Welcome to ThinScale’s new cybersecurity TL;DR series, where we break down the latest news and trends in the cyber world.

In this week’s update, we look at trending news stories, including the successful infiltration of the Cicada3301 ransomware group and details on the recent ClickFix infostealing campaign.

Cicada3301 Ransomware Affiliate Program

The Cicada3301 ransomware group has emerged as a major threat that targets both Windows and Linux systems. Cicada3301has appeared in over 30 attacks in the US and UK. This ransomware-as-a-service (RaaS) platform supports affiliates in conducting sophisticated attacks by offering features such as virtual machine shutdown, process termination, and network share encryption.

This group employs a double-extortion model, exfiltrating sensitive data before encrypting files to maximize pressure on victims. Their affiliate program, accessible via a web dashboard, recruits penetration testers and access brokers, offering them a 20% commission on successful ransoms. Victims across various industries have been severely impacted, with attacks affecting companies’ operational integrity and data security.

Cicada3301’s rapid rise highlights the increasing professionalism within ransomware operations. Companies must remain vigilant and proactive to mitigate the potential damage from such sophisticated threats.

Cicada3301 attacks – TL;DR

The new Cicada3301 ransomware is a cross-platform threat targeting both Windows and Linux systems. This malware is highly sophisticated, featuring evasion techniques and multi-stage encryption. It infiltrates systems and encrypts files, demanding ransom payments in cryptocurrency. Security researchers emphasize the importance of timely patches and enhanced monitoring to mitigate risks from this emerging threat.

ClickFix Infostealing Campaign

ClickFix, targets users with fake Google Meet pages to distribute info-stealing malware on both Windows and macOS. These fraudulent pages mimic legitimate Google Meet links and display error messages to trick users. Victims are prompted to copy and execute malicious PowerShell commands to resolve the fake errors, ultimately infecting their devices with malware.

This campaign primarily distributes infostealers like Stealc and Rhadamanthys on Windows, while macOS users are targeted with malware packaged as a disk image file named AMOS Stealer. The attackers use highly convincing URLs resembling legitimate services to lure targets through phishing emails, particularly focusing on industries like logistics and transportation.

ClickFix has evolved from similar phishing strategies targeting Google Chrome and OneDrive users earlier this year, demonstrating the adaptability of these threat actors. French cybersecurity firm Sekoia attributes this campaign to groups operating within the “traffers” ecosystem, hinting at shared resources and infrastructure between different cybercriminal factions.

ClickFix attacks – TL;DR

Threat actors dubbed “ClickFix” are using fake Google Meet error messages to spread infostealing malware via phishing campaigns. Victims are lured to fraudulent meeting pages showing technical issues, prompting them to copy and run malicious PowerShell code. This technique installs malware like Stealc, Rhadamanthys, and AMOS Stealer, targeting both Windows and macOS. The campaign, linked to groups like SNE and Scamquerteo, also uses Zoom and PDF readers as bait.

Stay ahead of cyber threats

These stories highlight the capabilities of malicious actors and how the scope of threat expands beyond a single operating system. It also illustrates the need for robust security practices for any enterprise IT environment.

If you need complete endpoint protection for your business, contact our team to learn how ThinScale can help safeguard your environment against today’s cyber threats.