ZeroFox Daily Intelligence Brief - March 7, 2023

ZeroFox Daily Intelligence Brief - March 7, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• DrayTek VPN Routers Hacked with New Malware to Steal Data
• Microsoft and MITRE Developed a Tool to Prepare Security Teams for Attacks on Machine Learning Systems
• Core Members of DoppelPaymer Ransomware Targeted in a Joint Operation
• Researchers Have Found Loopholes in Google Cloud Platform That Can Attract Data Exfiltration Attacks
• HDFC Bank Denies Data Leak Claim

DrayTek VPN Routers Hacked with New Malware to Steal Data

A new hacking campaign called “Hiatus” has been discovered that targets DrayTek Vigor router models used by small to medium-size organizations for remote connectivity to corporate networks. The hackers use a malicious program called "HiatusRAT" to steal data from the router, including email and FTP credentials. They then build a covert proxy network to hide their activity. Cybersecurity analysts have found at least a hundred businesses that have been infected by the HiatusRAT malware, mainly in Europe, North America, and South America.

Recommendations:

• It is not known how the DrayTek routers were initially compromised. DrayTek Vigor router users should regularly monitor, maintain, and install patches on the devices, and outdated models or firmware should be upgraded to safeguard against known vulnerabilities.
• Users should enable encryption/cryptographic protocols to protect data that is sent through networks.

Microsoft and MITRE Developed a Tool to Prepare Security Teams for Attacks on Machine Learning Systems

Microsoft and MITRE have developed a new plug-in to help cybersecurity professionals strengthen their defenses against attacks on machine learning (ML) systems. The Arsenal tool integrates various open-source software tools to emulate attacks on ML systems without requiring an in-depth background in ML or Artificial Intelligence (AI). It implements tactics and techniques from the MITRE ATLAS framework and has been released in partnership with Microsoft's Counterfit team as an automated adversarial attack library. The collaboration is part of MITRE's efforts to address issues of trust, transparency, and fairness in ML and AI systems. The Arsenal plug-in enables security professionals to discover novel vulnerabilities within an end-to-end ML workflow and develop countermeasures to prevent exploitation of ML systems deployed in the real world. These tools and collaborations highlight the potential benefits of AI, as well as the need for the security community to work together to address its risks.

Recommendations:

• Established security protocols should be adopted to ensure the security of AI/ML systems. This involves creating a sandboxed environment for running ML models using containers and virtualization technology, implementing network monitoring measures, and setting up firewalls.
• ML algorithms need to be able to distinguish between maliciously-introduced data and "Black Swan" events to ensure that learning models are not vulnerable to manipulation by attackers and trolls. This can be achieved by filtering training data that negatively impacts goals.
• AI/ML must identify and safeguard sensitive information. Rich user experiences in AI require vast amounts of raw data to train on, so “over-sharing” by customers must be accounted for.

Core Members of DoppelPaymer Ransomware Targeted in a Joint Operation

Two key members of the DoppelPaymer ransomware group were targeted in an operation conducted by Europol. A raid was carried out on the house of a German national, and an Ukranian national was interrogated. Europol experts seized electronic equipment to obtain forensic evidence, cross-checked operational information, and assisted with analysis, cryptotracing, and forensic work. The DoppelPaymer ransomware operation surfaced in 2019, with a primary focus on targeting critical infrastructure organizations and large companies. Between May 2019 and March 2021, victims in the United States paid approximately EUR 40 million in ransom. German authorities have confirmed 37 cases of extortion related to the DoppelPaymer ransomware operation.

Recommendations:

• Companies handling critical infrastructure and other large entities should adopt phishing-resistant multi-factor authentication (MFA) where possible.
• Follow ZeroFox Intelligence for guidelines and advisories for emerging threats.

Researchers Have Found Loopholes in Google Cloud Platform That Can Attract Data Exfiltration Attacks

A new study has revealed that Google Cloud Platform (GCP) has vulnerabilities that could attract malicious actors to exfiltrate sensitive data and gain control of an Identity and Access Management (IAM) entity in the targeted organization by using social engineering methods. The reason for the loophole is GCP's storage access logs, which do not provide adequate transparency to potential file access and read events. Instead, they group all of them as a single "Object Get" activity. This event is used for various purposes such as reading, downloading, copying files, and reading file metadata. This lack of distinction could enable a threat actor to harvest sensitive data without being detected, as there is no way to distinguish between malicious and legitimate user activity.

Recommendations:

• Administrators can utilize VPC Service Controls to define a service perimeter around resources of Google-managed services to control communication to and between those services.
• Organization restriction headers enable customers to restrict cloud resource requests made from their environments to only operate resources owned by select organizations.
• Restrict access to storage resources and consider removing read/transfer permissions.

HDFC Bank Denies Data Leak Claim

India’s largest private banking institute, HDFC Bank, denied a social media claim that there has been a breach in its user database. An anonymous user claimed to have leaked a 7 GB database of HDFC Bank customer information, which contained sensitive data like full name, date of birth, age, phone number, email address, residential address, employment information, transaction details, and several other fields of information. The alleged leak included data logs ranging from May 2022 to February 2023. In December 2020, the Reserve Bank of India directed HDFC Bank to temporarily halt all digital banking launches and stop issuing new cards to customers after the bank experienced multiple technical glitches.

Recommendations:

• HDFC account holders and those that have conducted business with the bank should be wary of any communication requesting personal or financial information, as scammers may use the exposed data to conduct follow-on attacks.
• Account holders should consider using identity-protection services, like those provided by ZeroFox’s IDX services, to protect their data from misuse.