Threat Intelligence Bulletin: 08/05/2022

Breach disclosure: 1M USA Credit

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 30, 2022, a reputed threat actor "Topazzz" from the Russian language deep web forum XSS posted a data leak package titled "1M~~USA~~Credit~Inquiries". From this package, ZeroFox extracted 999,762 email addresses. No passwords were found in this breach. Other notable compromised data fields in this package include name, IP address, and physical address.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach disclosure: Hackbase

On July 1, 2022, a VIP level threat actor "Downfall" from BreachForums posted a data breach package targeting Hackbase (hackbase.cc), a US-based community center which does the hacking to steal the personal information. From this package, ZeroFox extracted 12,425 usernames, email addresses, and hashed passwords.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On July 1, 2022, a VIP level threat actor "Downfall" from BreachForums posted a data breach package targeting Hackbase (hackbase.cc), a US-based community center which does the hacking to steal the personal information. The threat actor noted that the data dump includes 12500 rows of user information with username, password and email. From this package, ZeroFox extracted 12,425 usernames, email addresses, and hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach disclosure: UK_b2b

On June 24, 2022, a banned threat actor "Tooppaazz" from the Russian language deep web forum XSS posted a data leak package titled "UK_b2b". From this package, ZeroFox extracted 122,104 email addresses. No passwords were found in this breach.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On June 24, 2022, a banned threat actor "Tooppaazz" from the Russian language deep web forum XSS posted a data leak package titled "UK_b2b". The threat actor's account is banned for suspicious trade activity. From this package, ZeroFox extracted 122,104 email addresses. No passwords were found in this breach. Other notable compromised data fields in this package include phone numbers and addresses.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach disclosure: SPB_RU Medical Conference

On April 23, 2022, a threat actor "dynasty" from BreachForums posted a data leak package titled "Members of medical conference in SPB | RU | 2022". From this package, ZeroFox extracted 3,089 email addresses. No passwords were found in this breach.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Details

On April 23, 2022, a threat actor "dynasty" from BreachForums posted a data leak package titled "Members of medical conference in SPB | RU | 2022". The threat actor noted that the data dump contains 5 files from the events held from 2018 to 2022, with more than 4,600 lines of user information. From this package, ZeroFox extracted 3,089 email addresses. No passwords were found in this breach. Other notable data fields include name, date of birth, and phone number.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Microsoft Patch Tuesday 08/10/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may affect our customers.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights

Microsoft's Patch Tuesday update for August 2022 contained 121 vulnerabilities in total, with:

3 vulnerabilities rated as Critical
66 vulnerabilities rated as High
2 zero-day vulnerabilities, with one of them actively exploited

Microsoft stated that some of the Exchange Server flaws addressed as part of this Patch Tuesday require admins to manually enable Extended Protection on affected servers to fully block attacks.

Most notable vulnerabilities

Microsoft has listed 2 zero-day vulnerabilities (CVE-2022-34713 - Microsoft Windows Support Diagnostic Tool Remote Code Execution Vulnerability and CVE-2022-30134 - Microsoft Exchange Information Disclosure Vulnerability) among the bugs fixed in the August Patch Tuesday security update. The former (CVE-2022-34713, also referred to as DogWalk) is being actively exploited in the wild. This bug has been exploited by attackers tricking users into opening or interacting with specially crafted files.

CVE-2022-30133

CVE-2022-30133 (CVSS score: 9.8) is a Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability. Because of this memory-corruption bug in the Point-to-Point Tunneling Protocol component, Microsoft Windows could allow a remote attacker to execute arbitrary code on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. This bug is being actively exploited in the wild.