Hacking News

An unknown hacking group — potentially Russian state-sponsored — hit Croatian government agencies with spear phishing using post-exploitation frameworks; a Golang-written crypto miner targeting Linux servers was undetectable by most antivirus software; a Cloudflare WAF regex bug knocked 10% of the internet offline for 30 minutes; and the Christmas DDoS Grinch who took down PlayStation and Xbox networks received a 27-month prison sentence.

Stories Covered

Croatian Government Targeted by Spear Phishing Campaign Using Empire Backdoor and Silent Trinity

ZDNet reported on a series of spear phishing attacks against Croatian government employees by an unknown hacking group believed to be state-sponsored. Spear phishing differs from broad phishing in that it targets specific individuals or organizations rather than casting a wide net — the emails are tailored to the target’s context to increase the likelihood of engagement. In this campaign, the phishing emails contained Excel attachments with embedded macros. When a recipient opened the file and enabled macros, the macro downloaded a malware payload to the machine. Two malware families were identified: the Empire backdoor, which is part of the Empire post-exploitation framework — a tool designed to provide persistent access and command execution on compromised machines — and Silent Trinity, another post-exploitation tool. A presentation at Positive Hack Days had previously concluded that Silent Trinity had not previously been weaponized in active malware campaigns, making this deployment notable. The campaign operated undetected for two months before the Croatian Information Systems Security Bureau issued alerts and distributed indicators of compromise to government agencies. A FireEye report was cited as potentially linking the attacks to Russian threat actors based on shared command-and-control infrastructure with attacks against Ukrainian government agencies — though attributing attacks solely on shared C2 servers carries inherent uncertainty. The post-exploitation model used here — gaining access through phishing then using framework-based tools for persistent backdoor access — is standard nation-state espionage tradecraft.

Golang Malware Targeting Linux Servers: Undetectable by AV, Active Since Mid-2018

A Monero cryptocurrency mining malware written in Go (Golang) had been targeting Linux servers since mid-2018 and remained active. The malware exploited multiple CVEs to gain initial access: CVE-2019-9082 (ThinkPHP), CVE-2019-3396 (Atlassian Confluence), and CVE-2018-7600 (Drupal, also known as Drupalgeddon2). Beyond web application vulnerabilities, the malware spread via SSH credential enumeration, Redis database password enumeration, and by attempting to use SSH private keys found on already-compromised machines to pivot to additional servers. Once inside a machine, it deployed XMRig with the Cryptonight algorithm to mine Monero. The most significant aspect of this malware was its antivirus evasion: at the time of reporting, it was not detected by most antivirus products. Golang was not a common malware development language, and AV signature databases had not accumulated enough samples to reliably detect it. This was an early demonstration of the pattern — later confirmed widely across Go, Rust, and other “unusual” language malware — that novel implementation languages reliably bypass signature-based detection because AV engines have trained on far fewer examples. The malware affected several thousand servers. For Linux server administrators: ensure public-facing web applications running ThinkPHP, Confluence, or Drupal are patched, audit exposed Redis instances for unauthorized access, rotate SSH keys on any machine suspected of compromise, and monitor for unexpected CPU usage spikes that may indicate unauthorized mining.

Cloudflare Outage: One Bad Regex in a WAF Rule Crashed 10% of the Internet for 30 Minutes

Cloudflare experienced a 30-minute global outage that caused sites behind its network to return 502 errors, not from a hack or external attack, but from a misconfigured deployment. A new rule added to Cloudflare’s Web Application Firewall contained a regular expression — a pattern-matching syntax used to identify specific strings in traffic — that caused catastrophic CPU usage when applied to live traffic. A regular expression that contains certain pathological patterns can trigger “catastrophic backtracking,” where the regex engine attempts exponentially many partial matches before failing — consuming CPU in proportion to traffic volume rather than in constant time. The CPU spike was severe enough that Cloudflare’s network could not process ordinary traffic, causing requests to be dropped. Cloudflare rolled back the deployment and service was restored after approximately 30 minutes. The standard practice for WAF rule deployments is to run new rules in simulation or dry-run mode first, monitoring their behavior against production traffic without enforcing them, before enabling enforcement. In this case, the rule went directly to enforcement, bypassing the opportunity to observe the CPU impact before it affected customers. Cloudflare’s post-incident report acknowledged the process failure and committed to tighter deployment controls. The outage was a reminder that infrastructure providers who serve a significant fraction of internet traffic carry systemic risk — a single bad deployment at that scale affects millions of downstream services simultaneously.

Christmas DDoS Grinch Sentenced: 27 Months for Taking Down PlayStation and Xbox Networks

A 23-year-old hacker from Utah, operating under the handle “derptroll” and as a member of the group Derptrolling, was sentenced to 27 months in federal prison and ordered to pay $95,000 in restitution to Daybreak Games (formerly Sony Online Entertainment) for DDoS attacks that knocked PlayStation Network and Xbox Live offline during Christmas 2013 and January 2014. The timing of the attacks — targeting gaming services during the Christmas period when millions of people receive new consoles and games — was deliberate for maximum disruption. DDoS attacks against gaming networks affect more than just online play: many games require online authentication to launch even in single-player mode, and console updates are delivered over the same network infrastructure. The hacker had pleaded guilty in November 2018. The sentence is unrelated to the separately reported Lizard Squad DDoS attacks, which targeted the same gaming networks in 2014 and were carried out by a different group — though the timing overlap created confusion in media coverage at the time. The case represents one of the earlier successful federal prosecutions specifically for DDoS attacks against consumer gaming infrastructure.

Listen to the Episode

NASA’s Jet Propulsion Laboratory was compromised for a full year after an unauthorized Raspberry Pi was connected to its unsegmented network — resulting in 500 MB of ITAR-regulated data stolen, including access to NASA’s deep space satellite network; a new LooCipher ransomware spread via spam; and Steam gamers were targeted by a phishing chain that redirected through multiple URLs to a fake game site harvesting Steam credentials.

Stories Covered

NASA JPL Hacked for a Year via Rogue Raspberry Pi: 500 MB of ITAR Data Stolen, APT10 Suspected

The NASA Office of Inspector General released a report documenting a cyberattack against NASA’s Jet Propulsion Laboratory that lasted approximately one year, beginning in 2018. The initial entry point was an unauthorized Raspberry Pi — a small single-board computer — that had been connected to JPL’s internal network without authorization. Once on the network, the attackers were able to move laterally throughout JPL’s systems without significant resistance because JPL’s internal network was not properly segmented. Network segmentation — dividing a network into smaller subnetworks using switches, routers, or firewall rules so that devices in one segment cannot freely communicate with devices in another — is a fundamental security control precisely because it limits the blast radius of an initial compromise. Without it, a single compromised device provides pathways to everything else on the network. The attackers ultimately exfiltrated approximately 500 MB of data, some of which was subject to ITAR — the International Traffic in Arms Regulations — which governs the export of defense and military technology. The stolen data was associated with the Mars Science Laboratory, which operates the Curiosity Rover. Investigators also found that the attackers had accessed JPL’s Deep Space Network, which communicates with spacecraft and satellites. Attribution pointed to APT10, a Chinese state-sponsored hacking group, consistent with a Department of Justice indictment of two Chinese nationals charged in 2018 for hacking cloud providers, the U.S. Navy, and NASA.

WeTransfer Security Incident: Files Delivered to Wrong Recipients for Two Days

WeTransfer, a file-sharing service used to send large files, disclosed a security incident that occurred June 16–17, 2019. During that window, files transferred to intended recipients were also delivered to unintended third parties. WeTransfer notified affected users via email but did not disclose the technical cause of the misdistribution. The company responded by disabling transfer links associated with affected accounts, logging out impacted accounts, and resetting passwords — a response more consistent with a security breach than a simple routing bug. A pure code bug causing mis-delivery would typically be addressed by fixing the code and invalidating the links; the additional step of logging out accounts and forcing password resets suggests WeTransfer may have had reason to believe account credentials were exposed beyond the mis-delivery itself. The company did not publicly confirm or deny whether the incident involved a broader breach.

LooCipher Ransomware: Macro-Based Word Document Delivers Bitcoin-Demanding Countdown Timer

A new ransomware family called LooCipher (also spelled LoCipher) began spreading through spam campaigns using a malicious Word document named info_bsv_2019.doc. When a victim opens the document, Word prompts the user to enable macros. If macros are enabled, the macro connects to a Tor server and downloads a malicious executable that is renamed loocipher.exe and automatically executed. The ransomware then follows a standard encryption pattern: it creates a configuration file on the Windows desktop containing a unique victim ID, payment deadline, and Bitcoin wallet address; encrypts files, appending the .lcphr extension; creates a ransom note as a text file explaining payment instructions; changes the desktop wallpaper to display the ransom message; and opens a countdown timer window showing the payment deadline with a verification button. The infection vector is the same one used by most macro-based malware: the user must open an unsolicited document and explicitly choose to enable macros. Defenses are consistent: do not enable macros in documents received via email, maintain offline backups so recovery does not require paying the ransom, and treat any spam-delivered document attachment as potentially malicious regardless of how plausible the sender appears.

Steam Phishing Campaign: Compromised Accounts Send Fake Free Game Links to Harvest Credentials

Malwarebytes Labs documented a phishing campaign targeting Steam gamers. Compromised Steam accounts were used to send messages to the victim’s friends list claiming to offer a free game as a gift — a social engineering vector that works because the message appears to come from a known contact. The phishing chain routed victims through a Twitter short link (t.co), which redirected to steamredirect.fun, which then redirected to the actual phishing page. The phishing site presented itself as a gaming prize site where users could “win” games by pressing a play button. After appearing to win, the site displayed a countdown timer of 30 minutes and prompted users to log into their Steam account to claim the prize. The fake Steam login page displayed a third-party OAuth-style request under the name “Gift for Keys” — but while legitimate Steam third-party logins route through steamcommunity.com, the phishing page’s login URL was blank rather than the legitimate Steam domain, a clear sign of credential harvesting. Any credentials entered on that page went directly to the attacker. For Steam users: verify the URL of any login page before entering credentials, be skeptical of any “free game” link even from accounts you know (since accounts can be compromised), and do not click shortened URLs in gaming messages without checking the destination first.

Listen to the Episode