Threat Intelligence Bulletin: 12/16/2022 - 12/22/2022

Profile: Royal Ransomware

Product Serial: P-2022-12-19a

TLP: CLEAR

In this report, ZeroFox Intelligence provides an overview of Royal Ransomware's capabilities.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EST) on December 16, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

ZeroFox Intelligence has observed an uptick in activity from the Royal Ransomware group (Royal), especially in the past two months. Royal gains access to victim networks by conducting targeted callback phishing attacks with the goal of convincing a victim to install remote access software, which is used to gain access to a corporate network. The group deploys Cobalt Strike for persistence, credential harvesting, lateral movement through a Windows domain, data stealing, and device encryption. Recently, the U.S. Department of Health and Human Services issued an advisory warning healthcare organizations in particular to be wary of Royal ransomware based on historic ransomware targeting of the healthcare industry.

Breaking News: 2022-12-16 - 2022-12-22

FuboTV says World Cup streaming outage caused by a cyberattack

FuboTV has confirmed that a streaming outage preventing subscribers from watching the World Cup Qatar 2022 semifinal match between France and Morocco was caused by a cyberattack.

See the full report here: https://www.bleepingcomputer.com/news/security/fubotv-says-world-cup-streaming-outage-caused-by-a-cyberattack/

Phishing attack uses Facebook posts to evade email security

A new phishing campaign is using Facebook posts as part of its attack chain to trick users into giving away their account credentials and personally identifiable information (PII). The emails sent to targets pretend to be a copyright infringement issue on one of the recipient's Facebook posts, warning that their account will be deleted within 48 hours if no appeal is filed.

See the full report here: https://www.bleepingcomputer.com/news/security/phishing-attack-uses-facebook-posts-to-evade-email-security/

Ukrainian govt networks breached via trojanized Windows 10 installers

Ukrainian government entities were hacked in targeted attacks after their networks were first compromised via trojanized ISO files posing as legitimate Windows 10 installers.

See the full report here: https://www.bleepingcomputer.com/news/security/ukrainian-govt-networks-breached-via-trojanized-windows-10-installers/

Social Blade confirms breach after hacker posts stolen user data

Social media analytics platform Social Blade has confirmed they suffered a data breach after its database was breached and put up for sale on a hacking forum.

See the full report here: https://www.bleepingcomputer.com/news/security/social-blade-confirms-breach-after-hacker-posts-stolen-user-data/

LEGO BrickLink bugs let hackers hijack accounts, breach servers

Security analysts have discovered two API security vulnerabilities in BrickLink.com, LEGO Group's official second-hand and vintage marketplace for LEGO bricks. BrickLink is the world's largest online community of LEGO fans, with over a million registered members.

See the full report here: https://www.bleepingcomputer.com/news/security/lego-bricklink-bugs-let-hackers-hijack-accounts-breach-servers/

Hackers target Japanese politicians with new MirrorStealer malware

A hacking group tracked as MirrorFace has been targeting Japanese politicians for weeks before the House of Councilors election in July 2022, using a previously undocumented credentials stealer named "MirrorStealer."

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-target-japanese-politicians-with-new-mirrorstealer-malware/

Microsoft Reclassifies SPNEGO Extended Negotiation Security Vulnerability as "Critical"

Microsoft has revised the severity of a security vulnerability (CVE-2020-37958) it originally patched in September 2020, upgrading it to "Critical" after it emerged that it could be exploited to achieve remote code execution.

See the full report here: https://thehackernews.com/2022/12/microsoft-reclassifies-spnego-extended.html

Android Malware Campaign Leverages Money-Lending Apps to Blackmail Victims

A previously undocumented Android malware campaign has been observed leveraging money-lending apps to blackmail victims into paying up with personal information stolen from their devices.

See the full report here: https://thehackernews.com/2022/12/android-malware-campaign-leverages.html

Restaurant CRM platform "SevenRooms" confirms breach after data for sale

Restaurant customer management platform SevenRooms has confirmed it suffered a data breach after a threat actor began selling stolen data on a hacking forum.

See the full report here: https://www.bleepingcomputer.com/news/security/restaurant-crm-platform-sevenrooms-confirms-breach-after-data-for-sale/

T-Mobile hacker gets 10 years for USD 25 million phone unlock scheme

The former owner of a T-Mobile retail store was sentenced to 10 years in prison for a USD 25 million scheme where he unlocked and unblocked cellphones by hacking into T-Mobile's internal systems.

See the full report here: https://www.bleepingcomputer.com/news/security/t-mobile-hacker-gets-10-years-for-25-million-phone-unlock-scheme/

Glupteba malware is back in action after Google disruption

The Glupteba malware botnet has sprung back into action, infecting devices worldwide after its operation was disrupted earlier by Google

See the full report here: https://www.bleepingcomputer.com/news/security/glupteba-malware-is-back-in-action-after-google-disruption/

Colombian energy supplier EPM hit by BlackCat ransomware attack

Colombian energy company Empresas Públicas de Medellín (EPM) suffered a BlackCat/ALPHV ransomware attack which disrupted the company's operations and took down its online services. EPM is one of Colombia’s largest public energy, water, and gas providers, providing services to 123 municipalities.

See the full report here: https://www.bleepingcomputer.com/news/security/colombian-energy-supplier-epm-hit-by-blackcat-ransomware-attack/

FBI warns that BEC attacks now also target food shipments

Organizations in the food sector are being targeted in business email compromise (BEC) attacks that aim to steal entire shipments of food, according to a joint advisory issued by several U.S. federal agencies.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-that-bec-attacks-now-also-target-food-shipments/

Woman gets 66 months in prison for role in USD 3.3 million ID fraud op

The Australian Federal Police (AFP) has announced that a woman from Melbourne, arrested in 2019 for her role in large-scale, cyber-enabled identity theft crimes, was sentenced to five years and six months in prison. The woman pleaded guilty to her crimes on November 26, 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/woman-gets-66-months-in-prison-for-role-in-33-million-id-fraud-op/

Minecraft Servers Under Attack: Microsoft Warns About Cross-Platform DDoS Botnet

Microsoft flagged a cross-platform botnet primarily designed to launch distributed denial-of-service (DDoS) attacks against private Minecraft servers. Called MCCrash, the botnet is characterized by a unique spreading mechanism that allows it to propagate to Linux-based devices despite originating from malicious software downloads on Windows hosts.

See the full report here: https://thehackernews.com/2022/12/minecraft-servers-under-attack.html

Ex-Twitter employee Gets 3.5 Years Jail for Spying on Behalf of Saudi Arabia

A former Twitter employee who was found guilty of spying on behalf of Saudi Arabia by sharing data pertaining to specific individuals has been sentenced to three-and-a-half years in prison.

See the full report here: https://thehackernews.com/2022/12/ex-twitter-employee-gets-35-years-jail.html

Trojanized Windows 10 Installer Used in Cyberattacks Against Ukrainian Government Entities

Government entities in Ukraine have been breached as part of a new campaign that used trojanized versions of Windows 10 installer files to conduct post-exploitation activities. The malicious ISO files were distributed via Ukrainian- and Russian-language Torrent websites. The threat cluster is being tracked as UNC4166.

See the full report here: https://thehackernews.com/2022/12/trojanized-windows-10-installer-used-in.html

Samba Issues Security Updates to Patch Multiple High-Severity Vulnerabilities

Samba has released software updates to remediate multiple vulnerabilities that, if successfully exploited, could allow an attacker to take control of affected systems. The high-severity flaws, tracked as CVE-2022-38023, CVE-2022-37966, CVE-2022-37967, and CVE-2022-45141, have been patched in versions 4.17.4, 4.16.8 and 4.15.13 released on December 15, 2022.

See the full report here: https://thehackernews.com/2022/12/samba-issues-security-updates-to-patch.html

CISA Alert: Veeam Backup and Replication Vulnerabilities Being Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities impacting Veeam Backup & Replication software to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation in the wild. The now-patched critical flaws, tracked as CVE-2022-26500 and CVE-2022-26501, are both rated 9.8 on the CVSS scoring system, and could be leveraged to gain control of a target system.

See the full report here: https://thehackernews.com/2022/12/cisa-alert-veeam-backup-and-replication.html

Play ransomware claims attack on German hotel chain H-Hotels

The Play ransomware gang has claimed responsibility for a cyber attack on H-Hotels that has resulted in communication outages for the company. H-Hotels is a hospitality business with 60 hotels in 50 locations across Germany, Austria, and Switzerland.

See the full report here: https://www.bleepingcomputer.com/news/security/play-ransomware-claims-attack-on-german-hotel-chain-h-hotels/

Microsoft finds macOS bug that lets malware bypass security checks

Apple has fixed a vulnerability called "Achilles" that attackers could leverage to deploy malware on vulnerable macOS devices via untrusted applications capable of bypassing Gatekeeper application execution restrictions. The security flaw is tracked as CVE-2022-42821.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-finds-macos-bug-that-lets-malware-bypass-security-checks/

DraftKings warns data of 67,000 people was exposed in account hacks

Sports betting company DraftKings revealed that more than 67,000 customers had their personal information exposed following a credential attack in November 2022. In credential stuffing attacks, automated tools are used to make a massive number of attempts (up to millions at a time) to sign into accounts using credentials (user/password pairs) stolen from other online services.

See the full report here: https://www.bleepingcomputer.com/news/security/draftkings-warns-data-of-67k-people-was-exposed-in-account-hacks/

Ukraine's DELTA military system users targeted by info-stealing malware

A compromised Ukrainian Ministry of Defense email account was found sending phishing emails and instant messages to users of the DELTA situational awareness program to infect systems with information-stealing malware.

See the full report here: https://www.bleepingcomputer.com/news/security/ukraines-delta-military-system-users-targeted-by-info-stealing-malware/

Epic Games to pay USD 520 million for privacy violations, dark patterns

The Federal Trade Commission (FTC) says Epic Games, the maker of Fortnite, will pay USD 520 million to settle allegations of violating children's privacy laws and using dark patterns to trick millions of gamers into making unintentional in-game purchases.

See the full report here: https://www.bleepingcomputer.com/news/gaming/epic-games-to-pay-520-million-for-privacy-violations-dark-patterns/

Researchers Discover Malicious PyPI Package Posing as SentinelOne SDK to Steal Data

Cybersecurity researchers have discovered a new malicious package on the Python Package Index (PyPI) repository that impersonates a software development kit (SDK) for SentinelOne, a cybersecurity company, as part of a campaign dubbed SentinelSneak.

See the full report here: https://thehackernews.com/2022/12/researchers-discover-malicious-pypi.html

New Agenda Ransomware Variant, Written in Rust, Aiming at Critical Infrastructure

A Rust variant of a ransomware strain known as Agenda has been observed in the wild, making it the latest malware to adopt the cross-platform programming language after BlackCat, Hive, Luna, and RansomExx.

See the full report here: https://thehackernews.com/2022/12/new-agenda-ransomware-variant-written.html

Facebook Cracks Down on Spyware Vendors from U.S., China, Russia, Israel, and India

Meta Platforms disclosed that it took down more than 200 covert influence operations since 2017 spanning roughly 70 countries across 42 languages. The social media conglomerate also took steps to disable accounts and block infrastructure operated by spyware vendors, including in China, Russia, Israel, the U.S. and India, that targeted individuals in about 200 countries.

See the full report here: https://thehackernews.com/2022/12/facebook-cracks-down-on-spyware-vendors.html

Microsoft pushes emergency fix for Windows Server Hyper-V VM issues

Microsoft has released emergency out-of-band (OOB) Windows Server updates to address a known issue breaking virtual machine (VM) creation on Hyper-V hosts.The issue affects only VMs managed with the System Center Virtual Machine Manager (SCVMM) and using Software Defined Networking (SDN).

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-pushes-emergency-fix-for-windows-server-hyper-v-vm-issues/

Raspberry Robin worm drops fake malware to confuse researchers

The Raspberry Robin malware is now dropping a fake payload to confuse researchers and evade detection. Raspberry Robin is a worm-like malware dropper that sells initial access to compromised networks to ransomware gangs and malware operators.

See the full report here: https://www.bleepingcomputer.com/news/security/raspberry-robin-worm-drops-fake-malware-to-confuse-researchers/

Ransomware gang uses new Microsoft Exchange exploit to breach servers

Play ransomware threat actors are using a new exploit chain that bypasses ProxyNotShell URL rewrite mitigations to gain remote code execution (RCE) on vulnerable servers through Outlook Web Access (OWA).

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-uses-new-microsoft-exchange-exploit-to-breach-servers/

Google Ad fraud campaign used adult content to make millions

A massive advertising fraud campaign using Google Ads and "popunders" on adult sites is estimated to have generated millions of ad impressions on stolen articles, making the fraudsters an estimated USD 275,000 per month.

See the full report here: https://www.bleepingcomputer.com/news/security/google-ad-fraud-campaign-used-adult-content-to-make-millions/

Russian Hackers’ Latest Target Is Cab Dispatch Line at J.F.K.

U.S. federal prosecutors stated that two people from Queens (New York City) worked with Russians to charge cab drivers USD 10 to jump the line at the J.F.K. airport.

See the full report here: https://www.nytimes.com/2022/12/20/nyregion/russian-hackers-jfk-taxis.html

ChatGPT can be used by hacker to write phishing emails and codes, research shows

A research report indicated that multiple malicious scripts can be generated easily, with slight variations using different wordings, through the use of ChatGPT. Complicated attack processes can also be automated, using APIs to generate other malicious artifacts.

See the full report here: https://www.livemint.com/technology/tech-news/chatgpt-can-be-used-by-hacker-to-write-phishing-emails-and-codes-research-shows-11671533941833.html

Ransomware hackers take demands directly to college students

The Hive ransomware operation broke into the computer system at Knox College in Illinois and gained access to student data. The incident marks the first known case in which hackers used their access to contact students directly in order to intimidate them.

See the full report here: https://www.nbcnews.com/tech/security/ransomware-hackers-take-demands-directly-college-students-s-sad-day-rcna61253

Two men indicted for hacking a dozen Ring cameras and livestreaming swatting attacks

Two men have been accused of hacking into Ring doorbells and using their cameras to livestream swatting attacks. They allegedly spent a week using stolen Yahoo email addresses and passwords to access video from a dozen security systems before calling the police to each residence.

See the full report here: https://www.theverge.com/2022/12/20/23517973/ring-doorbells-swatting-yahoo-email-arrest

Korean IT expert arrested after hacking into over 400,000 home cameras

A South Korean man was arrested after hacking into over 400,000 home security cameras and attempting to sell the footage. The person allegedly used his knowledge as a cybersecurity and IT expert to hack into a total of 404,847 cameras in 638 apartment complexes across South Korea between August 2021 and November 2021.

See the full report here: https://news.yahoo.com/korean-expert-arrested-hacking-over-230724372.html

Kremlin-linked hackers tried to spy on oil firm in NATO country, researchers say

A Kremlin-linked hacking group known for focusing on Ukraine has stepped up its spying efforts against Ukraine’s NATO allies – in part by trying to hack a big oil firm in a NATO country back in August 2022.

See the full report here: https://edition.cnn.com/2022/12/20/politics/russia-ukraine-cyber-espionage-nato/index.html

How Hackers Used One Software Flaw to Take Down a County Computer System

A malicious cyberattack forced Suffolk County government offline for weeks. The hackers stole sensitive data, forcing officials on Long Island to disable email service for all 10,000 civil service workers

See the full report here: https://www.nytimes.com/2022/12/21/nyregion/suffolk-county-cyberattack.html

Ukrainian Hackers Gather Data on Russian Soldiers, Minister Says

Pro-Ukrainian hackers are gathering intelligence about Russian military personnel in order to help inform decision-making on the battlefield, according to Ukraine’s minister for digital transformation.

See the full report here: https://www.bloomberg.com/news/articles/2022-12-21/ukrainian-hackers-gather-data-on-russian-soldiers-minister-says

Microsoft Details Gatekeeper Bypass Vulnerability in Apple macOS Systems

Microsoft has disclosed details of a now-patched security flaw (CVE-2022-42821, CVSS score: 5.5) in Apple macOS that could be exploited by an attacker to get around security protections imposed to prevent the execution of malicious applications.

See the full report here: https://thehackernews.com/2022/12/microsoft-details-gatekeeper-bypass.html

Russian Hackers Targeted Petroleum Refinery in NATO Country During Ukraine War

The Russia-linked Gamaredon group made an unsuccessful attempt to break into a large petroleum refining company within a NATO member state amid the ongoing Russo-Ukrainian war.

See the full report here: https://thehackernews.com/2022/12/russian-hackers-target-major-petroleum.html

Cybercriminals Launch New BrasDex Android Trojan Targeting Brazilian Banking Users

The threat actors behind the Windows banking malware known as Casbaneiro has been attributed as behind a novel Android trojan called BrasDex that has been observed targeting Brazilian users as part of an ongoing multi-platform campaign

See the full report here: https://thehackernews.com/2022/12/beware-cybercriminals-launch-new.html

Ukraine's DELTA Military System Users Under Attack from Info Stealing Malware

The Computer Emergency Response Team of Ukraine (CERT-UA) disclosed that users of the Delta situational awareness program received phishing emails from a compromised email account belonging to the Ministry of Defense. The attacks, which have been attributed to a threat cluster dubbed UAC-0142, aimed to infect systems with two pieces of data-stealing malware referred to as FateGrab and StealDeal.

See the full report here: https://thehackernews.com/2022/12/ukraines-delta-military-system-users.html

Okta's source code stolen after GitHub repositories hacked

Okta, a leading provider of authentication services and Identity and Access Management (IAM) solutions, says that its private GitHub repositories were hacked. According to a 'confidential' email notification sent by Okta, the security incident involves threat actors stealing Okta's source code.

See the full report here: https://www.bleepingcomputer.com/news/security/oktas-source-code-stolen-after-github-repositories-hacked/

GodFather Android malware targets 400 banks, crypto exchanges

An Android banking malware named "Godfather" has been targeting users in 16 countries, attempting to steal account credentials for over 400 online banking sites and cryptocurrency exchanges.

See the full report here: https://www.bleepingcomputer.com/news/security/godfather-android-malware-targets-400-banks-crypto-exchanges/

FBI warns of search engine ads pushing malware, phishing

The FBI warns that threat actors are using search engine advertisements to promote websites distributing ransomware or stealing login credentials for financial institutions and crypto exchanges.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-search-engine-ads-pushing-malware-phishing/

FCC proposes record-breaking USD 300 million fine against robocaller

The U.S. Federal Communications Commission proposed a record-breaking USD 300 million fine against an auto warranty robocall operation that made billions of calls to more than 550 million phones across the United States.

See the full report here: https://www.bleepingcomputer.com/news/government/fcc-proposes-record-breaking-300-million-fine-against-robocaller/

Zerobot malware now spreads by exploiting Apache vulnerabilities

The Zerobot botnet has been upgraded to infect new devices by exploiting security vulnerabilities affecting Internet-exposed and unpatched Apache servers. It was also observed that the latest version adds new distributed denial-of-service (DDoS) capabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/zerobot-malware-now-spreads-by-exploiting-apache-vulnerabilities/

Samsung and Google fix Microsoft Intune Android 13 enrollment issue

Microsoft has confirmed that Samsung and Google have fixed an Intune enrollment issue affecting Galaxy S22 smartphones running Android 13. Microsoft Intune is a cloud-based service that helps enterprise admins manage Windows, Android, macOS, iOS, and iPadOS apps and devices.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/samsung-and-google-fix-microsoft-intune-android-13-enrollment-issue/

Guardian hit by serious IT incident believed to be ransomware attack

The Guardian has been hit by a serious IT incident, which is believed to be a ransomware attack. The incident affected huge parts of the company’s technology infrastructure, with staff being instructed to work from home. There has also been some disruption to behind-the-scenes services

See the full report here: https://www.theguardian.com/media/2022/dec/21/guardian-hit-by-serious-it-incident-believed-to-be-ransomware-attack