Global Threat Intelligence Report

Threat intelligence can be considered “the art of taking the adversary by surprise.” Anticipating, mitigating, and preventing surprises in the form of cyberattacks is the primary mission of a practical threat intelligence program.

Achieving that goal requires a proactive approach that answers critical questions like the following: Which threat actors are most likely to cause an impact in my organization? What are their motivations, goals, and capabilities? How do they behave, and what cyber-weapons do they use to achieve those goals? And most importantly, what actionable countermeasures can I deploy to improve my organization’s cyber defense capabilities?

Our team is proud to release our first BlackBerry Cybersecurity Global Threat Intelligence Report. The mission of this report is to provide actionable intelligence on targeted attacks, cybercrime-motivated threat actors, and campaigns targeting organizations like yours so that you can make well-informed decisions and take prompt effective actions.

In this first edition, you’ll find reports from some of the top threat researchers and intelligence analysts on the BlackBerry Threat Research and Intelligence team, world-class experts who understand not only technical threats but also local and global geopolitical developments and their impact on organizational threat models in each region. To produce this report (covering the 90 days between September 1 and November 30, 2022), the team leveraged data and telemetry obtained from our own artificial intelligence (AI)-driven products and analytical capabilities, complemented by other public and private intelligence sources.

Some of the research highlights in this report include:

• 90 days by the numbers. An overview of the 90-day reporting period in statistics, including the number of unique malware samples that BlackBerry prevented from impacting our customers and the geographical distribution of those attacks. Here’s a preview: our technology stopped an average of 62 new malicious samples per hour, or approximately one new sample per minute.

• Most common weapons. Information about the most common weapons used in cyberattacks, including the resurgence of malicious loaders like Emotet, Qakbot’s extensive presence on the cyberthreat landscape, and the increase in downloaders like GuLoader.

• Remote access increases infostealers. With the post-pandemic rise of remote and hybrid work, the need to access internal networks from the outside has become widespread. Attackers are taking advantage of new remote access possibilities by using information stealers (infostealers) to steal corporate credentials to sell them on the black market. Our report discusses some of the most prevalent and widespread infostealers we saw deployed during this time period.

• No platform is ‘safe.’ Threat actors have multiple strategies for targeting different server, desktop and mobile platforms. For example, despite prevailing opinion, macOS is not a “safer” platform: macOS malware and vulnerabilities abound. Other topics covered include trends such as the increasing number of attacks against Linux platforms; the way that less mainstream programming languages like GoLang are being used to develop cross-platform malware; and an in-depth analysis of threats affecting mobile devices running Android and iOS.

• Unique industry perspective. Due to our strong presence in both the cybersecurity and Internet of Things (IoT) industries, BlackBerry is uniquely positioned to uncover threats to industries such as automotive that aren’t often discussed in other threat reports. This edition includes information about cybersecurity trends we observed that will impact the automotive industry as well as the healthcare and financial industries.

• Top threat actors and countermeasures. Our telemetry also revealed the activities of many different threat actors. The report includes information about some of their most common tactics, techniques, and procedures (TTPs) as well as links to public lists of applied countermeasures mapped to MITRE ATT&CK and MITRE D3FEND. Our goal is to make it easier to update your organizational defenses and threat models based on this actionable information.

• Wrapping up and looking ahead. Finally, we present our conclusions and cyberthreat forecast for 2023.

I want to thank our elite global researchers on the BlackBerry Threat Research and Intelligence team who made this report possible and continue to produce numerous “first-to-market” research reports while continuously improving BlackBerry’s data- and Cylance AI-driven products and services.

Ismael Valenzuela
Vice President, Threat Research & Intelligence at BlackBerry

Twitter: @aboutsecurity

BlackBerry Cybersecurity Threat Intelligence Authors

• Dmitry Bestuzhev
• Pedro Drimel
• Jacob Faires
• Dean Given
• Eoin Healy
• Geoff O’Rourke
• Jose Luis Sanchez

The century-old automotive industry is in the midst of a major technological revolution. Breakthrough technology advances are enabling the development of new types of vehicles, systems, and services. This digital transformation offers many benefits but has also introduced new cybersecurity challenges.

As vehicles become more connected and autonomous, they become potentially more vulnerable to cyberthreats and threat actors. In addition, the increasingly complex manufacturing systems that produce vehicles are also at risk of cyberattacks.

In previous years, the automotive industry was relatively unaffected by large-scale and highly publicized threats. However, malicious entities have begun targeting not only automobile manufacturers but the industry as a whole through efforts to disrupt operations, steal sensitive data, and compromise supply chains. In 2022, we observed an increase in both the number of malicious entities targeting the auto industry and the amount of disruption that they cause.

To protect against these threats, companies in the automotive industry must recognize the potential risks inherent in a more connected automotive future and implement strong cybersecurity measures to protect vehicles and drivers.

Because of its global scale, the automotive industry presents an immense number of endpoints to monitor and protect. It includes every organization in the value chain, from companies that source raw building materials all the way up to automotive dealerships and automobile owners. The vast digital attack surface of this complex supply chain must be secured to keep this important global business operational.

Attacks between September 1 and November 30, 2022 ranged from sophisticated spearphishing to commodity malspam, indicating that the automotive industry is constantly under attack from both advanced and novice cyber adversaries.

Malware downloaders are prevalent in almost every type of cyberattack, and can vary in appearance, file type, and relative sophistication of the techniques they use to enter systems. Deceptive threat actors coax unwitting victims to install the downloader as the first part of a cyberattack. Once the code is executed, downloaders install additional malicious code and payloads to carry out more wide-reaching cyberattacks.

GuLoader is a prime example of a downloader that targeted the automotive industry during this reporting period. The malware was first identified in 2019 and continues to evolve. GuLoader often poses as legitimate digital documents or executables before downloading other commodity malware.

The automotive industry’s valuable and often proprietary data makes the industry a prime target for cyber thieves. This data is a commodity that can often be more valuable than the vehicles themselves.

Malware infostealers are a type of malicious code that seeks out and illicitly exfiltrates data from a victim’s system that can then be used to support financial and/or tactical goals. Infostealers can be used in conjunction with RATs like Remcos as commodity malware that is often sold as a service for other threat actors to gain malicious access and control of victim systems.

Ransomware is every security team’s nightmare, and threat actors know that ransomware targeting industry supply chains can be devastating. In the automotive industry, a ransomware attack at any stage of the supply chain could cease production or distribution, causing loss of revenue and reputation throughout the industry’s ecosystems.

BlackCat ransomware was observed in some of the more notorious ransomware attacks throughout 2022. Often preying on small- to medium-sized business, the cybercrime groups who use this particular RaaS appear to be largely financially motivated and have largely targeted manufacturing. BlackCat ransomware infiltrates an environment, exfiltrates valuable data, and then encrypts connected systems.

ALPVH (the threat group behind BlackCat ransomware) frequently uses double-extortion ploys, often publicizing compromised victims’ data via their leak site (a website that hosts stolen private and potentially sensitive documents). Their goal is to pressure the targeted organization to pay the ransom, capitalizing on the fear that more valuable data will be published or sold to competitors^xvi.

Dual-use applications are typically legitimate tools and software that offer features or functions that threat actors can potentially misuse or abuse. The term “living off the land” (LotL) describes the actions of threat actors who abuse legitimate tooling to bypass security systems and avoid detection.

Threat actors increasingly rely on dual-use tools instead of malicious code to propagate within an environment, exfiltrate valuable data or even deploy malware as an “allowed” tool. System administrators should remove all dual-use tools for which there are no valid use cases or business justification.

Both the pandemic and the Russian invasion of Ukraine have revealed that supply chains are fragile. The automotive industry is not immune to the delays, shortages, and disruptions that other industries face.

Given the complexities of the industry, many businesses rely on a just-in-time (JIT) supply-chain strategy to maintain their vast ecosystems of vendors, parts, and manufacturers, creating an extremely large attack surface that can potentially be exploited by threat actors. The hallmark of JIT strategy is that products are not manufactured until they are needed. As a result, manufacturing may be slowed or stopped if needed components and materials are not immediately available. As a result, a cyberattack within the supply chain can effectively halt automobile production.

Instead of directly targeting auto manufacturers, which may be heavily fortified against intrusions, malicious adversaries may instead attack its various vendors, especially those with less cybersecurity. For example, in March 2022, compromised file systems at plastic and electronic supplier resulted in production delays for an estimated 13,000 vehicles at a Japanese automotive company. According to a spokesperson quoted by Automotive News Europe, the automotive company’s supply chain includes 60,000 companies across four tiers^xxvii. Cyberattacks anywhere in a supply chain of that size can potentially impact the ability of other companies to receive necessary parts and materials.

The healthcare industry is facing an increasing number of cyberthreats as threat actors target healthcare organizations for their highly confidential data and valuable information. This is a significant issue for healthcare providers, as a successful cyberattack can have serious consequences including the loss or publication of sensitive patient data, financial losses, and even direct physical harm to patients. Healthcare is particularly vulnerable to these threats due to a combination of factors including the widespread use of medical technology with a long service life, the complex and often interconnected nature of healthcare systems and the vast amounts of sensitive data that are routinely collected and stored. It is imperative that healthcare providers understand the dangers of the current cyberthreat landscape and proactively protect themselves and their patients from potential harm.

Overall, ransomware still poses the biggest threat to the healthcare industry, and threat groups that rely on ransomware are still very actively targeting it, as we can see by the ransomware attack on CommonSpirit Health in October, where data belonging to more than 600,000 patients was compromised^xxix. In the past, some RaaS groups like Maze indicated they would not attack hospitals, but such promises cannot be guaranteed. With the diversity of multiple RaaS groups and the proliferation of affiliate models, the group that executes an attack may not be the same group that developed the malware, which makes tracing and attribution a concern.

According to our telemetry, Cylance Endpoint Security solutions stopped 7,748 unique malware samples targeting the healthcare industry during this reporting period, accounting for an average of more than 80 unique malware samples per day. The most popular Trojan was Qakbot, which has been used by cybercriminals since at least 2012 and poses a high risk to the healthcare industry. In 2022, Qakbot was mostly used by affiliates deploying Black Basta ransomware. Because Emotet did not operate many campaigns after its recent four-month shutdown and TrickBot seems more focused on improving its Bumblebee malware, we believe that Qakbot continues to be the most active Trojan facilitating healthcare network access for RaaS affiliates and IABs.

Meterpreter (a Metasploit payload that provides an interactive shell for the attacker) and BloodHound were also active during this timeframe. We detected an attack that used Meterpreter alongside the execution of SharpHound, a collector for BloodHound that is commonly used for lateral movement inside a network after an attack takes place. The Cybersecurity and Infrastructure Security Agency (CISA) recommends that network and system administrators intentionally execute BloodHound themselves to understand possible attack paths on their environments^xxx.

We also observed TinyNuke dropping the Netwire RAT. Originally a banking Trojan with similar functions as ZeuS, TinyNuke is a fully featured Trojan that includes the VNC server device controller and reverse SOCKS functionality. TinyNuke has also been used by Kimsuky Group^xxxi and attributed to the Democratic People’s Republic of Korea (DPRK). While examining this attack, we found TinyNuke downloading and executing Netwire RAT and connecting to a domain hosted on DuckDNS, which is commonly used by RATs.

BlackBerry researchers also found an instance where an unknown threat actor deployed the PlugX RAT, which is commonly used by multiple nation-state threat actors including Mustang Panda (learn more in our public report), indicating that both cybercriminals and nation-state actors are interested in attacking the healthcare industry. And, while we haven’t seen infostealers like Redline and Raccoon specifically targeting healthcare, we did encounter an instance of GuLoader, a downloader commonly used by cybercriminals to deploy infostealers.

The financial industry has historically been targeted by cybercriminals as well as nation-state threat actors who reside in areas affected by financial sanctions. During this 90-day reporting period, Cylance Endpoint Security solutions stopped 9,721 unique malware samples launched against targets in the financial industry, with an average of about 108 unique malicious samples identified per day.

Different threat actors, including nation-state actors, have relied on commercial penetration testing (pen testing) tools like Cobalt Strike and others to blur the attribution line between cybercriminals and legitimate testing activities. This confusion gives cybercriminals more time to operate within a network after they gain access. In 2022, we witnessed several incidents where commercial adversary-simulating software including Cobalt Strike and pen testing software Metasploit, Mimikatz, and Brute Ratel were used inside financial institutions. Brute Ratel is an adversarial attack simulation tool, and attackers and security professionals both commonly use Mimikatz to extract confidential information such as passwords and credentials from a system’s memory. At this time, it is not known whether the presence of Mimikatz and Brute Ratel were part of legitimate pen testing activities or real attacks.

Among other top threats, we stopped initial-access infostealers such as Redline Stealer It is publicly known that initial access tools are in high demand because they gain access to victims’ networks that can then be sold. Many threat actors including, the Lapsus$ group, rely on infostealers to gain access to enterprises. (The Lapsus$ group is an international extortion-focused threat group known for numerous cyberattacks against companies and government agencies.)

Cylance Endpoint Security solutions have also stopped miscellaneous attacks connected to crypto mining and attacks on Linux ecosystems, which are attractive targets because of the relative lack of visibility compared to the Windows world. One example is the backdoor Rekoobe, a Linux Trojan that has been actively targeting victims worldwide for at least seven years^xxxii.

Between September 1 and November 30, 2022, the BlackBerry Threat Research and Intelligence team tracked, uncovered, researched, and published the latest information about the cyberthreat landscape around the world. The world economy is still recovering in the aftermath of the COVID-19 pandemic, and current geopolitical events in Eastern Europe and East-West relations continue to be uncertain. These factors converge to create fertile soil for threat actors that attempt both politically motivated and financial exploits.

This quarter, we saw state-affiliated APT groups, financially motivated ransomware gangs, and many other threat actors of all sizes, capabilities, and motivations conducting multiple campaigns. Below is a selection of some of the most consequential attacks across the global landscape and our own most significant finds during the quarter.

DJVU ransomware masquerades as legitimate services or applications and is often bundled with decoy files to appear benign. An evolution of the notorious STOP ransomware, DJVU has seen many iterations since its creation back in 2018. The ransomware uses cryptography stream cipher Salsa20 for its encryption routine. After carrying out numerous anti-analysis and anti-sandbox checks to confirm that it’s running on a real system, the malware encrypts multiple file types before generating a ransom note with instructions for the victim to recover their files. The threat recently became even more damaging when the threat actors added pre-encryption downloader capabilities to the ransomware.

This quarter, DJVU downloaded and deployed infostealer malware in apparent collaboration with the threat groups behind Arkei variant Vidar Stealer and Redline Stealer, creating additional paths for threat actors to benefit at victims’ expense.

In early October, we published the results of several months of tracking the Mustang Panda APT group. Also known as Bronze President, Red Delta, and Honeymyte, this group is publicly attributed to China.

During our investigation, we uncovered a campaign targeting Myanmar. The campaign impersonated popular Myanmar news outlets and targeted multiple entities including a government VPN portal. The infection vector in this campaign used phishing lures with malicious attachments that fool users into executing them, which allows the attackers to gain a foothold on the system.

The execution chain contained several components, including a legitimate benign utility that is susceptible to DLL search order hijacking, plus a malicious DLL loader and an encrypted DAT payload. After the malicious DLL loader is sideloaded, a PlugX payload is loaded into memory. The infection vector, execution chain, and use of PlugX and overall TTPs conform to Mustang Panda’s tried-and-tested campaign methodology.

BianLian is an extremely fast-acting ransomware written in the Go programming language (GoLang). In this white paper, we predicted the current rise in the malicious use of less commonly used languages like GoLang. Threat actors recognize these languages’ potential to create malware, especially bespoke ransomware. GoLang offers particularly robust support for concurrency, which can speed attacks by enabling multiple malicious functions to run independently at the same time.

BianLian is a relatively new threat that has targeted a wide range of industries. The group behind the malware appears to be purely financially motivated, and attacks related to BianLian continued through the end of 2022. The group appears to heavily exploit the systems and networks that they access. Their typical deployment method is manual infiltration of systems to gain initial access, followed by abuse of LOLBins to explore the networks and systems. After gathering this information, they deploy their ransomware for financial gain.

In October, BlackBerry uncovered the previously unknown RomCom RAT targeting Ukrainian military institutions. The same threat actor was known to deploy spoofed versions of the popular Advanced IP Scanner software before switching their efforts to PDF Filler (another popular application) and may have developed these exploits themselves.

The RomCom RAT attempts to take malicious control of affected devices. The initial infection vector we observed was an email with an embedded link to a fake Ukrainian-language document called Наказ_309.pdf (Order_309.pdf in English) that dropped the next-stage downloader.

During this reporting period, this threat actor was observed actively developing new techniques targeting victims worldwide.

After a series of attacks on Ukraine, the same group launched new attack campaigns that took advantage of popular software brands. The BlackBerry Threat Research and Intelligence team uncovered the campaigns while analyzing network artifacts identified during our earlier research into RomCom RAT.

Our researchers found the threat actor impersonating SolarWinds Network Performance Monitor, KeePass Open-Source Password Manager, and PDF Reader Pro in their campaigns. The campaigns used these legitimate companies as fronts and designed fake websites that mimic the real ones to coax victims into downloading the Remcos RAT malware. The RomCom threat actor has continued to actively deploy new campaigns targeting victims in Ukraine, and may be expanding to English-speaking targets worldwide in their latest string of attacks.

The BlackBerry Threat Investigation team monitored the ARCrypter ransomware family throughout 2022. In August, an unknown variant that BlackBerry named ARCrypter was found targeting Latin American institutions. INVIMA (Colombia’s National Food and Drug Surveillance Institute) was temporarily shut down in October due to a reported cyberattack^xxxvi.

Through our threat hunting efforts, BlackBerry identified additional samples of interest for this ransomware. Given the attack’s timeframe and the contents of the ransom note mentioning INVIMA, we concluded with a high degree of certainty that ARCrypter ransomware was used in the INVIMA cyberattack. Additional research helped uncover two sets of files: an additional malware dropper and a file encryptor.

In December, our continuous monitoring of Mustang Panda uncovered a campaign targeting entities across multiple countries and continents.

This campaign relied on thematic lures (such as a file titled “Political Guidance for the New EU Approach Towards Russia.rar”) related to current geopolitical events. The lure contained a decoy document and LNK file that followed the same naming convention as the lure RAR file. Additional components included legitimate utilities that are susceptible to DLL search order hijacking, malicious DLL loaders, and DAT payloads similar to components that the group has used in the past.

The goal of the execution chain is to deliver a PlugX payload into the host system’s memory that provides full remote access capabilities to compromised hosts.

Although the core execution chain and TTPs in this campaign have been seen before, these attacks demonstrated subtle changes, including a small alteration in execution flow so that the function EnumSystemCodePagesW was used for shellcode execution instead of EnumThreadWindows. This modest modification required adjustments to defensive awareness and countermeasures to ensure the most effective protection.

By pivoting off a unique domain SSL certificate, we were able to uncover 15 additional IP addresses, five of which were C2 servers for the Mustang Panda group that serve similar files conforming to the same attack chain and TTPs to additional locations and victims.

The global range of the campaigns indicates that the group has powerful resources and capabilities. We do not expect this to be their last attack.

The past quarter (and 2022 in general) revealed significant cybersecurity trends that are likely to continue throughout 2023 and beyond. The number of politically motivated threat actors continues to grow, with threats including the distribution of misinformation and disinformation through fake news sites, tracking the actions and behaviors of journalists and dissidents, and attempted direct attacks on government and military organizations.

Across the board, threat actors used an array of methods that include newly identified tools and techniques as well as modifications to existing tools that enable them to better evade detection. The growth of targeted attacks in the automotive, healthcare, and financial industries cast a harsh light on the critical need to protect these sectors’ expansive and vulnerable threat surfaces.

Defending your organization against malware and cyberattacks requires in-depth knowledge of how threat actors are targeting your industry, the tools that they use, and their possible motivations. This detailed knowledge provides contextual, anticipative, and actionable cyberthreat intelligence that can reduce the impact of threats on your organization.

• In addition to financial motivation, increasing numbers of threat actors are now targeting individual and institutional victims based on economics, geopolitics, and societal circumstances. Defenders must proactively consider the possible impact of economic and political developments on cybersecurity.
• Threat actors are increasingly using less common or exotic programming languages such as GoLang and Rust to develop new malware. Threat hunters must remain vigilant and learn how the use of novel programming languages can manifest in attacks. Because GoLang supports cross-platform coding, more attacks on Linux and macOS may occur in the future.
• Wider access to initial access tools resulted in major incidents in 2022, as did the availability of ransomware as a managed service to groups without sufficient technical skills to create their own malware. As a result, use of ransomware by nation-state threat actors grew.
• The automotive industry was heavily impacted by a wide variety of cyberattacks in 2022. The compromise of large-scale manufacturers and industry suppliers resulted in stoppages across a number of production lines. These strings of attacks are likely to continue into 2023.
• Supply chain attacks that abuse legitimate apps to deliver malicious payloads can be mitigated and even prevented by implementing zero-trust policies that require continual authentication and authorization to access networks and applications.

• To date, a key characteristic of Russia’s invasion of Ukraine has included cyberattacks against Ukrainian military and civilian infrastructure. If hostilities continue, we are likely to see this pattern of targeted cyberattacks repeated.
• Ransomware operations targeting hospitals and medical organizations will continue, especially in countries that support or fund Ukraine.
• Cyberattacks on critical infrastructure will continue. AI may be increasingly used not only for attack automation, but also to develop advanced deepfake attacks.
• Attacks on European financial institutions, like the September 2022 attack on U.K.-based Revolut (a popular fintech company and app) that compromised more than 50,000 customer records, may also continue.
• In the Americas, we predict an explosion of commercial mobile spyware attacks. We expect that threat actors in Brazil will further expand Trojan banking attacks from desktop systems to mobile devices and continue targeting victims in Latin America. In fact, December 2022 revealed the BrasDex malware family^xxxix, which specifically targets Brazilian banking including PIX, a payment system similar to Zelle in the U.S.
• Attacks on Linux systems may continue to fly under the radar, especially those that virtualize systems, drop ransomware and install backdoors on target systems.
• We expect more targeted attacks on cloud infrastructure in every industry, as threat actors seek to gain additional visibility into the organizations that they seek to undermine or extract profit.

©2023 BlackBerry Limited. Trademarks, including but not limited to BLACKBERRY, EMBLEM Design and CYLANCE are the trademarks or registered trademarks of BlackBerry Limited, its subsidiaries and/or affiliates, used under license, and the exclusive rights to such trademarks are expressly reserved. All other trademarks are the property of their respective owners. BlackBerry is not responsible for any third party products or services. This document may not be modified, reproduced, transmitted, or copied, in part or whole, without the express written permission of BlackBerry Limited.

Disclaimer: The information contained in this report is intended for educational purposes only. BlackBerry does not guarantee or take responsibility for the accuracy, completeness and reliability of any third-party statements or research referenced herein. The analysis expressed in this report reflects the current understanding of available information by our research analysts and may be subject to change as additional information is made known to us. Readers are responsible for exercising their own due diligence when applying this information to their private and professional lives. BlackBerry does not condone any malicious use or misuse of the information presented in this report.