ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - February 9, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

New Version of ESXiArgs Ransomware
Hong Kong Police Crack International Phishing Syndicate Using Rogue Mobile Apps to Steal Information
Weee! Food Delivery Data Breach Impacts 1.1 Million Customers
Threat Actors Increasing Use of Microsoft OneNote for Info-Stealing RATs
Money Lover App Security Flaw Exposes Shared Wallet Data

New Version of ESXiArgs Ransomware Encrypts More Data, Making Recovery Difficult

The ESXiArgs ransomware has evolved and is now encrypting larger amounts of data, making recovery of encrypted VMware ESXi virtual machines more challenging. In the first wave of attacks, over 3,000 internet-exposed VMware ESXi servers were encrypted, possibly through exploiting old VMware SLP vulnerabilities. The initial encryption process involved a script that encrypted virtual machine files in increments, leaving larger chunks of unencrypted data. However, a second wave of attacks is now underway with a modified encryption routine that encrypts much more data in large files, rendering recovery highly unlikely. The second wave also removed the Bitcoin addresses from the ransom note. According to an admin who reported the attack, the Service Location Protocol (SLP) was disabled, but the server was still compromised.

Recommendation:

ZeroFox still recommends attempting to recover encrypted ESXi servers using CISA's recovery script.

Hong Kong Police Crack International Phishing Syndicate Using Rogue Mobile Apps to Steal Information

An 11-month operation by Hong Kong police and Interpol has resulted in a crackdown on an international phishing syndicate that used 563 fake mobile applications to steal information from phones globally. The operation, named "Magicflame," tracked down 258 servers around the world linked to malicious mobile apps impersonating banks and financial institutions. The victims were infected after clicking on a link from a smishing message, allowing the hackers to steal personal information that included bank account and credit card details, phone contacts, and photographs. The servers stored data stolen from 519 phones, mostly from Japan and South Korea. No arrests were made by Hong Kong police, but information about the suspects was passed on to overseas enforcement agencies.

Recommendations:

ZeroFox recommends staying alert; avoid connecting to any suspicious websites or mobile apps via hyperlinks in emails or text messages.
Be vigilant when downloading and installing applications, especially if they are from unknown or untrusted sources. Check the developer information and reviews before downloading.

Weee! Food Delivery Data Breach Impacts 1.1 Million Customers

Weee! food delivery service suffered a data breach affecting at least 1.1 million customers. A newer and very well-reputed threat actor named “IntelBroker” leaked the information, which contains first and last names, email addresses, phone numbers, device type, order notes, and other data used by the delivery platform. Weee! has confirmed the breach but states that no payment information was exposed, as the company does not retain payment information in its databases. Information of customers who placed orders between July 12, 2021, and July 12, 2022, may have been impacted. Weee! has informed all customers of the issue and is reviewing its security measures.

Recommendations:

Change the password for your email account and any other accounts where you use the same or similar login credentials. Use strong and unique passwords for each online account.
Configure ongoing monitoring for Compromised Account Credentials in the event any of your credentials circulate in the underground.
If available, turn on two-factor authentication for your email and other accounts to add an extra layer of security.

Threat Actors Increasing Use of Microsoft OneNote for Info-Stealing RATs

Security researchers discovered a new type of cyberattack using Microsoft OneNote attachments to deliver remote access Trojans (RATs) in phishing campaigns. The OneNote attachments contain Visual Basic Script (VBS) files, which retrieve two files from a command and control (C2) server. The first file is a decoy OneNote file, and the second is a malicious batch file that deploys one of four info-stealing RAT variants: AsyncRAT, XWorm, QuasarRAT, and Formbook. The RATs can steal sensitive information such as passwords, keystrokes, session cookies, and cryptocurrency wallets. Historically, attackers used Microsoft Word and Excel macros to spread malware, but Microsoft banned the use of macros in 2022—forcing attackers to find new methods.

Recommendations:

Provide cybersecurity awareness training to employees with a focus on phishing.
Inform employees to be cautious when dealing with Microsoft Office files, especially OneNote files.
If OneNote is not used within the organization, consider blocking .one files at the email firewall to prevent them from reaching employees.

Money Lover App Security Flaw Exposes Shared Wallet Data

A vulnerability in financial app Money Lover, which allows users to manage their expenses and budget, exposed transaction data and email addresses of users who had created shared wallets. The data was exposed to any authenticated user of the app and could be viewed using the browser's developer tools. The vulnerability impacted only users who had used the shared wallet feature and exposed email addresses, wallet names, and limited transaction data. The publisher of Money Lover, Finsify, released an update to fix the issue on January 27, 2023.

Recommendation:

Money Lover users are advised to update their app to the latest version to avoid potential targeted phishing attacks that could further compromise sensitive information.

OpenSSL Releases Fixes for High-Severity Security Flaws in Encryption Toolkit

The OpenSSL Project has released fixes to address several security vulnerabilities, including a high-severity bug in the open source encryption toolkit tracked as CVE-2023-0286. This issue relates to type confusion in the handling of X.509 certificates, which may allow an adversary to read memory contents or cause a denial-of-service attack. The vulnerability is likely to impact only those applications that have a custom implementation for retrieving a certificate revocation list over a network. The bug has been patched in OpenSSL versions 3.0.8, 1.1.1t, and 1.0.2zg. These fixes arrive nearly two months after OpenSSL plugged a low-severity flaw in the processing of X.509 certificates, which resulted in a denial-of-service condition.

Recommendation:

ZeroFox recommends updating applications to the latest versions of OpenSSL, which are 3.0.8, 1.1.1t, and 1.0.2zg. Updating to the latest versions of OpenSSL is important to ensure the security of sensitive information and prevent potential security incidents.