Global Threat Intelligence Report

These are the threats that BlackBerry identified and guards against within its own customer base. 

Type: Infostealer

Targets: Food Production, Justice System, Education

Regions: APAC, NALA

FormBook and its evolution, xLoader, are advanced malware families functioning as both infostealers and versatile downloaders. They have consistently adapted to evade cyber defenses using anti-virtual machine (VM) techniques, process injection and custom encryption. Sold as malware-as-a-service (MaaS), xLoader can extract data from browsers, email clients and various applications. Recent cyber incidents involving xLoader/FormBook have targeted food production in the APAC region, as well as the education and justice sectors in NALA.

Type: Infostealer

Targets: Food Production

Regions: APAC

Snake Keylogger (also known as 404 Keylogger and KrakenKeylogger) is a MaaS which utilizes a subscription-based keylogger with a plethora of capabilities. The malware can steal sensitive data and pilfer credentials from Internet browsers, as well as log keystrokes and capture screenshots of the victim's desktop.

Initially released on a Russian hacking forum in late 2019, Snake Keylogger has since grown in complexity, with greater diversification of its command-and-control (C2) infrastructure and the ability to encrypt its malware payloads. The malware can also deactivate antivirus (AV) services so it can run unhindered. Its exfiltration methods are unusually comprehensive, including email, FTP, SMTP, Pastebin (a text storage website) and the messaging app Telegram. It is noteworthy that Telegram accounted for 60 – 80% of total Internet traffic in Russia in 2023 and provides an almost completely uncensored communication environment in a country where access to Internet sites is tightly controlled.

Type: Downloader

Targets: Food Production, Justice System

Regions: APAC

GuLoader (also known as CloudEyE) is a prominent downloader that distributes additional malware. Since 2020, the threat group behind GuLoader has added anti-analysis techniques to make it more difficult for security services to identify its presence on a system or implement countermeasures. GuLoader commonly works in tandem with other malware, namely infostealers like FormBook, Agent Tesla and Remcos.

Type: Infostealer

Targets: Healthcare, Public Sector, Education, Food Production

Regions: NALA, APAC

RedLine is an infostealer frequently distributed through MaaS platforms. Its operators are primarily driven by financial motives rather than political or espionage interests and employ a “scattershot” attack strategy, attacking all industries and regions without seeming to focus on specific targets.

BlackBerry researchers compiled a list of recent notable cyberattacks that happened this quarter and were reported on by the media and other cybersecurity organizations. Our goal in doing so is to provide a broader view of the cyberthreat landscape in critical infrastructure.

In July, the Play (PlayCrypt) ransomware threat group targeted two energy organizations: Texas Electric Cooperatives, an association that represents 76 electric cooperatives statewide, and the 21st Century Energy Group, a supplier of various energy services and products in Pennsylvania and Ohio. The breaches led to losses of personal information and accounting and tax data, some of which was posted to the Play leak site shortly thereafter.

Another July attack targeted the Richland Paris Hospital, a Louisiana non-profit providing essential healthcare services to the rural community. This attack was perpetrated by the Dispossessor ransomware group, first observed in December 2023. Dispossessor acts as a data broker rather than a traditional ransomware group. In an unusual move, Dispossessor released a video showcasing 100+ pages of sensitive patient information. In August, the FBI working in tandem with local and international law enforcement agencies announced they had dismantled the infrastructure behind the Dispossessor group.

In mid-September, Google researchers observed a cyber espionage group dubbed UNC2970, believed to be linked to the North Korean government. Using phishing tactics, this group posed as several different established companies within the energy and aerospace sectors, creating fake job adverts designed to attract specific targets. Once a victim engaged with the lure, they received a "job description" PDF within a ZIP archive. To open this file, the attackers provided a maliciously modified version of SumatraPDF. When executed, this initiated an execution chain facilitated by BURNBOOK, a malware launcher crafted in C/C++, which ultimately deployed a MISTPEN backdoor. MISTPEN is a trojanized version of binhex.dll, a Notepad++ plugin, which was altered to include a backdoor, compromising the targeted user's computer.

These are the threats that BlackBerry identified and guards against within its own customer base. 

Type: Infostealer

Targets: Retail and Wholesale Trade, Commercial and Professional Services

Regions: APAC, NALA

First observed in August 2022, LummaC2 (also known as LummaC2 Stealer) is an infostealer, written in the C programming language, that targets both commercial enterprise and critical infrastructure. Focused on exfiltrating sensitive data, it is often promoted and distributed via underground Russian cybercrime forums and Telegram groups. This potent infostealer runs as a MaaS operation and often relies on trojans and email spam to propagate.

Type: Infostealer

Targets: Capital Goods, Commercial and Professional Services

Regions: APAC, NALA

StealerC is a C-based infostealer designed to steal sensitive data from various programs, web browsers and email clients before exfiltrating this private information back to the attacker. First observed in 2023, the malware can drop further malware payloads onto the victim device.

Type: Infostealer

Targets: Retail And Wholesale Trade, Commercial and Professional Services

Regions: NALA, APAC

FormBook (first observed in 2016) and its evolution, xLoader, are sophisticated malware families operating as complex infostealers and versatile downloaders for additional malware. They continue evolving to evade cyber defenses through anti-VM techniques, process injection and custom encryption routines. xLoader can steal data from browsers and email clients and perform a wide range of other actions. Because it is sold as MaaS, its presence on a system or network doesn’t necessarily point to any specific threat actor. This flexible operational model enables it to target a diverse array of industry sectors worldwide.

Type: Downloader

Targets: Retail and Wholesale Trade, Commercial and Professional Services

Regions: APAC, NALA

GuLoader (also known as CloudEyE) is a prominent downloader that distributes malware. First observed in 2020, GuLoader’s anti-analysis techniques make it more difficult for security teams to identify attacks or devise countermeasures. GuLoader commonly works in tandem with other malware, namely infostealers like FormBook, Agent Tesla and Remcos.

Type: Infostealer

Targets: Capital Goods, Consumer Durables and Apparel, Commercial and Professional Services

Regions: APAC, NALA

RedLine is a widely distributed malware infostealer, first observed in March 2020 and often sold as MaaS. The threat group that distributes the malware appears to be motivated by financial gain rather than politics, data destruction or espionage. This is why RedLine constantly pops up on our radar, actively targeting an unusually wide range of industries and geographic regions.

Type: Remote Access

Targets: Retail and Wholesale, Commercial and Professional Services

Regions: APAC, NALA

Remcos, short for Remote Control and Surveillance, is a commercial-grade remote access trojan (RAT) used to remotely control a computer or device. Though advertised as legitimate software, it is often abused to gain unlawful access to a victim’s machine or network.

BlackBerry researchers compiled a list of notable recent cyberattacks, reported by the media and other cybersecurity organizations, to provide a broader view of the cyberthreat landscape for commercial enterprises.

In July, Empereon Constar, an Arizona-based business process outsourcing company, suffered a breach by Akira ransomware operators who allegedly stole 800GB of data including client information, employee files and financial records. The group employs double extortion tactics, demanding a ransom both for decryption and non-disclosure of confidential information. If not paid, they threaten to publish the stolen data on both surface web and dark web leak sites.

In late July, Pennsylvania's Odyssey Fitness Center was targeted by the Play ransomware group (also known as PlayCrypt). The cybercrime group, responsible for over 300 global ransomware attacks, used their signature double-extortion approach, encrypting the fitness center’s systems after exfiltrating sensitive data.

In late September, Indian electronics retailer Poorvika Mobiles was targeted by the KILLSEC group. The breach exposed a large amount of customer data, including names, addresses, phone numbers, tax IDs, product delivery details, invoice numbers, transaction amounts and tax documentation.

This section delves into the dynamic world of cyberthreats, beginning with an analysis of the most prominent threat actors.

Salt Typhoon (also known as Earth Estries) is a sophisticated threat actor closely linked to China's Ministry of State Security (MSS) that emerged into the public spotlight in 2024. The group compromised multiple major U.S. telecommunications providers and Internet service providers by exploiting backdoors in ISP systems originally implemented for court-approved law enforcement compliance. The group has demonstrated advanced capabilities in maintaining long-term stealth, in this instance remaining undetected in telecommunications networks for over a year.

Once they had established persistence within the network, Salt Typhoon gained access to extensive data including the U.S. Justice Department's lawful intercept wiretap lists, call logs, unencrypted text messages, audio recordings and Internet traffic flowing through provider networks. Their targeting of high-profile U.S. government officials and political figures prompted unprecedented response measures, including a White House Situation Room meeting with telecommunications executives, and warnings from federal agencies about mobile device usage. Members of Congress in the House and Senate have expressed grave concerns over these incidents and have called on U.S. federal agencies to provide further information about the attacks. Read the section on communications security for a more detailed look at threats to critical infrastructure.

RansomHub (also known as Cyclops and Knight) operates via a RaaS model and has recently gained significant prominence on the threat landscape. The effectiveness and success of this operational model has attracted multiple well-known affiliates, such as LockBit and ALPHV, who perform network infiltration and data exfiltration.

RansomHub operates through a double extortion approach. The group also employs a variety of techniques to disable or terminate endpoint detection and response (EDR) solutions, allowing it to evade detection and maintain an extended presence within compromised networks. Since its launch in February 2024, RansomHub has rapidly expanded, targeting and exfiltrating data from over 210 victims across critical infrastructure sectors. This swift growth has positioned it among the most prolific ransomware operators in terms of publicly claimed attacks. Industries attacked include:

Healthcare and Pharmacy

• Threat Activity: Targeted ransomware attacks against healthcare providers and pharmacies
• Notable Impact: Rite Aid breach affecting 2.2 million customers (July 2024)
• Critical Concerns: Theft and exposure of sensitive patient data, disruption to prescription management systems and compromise of protected health information (PHI)

Energy and Industrial

• Threat Activity: Sophisticated attacks targeting operational technology and business systems.
• Notable Impact: Disruption of an oil and gas services giant’s IT systems (August 2024)
• Critical Concerns: Business operation interruptions, supply chain disruptions, invoice and purchase order system compromises

Non-Profit and Healthcare Services

• Threat Activity: Data theft campaigns targeting sensitive organizational data
• Notable Impact: Planned Parenthood Montana breach (September 2024), resulting in theft of confidential patient data and disruption of operations
• Critical Concerns: Exposure of confidential patient information, privacy violations and reputational damage

Play is a ransomware group that first emerged in June 2022. Play has compromised hundreds of organizations in a variety of industries across North America, South America and Europe, with its primary focus being the U.S. and Canada. Play typically employs double extortion tactics, threatening to publish data stolen from victim organizations.

To gain initial access to a target system or network, Play abuses valid accounts and vulnerable public-facing applications on Windows environments. After mapping out networks with tools such as AdFind, they move laterally with tools such as PsExec and Cobalt Strike, using additional tools like Mimikatz to gain domain administrator credentials. Once devices containing sensitive information are identified, the group collects the files into .RAR archives, then exfiltrates them using WinSCP before finally encrypting the files on the plundered devices.

In July, Play was observed using a new Linux variant of their ransomware that only targets files running in VMware ESXi environments.

Hunters International, first identified in October 2023, has notable similarities to Hive ransomware. When Hunters International’s operators acquired the Hive group’s malware and infrastructure, they differentiated themselves from Hive by marketing enhanced capabilities.

Their operations primarily focus on double extortion, prioritizing data exfiltration and using stolen information to pressure victims into making ransom payments. The group also employs file encryption using ChaCha20-Poly1305 and RSA Optimal Asymmetric Encryption Padding (OAEP), resulting in files marked with the “.LOCKED” extension.

Typical attack chains start with phishing campaigns or the exploitation of a vulnerability. The group targets a range of sectors, including manufacturing, healthcare and education, taking an opportunistic approach with no specific focus on any particular region or industry, compromising targets in North America, Europe and Africa. A key tool in their arsenal is SharpRhino, a backdoor disguised as legitimate software, used alongside aggressive measures to disable backup systems by executing a series of commands and attempting to terminate specific services and processes typically associated with system recovery.

Over the past quarter, Hunters International has been very active indeed, targeting all types of organizations, industries and geographic regions, underscoring their adaptability and broad threat potential. They are well-known for their somewhat spiteful tactic of reinfecting victims who have managed to restore their systems from backups without paying the ransom, either with a second dose of their own ransomware or a different variant.

Meow Leaks is a threat group with possible ties to the Meow ransomware group (also tracked as MeowCorp and Meow2022) that emerged in 2022 as a variant of Conti ransomware. This new Meow group, which emerged in late 2023, focuses its efforts on the sale of stolen data via a Tor-based eponymous “Meow Leaks” site.

Meow claims not to deal in ransomware; the group has publicly stated in an interview that they are not involved with Conti and have no current affiliation with MeowCorp. That much said, it’s possible that this new group lacks expertise in developing ransomware, a theory reflected in its limited dark web victim list which so far has focused mainly on U.S.-based targets, although it has a few international victims. This classifies them as primarily an extortion-based threat group, since they can’t rely on encryption of the original data to pressure victims to pay up.

Regardless of their connections to the initial ransomware group, the new Meow Leaks threat group had a significant spike in activity this quarter, as evidenced by their growing leak site. A free decryptor for victims of MeowCorp called RakhniDecryptor was released by security researchers in March. The decryption tool works to decrypt files with the file extensions .KREMLIN, .RUSSIA and .PUTIN. (Prior attacks by MeowCorp using the Conti-based encryptor initially targeted Russian organizations.)

Qilin is a RaaS, active since 2022, that continues to target healthcare and various other industries worldwide. Originally launched as “Agenda” in July 2022, the operation rebranded as “Qilin” and now operates under that name.

Qilin ransomware includes variants written in Golang and Rust and often gains initial access to a victim through spearphishing attacks. The group utilizes remote monitoring and management (RMM) tools and Cobalt Strike for binary deployment. During an attack, Qilin locates the target’s domain controller and executes a credential-harvesting script that specifically targets stored passwords in Google Chrome for authenticated users. Known for its double extortion strategies, Qilin demands ransom payments to prevent the public disclosure of stolen data.

Tools like AnyDesk, PowerShell and Cobalt Strike are vital in data management, penetration testing and system maintenance. Their flexibility and accessibility also make them useful tools to be misused by threat actors.

Microsoft PowerShell is a powerful command-line shell and scripting language designed for automating tasks and managing Windows systems. Widely used by administrators and security professionals worldwide, it supports automating routine tasks, system management and responses to security incidents. However, its versatility also makes it a target for abuse by attackers who can exploit PowerShell to gain unauthorized access and execute malicious code. The real danger lies in PowerShell's ability to run scripts both from disk and directly in memory, enabling "fileless" malware attacks that are difficult to detect.

Read our MDR team’s account of a PowerShell incident.

Cobalt Strike serves as a sophisticated adversary simulation framework, meticulously engineered to replicate the persistent presence of threat actors within network environments. Structured around two pivotal components — an Agent (Beacon) and a Server (Team Server) — Cobalt Strike orchestrates a seamless interaction. The Cobalt Strike Team Server, functioning as a long-term C2 server hosted on the Internet, maintains constant communication with Beacon payloads deployed on victim machines.

While Cobalt Strike is primarily used as a legitimate tool for penetration testers and red teamers to assess the security posture of networks, it has also been exploited by threat actors for nefarious purposes. Instances of its code being leaked online have also occurred, leading to its rapid weaponization by a diverse array of adversaries. This dual nature highlights the importance of vigilance and robust cybersecurity measures to mitigate the risks associated with its misuse.

WinSCP (Windows Secure Copy) is a free open-source client for SFTP, FTP, WebDAV and SCP protocols, designed for Microsoft Windows. It facilitates secure file transfers between local and remote computers, leveraging encrypted protocols like SFTP to ensure data security. However, its capabilities also make it a tool of choice for threat actors. Attackers can use WinSCP to stealthily exfiltrate large volumes of data, upload malware to target servers for further system compromise and gain remote access to execute arbitrary commands or deploy additional malicious software, maintaining persistent control over compromised systems.

In our CylanceMDR Threats and Mitigations section, our CylanceMDR team reviewed the most prevalent tools that could be used for exfiltration in our customer environments. The team found that WinSCP made up 51% of the most commonly abused exfiltration tools found on client systems.

New threats and threat groups are constantly evolving and presenting new challenges. Organizations that aim to protect their digital assets must adopt a comprehensive cybersecurity strategy, incorporating robust mitigation measures along with employee training. Here, we explore several key strategies that can be implemented to thwart cyberthreats like those posed by the Lynx ransomware group.

Implementing network segmentation is a foundational step in containing potential breaches.

• Tactic: By dividing the network into distinct segments according to a system classification policy, organizations can create choke points that can limit an attacker’s ability to maneuver, extending protection time and creating more opportunities for the detection of the adversary.
• Example: A major healthcare provider thwarts a cyberattack by isolating its patient data servers from its general use network, ensuring that critical data remains secure even if other parts of the network are compromised.

Organizations should maintain up-to-date offline copies of data stored in a separate backup infrastructure inaccessible from primary networks.

• Tactic: Maintain a separate backup infrastructure.
• Example: This approach is successfully adopted by a global manufacturing firm which regularly conducts data snapshots and stores them offline, ensuring data integrity and availability even after a ransomware attack.

Organizations should monitor for specific indicators; in the case of a Lynx attack, monitor for the appearance of file extensions like ".LYNX" or the creation of files named "README.txt," which is a typical filename given to ransom notes.

• Tactic: Early warning systems can detect unusual data transfer patterns or mass file modifications, allowing a rapid response to potential breaches.
• Example: A financial institution avoids a significant data breach by deploying endpoint detection and response that flagged unauthorized after-hours access to its backup systems.

Access management is a security practice focused on controlling and monitoring access to systems, resources and data within an organization. Implementing comprehensive access control monitoring can help organizations detect and prevent unauthorized access attempts to critical systems.

• Tactic: Deploy detailed logging of all access attempts to sensitive systems and data. Regularly review access logs for suspicious patterns. Implement automated alerts for unusual access behavior. Maintain strict access control lists (ACLs) with regular audits of user permissions.
• Example: A financial services company detects and prevents a potential data breach by identifying unusual access patterns through their monitoring system, which could flag multiple failed login attempts from an authorized user account outside normal working hours.

A well-defined incident response (IR) plan enables organizations to react quickly and effectively to cybersecurity incidents, minimizing potential damage and recovery time.

• Tactic: Develop detailed incident response procedures, establish clear roles and responsibilities, maintain updated contact lists for key stakeholders and external resources (law enforcement, incident response firms), and conduct regular tabletop exercises to test response effectiveness.
• Example: A manufacturing company might contain a ransomware incident within hours by following their tested incident response plan, which included immediate system isolation procedures and pre-established communication channels with their incident response team.

Assessing the security posture of key products with access to your network is critical.

• Tactic: Implement a supply chain risk management program, a security testing practice for products with access to critical systems, and regularly review third-party access permissions to mitigate supply chain risks.
• Example: A pharmaceutical firm could enhance its supply chain security by conducting thorough security assessments, ensuring that all partners adhered to stringent cybersecurity standards.

Using advanced security technologies such as EDR solutions, email filtering and application whitelisting on critical systems can significantly enhance an organization's security posture.

• Tactic: Establish continuous network monitoring and threat hunting capabilities.
• Example: A telecommunications company identifies and neutralizes an advanced persistent threat (APT) through proactive threat hunting.

The BlackBerry Threat Research and Intelligence team analyzed the following MITRE Techniques often used by threat actors:

Virtualization/Sandbox Evasion (T1497) is a technique under the Defense Evasion (TA0005) tactic. This technique is used to detect virtualized or sandboxed environments typically employed by malware analysis and threat detection solutions. By identifying these environments, malicious actors can evade detection by halting or altering the behavior of their payload which prevents analysis tools from accurately assessing the threat.

Adversaries use the Virtualization/Sandbox Evasion technique to verify if their payload is being executed in an analysis environment rather than on a genuine host. This is critical for bypassing detection and enables the malware to remain stealthy. The payload may be configured to behave differently based on environmental checks, executing only in real-world settings and avoiding activation when virtual or sandbox environments are detected.

Common indicators that an adversary is present may include:

• Registry entries and system artifacts associated with VMs.
• Hardware configuration cues such as specific virtualization drivers or low resource limits which can indicate a sandboxed environment.
• Processes or file paths tied to popular sandboxing tools or virtual environments.
• System behavior or uptime checks to detect whether the environment is newly initialized, a common trait of sandbox setups.

Attackers often employ PowerShell or batch scripts with embedded system checks to detect virtualized conditions. Below is an example of a PowerShell command used to evade sandbox analysis by checking for a VM presence:

Get-WmiObject -Class Win32_BIOS | Select-String "VMware|VirtualBox|Xen"

If the command returns a match, the payload may alter its execution path or terminate, evading further analysis within a virtualized environment.

Electron applications are desktop applications built using web technologies such as HTML, CSS and JavaScript. They are developed on the Electron framework which combines the Chromium rendering engine with the Node.js runtime.

Since Electron applications can request significant system permissions, an adversary can exploit this access to execute commands or scripts with the same privileges as the application itself.

Threat actors can leverage the ability to run arbitrary commands to execute malicious code through legitimate processes by using System Binary Proxy Execution. Example: chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe" demonstrates how system binary proxy execution can be exploited. By using the --disable-gpu-sandbox flag, the threat actor weakens Chrome's security by disabling process isolation. The --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe" command enables adversaries to execute arbitrary commands through cmd.exe.

Another example is: teams.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c ping google.com &&" which spawns cmd.exe as a child process to execute the arbitrary command while disabling GPU sandboxing, allowing the process to run without isolation.

During the most recent MITRE V15 update, the original technique of System Script Proxy Execution (T1216) has expanded with a new sub-technique, identified as T1216.002 and named SyncAppvPublishingServer. This sub-technique falls under the Defense Evasion tactic (TA0005) and is manipulated by adversaries to proxy the execution of malicious PowerShell commands.

SyncAppvPublishingServer.vbs is a legitimate Visual Basic script associated with Microsoft and its Application Virtualization (App-V) which allows Windows to virtualize applications. The SyncAppvPublishingServer.vbs script is signed by Microsoft, which gives it credibility. 

Malicious actors exploit this sub-technique to bypass PowerShell execution restrictions and evade detection systems by utilizing native, trusted processes, a method commonly known as “living off the land.” This allows for the execution of malicious command while blending into native system operations.

Here is an example command line of how this can be invoked:
“SyncAppvPublishingServer.vbs "n; {Malicious PowerShell Command}"”