Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

On October 12, 2022, a reputed threat actor "anony" from the BreachForums posted a data breach package targeting Doomworld (doomworld[.]com), a gaming discussion forum operating from the United States. The threat actor noted that the data dump includes 34.4k user information. The data dump was also circulated in a Telegram channel "Hydra Market REBUILD" (hXXps[:]//t[.]me/hydramarketrebuild/797) on November 3, 2022. From the package published on BreachForums, ZeroFox extracted 34,450 email addresses and/or usernames. Of these, an assessed 26,715 records were successfully linked to hashed passwords. Other notable data fields observed in this package include: joined, ip_address, last_visit, and last_activity.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks