ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - February 7, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Microsoft Outlook Experiences Global Outage

Microsoft is dealing with an ongoing outage affecting its Outlook webmail service. Customers are experiencing issues with sending, receiving, or searching email or even logging in and having their accounts wiped. Microsoft is restarting portions of the infrastructure impacted by a recent change, and the problem has spread to regions beyond North America. The current Outlook outage also affects additional services like the Microsoft Teams communication platform. This follows a recent five-hour incident that impacted Azure and Microsoft 365 globally and took down multiple services, including Microsoft Teams, Exchange Online, and Outlook. This is a developing story.

Recommendation:

If you are a Microsoft Outlook user, it is best to monitor updates from Microsoft or from the Office Service Health Status page for further information and resolution of the issue.

New Hacking Campaign Exploits Sunlogin Vulnerabilities to Deploy Sliver Toolkit and Disable Security Software

A recent hacking attack has been identified that targets remote-control software Sunlogin. The attackers use two weaknesses in the software to install a tool called Sliver, which is used to disable security software on a device. The attack begins with exploiting the CNVD-2022-10270 / CNVD-2022-03672 RCE vulnerabilities in Sunlogin v11.0.0.33 and earlier, using readily-available proof of concept exploits. The attackers use PowerShell to bypass security products and gain control over the device. They then use Powercat to connect to a remote server, giving them access to the device. In some cases, the attackers also install Gh0st RAT to carry out further actions.

Recommendation:

To protect against this type of attack, Windows admins can use certain security measures provided by Microsoft, including enabling the vulnerable driver blocklist, blocking the hash of the AV killer, and monitoring event logs for newly-installed services named "mhyprot2."

List of Proxy IPs to Help Block KillNet's DDoS Bots

A free tool has been developed to help organizations defend against DDoS attacks from Russian cybercrime group KillNet. The tool, which is an open proxy IP blocklist, lists tens of thousands of proxy IP addresses used by the Russian group in its network-traffic flooding events. The U.S. Department of Health and Human Services issued a second warning about the threat KillNet poses to the healthcare sector after the group claimed responsibility for a series of attacks that took 14 U.S. hospitals' websites offline. KillNet's attacks and threats often have a political slant, but the FBI and private security researchers have called the group's DDoS events publicity stunts with limited success. Although KillNet's attacks usually do not cause major damage, they can cause service outages and hinder access to healthcare information; the group may also use DDoS as a distraction while attempting more serious attacks.

Recommendations:

Take precautions and ensure the security measures of your organization, especially in the wake of increased DDoS attacks by the Russian cybercrime group KillNet.
Be aware of the group's tendency to exaggerate its actions, and take its claims with a grain of salt.

New Linux Variant of Clop Ransomware Discovered with Flawed Encryption

A Linux variant of the Clop ransomware has been discovered in the wild, but it has a faulty encryption algorithm that can be reversed. The Linux version is believed to be an early stage of the ransomware and is missing some functions that are present in the Windows version. The malware targets specific folders and file types for encryption but contains a hard-coded master key that can be used to recover the original files without paying the ransom. The development shows that threat actors are increasingly targeting platforms beyond Windows, and it is likely that we will see more Linux-targeted ransomware campaigns in the future.

Recommendations:

Secure your data by creating regular backups and storing them in a remote and inaccessible location.
Proactively ensure that software and systems are equipped with the latest security updates.
Require strong and unique passwords, and implement password policies that encourage frequent changes and multi-factor authentication.

The GuLoader Malware Campaign: A Growing Threat to E-commerce Industries

E-commerce industries in South Korea and the United States, as well as Germany, Saudi Arabia, Taiwan, and Japan, are being targeted by a malware campaign called GuLoader. In the past, the malware was spread through Microsoft Word documents with macros, but now it is being spread through NSIS executable files. NSIS is an open-source tool used for creating installers for Windows operating systems. The NSIS files are embedded in ZIP or ISO images to help the malware evade detection. The GuLoader malware has become more sophisticated over time, adding obfuscation and encryption layers to hide its activities. The shift towards using NSIS files is a response to Microsoft blocking macros in Office files downloaded from the internet. Threat actors are being creative and persistent in evading detection and analysis.

Recommendations:

Secure your data by creating regular backups and storing them in a remote and inaccessible location.
Proactively ensure that software and systems are equipped with the latest security updates.

Sanctioned Iran Group Tied to Charlie Hebdo Hack

Microsoft revealed that an Iranian nation-state group sanctioned by the U.S. government is responsible for the hack of French satirical magazine Charlie Hebdo, likely in response to the magazine sponsoring a cartoon contest "ridiculing" Iranian Supreme Leader Ali Khamenei. The group, Emennet Pasargad, which is tracked by Microsoft under the name NEPTUNIUM, was also linked by the FBI to a sophisticated influence campaign aimed at interfering with the 2020 U.S. presidential elections. In early January 2023, a "hacktivist" group calling itself Holy Souls claimed to have the personal information of more than 200,000 Charlie Hebdo customers and threatened to release it for 20 Bitcoins, a common tactic used by Iran-sponsored hacktivist groups that routinely target perceived regime rivals.

Recommendations:

Protect your online identity and reputation with solid password practices and two-step verification.
Stay ahead of potential breaches by continuously monitoring for compromised credentials.
Uncover threats and potential security issues with the powerful intelligence search feature on the ZeroFox platform.