Threat Intelligence Bulletin: 08/06/2021

Breach Disclosure: MMG Fusion

On December 20th, 2020, a software platform for dentists and orthodontists, MMG Fusion, suffered a data breach. The data includes patient information and credentials including email addresses, full names, addresses, contact information and more. Over 14 million patient records were included in the breached database.

Standing Intelligence Requirements

PII & Fraud

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Review network logs for potential signs of compromise and data egress.
Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

The hacker under the alias of pompompurin posted a thread on a popular cyber crime forum in January, 2021. In the thread they detail when the breach took place and the amount of information they included within the data breach package.

Figure 1: Post from pompompurin advertising MMG Fusion breach data

The CSV containing the breached data totals over 15 million lines. However, the author explains that after deduplication of data there are approximately 14,772,314 lines of unique patient data. Based on the breached data analysed, the package includes:

Email addresses
First Names
Last names
Home Addresses
Personal and business contact numbers
Dates of Birth
Appointment history
SMS Logs with message sent
Patient review history
Emails sent to patients

Breach Disclosure: OrderSnapp

In June, 2020, the point of sale product provider OrderSnapp, suffered a data breach. The breached data includes over 1.3 million records of user data including names, email addresses, passwords, contact information and more.

Standing Intelligence Requirements

PII & Fraud

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Review network logs for potential signs of compromise and data egress.
Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

The hacker known as ShinyHunters posted a thread on a popular cyber crime forum in November, 2020, providing the data breach package for free to members of the forum. In the thread they detail the number of records contained within the breached data and the types of user information.

Figure 1: Post from ShinyHunters advertising OrderSnapp breach data

The compromised data contains multiple fields, holding the following user information for 1,304,418 accounts:

Email address
First name
Last name
Bcrypt hashed passwords

Microsoft Patch Tuesday 08/11/2021 Notes

This advisory addresses and summarizes the latest vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

Vulnerability

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information. Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Microsoft's Patch Tuesday update for August 2021 contained 51 vulnerabilities in total, with:

2 vulnerabilities rated as Critical
37 vulnerabilities rated as High
12 vulnerabilities rated as Medium

Most notable vulnerabilities

Microsoft has listed the seven vulnerabilities, CVE-2021-34480, CVE-2021-34535, CVE-2021-36947, CVE-2021-36936, CVE-2021-26432, and CVE-2021-26424 which are most likely to be exploited in the wild. The CVE-2021-36948 is detected being exploited, but there is no exploit code publicly available.

CVE-2021-34480
CVE-2021-34480 is a memory corruption vulnerability in Windows Server that could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Scripting Engine component. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.