ZeroFox Daily Intelligence Brief - February 14, 2023

ZeroFox Daily Intelligence Brief - February 14, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Cloudflare Blocked Record-Breaking 71 Million RPS DDoS Attack
• Apple Releases Critical Security Updates
• New Financially Motivated Campaign Deploys MortalKombat Ransomware and Laplas Cryptocurrency Hijacker
• Eurostar Faces Backlash Against Recent Password Reset Issue
• Increasing Use of Phishing Attacks to Bypass MFA in Microsoft 365

Cloudflare Blocked Record-Breaking 71 Million RPS DDoS Attack

Cloudflare recently blocked a massive attack massive DDoS attack with a peak traffic volume of 17.2 million requests per second and a sustained traffic volume of 71 million RPS. The attack lasted for several days and targeted a large unspecified customer. Cloudflare successfully mitigated the attack by using a combination of techniques such as rate limiting, caching, and DDoS protection services.

Recommendation:

• ZeroFox recommends that organizations consider using cloud-based DDoS protection services, like those offered by Cloudflare, to defend against large-scale attacks, as well as having a response plan in place to mitigate such attacks.

Apple Releases Critical Security Updates

Apple recently released critical security updates for its iOS, iPadOS, macOS, and watchOS operating systems to address multiple vulnerabilities that could allow attackers to execute arbitrary code with kernel privileges. The vulnerabilities were reported by external security researchers and could be exploited remotely. The security updates also address a vulnerability in the Safari browser that could allow a remote attacker to execute arbitrary code with root privileges.

Recommendations:

• Apple users should immediately apply the updates.
• ZeroFox recommends enabling automatic updates to stay ahead of potential security risks and ensure that your device is always equipped with the latest security features.

New Financially Motivated Campaign Deploys MortalKombat Ransomware and Laplas Cryptocurrency Hijacker

A new financially motivated campaign using the MortalKombat ransomware and Laplas cryptocurrency hijacker has been discovered. MortalKombat is a variant of the Xorist commodity ransomware family, which allows threat actors to customize the malware. Laplas monitors the Windows clipboard for cryptocurrency addresses and substitutes them for addresses under the attacker's control. The attackers send phishing emails with a malicious ZIP attachment containing a BAT loader script that downloads a second archive from a remote resource. This archive contains either the MortalKombat ransomware or Laplas.

Recommendations:

• Use ZeroFox Intelligence to enhance your understanding of the most recent campaigns.
• Users should be vigilant when opening email attachments and implement anti-phishing measures to prevent these attacks.
• Organizations should also use endpoint protection and multi-layered security controls to mitigate the risks of malware attacks.

Eurostar Faces Backlash Against Recent Password Reset Issue

Eurostar, a high-speed railway service between the UK and mainland Europe, recently forced a password reset for its users due to a potential security incident. However, many users were unable to reset their passwords, as the reset links were not working or were expired. This led to frustration and confusion among users, and some were even locked out of their accounts. The company acknowledged the issue and apologized but did not provide further details about the potential security incident. Eurostar has since resolved the issue and urged affected users to contact customer service if they are still experiencing problems.

Recommendations:

• Eurostar users who were affected by the password reset issue and subsequent lockouts should contact customer service for assistance.
• Users who have not yet reset their passwords should do so as soon as possible to ensure the security of their accounts.

Increasing Use of Phishing Attacks to Bypass MFA in Microsoft 365

Attackers are increasingly using phishing attacks to bypass multifactor authentication (MFA) in Microsoft 365. Frameworks such as Evilginx2 are used to steal login credentials and session cookies for initial access and MFA bypass. While certificate-based authentication and FIDO2 can mitigate these attacks, many organizations are still using time-based one-time passwords (TOTPs) and push notifications for MFA. These gaps can be exploited by attackers, who are constantly innovating and evolving their tactics to compromise networks.

Recommendations:

• ZeroFox advises users to remain vigilant and to use additional security measures, such as behavioral biometrics, to enhance the security of their MFA systems.
• ZeroFox recommends that organizations adopt a defensive posture to the changing environment and take proactive measures to protect their data.