ZeroFox Daily Intelligence Brief - February 28, 2023

ZeroFox Daily Intelligence Brief - February 28, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• U.S. Marshals Service Suffers Security Breach That Compromises Sensitive Information
• LastPass Says Employee’s Home Computer was Hacked and Corporate Vault Taken
• Thousands of Texan Drivers of Asian Origin Targeted in License Breach
• MedusaLocker Ransomware Leveraged In Healthcare Cyberattacks

U.S. Marshals Service Suffers Security Breach That Compromises Sensitive Information

A data breach at the U.S. Marshals Service (USMS) exposed law enforcement sensitive information that included returns from legal process, administrative information, and personally identifiable information (PII) relating to subjects of USMS investigations, third parties, and certain USMS employees. A ransomware and data-exfiltration incident at a standalone USMS system, which has been disconnected from the network, led to this breach. The breached database reportedly had no connection to the Witness Security Program and therefore should not pose any significant threat to those involved in witness protection.

Recommendations:

• USMS employees, affiliates, and investigation subjects should be cautious regarding any communications related to this breach, particularly those that seek additional PII, as these could be follow-on attacks by threat actors.
• Identity-protection services, such as those provided by IDX, could help protect against misuse of leaked information.
• Organizations should periodically audit their cybersecurity posture (including vulnerability management and authentication policies) to ensure they are best-prepared to guard against emerging threats.

LastPass Says Employee’s Home Computer was Hacked and Corporate Vault Taken

Password manager LastPass has disclosed details of how a threat actor leveraged information stolen in an August 2022 data breach and a vulnerability in a third-party media software package to conduct the much-publicized December 2022 data breach. The threat actor stole valid credentials from a senior DevOps engineer to access a LastPass corporate vault. Because valid credentials were used, the company’s security apparatus was unable to distinguish the threat actor’s activity from normal operations, leading to the theft of confidential information for two months.

Recommendations:

• LastPass users should update all of their passwords, including the vault master password, to guard against unauthorized activity.
• Ensure that your organization sets up enhanced detection and response processes to mitigate such incidents in the event that any employee credentials are compromised.
• Employees should guard against credential theft by never installing unauthorized software, even on their home computers, and remaining vigilant against attacks that could leverage multi-factor authentication (MFA) fatigue.

Thousands of Texan Drivers of Asian Origin Targeted in License Breach

A security lapse has resulted in the state of Texas shipping thousands of Texas driver’s licenses to an international organized crime group based in New York; at least 3,000 Texans have been affected. The gang scoured leak packages on the dark web for PII (including potential answers to security questions) of drivers of Asian origin and used this information to request replacement IDs through Texas’ state website. The criminals specifically targeted Asians of various backgrounds for “look-alikes” of undocumented Chinese nationals already living illegally in the United States.

Recommendations:

• Texans who may be a victim of the scam should contact local law enforcement or file a report with the state’s iWatch system.
• Dark web data scanning and collection services, including those offered by ZeroFox, can help monitor the stolen data being sold or shared in the deep and dark web.
• Organizations should monitor their security apparatus to ensure holistic and seamless coverage, rather than cyber and other security measures working in silos.

MedusaLocker Ransomware Leveraged In Healthcare Cyberattacks

The U.S. Health Sector Cybersecurity Coordination Center (HC3) has issued an advisory warning healthcare organizations they may be targeted by the MedusaLocker ransomware operation. Since its emergence in late 2019, this ransomware operation has primarily focused on healthcare organizations—in contrast to some other threat groups’ philosophy of not targeting medical institutions. The advisory details the operation’s tactics, techniques, and procedures (TTPs), noting that the group operates under a Ransomware-as-a-Service (RaaS) model, takes advantage of Remote Desktop Protocol (RDP) vulnerabilities, and typically propagates throughout a network via a batch file that executes a PowerShell script.

Recommendations:

• Healthcare organizations should ensure that their security policy requires all RDP instances to have multiple levels of access controls, prioritizes patching RDP vulnerabilities, enforces the creation of strong passwords and MFA, and monitors RDP utilization.
• Organizations should consider using a VPN, disabling hyperlinks in received emails, and maintaining a strong incident response plan.
• For details on the group’s operations, refer to the joint advisory issued by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Department of the Treasury, and the Financial Crimes Enforcement Network (FinCEN) in August 2022.