Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On July 27, 2022, a reputed threat actor "mahony" from BreachForums posted a data breach package targeting "Currently" a news portal from AT&T. On August 5, 2022, the threat actor name "mahony" has changed to "dirtbike" in the Breachforums. The data package was also circulated in a deep web forum Cracked on November 16, 2022 by the threat actor "hoaidz126". From the package published on BreachForums, ZeroFox extracted 702,735 email addresses and/or usernames. Of these, 702,348 records were successfully linked to plain-text and hashed passwords.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks