ZeroFox Daily Intelligence Brief - March 8, 2023

ZeroFox Daily Intelligence Brief - March 8, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Cyber Attack at Indonesian Unit of Commonwealth Bank of Australia
• 60 Vulnerabilities, Including Two Critical-Severity Remote Code Execution Bugs, Fixed in Android March 2023 Security Updates
• About 160 GB of Confidential Data Stolen from Acer
• Data of 15,298 Northeast Surgical Group Patients’ Breached

Cyber Attack at Indonesian Unit of Commonwealth Bank of Australia

The Commonwealth Bank of Australia has disclosed that its Indonesian unit, the PT Bank Commonwealth (PTBC), has suffered a cyberattack involving unauthorized access of a web-based software application used for project management. The bank stated that its systems are segregated from PTBC’s and that all operations are continuing as normal. The ZeroFox Intelligence Collections team has identified claims that Telegram channel “0x_dump” is in possession of a database exfiltrated in this breach, but the threat actors have refused to provide a free sample for verification. The channel admins claim that the breach package contains 162 million rows of user data, including account holders’ names and contact details, account and transaction information, credit card details, and other sensitive financial information. 0x_dump has quoted a price of USD 620,000 for the full database and USD 8,000 for a sample containing two million records.

Recommendations:

• Deep and dark web scanning services, such as those provided by ZeroFox, can help monitor user data being shared in underground networks.
• Past and present account holders of PTBC should keep a close eye on their bank accounts’ transaction details and report any anomaly to the bank. They should also avoid revealing any sensitive information to people contacting them and claiming to be bank representatives, as threat actors often conduct follow-on attacks leveraging financial data exposed in breaches.

60 Vulnerabilities, Including Two Critical-Severity Remote Code Execution Bugs, Fixed in Android March 2023 Security Updates

The March 2023 security updates for Android fixes 60 bugs in total, including two critical-severity bugs (CVE-2023-20951 and CVE-2023-20954). The most severe of the bugs patched in these updates affects the System component and could lead to remote code execution (RCE) with no additional execution privileges or user interaction needed. The security updates are available in two separate security patch levels: 2023-03-01 and 2023-03-05.

Recommendations:

• Android users should check for available security updates in their system settings and apply the latest available patches to secure their devices.
• Android urges its partners to bundle the fixes for all issues they are addressing in a single update.
• Follow ZeroFox Intelligence for more guidelines and advisories.

About 160 GB of Confidential Data Stolen from Acer

Close to 160 GB of data was stolen from Taiwanese computer giant Acer in mid-February 2023, but the company says that the intrusion has not exposed any user data. A threat actor has now posted a data package for sale on a popular forum that purportedly contains 3,000 files stolen in the breach, including technical manuals; software tools; backend infrastructure details; product model documentation for phones, tablets, and laptops; BIOS images; ROM files; ISO files; and replacement digital product keys (RDPK). The threat actor also shared screen shots of technical schematics for the Acer V206HQL display, documents, BIOS definitions, and other confidential documents and stated that they would sell the entire dataset to the highest bidder in return for payment in the private cryptocurrency Monero (XMR). Acer was previously breached in March 2021 by the REvil Ransomware gang and in October 2021 by hacking group Desorden.

Recommendations:

• Organizations should conduct regular audits of their security posture, including monitoring for regular deployment of software updates and patches, control of remote access, and use of unique passwords and their periodic change, as well as multi-factor (MFA) authentication. Access granted to old, inactive profiles should be periodically revoked.
• Organizations should follow the principle of minimum privilege in information access so that a breach of one particular system can be contained to a limited space in order to minimize the exposure of confidential data.

Data of 15,298 Northeast Surgical Group Patients’ Breached

The data of 15,298 patients of Northeast Surgical Group (NESG) was breached by the BianLian ransomware operation. Though security researchers notified NESG the data was leaked on the threat actors’ BreachForums account in early February, NESG did not notify affected patients of the breach until March 6. NESG stated that it detected suspicious activity in its network on January 8, 2023, and engaged a firm to investigate. The investigation concluded on February 13, 2023, and revealed that patients’ personal information—including names, addresses, Social Security numbers, dates of birth, and medical and treatment information—was leaked and may have also been dumped.

Recommendations:

• Affected patients should enroll in the 12 months of free credit monitoring services being provided by NSEG.
• NSEG patients should be alert for any signs of fraudulent use of their personal information, including attempts to open new bank accounts or credit cards as well as any unauthorized medical claims, as these could be follow-on attacks by threat actors using the leaked data.