Within the ever-evolving cybersecurity panorama, 2023 witnessed a dramatic surge within the sophistication of cyber threats and malware. AT&T Cybersecurity Alien Labs reviewed the massive occasions of 2023 and the way malware morphed this 12 months to attempt new methods to breach and wreak havoc.

This 12 months’s occasions saved cybersecurity consultants on their toes, from increasing malware variants to introducing new menace actors and assault strategies. Listed here are among the most compelling developments, highlighting malware’s evolving capabilities and the challenges defenders face.

Highlights of the 12 months: Rising traits and notable incidents

Because the 12 months unfolded, a number of traits and incidents left an indelible mark on the cybersecurity panorama:

Exploiting OneNote for malicious payloads

Cybercriminals leveraged Microsoft OneNote to ship many malicious payloads to victims, together with Redline, AgentTesla, Quasar RAT, and others. This beforehand underutilized Workplace program grew to become a well-liked software resulting from its low suspicion and widespread utilization.

search engine optimization poisoning and Google Advertisements

Malicious actors resorted to search engine optimization poisoning techniques, deploying phishing hyperlinks by means of Google Advertisements to deceive unsuspecting victims. These hyperlinks led to cloned, benign net pages, avoiding Google’s detection and remaining lively for prolonged intervals. Outstanding malware households, together with Raccoon Stealer and IcedID, capitalized on this technique.

Exploiting geopolitical occasions

Cybercriminals exploited the geopolitical local weather, significantly the Center East battle, as a lure for his or her assaults. This development mirrored the earlier 12 months’s Ukraine-related phishing campaigns and crypto scams.

APTs: State-sponsored espionage continues to current challenges

Superior Persistent Threats (APTs) continued to pose a major menace in 2023:

• Snake: CISA reported on the Snake APT, a sophisticated cyber-espionage software related to the Russian Federal Safety Service (FSB). This malware had been in use for almost twenty years.
• Volt Storm: A marketing campaign focusing on important infrastructure organizations in america was attributed to Volt Storm, a state-sponsored actor based mostly in China. Their focus lay on espionage and knowledge gathering.
• Storm-0558: This extremely refined intrusion marketing campaign, orchestrated by the Storm-0558 APT from China, infiltrated the e-mail accounts of roughly 25 organizations, together with authorities companies.

Ransomware’s relentless rise

Ransomware remained a prevalent and profitable menace all year long:

• Cuba and Snatch: Ransomware teams like Cuba and Snatch focused important infrastructure in america, inflicting concern for nationwide safety.
• ALPHV/BlackCat: Past search engine optimization poisoning, this group compromised the pc methods of Caesar and MGM casinos. In addition they resorted to submitting complaints with the US Securities and Change Fee (SEC) towards their victims, making use of extra strain to pay ransoms.
• Exploiting new vulnerabilities: Cybercriminals wasted no time exploiting newly found vulnerabilities, resembling CVE-2023-22518 in Atlassian’s Confluence, CVE-2023-4966 (Citrix bleed), and others. These vulnerabilities grew to become gateways for ransomware assaults.
• Evolving ransomware households: New ransomware variants like Trash Panda emerged whereas current households tailored to focus on Linux and ESXi servers, additional increasing their attain.

Notable blogs of the 12 months

1. BlackGuard: Elevating Malware-as-a-Service

One of many 12 months’s standout tales was the evolution of BlackGuard, a formidable Malware-as-a-Service (MaaS) supplied in underground boards and Telegram channels. This insidious software underwent a major improve, amplifying its capabilities. Already recognized for its skill to pilfer delicate information from browsers, video games, chats, and cryptocurrencies, the brand new BlackGuard variant upped the ante.

BlackGuard improved its Anti-Reversing and Sandboxing capabilities, making it much more elusive to safety consultants. Furthermore, it might now tamper with cryptocurrency wallets copied to the clipboard. This enhancement posed a extreme menace to cryptocurrency lovers and traders. Moreover, BlackGuard integrated superior Loader capabilities, enabling it to propagate by means of shared or detachable gadgets and masks its communications through private and non-private proxies or the nameless Tor community.

2. SeroXen: A RAT’s speedy ascent and fall

In a coincidence, 2023 witnessed the meteoric rise and fall of SeroXen, a brand new variant of the Quasar Distant Entry Trojan (RAT). This modified department of the open-source RAT added important modifications to its authentic framework, enhancing its capabilities.

SeroXen achieved fast notoriety, with tons of of samples recognized inside the first few months of the 12 months. Nonetheless, shortly after the weblog highlighting its emergence was printed, the SeroXen web site introduced its shutdown and carried out a kill-switch, rendering contaminated PCs ineffective to malicious actors. It was a uncommon occasion the place the publication of analysis inadvertently led to the downfall of a malware software.

3. AdLoad: Mac methods became proxy servers

AT&T Cybersecurity Alien Labs uncovered a devious malware marketing campaign involving AdLoad. This malware ingeniously remodeled customers’ Mac methods into proxy servers, then offered to 3rd events, together with some with illicit functions. The menace actor behind AdLoad contaminated goal methods surreptitiously put in a proxy software within the background.

These contaminated methods had been subsequently supplied to proxy corporations, portraying themselves as legit entities. Patrons exploited the advantages of those residential proxy botnets, having fun with anonymity, broad geographical availability, and excessive IP rotation for conducting nefarious actions, together with SPAM campaigns.

Following the publication of the analysis weblog, the same marketing campaign focusing on Home windows methods emerged. The modus operandi mirrored that of the Mac model however was tailor-made for Home windows OS, considerably increasing the potential goal pool and the impression of the proxy community.

4. AsyncRAT: The persistent phishing menace

All through 2023, cybersecurity consultants noticed a steady inflow of phishing emails utilizing superior strategies. These emails enticed victims to obtain a malicious JavaScript file, closely obfuscated and armed with anti-sandboxing measures to evade detection. These assaults aimed to execute an AsyncRAT consumer on the compromised methods, granting attackers full distant entry. 

About us

AT&T Alien Labs is the menace intelligence unit of AT&T Cybersecurity. We assist gas our cybersecurity consulting and managed safety companies with probably the most up-to-date menace intelligence info. We work with the Open Menace Change (OTX) to offer actionable and community-powered menace information. Watch the AT&T Cybersecurity weblog for extra observations and analysis from the Alien Labs workforce.