Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On October 10, 2022, the ZeroFox Dark Ops team acquired a data breach package purportedly comprising 1.2 million records from a dark web carding marketplace named "BidenCash." On October 7, 2022, the same dump was distributed on the Russian language deep web forum "XSS." ZeroFox Dark Ops published a similar data package named "BidenCash_7.9m" in June 2022, posted by threat actor BidenCash. By comparing the data with the latest dump, we found 20,866 unique email addresses out of 967,634. In the current dump, there were email addresses with no passwords, credit card details (like number, CVV, and expiry date) and card holder personal details (like name, phone number, and address).

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks