Threat Intelligence Bulletin: 02/17/2023

The Underground Economist: Volume 3, Issue 4

Welcome back to The Underground Economist, Volume 3, Issue 4, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of February 17, 2023.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full piece here.

ZeroFox Daily Intelligence Brief: 2023-02-17 - 2023-02-23

ZeroFox Daily Intelligence Brief - February 17, 2023

Key Findings

Atlassian Says Recent Data Leak Stems from Third-Party Vendor Hack
Microsoft Exchange ProxyShell Flaws Exploited in New Crypto-Mining Attack
New Mirai Malware Variant Infects Linux Devices to Build DDoS Botnet
CISA Warns of Windows and iOS Bugs Exploited as Zero-Days

Report: https://cloud.zerofox.com/intelligence/advisories/19694

ZeroFox Daily Intelligence Brief - February 20, 2023

Key Findings

GoDaddy: Hackers Stole Source Code, Installed Malware in Multi-Year Breach
Europol Busts "CEO Fraud" Gang That Stole EUR 38 Million in a Few Days
Critical RCE Vulnerability Discovered in ClamAV Open Source Antivirus Software
Hackers Leverage PayPal to Send Malicious Invoices

Report: https://cloud.zerofox.com/intelligence/advisories/19707

ZeroFox Daily Intelligence Brief - February 21, 2023

Key Findings

New Stealc Malware Emerges with a Wide Set of Stealing Capabilities
Microsoft Outlook Flooded with Spam Due to Broken Email Filters
Coinbase Cyberattack Targeted Employees with Fake SMS Alert

Report: https://cloud.zerofox.com/intelligence/advisories/19723

ZeroFox Daily Intelligence Brief - February 22, 2023

Key Findings

Activision Confirms Data Breach Exposing Employee and Game Info
Exploit Released for Critical Fortinet RCE Flaws, Patch Now
U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog

Report: https://cloud.zerofox.com/intelligence/advisories/19737

ZeroFox Daily Intelligence Brief - February 23, 2023

Key Findings

NSA: Best Practices for Securing Your Home Network
Mozilla Study: Data Privacy Labels for Most Top Apps in Google Play Store are False or Misleading
Hackers Use Fake ChatGPT Apps to Push Windows, Android Malware

Report: https://cloud.zerofox.com/intelligence/advisories/19748

Breach Disclosures: 2023-02-17 - 2023-02-23

Breaking News: 2023-02-17 - 2023-02-23

Hackers backdoor Microsoft IIS servers with new Frebniis malware

Hackers are deploying a new malware named "Frebniss" on Microsoft's Internet Information Services (IIS) that stealthily executes commands sent via web requests. Frebniis was discovered by cybersecurity researchers who reported that an unknown threat actor is currently using it against Taiwan-based targets.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-backdoor-microsoft-iis-servers-with-new-frebniis-malware/

Burton Snowboards cancels online orders after cyber incident

Burton Snowboards, a leading snowboard manufacturing company, has canceled all online orders following what it describes as a cyber incident. In a separate statement, Burton said that it's currently investigating the incident with the help of outside experts to establish its impact.

See the full report here: https://www.bleepingcomputer.com/news/security/burton-snowboards-cancels-online-orders-after-cyber-incident/

CISA warns of Windows and iOS bugs exploited as zero-days

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four security vulnerabilities exploited in attacks as zero-day to its list of bugs known to be abused in the wild. CISA has now given U.S. federal agencies three weeks, until March 7, 2023 to patch the four Apple and Microsoft security vulnerabilities and thwart attacks that could target their networks.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-of-windows-and-ios-bugs-exploited-as-zero-days/

Scandinavian Airlines says cyberattack caused passenger data leak

Scandinavian Airlines (SAS) has posted a notice warning passengers that a recent multi-hour outage of its website and mobile app was caused by a cyberattack that also exposed customer data. The cyberattack caused some form of a malfunction on the airline's online system, causing passenger data to become visible to other passengers. This data includes contact details, previous and upcoming flights, as well the last four digits of the credit card number.

See the full report here: https://www.bleepingcomputer.com/news/security/scandinavian-airlines-says-cyberattack-caused-passenger-data-leak/

Microsoft Exchange ProxyShell flaws exploited in new crypto-mining attack

A new malware dubbed "ProxyShellMiner" exploits the Microsoft Exchange ProxyShell vulnerabilities to deploy cryptocurrency miners throughout a Windows domain to generate profit for the attackers. ProxyShell is the name of three Exchange vulnerabilities discovered and fixed by Microsoft in 2021. When chained together, the vulnerabilities allow unauthenticated, remote code execution, letting attackers take complete control of the Exchange server and pivot to other parts of the organization's network.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-proxyshell-flaws-exploited-in-new-crypto-mining-attack/

ESXiArgs Ransomware Hits Over 500 New Targets in European Countries

More than 500 hosts have been newly compromised en masse by the ESXiArgs ransomware strain, most of which are located in France, Germany, the Netherlands, the U.K., and Ukraine. The findings come from cybersecurity researchers, who discovered two hosts with similar ransom notes dating back to mid-October 2022, just after ESXi versions 6.5 and 6.7 reached end of life.

See the full report here: https://thehackernews.com/2023/02/esxiargs-ransomware-hits-over-500-new.html

Researchers Hijack Popular NPM Package with Millions of Downloads

A popular npm package with more than 3.5 million weekly downloads has been found vulnerable to an account takeover attack. The attack grants a threat actor access to the package's associated GitHub account, effectively making it possible to publish trojanized versions to the npm registry that can be weaponized to conduct supply chain attacks at scale

See the full report here: https://thehackernews.com/2023/02/researchers-hijack-popular-npm-package.html

Researchers Link SideWinder Group to Dozens of Targeted Attacks in Multiple Countries

The prolific SideWinder group has been attributed as the nation-state actor behind attempted attacks against 61 entities in Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka between June and November 2021.

See the full report here: https://thehackernews.com/2023/02/researchers-link-sidewinder-group-to.html

Hackers Using Google Ads to Spread FatalRAT Malware Disguised as Popular Apps

Chinese-speaking individuals in Southeast and East Asia are the targets of a new rogue Google Ads campaign that delivers remote access trojans such as FatalRAT to compromised machines. The attacks involve purchasing ad slots to appear in Google search results and direct users looking for popular applications to rogue websites hosting trojanized installers. The ads have since been taken down.

See the full report here: https://thehackernews.com/2023/02/hackers-using-google-ads-to-spread.html

Researchers Warn of Critical Security Bugs in Schneider Electric Modicon PLCs

Security researchers have disclosed two new vulnerabilities affecting Schneider Electric Modicon programmable logic controllers (PLCs) that could allow for authentication bypass and remote code execution. The flaws, tracked as CVE-2022-45788 (CVSS score: 7.5) and CVE-2022-45789 (CVSS score: 8.1), are part of a broader collection of security defects tracked by cybersecurity researchers.

See the full report here: https://thehackernews.com/2023/02/researchers-warn-of-critical-security.html

German airport websites down in possible hacker attack

Experts are investigating after several German airports reported website failures. The disruption has been attributed to a possible hacking attack. Several German airports had their websites disrupted, with experts investigating a possible online attack. The problems come after a major IT failure at Germany's national carrier Lufthansa left thousands of passengers stranded at Frankfurt airport.

See the full report here: https://www.dw.com/en/german-airport-websites-down-in-possible-hacker-attack/a-64724769

Medibank class action launched after massive hack put private information of millions on dark web

The law firm Baker McKenzie has launched a class action lawsuit against Medibank over the health insurer’s massive cyber attack last year that resulted in the personal details of up to 10 million customers being posted on the dark web.

See the full report here: https://www.theguardian.com/australia-news/2023/feb/16/medibank-class-action-launched-data-breach-private-information-dark-web?&web_view=true

Intel issues patches for SGX vulnerabilities

Intel's Software Guard Extensions (SGX) are under the spotlight again after the chipmaker disclosed several newly discovered vulnerabilities affecting the tech, and recommended users update their firmware. The security holes are among the latest disclosures listed on Intel's Security Center page. These cover a wide range of Intel products including Xeon processors, network adapters, and also software.

See the full report here: https://www.theregister.com/2023/02/15/intel_sgx_vulns/?&web_view=true

Atlassian says recent data leak stems from third-party vendor hack

Atlassian, a collaboration software company based out of Australia has confirmed that a breach at a third-party vendor caused a recent leak of company data and that their network and customer information is secure. A hacking group known as SiegedSec leaked data on Telegram claiming it was stolen from Atlassian.

See the full report here: https://www.bleepingcomputer.com/news/security/atlassian-says-recent-data-leak-stems-from-third-party-vendor-hack/

Armenian Entities Hit by New Version of OxtaRAT Spying Tool

Entities in Armenia have been targeted by a cyber attack using an updated version of a backdoor known as OxtaRAT. This particular malware provides remote access and desktop surveillance to threat actors. The latest campaign began in November 2022 and is notable for being the first time that these threat actors have extended their focus beyond Azerbaijan.

See the full report here: https://thehackernews.com/2023/02/armenian-entities-hit-by-new-version-of.html

New Threat Actor WIP26 Targeting Telecom Service Providers in the Middle East

Telecommunication service providers in the Middle East are being targeted by a previously undocumented threat actor as part of a suspected intelligence gathering mission. The initial intrusion vector used in the attacks entails targeting of employees via WhatsApp messages that contain links to Dropbox links to supposedly benign archive files.

See the full report here: https://thehackernews.com/2023/02/new-threat-actor-wip26-targeting.html

Fortinet Issues Patches for 40 Flaws Affecting FortiWeb, FortiOS, FortiNAC, and FortiProxy

Fortinet has released security updates to address 40 vulnerabilities in its software lineup, including FortiWeb, FortiOS, FortiNAC, and FortiProxy, among others. Two of the 40 flaws are rated critical, 15 are rated High, 22 are rated medium, and one is rated low in severity. Patches have been released in FortiNAC versions 7.2.0, 9.1.8, 9.1.8, and 9.1.8.

See the full report here: https://thehackernews.com/2023/02/fortinet-issues-patches-for-40-flaws.html

GoDaddy Discloses Multi-Year Security Breach Causing Malware Installations and Source Code Theft

Web hosting services provider GoDaddy disclosed a multi-year security breach that enabled unknown threat actors to install malware and siphon source code related to some of its services. The company attributed the campaign to an organized group targeting hosting services.

See the full report here: https://thehackernews.com/2023/02/godaddy-discloses-multi-year-security.html

Experts Warn of RambleOn Android Malware Targeting South Korean Journalists

Suspected North Korean nation-state actors targeted a journalist in South Korea with a malware-laced Android app as part of a social engineering campaign. The malicious functionalities include the ability to read and leak target's contact list, SMS, voice call content, location and others from the time of compromise on the target.The spyware camouflages as a secure chat app called Fizzle, but in reality, acts as a conduit to deliver a next-stage payload hosted on pCloud and Yandex.

See the full report here: https://thehackernews.com/2023/02/experts-warn-of-rambleon-android.html

New Mirai Botnet Variant "V3G4" Exploiting 13 Flaws to Target Linux and IoT Devices

A new variant of the notorious Mirai botnet has been found leveraging several security vulnerabilities to propagate itself to Linux and IoT devices.

See the full report here: https://thehackernews.com/2023/02/new-mirai-botnet-variant-v3g4.html

Critical RCE Vulnerability Discovered in ClamAV Open Source Antivirus Software

Cisco has rolled out security updates to address a critical flaw reported in the ClamAV open source antivirus engine that could lead to remote code execution on susceptible devices. Tracked as CVE-2023-20032 (CVSS score: 9.8), the issue relates to a case of remote code execution residing in the HFS+ file parser component. The flaw affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.

See the full report here: https://thehackernews.com/2023/02/critical-rce-vulnerability-discovered.html

Europol busts "CEO fraud" gang that stole EUR 38M in a few days

Europol has dismantled a Franco-Israeli "CEO fraud" group that employed business email compromise (BEC) attacks to divert payments from organizations to bank accounts under the threat actor's control. In one case against a single company, the fraudsters managed to pilfer EUR 38,000,000 within a couple of days, quickly moving the money across Europe, China, and eventually cashing out in Israel.

See the full report here: https://www.bleepingcomputer.com/news/security/europol-busts-ceo-fraud-gang-that-stole-38m-in-a-few-days/

Norwegian police recover USD 5.8 million in crypto from massive Axie Infinity hack

Norwegian police have seized USD 5,800,000 worth of cryptocurrency stolen by the North Korean Lazarus hacking group from Axie Infinity's Ronin Bridge. The seized funds will be returned to Sky Mavis, and from there, it will be used for partial victim reimbursement.

See the full report here: https://www.bleepingcomputer.com/news/security/norwegian-police-recover-58m-crypto-from-massive-axie-infinity-hack/

FBI is investigating a cybersecurity incident on its network

The U.S. Federal Bureau of Investigation (FBI) is reportedly investigating malicious cyber activity on the agency’s network. The federal law enforcement agency says it already contained the isolated incident and is working to uncover its scope and overall impact. CNN first reported that this was a hacking incident involving an FBI New York Field Office computer system used to investigate child sexual exploitation.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-is-investigating-a-cybersecurity-incident-on-its-network/

HardBit ransomware wants insurance details to set the perfect price

A ransomware known as HardBit has advanced to version 2.0, and its operators are trying to negotiate a ransom payment that would be covered by the victim's insurance company. Refusing to pay the ransom and reporting the incident to law enforcement along with having a consistent backup strategy are the only ways to fight this type of threat and bring it to an end.

See the full report here: https://www.bleepingcomputer.com/news/security/hardbit-ransomware-wants-insurance-details-to-set-the-perfect-price/

New Stealc malware emerges with a wide set of stealing capabilities

A new information stealer called Stealc has emerged on the dark web and is gaining traction due to aggressive promotion of its stealing capabilities. It bears similarities with malware of the same kind like Vidar, Raccoon, Mars, and Redline. Security researchers first spotted the new strain in January, 2023.

See the full report here: https://www.bleepingcomputer.com/news/security/new-stealc-malware-emerges-with-a-wide-set-of-stealing-capabilities/

Microsoft Outlook flooded with spam due to broken email filters

According to reports from an increasing number of Microsoft customers, Outlook inboxes have been flooded with spam emails because email spam filters are currently broken. This ongoing issue was confirmed by countless Outlook users who reported on social media platforms and the Microsoft Community's website that all messages were landing in their inboxes, even those that would have previously been tagged as spam and sent to the junk folder.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-outlook-flooded-with-spam-due-to-broken-email-filters/

Coinbase cyberattack targeted employees with fake SMS alert

Coinbase, a cryptocurrency exchange platform, has disclosed that an unknown threat actor stole the login credentials of one of its employees in an attempt to gain remote access to the company's systems. As a result of the intrusion, the attacker obtained some contact information belonging to multiple Coinbase employees. However, the company confirmed that customer funds and data remained unaffected.

See the full report here: https://www.bleepingcomputer.com/news/security/coinbase-cyberattack-targeted-employees-with-fake-sms-alert/

New WhiskerSpy malware delivered via trojanized codec installer

Security researchers have discovered a new backdoor called WhiskerSpy used in a campaign by a relatively new advanced threat actor tracked as Earth Kitsune, who is known for targeting individuals showing an interest in North Korea. The actor used a tactic known as a watering hole attack and picked victims from visitors to a pro-North Korea website.

See the full report here: https://www.bleepingcomputer.com/news/security/new-whiskerspy-malware-delivered-via-trojanized-codec-installer/

Indian Ticketing Platform RailYatri Hacked – 31 Million Impacted

RailYatri, a popular Indian train ticket booking platform, had suffered a massive data breach that exposed the personal information of over 31 million users/travellers. The breach is believed to have occurred in late December 2022, and the database containing sensitive information is now being leaked online. The compromised data includes email addresses, full names, genders, phone numbers, and locations.

See the full report here: https://www.hackread.com/indian-ticketing-platform-railyatri-hacked/?web_view=true

Hackers Start Selling Data Center Logins for Some of World’s Largest Corporations

Hackers gained access to login credentials for data centers in Asia that are used by some of the world's largest businesses. The data caches were previously unreported and contained emails and passwords for customer-support websites belonging to two of the largest data center operators in Asia: Shanghai-based GDS Holdings Ltd. and Singapore-based ST Telemedia Global.

See the full report here: https://www.bloomberg.com/news/features/2023-02-21/hackers-scored-corporate-giants-logins-for-asian-data-centers

Chip company loses USD 250 after ransomware hits supply chain

According to a fiscal report, a hack that occurred at one of Applied Materials Inc.'s supplier will cost the company USD 250 million in lost sales. Executives from the Santa Clara-based company did not disclose the name of the affected supplier or provide further details about the incident.

See the full report here: https://www.bizjournals.com/sanjose/news/2023/02/17/applied-materials-to-see-250m-revenue-hit.html

Warning over new email scams targeting Facebook, Apple users

Two new email phishing scams have been detected targeting Facebook and Apple users. If you receive an email that prompts you to click on a suspicious link or enter your login credentials, do not be deceived.

See the full report here: https://www.foxnews.com/tech/warning-new-email-scams-targeting-facebook-apple-users

Activision confirms data breach exposing employee and game info

Activision confirmed that it suffered a data breach in early December 2022 when hackers gained access to the company's internal systems by tricking an employee with an SMS phishing text. The video game maker stated that the incident did not compromise game source code or player details.

See the full report here: https://www.bleepingcomputer.com/news/security/activision-confirms-data-breach-exposing-employee-and-game-info/

MyloBot Botnet Spreading Rapidly Worldwide: Infecting Over 50,000 Devices Daily

A sophisticated botnet known as MyloBot has compromised thousands of systems, most of them located in India, the United States, Indonesia, and Iran. In 2022, the malware was observed sending extortion emails from hacked endpoints as part of a financially motivated campaign seeking over USD 2,700 in Bitcoin.

See the full report here: https://thehackernews.com/2023/02/mylobot-botnet-spreading-rapidly.html

Tusla to begin contacting 20,000 people whose data was compromised during HSE cyber-attack

The child and family agency in Ireland, Tusla, is to begin contacting around 20,000 people whose data was compromised during the 2021 cyber-attack on the HSE (Health Service Executive). The compromised information includes referrals made to Tusla, reports and correspondence with service users along with personal information on staff. Affected persons will begin to receive letters this week and the process is expected to take about ten months.

See the full report here: https://www.thejournal.ie/tusla-contact-20000-people-data-compromised-during-hse-cyber-attack-5999841-Feb2023/?&web_view=true

Researchers Warn of ReverseRAT Backdoor Targeting Indian Government Agencies

A spear-phishing campaign targeting Indian government entities aims to deploy an updated version of a backdoor called ReverseRAT. The threat group, named SideCopy, is of Pakistani origin and shares overlaps with another actor called Transparent Tribe. The group is named for mimicking the infection chains associated with SideWinder to deliver its malware.

See the full report here: https://thehackernews.com/2023/02/researchers-warn-of-reverserat-backdoor.html?&web_view=true

New espionage-driven threat group targets Middle East telcos

Middle East telecommunications companies are being targeted by a new cyber-espionage campaign by an unknown threat actor. This follows a pattern of similar attacks on telecom organizations in multiple countries over the past few years.

See the full report here: https://www.itp.net/security/new-espionage-driven-threat-group-target-middle-east-telcos

Hackers use fake ChatGPT apps to push Windows, Android malware

Threat actors are exploiting the popularity of OpenAI's ChatGPT chatbot to distribute malware or redirect unsuspecting victims to phishing pages. ChatGPT is exclusively an online-based tool available only at "chat.openai.com" and doesn't offer any mobile or desktop apps for any operating systems at the moment. Therefore, any other apps or sites claiming to be ChatGPT are fraudulent and could potentially scam or infect users with malware.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-fake-chatgpt-apps-to-push-windows-android-malware/

NSA shares guidance on how to secure your home network

The U.S. National Security Agency (NSA) has released a guide to assist remote workers in securing their home networks and in protecting their devices against attacks. The Defense Department's intelligence agency published the guide which featured a lengthy list of suggestions, with a short list of key highlights that encourage teleworkers to ensure their devices and software are up-to-date.

See the full report here: https://www.bleepingcomputer.com/news/security/nsa-shares-guidance-on-how-to-secure-your-home-network/

Hackers now exploit critical Fortinet bug to backdoor servers

Threat actors are targeting Fortinet appliances that are exposed on the Internet using exploits that target CVE-2022-39952. This vulnerability involves unauthenticated file path manipulation in the FortiNAC webserver, which can be exploited to execute remote commands. Fortinet released a security advisory which disclosed that the bug affects several versions of the FortiNAC network access control solution, and allows attackers to execute unauthorized code or commands following successful exploitation.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-now-exploit-critical-fortinet-bug-to-backdoor-servers/

New S1deload Stealer malware hijacks Youtube, Facebook accounts

An ongoing malware campaign is targeting YouTube and Facebook users. It infects their computers with a new information stealer that can hijack their social media accounts and use their devices to mine for cryptocurrency. To avoid infection and prevent your social media accounts from being hijacked, never run executables from unknown sources and always keep your anti-malware software up to date.

See the full report here: https://www.bleepingcomputer.com/news/security/new-s1deload-stealer-malware-hijacks-youtube-facebook-accounts/

VMware warns admins of critical Carbon Black App Control flaw

VMware has released a critical security upgrade to address a vulnerability (CVE-2023-20858) that impacts several versions of Carbon Black App Control. The severity rating of this issue is 9.1 out of 10, and attackers can exploit it to gain access to the underlying operating system. CVE-2023-20858 impacts VMware Carbon Black App Control for Windows version 8.7.7 and older, version 8.8.5 and older, and version 8.9.3 and older. Administrators are recommended to upgrade to versions 8.9.4, 8.8.6, and 8.7.8 or later.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-warns-admins-of-critical-carbon-black-app-control-flaw/

Hydrochasma: New Threat Actor Targets Shipping Companies and Medical Labs in Asia

Shipping companies and medical laboratories in Asia are suspected to have been targeted in an espionage campaign by a previously unknown threat actor named Hydrochasma. While the group's origin and affiliation with known threat actors remain unknown, cybersecurity experts suggest that the group may have an interest in industry verticals involved in COVID-19-related treatments or vaccines.

See the full report here: https://www.bleepingcomputer.com/news/security/hydrochasma-hackers-target-medical-research-labs-shipping-firms/

U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. Successful exploitation of these vulnerabilities could allow a malicious attacker to make unidentified impacts such as authentication bypass, information disclosure, denial-of-service, or bypass IP address authentication.

See the full report here: https://thehackernews.com/2023/02/us-cybersecurity-agency-cisa-adds-three.html

Sensitive U.S. military emails spill online

The U.S. Department of Defense secured an exposed server that was spilling internal U.S. military emails to the open internet for the past two weeks. The exposed server was hosted on Microsoft’s Azure government cloud for Department of Defense customers, which uses servers that are physically separated from other commercial customers and as such can be used to share sensitive but unclassified government data.

See the full report here: https://techcrunch.com/2023/02/21/sensitive-united-states-military-emails-spill-online/

The Underground Economist: Volume 3, Issue 4

Standing Intelligence Requirements

Link to Download

ZeroFox Daily Intelligence Brief: 2023-02-17 - 2023-02-23

ZeroFox Daily Intelligence Brief - February 17, 2023

Key Findings

ZeroFox Daily Intelligence Brief - February 20, 2023

Key Findings

ZeroFox Daily Intelligence Brief - February 21, 2023

Key Findings

ZeroFox Daily Intelligence Brief - February 22, 2023

Key Findings

ZeroFox Daily Intelligence Brief - February 23, 2023

Key Findings

Breach Disclosures: 2023-02-17 - 2023-02-23

Breach Disclosure: PUMA

Breach Disclosure: Push

Breach Disclosure: LocalGiftCards

Breach Disclosure: Joi Gifts

Breach Disclosure: Belletica

Breach Disclosure: Keywordeye

Breach Disclosure: PayPorte

Breach Disclosure: Infikey Technologies

Breach Disclosure: Clifton Park Podiatry

Breach Disclosure: Monarch Specialties

Breach Disclosure: reWASD

Breach Disclosure: Benchmark

Breach Disclosure: GOLDMARK

Breach Disclosure: Blue Cross Blue Shield of Michigan

Breach Disclosure: Choice

Breach Disclosure: National Interagency Fire Center

Breach Disclosure: Teen Services Sonama

Breach Disclosure: Coster Group

Breaking News: 2023-02-17 - 2023-02-23

Hackers backdoor Microsoft IIS servers with new Frebniis malware

Burton Snowboards cancels online orders after cyber incident

CISA warns of Windows and iOS bugs exploited as zero-days

Scandinavian Airlines says cyberattack caused passenger data leak

Microsoft Exchange ProxyShell flaws exploited in new crypto-mining attack

ESXiArgs Ransomware Hits Over 500 New Targets in European Countries

Researchers Hijack Popular NPM Package with Millions of Downloads

Researchers Link SideWinder Group to Dozens of Targeted Attacks in Multiple Countries

Hackers Using Google Ads to Spread FatalRAT Malware Disguised as Popular Apps

Researchers Warn of Critical Security Bugs in Schneider Electric Modicon PLCs

German airport websites down in possible hacker attack

Medibank class action launched after massive hack put private information of millions on dark web

Intel issues patches for SGX vulnerabilities

Atlassian says recent data leak stems from third-party vendor hack

Armenian Entities Hit by New Version of OxtaRAT Spying Tool

New Threat Actor WIP26 Targeting Telecom Service Providers in the Middle East

Fortinet Issues Patches for 40 Flaws Affecting FortiWeb, FortiOS, FortiNAC, and FortiProxy

GoDaddy Discloses Multi-Year Security Breach Causing Malware Installations and Source Code Theft

Experts Warn of RambleOn Android Malware Targeting South Korean Journalists

New Mirai Botnet Variant "V3G4" Exploiting 13 Flaws to Target Linux and IoT Devices

Critical RCE Vulnerability Discovered in ClamAV Open Source Antivirus Software

Europol busts "CEO fraud" gang that stole EUR 38M in a few days

Norwegian police recover USD 5.8 million in crypto from massive Axie Infinity hack

FBI is investigating a cybersecurity incident on its network

HardBit ransomware wants insurance details to set the perfect price

New Stealc malware emerges with a wide set of stealing capabilities

Microsoft Outlook flooded with spam due to broken email filters

Coinbase cyberattack targeted employees with fake SMS alert

New WhiskerSpy malware delivered via trojanized codec installer

Indian Ticketing Platform RailYatri Hacked – 31 Million Impacted

Hackers Start Selling Data Center Logins for Some of World’s Largest Corporations

Chip company loses USD 250 after ransomware hits supply chain

Warning over new email scams targeting Facebook, Apple users

Activision confirms data breach exposing employee and game info

MyloBot Botnet Spreading Rapidly Worldwide: Infecting Over 50,000 Devices Daily

Tusla to begin contacting 20,000 people whose data was compromised during HSE cyber-attack

Researchers Warn of ReverseRAT Backdoor Targeting Indian Government Agencies

New espionage-driven threat group targets Middle East telcos

Hackers use fake ChatGPT apps to push Windows, Android malware

NSA shares guidance on how to secure your home network

Hackers now exploit critical Fortinet bug to backdoor servers

New S1deload Stealer malware hijacks Youtube, Facebook accounts

VMware warns admins of critical Carbon Black App Control flaw

Hydrochasma: New Threat Actor Targets Shipping Companies and Medical Labs in Asia

U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog

Sensitive U.S. military emails spill online