AI ‘Nudify’ Sites Serve Malware

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, AI nudify sites spread malware, BEC scammers got prison sentences, a London man charged with hacking for insider trading and a Spanish insurance company had a third-party breach. Also, a North Korean hacking group branches from cyberespionage and a West African crackdown on online scammers. Finally, a Schrödinger Windows vulnerability: Fortra says it’s real, Microsoft says it’s not.

See Also: Effective Communication Is Key to Successful Cybersecurity

“Nudify” websites promising fake pornographic content based on a real-life photo may serve up malware alongside the sexual abuse.

Researchers from Silent Push in research published Wednesday observed the Russia-based, financially motivated threat group commonly tracked as Fin7 running a network of websites that promise to to digitally undress women. The sites, many under the brandname aiNude.ai, embed a Trojan or infostealer in a web extension or other file that users are directed to download. 404 Media reported that some of the malicious sites allowed users to upload images. “The site did not nudify the image, but did display it on screen. After uploading a photo to nudify, one of the sites then said a ‘trial is ready for download.'”

Fin7 is serving up Lumma Stealer, the NetSupport remote access Trojan and Redline credential sealing malware.

The threat actor – also tracked as Carbon Spider, Elbrus and Sangria Tempest – has been active since 2013. Security researchers have found indications of its involvement in deploying REvil and DarkSide ransomware. Microsoft last year said the group has ties to the Clop ransomware gang.

The group runs two versions of nudify sites: one offering a free download of a “Deepnude Generator” tool, and another providing a putative free trial, using search engine optimization tactics to boost rankings of its sites.

Sites that create nude deepfakes have proliferated online along with the public availability of generative AI image models. San Francisco city attorney David Chiu in August sued 16 of the most popular “nudify” websites and apps, accusing them of violtating state and federal laws against sexual abuse and harassment. The FBI in June warned that malicious actors used nude deepfakes as blackmail material.

Two British-Nigerian men, Oludayo Kolawole John Adeagbo, 45, and Donald Ikenna Echeazu, 42, received prison sentences in the United States for orchestrating business email compromise schemes that defrauded organizations of millions of dollars. A judge sentenced Adeagbo to a seven-year prison term and Echeazu to an 18-month term and ordered to pay over $655,000 in restitution.

The pair targeted construction projects and government entities, tricking staff into sending payments to fraudulent accounts by posing as legitimate contractors. In North Carolina, they stole $1.9 million from a university. In Texas, they netted over $3 million from construction companies and local governments, including Galveston and Harris counties.

The FBI praised international cooperation in apprehending the cybercriminals. Adeagbo is also required to repay over $942,000 in restitution after his prison term.

The U.S. Department of Justice charged Robert Westbrook, a London resident, with hacking corporate executives’ email accounts to profit from non-public information in a scam that extended from January 2019 to May 2020. According to the DOJ, Westbrook accessed Office365 accounts of U.S.-based executives to obtain confidential information, including upcoming earnings announcements. He used this insider knowledge to trade securities, generating substantial profits.

Westbrook also set up auto-forwarding rules to funnel emails from compromised accounts to his own. Arrested in the United Kingdom, he now faces extradition to the United States on charges of securities fraud, wire fraud and computer fraud.

Major Spanish insurance company Mutua Madrileña suffered a cyberattack that compromised the personal data of thousands of home insurance customers. The Sept. 23 breach, linked to an external provider, exposed sensitive information like names and addresses, reported Spanish media.

Mutua Madrileña notified the Spanish Data Protection Agency and impacted clients, advising customers to monitor their bank accounts and credit reports for unusual activity.

The North Korean Stonefly group, also known as APT45 and Silent Chollima, continues its financially motivated cyberattacks against U.S. organizations despite a recent indictment from the U.S. Department of Justice. Linked to North Korea’s Reconnaissance General Bureau, the group has apparently shifted its focus from espionage to targeting private companies with limited intelligence value, said Symantec researchers, who spotted evidence of these attacks in August.

The group used advanced malware tools, including Backdoor.Preft, capable of executing commands and downloading files. The attackers also employed fake certificates, with one mimicking Tableau, and additional malware such as Nukebot and the Sliver penetration testing framework.

The attacks are financially driven rather than aimed at gathering state intelligence, a significant change in operational strategy, researchers said.

Authorities in Côte d’Ivoire and Nigeria arrested eight individuals as part of a West African crackdown on cybercrime, Interpol announced Tuesday. The suspects allegedly particiapated in a large-scale phishing scam that stole more than $1.4 million.

Scammers directed victims to small advertising websites, or use a QR code to go to fraudulent websites that mimicked a legitimate payment platform where victims would enter personal information such as their log in details or card number, Interpol said. Scammers also impersonated the customer service agents over the phone.

A Windows vulnerability tracked as CVE-2024-6769 allows attackers to bypass user access control and escalate privileges, potentially gaining full system control. Fortra researchers, who identified the flaw, rate it a 6.7 out of 10 on the CVSS scale. The exploit targets Windows integrity levels, allowing attackers to manipulate system files typically protected by UAC, including critical directories such as C:Windows.

The vulnerability involves “Activation Cache Poisoning” and DLL hijacking techniques. Attackers first remap the system’s root drive to their control, tricking Windows into loading a fake DLL at elevated privileges through the CTF Loader. They then poison the activation cache, leading Windows to load malicious files, allowing full system compromise.

Microsoft does not consider CVE-2024-6769 a vulnerability, since attackers already need administrative access to perform the exploit. “Administrative processes and users are considered part of the Trusted Computing Base for Windows and are therefore not strong isolated from the kernel boundary,” is Microsoft’s stance.

Other Stories From Last Week

With reporting from Information Security Media Group’s David Perera in Washington, D.C.