North Korean Maui Zowie, Linux and Windows RedAlert, Linux in OrBit, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 07 July, 2022
Episode 260 - 07 July 2022
North Korean Maui Zowie- https://www.zdnet.com/article/fbi-these-hackers-are-targeting-healthcare-records-and-it-systems-with-maui-ransomware/
Linux and Windows RedAlert -
https://www.bleepingcomputer.com/news/security/new-redalert-ransomware-targets-windows-linux-vmware-esxi-servers/
CuteBoi NPM Mining -
https://thehackernews.com/2022/07/over-1200-npm-packages-found-involved.html
SHI Attacked- https://www.bleepingcomputer.com/news/security/it-services-giant-shi-hit-by-professional-malware-attack/
Linux in OrBit -
https://thehackernews.com/2022/07/researchers-warn-of-new-orbit-linux.html
Hi, I’m Paul Torgersen. It’s Thursday July 7th 2022, and this is a look at the information security news from overnight.
From ZDNet.com
Several US agencies have issued an alert that North Korean sponsored attackers are targeting healthcare and public health organizations with the Maui ransomware. The warnings say these attacks have been going on since at least May of 2021, but they are still not sure of the initial attack vector. Early analysis suggests the malware is designed for attackers to manually select files for encryption, as opposed to encrypting all files wholesale. Details and a link to the advisory in the article.
From BleepingComputer.com:
A new ransomware operation called RedAlert, or N13V, targets both Windows and Linux VMWare ESXi servers with command-line options that allow the threat actors to shut down any running virtual machines before encrypting files. Victims are directed to a TOR site to pay a ransom in Monero to receive the decryptors. Details in the article.
From TheHackerNews.com:
Researchers have found a large-scale crypto mining campaign targeting the NPM JavaScript package repository. The malicious activity, attributed to a threat actor called CuteBoi, involves an array of 1,283 rogue modules from over 1,000 different user accounts using automation which includes the ability to pass the NPM 2FA challenge. Much of the source code in this attack is nearly identical to EazyMiner.
From BleepingComputer.com
SHI International has confirmed that a malware attack forced them to bring some of their systems, including email and public websites, offline. They described it as a coordinated and professional malware attack. The company says no customer data was exfiltrated and that third party systems in its supply chain were unaffected. No word on the threat actor or malware strain involved.
And last today, from TheHackerNews.com
Researchers have uncovered a new Linux threat dubbed OrBit, the fourth Linux targeting malware discovered in the past three months. This one can be installed either with persistence capabilities or as a volatile implant, and implements advanced evasion techniques. It ultimately provides the threat actors with remote access capabilities over SSH, harvests credentials, and logs TTY commands. Details on the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.