More than 10,000 threat actors have become active members of pro-Russian hacktivist operation NoName057(16)'s crowdsourced DDoSia platform, signifying a 2,400% growth since its emergence last summer, as the platform's main Telegram channel secured 45,000 subscribers, reports BleepingComputer.
DDoSia has employed a fully automated registration process for new users, with a Telegram bot providing a unique client ID once members provide their Telegram Open Network wallet address, a Sekoia report showed. Members are then given a ZIP archive with the attack tool containing payloads that could be executed with the placement of the client ID text file in the same folder containing the payloads. Most DDoSia attacks between May 8 and June 26 were found to be aimed at targets in Lithuania, Ukraine, and Poland, with the intrusions associated with the countries' opposition to Russia, while a Ukrainian education site, Ukraine government electronic journal, and a Ukrainian education support site were the three most targeted sites during the same period.
As part of its latest attacks discovered in June, Tropic Tropper exploited several known Microsoft Exchange Server and Adobe ColdFusion vulnerabilities to distribute an updated China Chopper web shell on a server hosting the Umbraco open-source content management system.
More than 50 Alibaba-hosted command-and-control servers have been leveraged to facilitate the distribution of the backdoor, which impersonates the Java, bash, sshd, SQLite, and edr-agent utilities.
Angola and the Democratic Republic of Congo, which is a new Intellexa client, may have leveraged new Predator infrastructure to enable spyware staging and exploitation, according to an analysis from Recorded Future's Insikt Group.