ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - February 10, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

Reddit Hit by a Phishing Attack
Joint Advisory Issued on DPRK State-Sponsored Ransomware Attacks Targeting Healthcare and Critical Infrastructure
Russian Threat Actors Target Eastern Europeans in Cryptocurrency Industry with Modified Stealerium Malware “Enigma”
Financially-Motivated Threat Group Using Custom Tools for Information Theft
United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang
Study Reveals Pre-Installed Spyware on Top-of-the-Line Android Devices in China

Reddit Hit by a Phishing Attack

Reddit suffered a phishing attack that led to unauthorized access to internal documents, code, and business systems. The highly-targeted attack, which occurred on February 5, 2023, tricked employees with plausible-looking prompts that redirected to a fake intranet portal. One employee's credentials were compromised, but there is no evidence of a breach in production systems or data compromise. The exposure included limited employee and advertiser information. This highlights the growing issue of adversaries defeating two-factor authentication through lookalike pages.

Recommendations:

Be aware of phishing attacks and the potential dangers they pose.
Be cautious when receiving emails that ask for sensitive information; always double-check the sender and the website's authenticity.

Joint Advisory Issued on DPRK State-Sponsored Ransomware Attacks Targeting Healthcare and Critical Infrastructure

The NSA, FBI, CISA, HHS, NIS, and DSA are jointly warning of ongoing ransomware attacks targeting healthcare and critical infrastructure sectors in a Cybersecurity Advisory. The Advisory highlights the tactics and indicators of compromise (IoCs) used by the Democratic People’s Republic of Korea (DPRK), including the use of cryptocurrency for ransom demands. The agencies discourage paying ransoms, as it does not guarantee recovery and may result in sanctions. The revenue supports the DPRK's national objectives.

Recommendations:

Be aware of the tactiques, techniques, and procedures (TTPs) used by the Democratic People’s Republic of Korea (DPRK) to conduct ransomware attacks and the IOCs associated with them. This information can help to identify and prevent these attacks.
Follow the recommendations provided in the Advisory.
If you are a victim of a ransomware attack, seek assistance from cybersecurity professionals to ensure that your organization is able to recover from the attack and prevent future attacks. Contact ZeroFox to find out more about our Incident Response services.

Russian Threat Actors Target Eastern Europeans in Cryptocurrency Industry with Modified Stealerium Malware “Enigma”

A new cyberattack campaign targeting Eastern Europeans in the cryptocurrency industry is using fake job offers and a modified version of the Stealerium malware named "Enigma." Russian threat actors are behind the attacks, which use a set of obfuscated loaders to bypass Microsoft Defender's protections and steal information, passwords, and tokens stored in various apps. The stolen data is then sent back to the attackers via Telegram. The attack shows the involvement of Russian threat actors, although researchers have not assigned attribution with confidence.

Recommendations:

ZeroFox recommends being cautious when receiving job offers from unknown sources, especially in the cryptocurrency industry.
Be aware of the tactics used by threat actors, such as using fake job offers and exploiting vulnerabilities, in order to protect personal information and systems from malicious attacks.

Financially-Motivated Threat Group Using Custom Tools for Information Theft

A new threat group named TA866 has been discovered that uses custom tools to identify and pursue high-value targets for information theft. The group appears to be financially motivated, but there may also be some overlap with nation-state activity. The recent campaign "Screentime" uses phishing emails with a "check my presentation" lure to initiate a multi-step attack chain and download custom malware. The malware can take screenshots of the user's desktop and perform reconnaissance on the target's Active Directory domain.

Recommendations:

ZeroFox recommends implementing multi-factor authentication and keeping software up-to-date with the latest security patches.
Monitor network traffic and maintain a backup of important data to minimize the impact of a successful attack.

United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang

The United States and the United Kingdom (UK) are sanctioning seven members of the Russia-based cybercrime group, Trickbot, as part of joint efforts to disrupt Russian cybercrime and ransomware. Trickbot, first identified in 2016, evolved from the Dyre Trojan, which was developed and operated by a group of cybercriminals to steal financial data. Trickbot is now a highly-modular malware suite that allows the group to conduct various illegal cyber activities, including ransomware attacks. The group has been associated with Russian intelligence services, and they targeted the U.S. government and U.S. companies in 2020. Thursday’s action is the first of its kind for the UK and highlights the strengthened partnership between the U.S. Office of Foreign Assets Control and the UK’s Office of Financial Sanctions Implementation.

Recommendation:

Use ZeroFox Intelligence Search to stay both up to date on developments in the global fight against cybercrime and informed about the latest methods used by malicious actors.

Study Reveals Pre-Installed Spyware on Top-of-the-Line Android Devices in China

A recent study conducted by researchers from the University of Edinburgh and Trinity College of Dublin analyzed the privacy implications of top-of-the-line Android devices sold in China. The researchers used both static and dynamic code analysis techniques to examine the data transmitted by pre-installed system apps on popular Chinese Android smartphones from Xiaomi, OnePlus, and Oppo Realme. The results showed the presence of several system, vendor, and third-party apps that were designed to stealthily extract user and device information, such as system information, geolocation, user profiles, social relationships, and call history. The analysis revealed that these smartphones were sending data to the device vendor and Chinese mobile network operators, even in the absence of a SIM card or the use of a SIM card from a different operator. This behavior presents a risk to users' privacy and exposes them to potential surveillance.

Recommendations:

Be cautious of preinstalled apps on Android devices, especially those manufactured in China.
Be mindful of the permissions given to third-party apps on your device.