ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - February 24, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

European Commission Bans TikTok on Its Corporate Devices
CISA Urges Increased Vigilance One Year After Russia's Invasion of Ukraine
New FTC Data Show Consumers Reported Losing Nearly USD 8.8 Billion to Scams in 2022
TELUS Investigating Leak of Stolen Source Code, Employee Data
Multiple Lawsuits Filed Against Regal Medical Group Over Ransomware Attack

European Commission Bans TikTok on Its Corporate Devices

The European Commission has banned the use of TikTok on its corporate devices and on personal devices enrolled in the Commission mobile device service, citing cybersecurity concerns. The ban, which goes into effect next month, follows similar restrictions on the use of TikTok on work-issued devices for U.S. federal employees.

Recommendations:

Follow ZeroFox Intelligence for the latest geopolitical and cybersecurity updates.
Consider the privacy risks associated with TikTok and whether it is worth having the app installed on your devices.
If you elect to use TikTok, do not give the app permission to access your phone; opt out of personalized ads; create a private profile versus a public one; and ensure no sensitive or personal data is listed in account bios.

CISA Urges Increased Vigilance One Year After Russia's Invasion of Ukraine

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a cautionary advisory about potential disruptive and defacement attacks against U.S. and European websites. CISA urges increased cyber vigilance around February 24, 2023, which marks the one-year anniversary of Russia's 2022 invasion of Ukraine.

Recommendation:

Implement the CISA guidelines provided in the following resources: DDoS Attack Guidance for Organizations and Federal Agencies Shields Up webpage, which includes guidance on: Increasing organizational vigilance Implementing cybersecurity best practices Increasing resilience and preparing for rapid response Lowering the threshold for threat and information sharing

New FTC Data Show Consumers Reported Losing Nearly USD 8.8 Billion to Scams in 2022

The Federal Trade Commission (FTC) recently released data indicating that consumers lost nearly USD 8.8 billion to fraud in 2022—an increase of more than 30 percent over last year. The report indicates consumers lost the most money to investment scams in 2022 (USD 3.8 billion), followed by imposter scams (USD 2.6 billion). The FTC received fraud reports from at least 2.4 million consumers in 2022 related to imposter scams; online shopping scams; prizes, and sweepstakes, and lotteries; investment-related reports; and business and job opportunities.

Recommendations:

Consumers can follow the FTC on social media to learn more about fraud, scams, and bad business practices.
Remember that online investment returns, relationships, sales prices, and dream jobs that sound “too good to be true” likely are.
Conduct a Person of Interest Investigation into fraudsters to establish identity, determine motivation, and assess reputation to help inform the appropriate course of action. You can request a Person of Interest Investigation via the RFI button in the ZeroFox platform.

TELUS Investigating Leak of Stolen Source Code, Employee Data

Canada’s second-largest telecommunications company, TELUS, is investigating a potential data breach after a threat actor offered private source code of TELUS repositories and employee payroll records for sale. Although TELUS has not yet found evidence of corporate or retail customer data being stolen, a sample data set posted on a data breach forum appears to contain valid names and email addresses corresponding to present-day TELUS employees, particularly software developers and technical staff. The seller is also claiming that the stolen source code contains the company's "sim-swap-api" that will purportedly enable adversaries to carry out SIM swap attacks.

Recommendations:

TELUS employees and customers should look out for any phishing or scam messaging targeting them and should refrain from responding to unknown or unexpected emails, texts, or telephone communications.
Utilize the ZeroFox Platform’s Intelligence news feed to receive the latest news and information related to this potential breach.

Multiple Lawsuits Filed Against Regal Medical Group Over Ransomware Attack

Several class action lawsuits have been filed against one of southern California’s largest physician-led medical groups, Regal Medical Group, and its affiliated healthcare providers following a February 1, 2023, announcement that the protected health information (PHI) of approximately 3.3 million patients may have been stolen in a December 2022 ransomware attack. A forensic investigation has indicated the attack started on or before December 1, 2022, and that the PHI extracted from Regal Medical Group’s servers included names, phone numbers, addresses, dates of birth, diagnosis and treatment information, laboratory test results, prescription data, radiology reports, health plan member numbers, and Social Security numbers. The lawsuits focus on the breadth of the data accessed, which can be misused in multiple ways, and the delay in notifying patients about the breach, which did not begin until February 1, 2023.

Recommendations:

Affected patients should enroll in the12-month credit monitoring service membership offered by Regal Medical Group.
Regal Medical Group patients should closely review their Explanation of Benefits summaries and immediately report any fraudulent use of their health plan coverage.
Regal Medical Group patients should be wary of any unexpected contact from anyone claiming to be associated with their healthcare providers, particularly those that seek payment or additional personal data. as these could be follow-on attacks using the leaked PHI.