ZeroFox Daily Intelligence Brief - February 15, 2023

ZeroFox Daily Intelligence Brief - February 15, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Airline SAS Network Hit by Hackers, Says App Was Compromised
• Healthcare Giant CHS Reports First Data Breach in GoAnywhere Hacks
• Microsoft February 2023 Patch Tuesday Fixes Three Exploited Zero-Days, 77 flaws
• European Systemic Risk Board (ESRB) Urges for Stronger Defense Against Attack on Financial Institutions
• Chinese Hackers Targeting South American Diplomatic Entities with ShadowPad

Airline SAS Network Hit by Hackers, Says App Was Compromised

Scandinavian Airlines System (SAS), the flag carrier of Denmark, Norway, and Sweden, suffered a cyberattack that reportedly froze its website and leaked customer information from its app. The company announced that the problems have been fixed.

A threat group called Anonymous Sudan has claimed responsibility for this attack. This group has claimed several recent attacks on entities in Sweden—including attacks on the country’s national public television broadcaster, SVT, as well as on several airports, telecommunications companies, and educational institutions—allegedly in retaliation for the Quran-burning incident at a political protest in Stockholm last month.

Recommendations:

• Utilize strong and unique passwords, and implement password policies that encourage frequent changes and multi-factor authentication (MFA).
• Follow ZeroFox Intelligence to remain up-to-date on the latest geopolitical cyber threats.
• Configure ongoing monitoring for Compromised Account Credentials in the event any of your credentials circulate in the underground.

Healthcare Giant CHS Reports First Data Breach in GoAnywhere Hacks

Community Health Systems (CHS), one of the largest healthcare providers in the United States, suffered a data breach that leaked the personal and health information of up to one million patients. CHS reported to the Securities and Exchange Commission (SEC) that it will provide appropriate notifications to affected individuals and to regulatory agencies, as well as offer identity theft protection services to the affected individuals.

The breach was a result of the Clop ransomware gang exploiting a now-patched zero-day vulnerability (CVE-2023-0669) in the GoAnywhere MFT secure file transfer tool, which led to data breaches in over 130 organizations.

Recommendations:

• System administrators should deploy the latest available patches to protect against the exploitation of the zero-day vulnerability.
• Affected patients should be wary of any healthcare-related communication involving targeted emails, SMSes, or phone calls from unknown sources conveying confidential medical and personal information, as threat actors might use the leaked data for spear phishing attacks.
• Consider using ZeroFox to monitor any of the stolen data packages being sold or shared in the deep and dark web.
• Patients could use identity-protection services, like IDX, to prevent the misuse of their leaked information in impersonation and other scams.

Microsoft February 2023 Patch Tuesday Fixes Three Exploited Zero-Days, 77 flaws

On the second Tuesday of every month, Microsoft releases a batch of security updates for its products. Microsoft's Patch Tuesday update for February 2023 features fixes for 77 bugs, including three zero-day vulnerabilities that are being actively exploited in attacks. Of the patched vulnerabilities, nine have been marked “Critical” (Microsoft defines a vulnerability as critical if its exploitation could allow code execution without user interaction). Among the Critical bugs is a Microsoft Word bug (CVE-2023-21716) that can allow remote code execution via a malicious document, even if the document is viewed in the Preview Pane.

Recommendations:

• System administrators should ensure that all available security updates have been deployed.
• Remain up-to-date on the newly-patched vulnerabilities and their potential impact via the Microsoft Patch Tuesday Notes published by ZeroFox Intelligence.

European Systemic Risk Board (ESRB) Urges for Stronger Defense Against Attack on Financial Institutions

The European Union’s systemic risk watchdog has published a report aimed at “advancing macroprudential tools” for cyber resilience in the region. The report focuses on using appropriate tools to guard the overall financial system of the region—including the telecommunication and power systems crucial for the financial system’s operation—against hostile cyber forces. The ESRB has urged EU nations to play a more proactive role in terms of conducting stress tests on the system and identifying loopholes to be plugged.

Recommendations:

• Follow ZeroFox Intelligence to remain up-to-date on latest advisories and guidelines.
• Organizations should regularly assess and update their cybersecurity strategies and infrastructure, including firewalls, antivirus software, and intrusion detection systems, to stay protected against emerging threats

Chinese Hackers Targeting South American Diplomatic Entities with ShadowPad

A Chinese espionage group known to spy on government agencies and think tanks in Asia and Europe has been spotted compromising diplomatic targets in South America. The group uses tools like ShadowPad (a remote access trojan) to maintain persistence access and QuasarLoader to deploy additional malware.

Recommendations:

• Organizations should enforce MFA to secure their systems.
• Keeping in mind several attacks in the past year that exploited people’s MFA fatigue, organizations should conduct relevant training and awareness programs for their personnel highlighting the importance of the seemingly inconvenient security measure.
• System admins should deploy patches against all vulnerabilities as soon as they are available to pre-empt such espionage groups’ exploitation of system vulnerabilities.