ZeroFox Daily Intelligence Brief - March 1, 2023

ZeroFox Daily Intelligence Brief - March 1, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• CISA Adds ZK Java Framework RCE Bug to Known Exploited Vulnerabilities Catalog
• SCARLETEEL Hackers Use Advanced Cloud Skills to Steal Source Code, Data
• Confidential Bank Documents Found Dumped in Garbage Bin in Perth
• CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks
• London Honeypots Attacked 2,000 Times Per Minute
• Cyberattack on Boston Union Results in USD 6.4 Million Loss

CISA Adds ZK Java Framework RCE Bug to Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency has added a new vulnerability (CVE-2022-36537) to its Known Exploited Vulnerabilities Catalog. This high-severity bug affects several versions of the ZK Framework, which is an open-source Java framework widely used for creating graphical user interfaces for web applications. Threat actors can exploit this flaw in attacks to access sensitive information and perform remote code execution (RCE).

Recommendations:

• U.S. Federal Civilian Executive Branch (FCEB) agencies are mandated to patch this vulnerability by March 20, 2023.
• Considering the wide availability of exploit tools for this bug, all organizations should apply the available patches as soon as possible.
• Follow ZeroFox Intelligence for updates on vulnerabilities and corresponding mitigation measures.

SCARLETEEL Hackers Use Advanced Cloud Skills to Steal Source Code, Data

A sophisticated campaign dubbed SCARLETEEL has been observed targeting public-facing web apps running in containers to breach cloud services and deploy cryptominers. The operation has displayed significant prowess in AWS cloud mechanics as it intrudes deep into the victim’s cloud infrastructure—leading to concerns that the cryptominers might just be a red herring, with the real target being sensitive company data.

Recommendations:

• System architects should encourage the use of Instance Metadata Service Version 2 (IMDS v2), rather than IMDS v1, to guard against unauthorized metadata access.
• Basic information and system-security hygiene—like adopting principles of least privilege, periodically reviewing old permissions, and regularly deploying patches on vulnerable software—goes a long way in preventing such attacks.
• Audit the access to resources that might contain sensitive information, like Lambda functions and keys.

Confidential Bank Documents Found Dumped in Garbage Bin in Perth

Australian multinational banking and financial services company ANZ suffered a data breach, with pages of banking information discovered by commuters on the roadside in a suburb of Perth. The pages contained sensitive and personally identifiable information (PII), including names, email addresses, phone numbers, mortgage loan rates, transaction information, and internal banking procedures. The documents were reportedly discarded after a local ANZ branch shut down.

Recommendations:

• ANZ account holders and those that have conducted business with the bank should be wary of any communication requesting personal or financial information, as scammers may use the exposed data to conduct follow-on attacks.
• Consider using identity-protection services, like those provided by IDX, to protect your data from misuse.
• Considering the AUD 50 million fine on Australian companies for serious data breaches, organizations should establish, audit, and enforce standard operating procedures (SOPs) for sensitive document disposal.

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks

CISA has released a cybersecurity advisory to provide network defenders of critical infrastructure organizations proactive steps to reduce the threat from malicious cyber actors. This advisory is based on a red team assessment (RTA) conducted by CISA in 2022 at the request of a large critical infrastructure organization with multiple geographically-separated sites. This advisory details the red team’s tactics, techniques, and procedures (TTPs) and key findings to mitigate similar attacks from adversaries.

Recommendations:

• Establish a security baseline of normal network activity; tune network and host-based appliances to detect anomalous behavior.
• Conduct regular assessments to ensure appropriate procedures are created and can be followed by security staff and end users.
• Enforce phishing-resistant multi-factor authentication (MFA) to the greatest extent possible.

London Honeypots Attacked 2,000 Times Per Minute

Security experts have issued a warning about the surge in cyberattacks on remote workers in London, recording 91 million threats over a 28-day period in January 2023. In a project to determine the scope of this threat, cyber insurance and security provider Insurer Coalition deployed honeypots to determine the level of cyber threats to businesses in the region. The study identified 101,000 different threat actors, with the majority attempting to hijack remote desktop connections. Russia was the largest single source of attacks, followed by Bulgaria, Monaco, and Panama. However, many threat actors conceal their true location using VPNs routed through other countries.The research revealed that home working has greatly expanded the corporate attack surface.

Recommendations:

• Companies should assess and update their security protocols to account for the increased attack surface as a result of remote work.
• Remote workers should be trained on ensuring confidentiality and security of their systems. They should change their home router’s default password to a unique and strong one. Remote access to routers should be disabled.
• Security teams should regularly monitor whether employees working from their personal devices have deployed all available security patches. Employees should be trained to identify phishing emails and report them to security.
• Follow ZeroFox Intelligence for guidelines and advisories for emerging threats.

Cyberattack on Boston Union Results in USD 6.4 Million Loss

A cyber attack against the union health fund of Pipefitters Local 537, a Boston-based labor union, resulted in a loss of USD 6.4 million, but a forensic investigation indicates that members’ personal information was not lost or stolen. Law enforcement is “optimistic” they will be able to return the majority of the lost funds, and the health fund is also insured. The attack was reportedly conducted via social engineering versus any type of hack or breach; there are indications a fraudulent wire request was made—and honored—resulting in the loss of funds.

Recommendations:

• Individuals should be mindful of the amount of personal data they put out online and on social media, as these are easy places for cybercriminals to gather information and locate potential targets.
• Always use a secondary confirmation method to ensure legitimacy before granting wire transfer requests.