ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - March 6, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

Ransomware Group Threatens to Leak Sensitive Patient Data, Including Photographs of Unclothed Female Patients, to Coerce Healthcare Group to Pay Ransom
Australian Pension Funds Seek More Time to Process Funds to Avoid Cyberattacks
FTC Says Online Counseling Service BetterHelp Pushed People into Handing Over Health Information – and Broke Its Privacy Promises
Mexican Banks Targeted by New Malware Strain FiXS
Play Ransomware Gang Leaks 10 GB of Data of Citizens of Oakland, California

Ransomware Group Threatens to Leak Sensitive Patient Data, Including Photographs of Unclothed Female Patients, to Coerce Healthcare Group to Pay Ransom

ZeroFox Intelligence identified that Pennsylvania-based Lehigh Valley Health Network was hit by an ALPHV ransomware attack last month, but the healthcare network refused to pay the ransom demanded. Now, stooping to a deplorably new low, the threat actors have begun leaking photographs of unclothed female breast cancer patients as well as confidential medical documents in a bid to force the Lehigh Valley Health Network to pay the ransom. The ransomware group claims to be in possession of sensitive customer information, including passport details, medical data and questionnaires, and photographs, and has released some samples on its leak site.

Recommendations:

The network security personnel defending healthcare providers should devise and enforce a robust security policy involving regular deployment of software updates and patches, monitoring and control of remote access, use of unique passwords and their periodic change, and multi-factor (MFA) authentication.
Hospitals should conduct periodic training and awareness sessions for their employees. Keeping in mind several attacks in the past year that exploited people’s MFA fatigue, organizations should also highlight the importance of the seemingly-inconvenient security measure in these sessions.
Patients who are undergoing or have undergone treatment or conducted tests in institutions linked with Lehigh Valley Health Network should be wary of unexpected contact claiming to be from hospital employees, as cybercriminals could attempt follow-on attacks using the leaked data.

Australian Pension Funds Seek More Time to Process Funds to Avoid Cyberattacks

Amid concerns that threat actors are targeting Australia’s superannuation sector, which is worth AUD 3.3 trillion, pension fund managers have appealed to the Australian Prudential Regulation Authority to increase the time allocated to process requests for transfer of pensioners’ funds by modifying an existing three-day rule. Cybersecurity concerns in Australia have escalated after incidents of large-scale data breach were reported by various organizations, including telecommunications company Optus. Spokespeople from the country’s largest funds have stated that many hackers impersonate legitimate members, and the existing three-day rule does not give them enough time for them to complete necessary fraud and identity checks.

Recommendation:

Those with funds in Australian pension funds should be aware it may soon take more than three days to process transfer requests and allow more time for the movement of their funds. Members of the superannuation systems must be extremely careful while using their personal credentials online. They should never reveal these credentials to anyone asking for them via phone calls or SMS.

FTC Says Online Counseling Service BetterHelp Pushed People into Handing Over Health Information – and Broke Its Privacy Promises

The U.S. Federal Trade Commission (FTC) has proposed a USD 7.8 million settlement with online counseling service BetterHelp for partial refunds to BetterHelp customers stemming from BetterHelp’s sharing of sensitive mental health data with third-party advertisers and marketers, including Facebook and Snapchat. The FTC reported that BetterHelp engaged in bad data-handling practices, including sharing information from those who visited its site or used its apps, regardless of whether they signed up for counseling services. The FTC states that BetterHelp's practices are illegal and pose risks to vulnerable individuals, worsening their mental health condition. BetterHelp must now gain user consent, introduce safeguards, and limit the retention of sensitive information.Though the company agreed to the amount specified by the FTC, it did not admit to any wrongdoing.

Recommendations:

Users are strongly advised to carefully review the privacy terms and accompanying documentation on websites they visit to understand how companies or services manage and preserve their data, as well as said site’s policies regarding the sale of collected data to third parties.
Health-related companies are urged to obtain explicit consent from users prior to sharing their data with any third party for any purpose, to implement robust measures to safeguard consumer health data, and adhere to retention period guidelines for sensitive health information.

Mexican Banks Targeted by New Malware Strain FiXS

FiXS, a new ATM malware strain, has been targeting Mexican banks since the beginning of February 2023. The new strain can reportedly dispense money 30 minutes after the last ATM reboot by leveraging the Windows GetTickCount API. This ATM malware is vendor-agnostic and is capable of infecting any teller machine that supports CEN/XFS (eXtensions for Financial Services). FiXS is similar to ATM malware codenamed Ploutus that enabled cybercriminals to extract cash from ATMs by using external keyboards or by sending an SMS message.

Recommendations

In the short term, banking customers in Mexico should consider entering the bank and using window tellers versus ATM machines to protect their accounts from fraudulent, malware-enabled withdrawals.
Follow ZeroFox Intelligence to remain up-to-date on emerging threats.

Play Ransomware Gang Leaks 10 GB of Data of Citizens of Oakland, California

The Play ransomware gang has leaked a 10 GB multi-part archive containing confidential documents, including IDs, passports, and employee information from the City of Oakland, California. The City of Oakland has stated that an unauthorized third party has acquired certain files and has intentions to release the information to the public; it will monitor the situation and notify individuals whose personal data has been exposed, in accordance with the law. The city suffered a ransomware attack on February 8, 2023, and later declared a local state of emergency to facilitate a proper response to the incident.

Recommendations

The City of Oakland should consider utilizing data-protection services, such as those provided by ZeroFox’s IDX, to protect the citizens’ exposed data from abuse in attacks.
Oakland citizens should be wary of threat actors and scammers using their personal data and report any suspicious communication to the authorities, as scammers typically conduct follow-on attacks using leaked information.