ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - February 8, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Urgent Update Needed: Go Anywhere MFT Software Vulnerability Discovered

A zero-day vulnerability has been discovered in GoAnywhere MFT, a managed file transfer (MFT) software that enables companies to share data with other users. The flaw allows an attacker to access the software's servers and execute code on exposed admin consoles, either via a VPN, whitelisted IPs, or private company networks. The vendors have released a patch in version 7.1.2 of the software and urge users to update immediately. Many exposed admin consoles with non-HTTPS Port 8000 were found using a Shodan search. Customers are advised to review admin user accounts for unauthorized access and apply recommended configurations.

Recommendation:

Update GoAnywhere MFT software to version 7.1.2 as soon as possible to address the zero-day vulnerability.

CISA Releases Recovery Script for ESXiArgs Ransomware Victims

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a script on GitHub to help users recover their VMware ESXi servers encrypted by the recent ESXiArgs ransomware attacks. The attacks encrypted 2,800 servers, but the threat actors failed to encrypt flat files, which helped a tech team devise a method to rebuild virtual machines from the unencrypted files. The script automates the recovery process by cleaning up encrypted files and attempting to rebuild the .vmdk file using the unencrypted flat file.

Recommendation:

CISA urges administrators to review the script before using it and to create backups. The script is delivered without warranty, and CISA does not assume liability for damage caused by it.

Regulator Halts AI Chatbot Over GDPR Concerns

The Italian Data Protection Authority (GPDP) has ordered the AI chatbot Replika to stop processing data on its domestic citizens, as it violates GDPR rules. The app reportedly does not comply with the GDPR’s transparency requirements, and it processes the personal data of children unlawfully with no age verification mechanism. Some app store reviews have also reported that the bot has generated sexually-inappropriate content. Luka, the San Francisco-based developer of Replika, has been told to stop processing Italians' data within 20 days or face a fine of up to €20 million or 4 percent of its turnover. There are also concerns about the app's links to Russia and its broadcasting of Russian propaganda. The GPDP ruling may lead to similar scrutiny of other popular AI bots like ChatGPT.

Recommendation:

AI chatbot users should be aware that the Italian privacy regulator has ordered Replika to stop processing data on Italian citizens for violating GDPR rules, including lack of age verification and unsuitable content for younger users.

LockBit Ransomware Gang Claims Royal Mail Cyberattack

Royal Mail, the UK's leading mail delivery service, has had to halt its international shipping services following a cyberattack. The LockBit group is suspected of the ransomware attack but initially denied involvement and blamed other cybercriminals using the LockBit 3.0 ransomware builder. However, a representative of the group later confirmed LockBit was behind the attack and said a ransom must be paid in exchange for a decryptor and the deletion of stolen data. The attack is being investigated by the National Crime Agency and UK National Cyber Security Centre (NCSC). Royal Mail has described the incident as a "cyber incident" and has restored some of the services affected.

Recommendations:

Secure your data by creating regular backups and storing them in a remote and inaccessible location.
Proactively ensure that software and systems are equipped with the latest security updates.
Require strong and unique passwords, and implement password policies that encourage frequent changes and multi-factor authentication.

CERT-UA Issues Alert on Phishing Attacks Employing Remcos Software

The Computer Emergency Response Team of Ukraine (CERT-UA) is alerting state authorities of a new phishing campaign that leverages a legitimate remote monitoring and surveillance software, Remcos. The phishing emails appear to be from Ukrainian telecom company Ukrtelecom and include an attachment over 600MB in size that, when executed, installs the Remcos software on the victim's machine. The Remcos software was developed by BreakingSecurity; however, in this case, it is being used for espionage purposes. The CERT-UA has provided Indicators of Compromise (IoCs) commonly used in the attack. The CERT-UA attributes the campaign to the nation-state actor UAC-0050, which has been known to target state authorities in Ukraine for the purpose of espionage.

Recommendations:

ZeroFox recommends using caution when receiving emails from unknown sources, especially those that contain large attachments
Be aware of the presence of nation-state actors conducting cyber-espionage campaigns and take the necessary steps to protect systems and information, such as keeping software and security systems up to date and monitor for the presence of IoCs provided by the CERT-UA.