ZeroFox Daily Intelligence Brief - February 20, 2023

ZeroFox Daily Intelligence Brief - February 20, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• GoDaddy: Hackers Stole Source Code, Installed Malware in Multi-Year Breach
• Europol Busts "CEO Fraud" Gang That Stole EUR 38 Million in a Few Days
• Critical RCE Vulnerability Discovered in ClamAV Open Source Antivirus Software
• Hackers Leverage PayPal to Send Malicious Invoices

GoDaddy: Hackers Stole Source Code, Installed Malware in Multi-Year Breach

Web-hosting provider GoDaddy suffered a breach that led to malware being deployed on its servers and the theft of source code. The company revealed that the breach was the result of a multi-year attack by a sophisticated threat actor targeting hosting companies worldwide. The attacker’s goal was to infect websites and servers with malware for phishing campaigns and malware distribution.

Two other recent breaches at GoDaddy, disclosed in November 2021 and March 2020, were reportedly linked to the same multi-year campaign.

Recommendations:

• Admins of websites hosted on GoDaddy should change all passwords and run a thorough security scan to check for the presence of malware, including trojans.
• It is important to be cautious when receiving emails from GoDaddy or other organizations, as the attackers may use phishing emails to obtain login credentials.
• Follow ZeroFox Intelligence for updates on new types of malware, their indicators of compromise (IOCs), and ways to protect your systems against them.

Europol Busts "CEO Fraud" Gang That Stole EUR 38 Million in a Few Days

The European Union Agency for Law Enforcement Cooperation, commonly known as Europol, has dismantled the operations of a gang of scammers that targeted its victims via business email compromise (BEC) attacks. The gang members impersonated Chief Executive Officers and duped employees of the target companies’ financial departments into making payments to bank accounts under the scammers’ control. The police have arrested eight suspected gang members from France and Israel and seized cars, electronic equipment, digital assets, and bank accounts operated by the scammers.

Recommendations:

• Always confirm the legitimacy of an email request for money or confidential information via an alternative method, such as a phone call.
• Set up DMARC rules and protection schemes against domain spoofing and display-name spoofing.
• Contact ZeroFox for anti-impersonation, identity protection, and brand protection services.

Critical RCE Vulnerability Discovered in ClamAV Open Source Antivirus Software

Cisco has released patches to fix a critical bug (CVE-2023-20032; CVSS score: 9.8) in open-source antivirus software ClamAV. The bug—which affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier—could allow an attacker to execute malicious code with the same privileges as that of the ClamAV scanning process and to crash the process. Cisco stated that Secure Endpoint (Windows, macOS, and Linux), Secure Endpoint Private Cloud, and Secure Web Appliance are vulnerable to the bug.

Recommendations:

• Deploy the latest official patches to guard your systems against attacks.
• Use the ZeroFox platform’s Intelligence Search interface to investigate vulnerabilities that may apply to your environment and their associated exploits. * Vulnerabilities are sourced from the NIST database and enriched by ZeroFox analysts, with an attack surface risk score, potential impact, and remediation steps.

Hackers Leverage PayPal to Send Malicious Invoices

Security researchers have recently discovered a phishing campaign in which threat actors are using the PayPal platform to send malicious invoices to users. The accompanying email warns there has been fraud on the account and that the user will be fined if no action is taken; a phone number is provided for the user to seek help. This campaign is unique in that the invoice is coming directly from PayPal versus from a spoofed site; it comes weeks after PayPal notified thousands of U.S. customers that their accounts were compromised.

Recommendations:

• Use caution regarding any emails regarding PayPal invoices. The emails used in this campaign contained many spelling and grammar errors, and the telephone number provided is not PayPal’s legitimate customer service number. This campaign also threatened that the user could incur a hefty fine if they did not take action, which should raise a red flag.
• Rather than clicking on invoice links sent via emails that purport to be from PayPal, log into your account directly via PayPal’s official app or website and confirm that any pending invoices match known transactions there before taking any action.