ZeroFox Daily Intelligence Brief - February 17, 2023

ZeroFox Daily Intelligence Brief - February 17, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Atlassian Says Recent Data Leak Stems from Third-Party Vendor Hack
• Microsoft Exchange ProxyShell Flaws Exploited in New Crypto-Mining Attack
• New Mirai Malware Variant Infects Linux Devices to Build DDoS Botnet
• CISA Warns of Windows and iOS Bugs Exploited as Zero-Days

Atlassian Says Recent Data Leak Stems from Third-Party Vendor Hack

Atlassian, the company behind collaboration tools like Jira, Confluence, and Trello, suffered a data breach that resulted in the company’s internal information being posted on Telegram. The leaked data—posted by hacking group SiegedSec—includes employee names, email addresses, phone numbers, and floorplans of the company’s Sydney and San Francisco offices. Atlassian has stated that the incident was caused by a breach of its third-party vendor, Envoy, but Envoy’s initial research reportedly indicates that a hacker gained access to an Atlassian employee's credentials and accessed the Atlassian employee directory.

Recommendations:

• Companies should periodically review the access granted to third-party vendors and conduct security audits.
• Affected organizations should seek assistance from cybersecurity professionals to ensure smooth recovery and plug security loopholes. Contact ZeroFox to find out more about our Incident Response services.
• Network segmentation can help prevent lateral movement by attackers, limiting the impact of a successful cyberattack.
• Employees should use strong and unique passwords for all their online accounts and never share them; they should also enable multi-factor authentication (MFA) wherever possible.
• Users should be wary of unexpected contact claiming to be from Atlassian employees, as cybercriminals could attempt follow-on attacks using the leaked data.

Microsoft Exchange ProxyShell Flaws Exploited in New Crypto-Mining Attack

Systems with unpatched Microsoft Exchange ProxyShell vulnerabilities are being targeted via a new malware strain called ProxyShellMiner to deploy a Monero (XMR) cryptocurrency miner. Although Microsoft deployed patches for the ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) last year, many systems are yet to be patched and remain vulnerable to waves of attacks. The latest malware campaign can lead to the overuse of system resources, overheating, degrading of system performance, and even backdoor deployment and remote code execution.

Recommendations:

• Organizations should apply approved security patches and updates as soon as they are available to protect against known vulnerabilities.
• Use the ZeroFox platform’s Intelligence Search to stay up-to-date on latest malware campaigns and other emerging threats.

New Mirai Malware Variant Infects Linux Devices to Build DDoS Botnet

Security researchers have spotted a new variant of the Mirai botnet that spreads by brute-forcing weak or default telnet/SSH credentials and exploiting hardcoded flaws in Linux systems. Operators of the botnet attempt to exploit 13 vulnerabilities in Linux as they scan for vulnerable devices to command in DDoS attacks.

Unlike most Mirai variants that use one XOR encryption key, this new variant (tracked as V3G4) uses four, which makes it challenging for malware researchers to reverse-engineer its source code and analyze its capabilities.

Recommendations:

• Users should change the default passwords of systems and install latest security updates to guard their systems from being used in a botnet.
• Utilize the ZeroFox platform’s Intelligence Search interface to investigate network and infrastructure Indicators of Compromise (IOCs) of interest including C2 Domains, Botnet Infected Hosts, Compromised Account Credentials, Domain Registrations, and phishing-related Email Addresses and Phone Numbers.

CISA Warns of Windows and iOS Bugs Exploited as Zero-Days

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five new security vulnerabilities to its catalog of Known Exploited Vulnerabilities. Three of the actively-exploited bugs (CVE-2023-21823, CVE-2023-23376, and CVE-2023-21715) relate to Microsoft products, while the fourth (CVE-2023-23529) is an Apple WebKit zero-day bug. The fifth bug (CVE-2022-46169) is a Cacti command injection vulnerability. Cacti is an open-source, web-based network monitoring, performance, fault, and configuration management framework for the data-logging tool RRDtool.

All Federal Civilian Executive Branch Agencies (FCEB) agencies in the United States must patch the Windows and iOS bugs by March 7 and the Cacti bug by March 9, 2023.

Recommendations:

• Even though only U.S. federal agencies are mandated to apply the patches by the designated date, all organizations should deploy the available security updates to secure their systems.
• Utilize the ZeroFox platform’s Intelligence Search for updates on actively-exploited vulnerabilities.