A China-nexus threat actor has been observed using a Go-based backdoor, dubbed HOOKEDGE, to target diplomatic and defense organizations in Myanmar. The backdoor is delivered via VHD files as part of an operation named QUICKSILVER. This activity is consistent with the tactics of the Russian APT group BlueDelta, which has also been seen employing HOOKEDGE against similar targets.
In other recent cybersecurity developments, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities catalog. New additions include flaws affecting ownCloud, the Linux Kernel, JFrog Artifactory, Red Hat, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler. CISA also issued a warning to water utilities, urging them to identify and secure any exposed Programmable Logic Controllers (PLCs) before they can be exploited by attackers. This follows a CISA Red Team exercise that successfully compromised two critical infrastructure organizations.
Separately, the FBI has taken action against China-linked hacking platforms QScan and QTRouter, which were reportedly used in attacks against critical infrastructure.
Ransomware groups continue to be active, with the Rhysida group claiming an attack on the Berlin government ahead of an upcoming vote. Meanwhile, hackers are actively probing PaperCut servers, with reports indicating that 47% of affected servers remain unpatched for a recently disclosed zero-day vulnerability. An emergency patch has been released for this flaw, which is under active exploitation.
In the United Kingdom, airport operator MAG experienced a cyberattack that exposed the data of 8.7 million customers across three airports. Elsewhere, the Dark Caracal group has deployed new Go malware that incorporates an Ethereum-based command and control (C2) fallback mechanism.
Other notable incidents include a breach at Love Electric, where records for 877,000 drivers are being offered for sale. Australian police have also charged two individuals in connection with credential theft related to TeamPCP.
Finally, OpenAI has reportedly banned Russian ChatGPT accounts that were found to be supporting a covert influence operation.
