ZeroFox Daily Intelligence Brief - March 3, 2023

ZeroFox Daily Intelligence Brief - March 3, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Hatch Bank Says Hackers Used Fortra Bug to Steal 140,000 Customer Social Security Numbers
• CISA Releases Five Industrial Control Systems Advisories
• #StopRansomware: Royal Ransomware
• Chick-fil-A Confirms Accounts Hacked in Months-Long "Automated" Attack

Hatch Bank Says Hackers Used Fortra Bug to Steal 140,000 Customer Social Security Numbers

Hatch Bank, a digital-first bank that provides infrastructure for fintech companies offering their own brand credit cards, confirmed that hackers exploited a zero-day vulnerability in the Fortra GoAnywhere file transfer software used by the bank to gain access to thousands of customers’ Social Security numbers. The attack has been attributed to the Clop ransomware gang. Hatch Bank is the second known victim; a large U.S. healthcare company publicly disclosed it had fallen victim to the same vulnerability in mid-February.

Recommendations:

• Affected Hatch Bank customers should enroll in the free credit monitoring services being offered by the bank in order to stay informed about potential misuse of their Social Security numbers.
• System administrators should deploy the latest available patches for the GoAnywhere software to protect against the exploitation of the zero-day vulnerability.
• Consider using ZeroFox to monitor any of the stolen data packages being sold or shared in the deep and dark web.

CISA Releases Five Industrial Control Systems Advisories

The Cybersecurity and Infrastructure Security Agency (CISA) has released five advisories detailing the security issues, vulnerabilities, and exploits associated with industrial control systems (ICS). Threat actors, including those aligned with nation-states, have been increasingly targeting ICS in water treatment plants, oil refineries, power grids, and other critical infrastructure targets. The cyber war accompanying the ongoing Russia-Ukraine conflict has seen adversarial groups targeting supervisory control and data acquisition (SCADA) and ICS in both countries, highlighting the need for appropriate protective measures. The advisories recently released by CISA pertain to Mitsubishi Electric MELSEC Series, Baicells Nova, Rittal CMC III Access systems, Medtronic Micro Clinician and InterStim Apps, and Mitsubishi Electric Factory Automation Engineering Products (Update J).

Recommendations:

• Restrict physical access to the areas where ICS controls are located via secure access cards and other appropriate physical-security measures.
• Minimize ICS’ internet exposure, using firewalls and virtual private networks (VPN), and deploy unidirectional gateways between networks where possible.
• Block access from untrusted networks and hosts; use IP filters to ban known malicious domains.
• Employees should be trained to avoid clicking on links in suspicious or unsolicited emails and SMS messages. Periodically conduct social-engineering training to raise awareness of these risks.
• Follow ZeroFox Intelligence to remain updated on emerging threats.

#StopRansomware: Royal Ransomware

The Federal Bureau of Investigation (FBI) and CISA have released a joint advisory that describes the tactics, techniques, and procedures (TTPs) of the Royal ransomware group and highlights the corresponding indicators of compromise (IOCs). This operation has targeted organizations from diverse industries across the world in the past six months—disabling antivirus software, exfiltrating data, and encrypting target systems with a customized encryptor. The campaign operators gain initial access to the target networks via phishing attacks in a majority of cases, followed by Remote Desktop Protocol (RDP) compromise, exploiting public-facing applications, and harvesting VPN credentials from stealer logs.

Recommendations:

• Considering the attack vectors leveraged by the threat actors in this campaign, organizations should train employees to recognize and report phishing attempts and enforce strict multi-factor authentication (MFA) policies.
• Deep and dark web scanning services, like those provided by ZeroFox, can help monitor compromised credentials being shared in underground forums and marketplaces.

Chick-fil-A Confirms Accounts Hacked in Months-Long "Automated" Attack

Threat actors have breached the customer accounts of American fast food chain Chick-fil-A, gaining access to account holders’ names, email addresses, Chick-fil-A One membership numbers and mobile pay numbers, QR codes, masked credit/debit card numbers, and account balances. There are reports that stolen accounts have been sold online for USD 2 to USD 200; the pricing varied based on account balances and linked payment methods. Chick-fil-A has filed a notice with the California Attorney General indicating the company suffered a months-long credential stuffing attack between December 18, 2022, and February 12, 2023. In response to the attack, Chick-fil-A has forced customers to reset passwords, frozen funds loaded on accounts, and removed stored payment details. The company has also restored account balances and added rewards on impacted accounts.

Recommendations:

• Impacted Chick-fil-A customers should immediately reset their passwords for all accounts where they use the same or similar passwords and use password managers going forward to increase password security.
• Impacted customers should be wary of unsolicited emails or text messages, particularly those that seek personal data or claim to be concerned with “account security,” as these could be follow-on attacks by threat actors using the breached data.
• Personal brand and data protection services, such as those provided by IDX, can help protect Chick-fil-A customers from unauthorized use of their personal information.