Emerging Cyber Threats: New Malware and Ransomware Strains Discovered in July 2024

As cybersecurity threats continue to evolve, July 2024 saw the emergence of several new malware and ransomware strains. These discoveries highlight the ongoing need for vigilance and robust security measures in an increasingly complex digital landscape.

DragonForce Ransomware: A New Threat on the Horizon

In mid-July 2024, researchers uncovered a new ransomware variant dubbed DragonForce. This malicious software targets Windows systems and has been observed affecting organizations across multiple industries and countries. Key features of DragonForce include:

• File encryption with random string renaming
• Appending ".dragonforce_encrypted" extension to affected files
• Leaving a "readme.txt" ransom note
• Demanding Bitcoin payment for decryption
• Using Tor for communication and Tox messenger for support

The ransomware's operators threaten to publish stolen data if victims don't comply with their demands, adding an extra layer of pressure to affected organizations.

Eldorado: The Rising Ransomware-as-a-Service

While first appearing in March 2024, the Eldorado Ransomware-as-a-Service (RaaS) gained significant traction in July. This sophisticated malware targets both Windows and Linux systems, showcasing the growing trend of cross-platform threats. Notable aspects of Eldorado include:

• Written in Golang for cross-platform functionality
• Utilizes Chacha20 for file encryption and RSA-OAEP for key encryption
• Capable of encrypting files on shared networks via SMB protocol
• Already claimed 16 victims by June 2024, primarily in the U.S.

BugSleep: MuddyWater's New Backdoor

The MuddyWater hacking group introduced a new backdoor called BugSleep in May 2024, which saw active use in July. This malware partially replaces the group's previous reliance on legitimate Remote Monitoring and Management (RMM) tools. BugSleep employs various evasion techniques to avoid detection, making it a formidable threat to targeted systems.

XDSpy.DSDownloader: New Tool in Cyberespionage

July also saw the discovery of XDSpy.DSDownloader, a new tool used by the XDSpy cyberespionage group. This malware was identified in attacks targeting organizations in Russia and Moldova, highlighting the ongoing geopolitical dimensions of cyber threats.

DodgeBox: APT41's Latest Weapon

Researchers recently uncovered DodgeBox, a new malware loader associated with the Chinese threat actor APT41. This loader is used to install a backdoor called MoonWalk, further expanding the arsenal of this notorious hacking group.

Ongoing Threats: Familiar Names, New Variants

While not new discoveries, several existing ransomware groups continued to evolve and pose significant threats in July 2024:

• LukaLocker: Notable for direct victim communication instead of using data leak sites
• Mallox (aka Fargo, TargetCompany, and Mawahelper): Introduced new Linux variants
• RansomHub: Attacked Coca-Cola's Myanmar office
• Nullbulge Group: Claimed responsibility for a major cyber attack on Disney
• BianLian: Targeted an Australian IT services company

Here's a list of threat actors that were active in July 2024:

1. Nullbulge Group: Claimed responsibility for a major cyber attack on Disney, leaking about one terabyte of data from Disney's internal Slack workspace.
2. RansomHub: Attacked Rite Aid Pharmacy, impacting 2.2 million customers' personal information.
3. BianLian ransomware: Targeted an Australian IT services company, Insula Group, claiming to have stolen 400 gigabytes of data.
4. LockBit Ransomware: Claimed responsibility for a cyber attack on Croatia's largest hospital, KBC Zagreb.
5. Qilin ransomware: Affiliates attacked Synnovis, affecting medical care in the UK NHS.
6. Fog ransomware: Targeted the U.S. education sector, exploiting a vulnerability in Veeam Backup and Restore software.
7. APT41: A Chinese threat actor group associated with a new malware loader called DodgeBox.
8. MuddyWater: A hacking group that introduced a new backdoor called BugSleep.
9. XDSpy: A cyberespionage group that used a new tool called XDSpy.DSDownloader in attacks targeting Russia and Moldova.
10. Eldorado Ransomware-as-a-Service (RaaS): While not specifically tied to a single group, this RaaS platform gained prominence in July 2024.
11. DragonForce Ransomware: A new ransomware strain uncovered in mid-July 2024.

It's important to note that many cyber attacks and data breaches occur without clear attribution to specific threat actors. The list above represents the groups and malware strains that were explicitly mentioned or attributed to attacks in the provided search results for July 2024.

Conclusion

The discovery of these new malware and ransomware strains in July 2024 underscores the dynamic nature of cyber threats. Organizations must remain vigilant, continuously update their security measures, and stay informed about emerging threats to protect their digital assets effectively. As cyber criminals continue to innovate, the cybersecurity community must respond with equal creativity and determination to safeguard our increasingly interconnected digital world.