ZeroFox Daily Intelligence Brief - February 27, 2023

ZeroFox Daily Intelligence Brief - February 27, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Dish Network Goes Offline After Likely Cyberattack, Employees Cut Off
• News Corp Says State Hackers Were on Its Network for Two Years
• ChromeLoader Campaign Uses VHD Files Disguised as Cracked Games and Pirated Software

Dish Network Goes Offline After Likely Cyberattack, Employees Cut Off

A suspected cyberattack has targeted American television and satellite broadcaster Dish Network, leading to widespread outages in the company’s services. The outage has affected various networks and websites operated by the company, including wireless carrier Boost Mobile. Customer support has also been affected, and remote employees are reportedly unable to log in. The company has not yet issued a statement on the nature, impact, and scope of the incident.

Recommendations:

• Follow ZeroFox Intelligence for further updates.
• Be cautious if you receive any communication (email, SMS, and/or phone call) claiming to be from Dish Network, as these could be follow-on attacks by threat actors utilizing breached data. Do not provide any personal information requested via any unsolicited communication.

News Corp Says State Hackers Were on Its Network for Two Years

Media giant News Corp has informed certain employees that threat actors potentially accessed their personal and health data for a two-year period from 2020 to 2022. The attackers were able to access sensitive and personally identifiable information—names, dates of birth, Social Security numbers, passport and driver's license numbers, financial account information, and health insurance details—belonging to some employees of The Wall Street Journal, the New York Post, and other organizations under the News Corp umbrella.

Recommendations:

• Should your organization be impacted by this cyber event, engage with the ZeroFox DarkOps team by utilizing the RFI button in the ZeroFox platform.
• Deep and dark web scanning services could alert employees in the event that their personal details are shared on underground forums.
• It is quite common for threat actors to contact people who have recently suffered a cyberattack and masquerade as law-enforcement officials. So, affected employees should be cautious of suspicious individuals claiming to help restore their data and seeking more information, usually login credentials and other confidential information, in the name of “verification.”

ChromeLoader Campaign Uses VHD Files Disguised as Cracked Games and Pirated Software

Threat actors are using VHD files (file formats representing a virtual hard disk drive) masquerading as pirated/cracked versions of popular games, such as Elden Ring, Minecraft, Need for Speed, and Call of Duty, to hoodwink victims into executing malware-ridden files. These files install the ChromeLoader extension, which directs the user from legitimate searches to malvertising sites. The adware extension is also known to collect user data and modify browser settings.

Recommendations:

• Users should refrain from downloading cracked or pirated versions of gaming and other software, as they are quite likely to be laced with malware.
• Never run any executable file on your systems unless you can trust its source.
• Access the ZeroFox platform’s Intelligence Search interface to investigate Indicators of Compromise (IOCs) and metadata related to Malware and Ransomware.