Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On August 16, 2022, a threat actor “Addka72424” from BreachForums reposted a data breach package (which was originally posted by the threat actor “sin” on July 5, 2022 in the same forum) targeting Engrenagem Virtual, a Brazil-based company that builds relationship programs to form a channel between companies and people in different segments of businesses. The breach posts created by both threat actors have since been removed from BreachForums. The threat actor Addka72424 noted that the data package is from 2020 and includes 430,939 lines of user information. The data package was also circulated in the Russian language deep web forum XSS on June 4, 2021, by the threat actor “rx26386” and in RaidForums on March 3, 2021. From the package shared by Addka72424 on BreachForums, ZeroFox extracted 239,860 email addresses and usernames. Of these, 17,780 records were successfully linked to hashed passwords. Other notable data fields in this package include tenant ID, full name, date of birth, last activity date, last login date, and gender.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks