ article states Salt Typhoon threat actors attempt to gain critical data from broadband service providers, has been going on for months and has been linked to China by U.S. government investigators. The reason for targeting broadband providers, in particular, is to take control of those providers’ systems and, from there, access their data and possibly launch a separate cyberattack from within their networks.  

- CISA Executive Assistant Director for Cybersecurity Jeff Greene told us the agency is aware of the report of the compromised ISPs, and said that China is known to be infiltrating all manner of critical targets, who have compromised the IT environments across multiple critical infrastructure sectors and organizations.

- China's Salt Typhoon cyber spies spotted deep inside US ISPs
Activity is confirmed, govt aid provided.
No advisory on mitigations for customers at this time

Resources:

Chinese spies spent months inside aerospace engineering firm's network via legacy IT
(The Register, 18 September 2024)
https://www.theregister.com/2024/09/18/chinese_spies_found_on_us_hq_firm_network

China's Salt Typhoon cyber spies are deep inside US ISPs
(The Register, 25 September 2024)
https://www.theregister.com/2024/09/25/chinas_salt_typhoon_cyber_spies

China-Linked Hackers Breach U.S. Internet Providers in New ‘Salt Typhoon’ Cyberattack
(The Wall Street Journal, 26 September 2024)
https://www.wsj.com/politics/national-security/china-cyberattack-internet-providers-260bd835

China-linked APT group Salt Typhoon compromised some U.S. internet service providers (ISPs)
(Security Affairs, 26 September 2024) – see graphic below
https://securityaffairs.com/168941/apt/salt-typhoon-china-linked-threat-actors-breached-us-isp.html 

Salt Typhoon Cyberattack Targets U.S. Broadband Service Provider
(TeleCompetitor, 27 September 2024)
https://www.telecompetitor.com/salt-typhoon-cyberattack-targets-u-s-broadband-service-providers/

Image Source: China-linked APT group Salt Typhoon compromised some U.S. internet service providers (ISPs) Security Affairs, 26 September 2024

Continues To Use Credential Phishing Infrastructure to Target Individuals Perceived as a Threat to the Iranian Regime

Since June 2024, the Iran-nexus actor CHARMING KITTEN (APT42, Mint Sandstorm, TA453) continues to create new network infrastructure consistent with what the Mandiant intelligence team identifies as Cluster B. Mandiant previously reported on this CHARMING KITTEN infrastructure cluster using credential phishing pages to target individuals perceived as a threat to the Iranian regime, including researchers, journalists, NGO leaders, and human rights activists. There are no confirmed targets of the new infrastructure; however, it is likely that the actor’s target scope remains focused on entities deemed a threat to the Iranian regime.

Details

Newly Identified Domains:

• growing-prices-advanced[.]top
• competitive-searchvolume-considered[.]top
• software-selection-features[.]buzz
• app-engage-station[.]help
• Horse-improve-department[.]top
• click-manage-room[.]cfd
• flow-exulltation-uplift[.]top
• house-server-digital[.]xyz
• interconnected-equipment-buildings[.]buzz
• nail-forward-valid[.]lol
• request-human-received[.]xyz
• paper-blue-hero[.]top

These domains were all registered since the publication of Mandiant’s blog with some registered as recently as September 2024.  The domains listed above share many similarities with domains previously attributed to Cluster B including:

• Similar TLDs: The new domains use TLDs such as ".top," ".buzz," and ".help," “.cfd,” “.xyz,” and “.lol” all of which were reported by Mandiant. 
• Hyphenated Naming Conventions:  The new domains continue to contain several words separated by hyphens.
• IP Overlap: All listed domains resolve to 135.181.203[.]1, an IP address assigned to the hosting provider, Hetzner, and used to host multiple Cluster B domains publicly reported by Mandiant.

Targeting

Specific targeting for these newly-identified domains is not known. However, public reporting indicates that Cluster B infrastructure commonly masquerades as login pages for Google, YouTube, and other file hosting services. The actor typically disseminates these credential harvesting pages through spear phishing emails that often pose as invitations to conferences or links to legitimate documents hosted on cloud infrastructure. 

The most recent specific targeting information for Cluster B includes multiple entities impacted during March 2024. This includes Cluster B infrastructure to target a news editor working for a Persian-language news television channel using a fake Gmail login page and to target Google, Microsoft, and Yahoo credentials from individuals in the research and academic sectors in the U.S., Israel, and Europe.

Conclusion

The newly identified domains indicate that the CHARMING KITTEN actor continues to be active in the wake of public reporting. It is likely that this new infrastructure is being used in a manner consistent with previously reported activity: targeted spear phishing used to direct intended victims to credential phishing pages. The actor’s target set likely continues to be focused on  entities deemed a threat to the Iranian regime. 

IOCs on GitHub

Find all IOCs on our GitHub.

Crypto News relayed widespread social media reports of Web3-related domain takeovers of Squarespace-held domains.

Wester European targeted SMS campaigns that are phishing for credentials and banking information.

1600+ were registered between 2024-06-19 and 2024-06-20.

200+ registrations in concert with financial or credential phishing

We see over 200+ billing-oriented TEPCO domains created in the last month with the same host. We suspect it’s a mass domain registration in concert with financial or credential phishing.

The domains and historical passive DNS records for the two IPs involved can be found in the GitHub link below. The pDNS may or may not include uninvolved domains, but many appear to be part of the same cluster or campaign.

If the community has any additional input, please let us know.

https://github.com/DomainTools/SecuritySnacks/tree/main/2024/TEPCO

195 domains registered and used for credential phishing pulled from a phish impersonating DocuSign using a click thru URL obfuscator.

Potential phishing on reregistering old, inactive vmware-related domains.

Suspicious campaigns registering thousands of domains across cheaper TLDs

We observed multiple suspicious campaigns recently auto-registering thousands of domains across cheaper TLDs such as .cfd and .bond. While their purpose is not yet apparent, and the two sets of events appear unconnected, here's what we've observed so far:

More than 10k domains in 3 days across .cfd registered through Aceville Pte. Ltd. with higher-than-average Iris risk scores fitting several pseudorandom-looking/DGA patterns. Examples:

388aqo001[.]cfd
4qwljn001[.]cfd
8hgsxe001[.]cfd

adix348002[.]cfd
adpzfsn002[.]cfd
aerx7v9002[.]cfd

91-yongjiudizhi-f19q4x8j-dpq[.]cfd
91-yongjiudizhi-q8hkazxp-sij[.]cfd

And several thousand .bond domains newly registered through Key-Systems fitting one of the following patterns:

security-jobs-#####
cyber-security-degree-#####
cyber-security-jobs-#####
homeland-security-jobs-#####
cyber-security-#####
security-surveillance-cameras-#####
home-security-#####
password-manager-#####

Barbie & Barbenheimer domains list

While fans are still flocking to Barbie for the second week in a row, bad actors are flocking to register barbie and barbenheimer domains. See the full list here:

https://github.com/DomainTools/SecuritySnacks/blob/main/2023/Barbie/barbie-domains.txt

79 newly registered domains to "help"

CISOs - worried about getting an SEC notice? Looking for an attorney? 79 domains were recently registered to "help" you find one no matter where you are in the US. (we're kidding, of course, you probably want to avoid all of these)

https://github.com/DomainTools/SecuritySnacks/blob/main/2023/securitylawyer/security-lawyer-domains.txt

Down to only a few thousand

We continue to monitor the drop of active .GA domains as part of their move away from FreeNom. Since late March we saw a drop from ~9M to ~1.5M domains, and now down to a few thousand.