zerofox logo
Advisories

Threat Intelligence Bulletin: 07/01/2022 - 07/07/2022

|by Alpha Team

banner image

Breach Disclosure: Sub-Talk

On June 5, 2022, a threat actor "Amius" on BreachForums posted a data package relating to Sub-Talk, a television-show discussion forum operating from France. The threat actor noted that the package included 32,500 lines of user information. From this package, ZeroFox extracted 23,832 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

Sub-Talk, a television-show discussion forum operating from France, faced a data breach. On June 5, 2022, a threat actor "Amius" on the underground forum BreachForums posted a data package relating to Sub-Talk. The threat actor noted that the data package included 32,500 lines of user information. From this package, ZeroFox extracted 23,832 email addresses. No passwords were found in this breach. Other notable compromised data fields in this package included name, date of birth, and IP address.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: World Express Information

On June 17, 2022, a threat actor "lolita" on the underground forum BreachForums posted a data breach package titled "World Express Information 1.7M." The actor claimed that the data dump included 1.7 million lines of data relating to courier packages from various countries. From this package, ZeroFox extracted 1,148,161 email addresses.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 17, 2022, a threat actor "lolita" on the underground forum BreachForums posted a data breach package titled "World Express Information 1.7M." The actor claimed that the data dump included 1.7 million lines of data relating to courier packages from various countries. From this package, ZeroFox extracted 1,148,161 email addresses. No passwords were found in this breach. The data fields in this package included names, phone numbers, postal addresses, and others.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Alleged Data Breach by ChinaDan

Product Serial: F-2022-07-06a

TLP: WHITE

In this flash, ZeroFox Intelligence provides insight into an alleged data breach that advertised 23 terabytes of personally identifiable information (PII) from the Shanghai National Police.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full flash here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00PM (EDT) on June 22, 2022 ; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

  • On June 30, 2022, a threat actor advertised 23 terabytes of personally identifiable information (PII) from the Shanghai National Police for sale. The data is priced at 10 BTC (approximately USD 200,000).
  • The database allegedly contains the PII of one billion Chinese victims' names, addresses, birthplaces, national ID numbers, telephone numbers, and criminal history.
  • At the time of writing, it is unclear how the threat actor obtained the database being advertised.

Breach Disclosure: Extreme Poker Tour

On June 7, 2022, threat actor "pompompurin" from BreachForums posted a data breach package targeting Extreme Poker Tour, a poker game tournaments and venue organizers and management firm operating from Georgia, United States. The threat actor noted that the data dump includes 21k users' information.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 7, 2022, a reputed threat actor "pompompurin" from the BreachForums posted a data breach package targeting Extreme Poker Tour, a poker game tournaments and venue organizers and management firm operating from Georgia, United States. The threat actor noted that the data dump includes information of 21k users. From this package, ZeroFox has extracted email addresses. Of this total, an assessed 1,695 records contained plain-text passwords. Other notable compromised data fields in this package include first_name, last_name, date of birth, phone number, and address.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: JobTH

On June 16, 2022, an actor "Mahony" on the deep web forum Cracked posted a data breach package targeting JobTH, an employment website operating from Bangkok, Thailand. The data dump is from 2019 and includes 2.8 million users' information. From the package, ZeroFox extracted 2,729,513 email addresses. 2,729,472 records contained plain-text passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

JobTH, an employment website operating from Thailand suffered a data breach. On June 16, 2022, a threat actor "Mahony" from the underground forum Cracked posted a data package containing leaked information from this breach. The data dump was also circulated on Raid Forums on September 13, 2021, and in a deep web forum "Eternia" on January 6, 2021 by the threat actor "StarRain." The threat actor "StarRain" from Eternia noted that the data dump is from the year 2019 and includes 2.8 million users' information. From the package shared on the Cracked forum, ZeroFox extracted 2,729,513 email addresses. Of this total, 2,729,472 records contained plain-text passwords.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Coinzilla

On June 12, 2022, a threat actor from the Russian-speaking underground forum XSS posted a data breach package targeting the organization Coinzilla, an advertising technology platform focusing on the finance and cryptocurrency industries. The data dump was also circulated in RaidForums on July 09, 2021. From the package shared on XSS forum, ZeroFox extracted 51,315 usernames, email addresses, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Details

Coinzilla, an advertising platform focusing on the finance and cryptocurrency industries (developed by the advertising technology firm Sevio) suffered a data breach. On June 12, 2022, a threat actor "shrinbaba" on the Russian-speaking underground forum XSS posted a data package relating to this breach. The package was also circulated on RaidForums on July 09, 2021, by the threat actor "osintguy." The headers in the leaked database included names (first and last names), email addresses , usernames, passwords, last login, dollar balance, and others. From the package shared on XSS, ZeroFox extracted 51,315 usernames, email addresses, and hashed passwords.

Recommendations

  • If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
  • If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
  • Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2022-07-01 - 2022-07-07

Toll fraud malware disables your WiFi to force premium subscriptions

Toll fraud malware has become one of the most prevalent threats on Android and is evolving with features that allow automatic subscription to premium services. Toll fraud is a type of billing fraud, where the threat actor tricks victims into calling or sending an SMS to a premium number.

See the full report here: https://www.bleepingcomputer.com/news/security/toll-fraud-malware-disables-your-wifi-to-force-premium-subscriptions/

Macmillan shuts down systems after likely ransomware attack

Publishing giant Macmillan had to shut down their network and offices after a security incident that appears to be a ransomware attack. It is unclear what ransomware gang is behind the attack and if data was stolen.

See the full report here: https://www.bleepingcomputer.com/news/security/macmillan-shuts-down-systems-after-likely-ransomware-attack/

Microsoft Exchange servers worldwide backdoored with new malware

A newly discovered malware dubbed SessionManager is being used to backdoor Microsoft Exchange servers belonging to government and military organizations from Europe, the Middle East, Asia, and Africa. It has been used in the wild without being detected since at least March 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-worldwide-backdoored-with-new-malware/

Russian hacktivists take down Norway govt sites in DDoS attacks

Some of Norway’s most important websites and online services are being rendered inaccessible due to distributed denial of service (DDoS) attacks. The suspected attacker, “Legion – Cyber Spetsnaz RF,” is believed to be affiliated with Killnet, a pro-Russian group that hit Romania, Italy, and many other countries with DDoS attacks in previous months.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hacktivists-take-down-norway-govt-sites-in-ddos-attacks/

XFiles info-stealing malware adds support for Follina delivery

The XFiles info-stealer malware has added a delivery module that exploits CVE-2022-30190, aka Follina, for dropping the payload on target computers. Incorporating the Follina-exploiting document reduces the infection friction and increases the rate of successful attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/xfiles-info-stealing-malware-adds-support-for-follina-delivery/

Google blocked dozens of domains used by hack-for-hire groups

Google's Threat Analysis Group (TAG) has blocked dozens of malicious domains and websites used by hack-for-hire groups in attacks targeting high-risk targets worldwide. Unlike commercial surveillance vendors whose tools are deployed in attacks by clients, hack-for-hire operators are directly involved in attacks and are usually employed by a firm offering such services.

See the full report here: https://www.bleepingcomputer.com/news/security/google-blocked-dozens-of-domains-used-by-hack-for-hire-groups/

OpenSea discloses data breach, warns users of phishing attacks

The non-fungible token (NFT) marketplace OpenSea disclosed a data breach and warned users of phishing attacks that could target them in the coming days. An employee of Customer.io, the platform's email delivery vendor, reportedly downloaded email addresses belonging to OpenSea users and newsletter subscribers.

See the full report here: https://www.bleepingcomputer.com/news/security/opensea-discloses-data-breach-warns-users-of-phishing-attacks/

AstraLocker 2.0 infects users directly from Word attachments

A ransomware strain called AstraLocker has recently released its second major version. Its operators reportedly engage in rapid attacks that drop its payload directly from email attachments. This approach is quite unusual – other groups mostly use intermediate steps to help evade detection and minimize the chances of raising red flags on email security products.

See the full report here: https://www.bleepingcomputer.com/news/security/astralocker-20-infects-users-directly-from-word-attachments/

North Korean Hackers Suspected to be Behind $100M Horizon Bridge Hack

The North Korea-backed hacking collective Lazarus Group is suspected to be behind the recent $100 million altcoin theft from Harmony Horizon Bridge. The stolen crypto assets included Ether (ETH), Tether (USDT), Wrapped Bitcoin (WBTC) and BNB.

See the full report here: https://thehackernews.com/2022/06/north-korean-hackers-suspected-to-be.html

Zoho ManageEngine ADAudit Plus bug gets public RCE exploit

Security researchers have published details and proof-of-concept exploit code for CVE-2022-28219, a critical vulnerability (severity score of 9.8 out of 10) in the Zoho ManageEngine ADAudit Plus tool. The vulnerability allows an unauthenticated attacker to execute code remotely and compromise Active Directory accounts. Zoho addressed the issue in ADAudit Plus build 7060.

See the full report here: https://www.bleepingcomputer.com/news/security/zoho-manageengine-adaudit-plus-bug-gets-public-rce-exploit/

Verified Twitter accounts hacked to send fake suspension notices

Threat actors are hacking verified Twitter accounts to send fake but well-written suspension messages that attempt to steal other verified users' credentials.

See the full report here: https://www.bleepingcomputer.com/news/security/verified-twitter-accounts-hacked-to-send-fake-suspension-notices/

Rogue HackerOne employee steals bug reports to sell on the side

A HackerOne employee stole vulnerability reports submitted through the bug bounty platform and disclosed them to affected customers to claim financial rewards. HackerOne is a platform for coordinating vulnerability disclosures and corresponding monetary rewards for the bug hunter submitting the security reports.

See the full report here: https://www.bleepingcomputer.com/news/security/rogue-hackerone-employee-steals-bug-reports-to-sell-on-the-side/

Privacy protection agency seizes servers of hacked travel company

The Privacy Protection Authority in Israel seized servers hosting multiple travel booking websites because their operator failed to address security issues that enabled data breaches affecting more than 300,000 individuals.

See the full report here: https://www.bleepingcomputer.com/news/security/privacy-protection-agency-seizes-servers-of-hacked-travel-company/

Microsoft finds Raspberry Robin worm in hundreds of Windows networks

Microsoft has announced that a recently spotted Windows worm (Raspberry Robin) has been found on the networks of hundreds of organizations from various industry sectors. Although Microsoft observed the malware connecting to addresses on the Tor network, the threat actors are reportedly yet to exploit the access they gained to their victims' networks.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-finds-raspberry-robin-worm-in-hundreds-of-windows-networks/

CISA orders agencies to patch Windows LSA bug exploited in the wild

CISA has re-added a security bug (CVE-2022-26925) affecting Windows devices to its list of bugs exploited in the wild after removing it in May due to Active Directory (AD) certificate authentication issues caused by Microsoft's May 2022 updates. The bug is an actively exploited Windows LSA (Local Security Authority) spoofing vulnerability, which has been confirmed to be a new PetitPotam Windows NTLM Relay attack vector.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-orders-agencies-to-patch-windows-lsa-bug-exploited-in-the-wild/

Jenkins discloses dozens of zero-day bugs in multiple plugins

Jenkins has announced 34 security vulnerabilities affecting 29 plugins for the Jenkins open source automation server; 29 of the bugs are zero-days that are not yet patched. Jenkins is a platform (with support for over 1,700 plugins) used by enterprises worldwide for building, testing, and deploying software.

See the full report here: https://www.bleepingcomputer.com/news/security/jenkins-discloses-dozens-of-zero-day-bugs-in-multiple-plugins/

Django fixes SQL Injection vulnerability in new releases

The Django project has patched a high severity vulnerability (CVE-2022-34265) in its latest releases (versions Django 4.0.6 and Django 3.2.14). The Django project is an open source Python-based web framework used by thousands of websites as their Model-Template-View framework.

See the full report here: https://www.bleepingcomputer.com/news/security/django-fixes-sql-injection-vulnerability-in-new-releases/

AstraLocker ransomware shuts down and releases decryptors

The threat actor behind the AstraLocker ransomware is reportedly shutting down the operation and plans to switch to cryptojacking. The operation has uploaded decryptors to the VirusTotal malware analysis platform. AstraLocker is based on the leaked Babuk Locker (Babyk) ransomware source code.

See the full report here: https://www.bleepingcomputer.com/news/security/astralocker-ransomware-shuts-down-and-releases-decryptors/

Google patches new Chrome zero-day flaw exploited in attacks

Google has released Chrome 103.0.5060.114 for Windows users to address a high-severity zero-day vulnerability (CVE-2022-2294) exploited by attackers in the wild. The bug is a heap-based buffer overflow weakness in the WebRTC (Web Real-Time Communications) component. The impact of successful heap overflow exploitation can range from program crashes and arbitrary code execution to bypassing security solutions if code execution is achieved during the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/google-patches-new-chrome-zero-day-flaw-exploited-in-attacks/

Hacker claims to have stolen data on 1 billion Chinese citizens

An anonymous threat actor is selling several databases allegedly containing more than 22 terabytes of stolen information on about 1 billion Chinese citizens for 10 BTC. The database reportedly contains Chinese national residents' names, addresses, national ID numbers, contact numbers, and several billion criminal records, and was allegedly leaked from the Shanghai National Police (SHGA) database.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-claims-to-have-stolen-data-on-1-billion-chinese-citizens/

UK Army’s Twitter, YouTube accounts hacked to push crypto scam

The British Army's Twitter and YouTube accounts were hacked and altered to promote online crypto scams. The army's verified Twitter account began displaying fake NFTs and bogus crypto giveaway schemes, and the YouTube account aired "Ark Invest" live streams featuring an older Elon Musk clip to mislead users into visiting cryptocurrency scam sites. The United Kingdom’s Ministry of Defence later confirmed having regained control of its Twitter and YouTube accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-army-s-twitter-youtube-accounts-hacked-to-push-crypto-scam/

Pro-China Group Uses Dragonbridge Campaign to Target Rare Earth Mining Companies

A pro-China influence campaign, dubbed “Dragonbridge,” reportedly targeted rare earth mining companies in Australia, Canada, and the U.S. with negative messaging to manipulate public discourse to China's benefit. Targeted firms included Australia's Lynas Rare Earths Ltd, Canada's Appia Rare Earths & Uranium Corp, and the American company USA Rare Earth. This campaign comprised thousands of inauthentic accounts across numerous social media platforms and forums to disseminate content that raised concerns over alleged environmental, health, and labor issues.

See the full report here: https://thehackernews.com/2022/07/pro-china-group-uses-dragonbridge.html

NPM supply-chain attack impacts hundreds of websites and apps

An NPM supply-chain attack dating back to December 2021 used dozens of malicious NPM modules containing obfuscated Javascript code to compromise hundreds of downstream desktop apps and websites. The threat actors behind this campaign (known as IconBurst) used typosquatting to infect developers looking for very popular packages, such as umbrellajs and ionic.io NPM modules.

See the full report here: https://www.bleepingcomputer.com/news/security/npm-supply-chain-attack-impacts-hundreds-of-websites-and-apps/

Microsoft quietly fixes ShadowCoerce Windows NTLM Relay bug

Microsoft has confirmed that it fixed a previously disclosed “ShadowCoerce” vulnerability as part of the June 2022 updates, which enabled attackers to target Windows servers in NTLM relay attacks. This NTLM relay attack method can be used by threat actors to force unpatched servers to authenticate against servers under the attacker's control, leading to a takeover of the Windows domain.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-quietly-fixes-shadowcoerce-windows-ntlm-relay-bug/

New RedAlert Ransomware targets Windows, Linux VMware ESXi servers

A new ransomware operation called RedAlert, or N13V, encrypts both Windows and Linux VMWare ESXi servers in attacks on corporate networks. Currently, the RedAlert data leak site only contains the data for one organization, indicating that the operation is very new.

See the full report here: https://www.bleepingcomputer.com/news/security/new-redalert-ransomware-targets-windows-linux-vmware-esxi-servers/

Ransomware, hacking groups move from Cobalt Strike to Brute Ratel

Hacking groups and ransomware operations are moving away from Cobalt Strike to the newer Brute Ratel post-exploitation toolkit to evade detection by EDR (endpoint detection and response) and antivirus solutions. Brute Ratel is an adversarial attack simulation tool that allows red teamers to deploy “Badgers” (similar to beacons in Cobalt Strike) on remote hosts.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-hacking-groups-move-from-cobalt-strike-to-brute-ratel/

Marriott hit by new data breach and a failed extortion attempt

Marriott International hotel confirmed that it was hit by a data breach after an unknown threat actor breached one of its properties (BWI Airport Marriott) and stole 20GB of files. This is the third data breach Marriott has confirmed since 2018.

See the full report here: https://www.bleepingcomputer.com/news/security/marriott-hit-by-new-data-breach-and-a-failed-extortion-attempt/

IT services giant SHI hit by "professional malware attack"

SHI International, a New Jersey-based Information Technology (IT) products and services company, has confirmed that a malware attack hit its network. While evaluating its systems' integrity and investigating the security incident, SHI was forced to take some of its systems offline, including the company's public websites and email.

See the full report here: https://www.bleepingcomputer.com/news/security/it-services-giant-shi-hit-by-professional-malware-attack/

Security advisory accidentally exposes vulnerable systems

A security advisory for a vulnerability (CVE) published by MITRE has accidentally been exposing links to remote admin consoles of over a dozen vulnerable IP devices (in its “references” section) since at least April 2022. CVE advisories published by MITRE get syndicated verbatim across a large number of public sources, feeds, infosec news sites, and vendors providing this data to their customers. Including links to publicly exposed unpatched systems can potentially allow threat actors to now target these systems and conduct their malicious activities.

See the full report here: https://www.bleepingcomputer.com/news/security/security-advisory-accidentally-exposes-vulnerable-systems/

US govt warns of Maui ransomware attacks against healthcare orgs

The FBI, CISA, and the U.S. Treasury Department have issued a joint advisory warning of North-Korean-backed threat actors using Maui ransomware in attacks against Healthcare and Public Health organizations. The advisory urged organizations to implement mitigation measures and apply a set of measures to prepare for, prevent, and respond to ransomware incidents.

See the full report here: https://www.bleepingcomputer.com/news/security/us-govt-warns-of-maui-ransomware-attacks-against-healthcare-orgs/

OpenSSL Releases Patch for High-Severity Bug that Could Lead to RCE Attacks

The OpenSSL project has released patches to address a high-severity bug (CVE-2022-2274) in the cryptographic library that could potentially lead to remote code execution under certain scenarios. Users of the library are recommended to upgrade to OpenSSL version 3.0.5 to mitigate any potential threats.

See the full report here: https://thehackernews.com/2022/07/openssl-releases-patch-for-high.html

Bitter APT Hackers Continue to Target Bangladesh Military Entities

An advanced persistent threat (APT) tracked as Bitter is targeting military entities in Bangladesh and conducting espionage by deploying Remote Access Trojans. Bitter, also tracked as APT-C-08 and T-APT-17, is said to be active since at least late 2013 and has a track record of targeting China, Pakistan, and Saudi Arabia using different tools such as BitterRAT and ArtraDownloader.

See the full report here: https://thehackernews.com/2022/07/bitter-apt-hackers-continue-to-target.html

NIST Announces First Four Quantum-Resistant Cryptographic Algorithms

The U.S. Department of Commerce's National Institute of Standards and Technology (NIST) has chosen the first set of quantum-resistant encryption algorithms that are designed to "withstand the assault of a future quantum computer." The post-quantum cryptography (PQC) technologies include the CRYSTALS-Kyber algorithm for general encryption, and CRYSTALS-Dilithium, FALCON, and SPHINCS+ for digital signatures. The agency also plans to include four more algorithms before finalizing the post-quantum cryptographic standard, a process that's expected to be completed in about two years.

See the full report here: https://thehackernews.com/2022/07/nist-announces-first-four-quantum.html

Tags: all industries,  global