ZeroFox Daily Intelligence Brief - February 13, 2023

ZeroFox Daily Intelligence Brief - February 13, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Namecheap Email Account Breach Leads to MetaMask and DHL Phishing Campaigns
• Play Ransomware Group Claims Attack on A10 Networks
• ChatGPT and the Growing Threat of AI-Driven Cyberattacks
• All India Institute of Medical Sciences Suffers Cyberattack Causing Network Shutdown
• Royal Mail Faces Ransom Deadline as LockBit 2.0 Hackers Claim Network Access
• CISA Adds Three New Vulnerabilities to Its List of Known Exploited Vulnerabilities
• Korenix JetWave Industrial Control Systems Vulnerable to Attack

Namecheap Email Account Breach Leads to MetaMask and DHL Phishing Campaigns

Domain registrar Namecheap experienced a breach of its email account on Sunday night, leading to a wave of phishing emails that attempted to steal users' personal information and cryptocurrency wallets. The phishing campaigns, which impersonated either DHL or MetaMask, started on Sunday night and were sent via the email platform SendGrid. The breach may be related to a December CloudSek report that highlighted the exposure of API keys for Mailgun, MailChimp, and SendGrid in mobile apps. Following the incident, Namecheap stopped all emails and began investigating the attack with its upstream provider.

Recommendations:

• If you received either a DHL or MetaMask phishing email from Namecheap, do not click on any links; immediately delete it.
• Users are advised to enable two-factor authentication and use strong, unique passwords for all their online accounts.

Play Ransomware Group Claims Attack on A10 Networks

The Play ransomware group has claimed responsibility for a cyberattack on A10 Networks, an application delivery controller (ADC) provider based in California. A10 Networks reported the cyberattack was identified and addressed quickly and that it did not impact products or customer solutions. The company did not disclose the type of cyberattack or if data was stolen, and it does not expect the cyberattack to have a significant impact on its operations. However, the Play ransomware gang claims it was able to exfiltrate various data types from the company and will make them public on February 14. Play ransomware has been active since June 2022 and was the fifth most active ransomware operation in January 2023.

Recommendation:

• Companies should assess and update their security protocols regularly to ensure they are up-to-date on the latest threats and vulnerabilities. This includes regular security audits, vulnerability assessments, and penetration testing.

ChatGPT and the Growing Threat of AI-Driven Cyberattacks

The use of artificial intelligence (AI) in cybersecurity is becoming increasingly popular, but many cybersecurity and IT professionals have concerns about its potential threats. A recent study from BlackBerry found that three-quarters of decision-makers who plan to invest in AI-driven cybersecurity by 2025 see AI as a serious threat to security. Many believe that chatbots like ChatGPT will be behind successful cyberattacks, and it is only a matter of time until threat actors use them to launch attacks. Chatbots are likely to be most effective in social engineering-based cyberattacks since they can create convincing conversations and have a massive knowledge base. Chatbots can be used to generate convincing email introductions and create malware code, allowing threat actors to evade, bypass, and circumvent existing security solutions. Threat actors can use AI models to map their attacks without leaving behind any signatures, flags, detections, behavior patterns, and traces, increasing the chances of their attacks delivering the desired outcome while going unnoticed.

Recommendations:

• ZeroFox recommends that IT and cybersecurity professionals stay informed about the latest trends in AI-based attacks and explore the latest defensive technologies.
• Implementing security protocols, training employees on cybersecurity best practices, and regularly testing defenses can help mitigate the risk of social engineering-based cyberattacks, which are likely to be the most effective chatbot threat.

All India Institute of Medical Sciences Suffers Cyberattack Causing Network Shutdown

The All India Institute of Medical Sciences (AIIMS) suffered a cyberattack on February 10, which resulted in the hospital's computer network being shut down. The attack has affected the hospital's outpatient department and other services, forcing patients to seek treatment elsewhere. The authorities have not provided any details about the nature of the attack or the extent of the damage. Meanwhile, the Indian government has acknowledged that there has been an increase in the number of cyberattacks on critical infrastructure, including healthcare facilities. The issue was raised in the upper house of the Indian Parliament, the Rajya Sabha, and the government stated that it is taking steps to improve the cybersecurity of critical infrastructure—including conducting regular audits and training personnel.

Recommendations:

• Critical infrastructure providers should implement security controls such as firewalls, intrusion detection and prevention systems, and access controls to prevent unauthorized access to their systems.
• Regular cybersecurity training can help raise awareness among staff about the risks of cyberattacks and teach them how to identify and avoid common attack methods, such as phishing scams.
• Please consider consulting ZeroFox Intelligence for any data breach updates.

Royal Mail Faces Ransom Deadline as LockBit 2.0 Hackers Claim Network Access

The United Kingdom’s Royal Mail is reportedly being targeted by the LockBit 2.0 ransomware collective, which claims to have accessed the company's network and stolen data. The group has demanded a ransom payment in exchange for not releasing the data and has set a deadline of February 16 for the payment. The Royal Mail has not confirmed whether any data has been stolen, but it has said that it is investigating the incident.

Recommendations:

• Secure your data by creating regular backups and storing them in a remote and inaccessible location.
• Proactively ensure that software and systems are equipped with the latest security updates.
• Require strong and unique passwords, and implement password policies that encourage frequent changes and multi-factor authentication.

CISA Adds Three New Vulnerabilities to Its List of Known Exploited Vulnerabilities

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog that are common attack routes for cybercriminals and pose significant risks to government networks. One of the vulnerabilities includes CVE-2022-24990, which affects TerraMaster network-attached storage (TNAS) devices and can lead to remote code execution. The vulnerability has been weaponized by North Korean nation-state hackers to strike healthcare and critical infrastructure entities with ransomware. Another flaw is CVE-2015-2291, an unspecified flaw in the Intel ethernet diagnostics driver for Windows that could put an affected device in a denial-of-service state. Lastly, CISA added a remote code injection discovered in Fortra's GoAnywhere managed file transfer (MFT) application (CVE-2023-0669) to the KEV catalog that has been linked to a cybercrime group affiliated with a ransomware operation.

Recommendations:

• CISA recommends that all organizations prioritize timely remediation of vulnerabilities as part of their vulnerability management practice.
• Network segmentation can help prevent lateral movement by attackers, limiting the impact of a successful cyberattack.
• Regularly backing up critical data and testing backup and recovery procedures can help ensure that systems and data can be restored in the event of a cyberattack.

Korenix JetWave Industrial Control Systems Vulnerable to Attack

A security researcher has discovered vulnerabilities in Korenix JetWave industrial control systems that could be exploited by attackers to gain access to sensitive data and disrupt critical infrastructure. The vulnerabilities include weak encryption, hardcoded passwords, and default credentials that could be used to access the system. Korenix has released a patch to fix the vulnerabilities, but it is important for organizations that use JetWave devices to ensure that they apply the patch as soon as possible.

Recommendations:

• New firmware versions with fixes have been released in January 2023, and Korenix has sent their customers a notification with the security advisory. The company advises their customers to upgrade affected devices to the latest firmware version available.
• Organizations should ensure that they apply security patches and updates as soon as they become available to protect against known vulnerabilities.