Threat Intelligence Bulletin: 03/03/2023

ZeroFox Intelligence Brief - Synthetic Media: A Primer

In this brief, ZeroFox Intelligence will provide an overview of the six segments of synthetic media with context, current threats, and recommendations for countering the threats presented by synthetic media.

Report: https://cloud.zerofox.com/intelligence/advisories/19847

ZeroFox Intelligence Flash Report - Swatting Attacks Wreaking Havoc on Executives and Organizations

Report: https://cloud.zerofox.com/intelligence/advisories/19856

The Underground Economist: Volume 3, Issue 5

The Underground Economist is an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of March 3, 2023.

Report: https://cloud.zerofox.com/intelligence/advisories/19869

ZeroFox Intelligence Profile - Updates on Black Basta Ransomware

In this profile report, ZeroFox Intelligence provides updates on Black Basta ransomware, including additional IOCs and activity since the previous profile report was disseminated in August 2022, and the group's significant feature updates in November 2022.

Report: https://cloud.zerofox.com/intelligence/advisories/19871

ZeroFox Daily Intelligence Brief: 03/03/2023 - 03/09/2023

ZeroFox Daily Intelligence Brief - March 6, 2023

Key Findings

Ransomware Group Threatens to Leak Sensitive Patient Data, Including Photographs of Unclothed Female Patients, to Coerce Healthcare Group to Pay Ransom
Australian Pension Funds Seek More Time to Process Funds to Avoid Cyberattacks
FTC Says Online Counseling Service BetterHelp Pushed People into Handing Over Health Information – and Broke Its Privacy Promises
Mexican Banks Targeted by New Malware Strain FiXS
Play Ransomware Gang Leaks 10 GB of Data of Citizens of Oakland, California

Report: https://cloud.zerofox.com/intelligence/advisories/19846

ZeroFox Daily Intelligence Brief - March 7, 2023

Key Findings

DrayTek VPN Routers Hacked with New Malware to Steal Data
Microsoft and MITRE Developed a Tool to Prepare Security Teams for Attacks on Machine Learning Systems
Core Members of DoppelPaymer Ransomware Targeted in a Joint Operation
Researchers Have Found Loopholes in Google Cloud Platform That Can Attract Data Exfiltration Attacks
HDFC Bank Denies Data Leak Claim

Report: https://cloud.zerofox.com/intelligence/advisories/19857

ZeroFox Daily Intelligence Brief - March 8, 2023

Key Findings

Cyber Attack at Indonesian Unit of Commonwealth Bank of Australia
60 Vulnerabilities, Including Two Critical-Severity Remote Code Execution Bugs, Fixed in Android March 2023 Security Updates
About 160 GB of Confidential Data Stolen from Acer
Data of 15,298 Northeast Surgical Group Patients’ Breached

Report: https://cloud.zerofox.com/intelligence/advisories/19870

ZeroFox Daily Intelligence Brief - March 9, 2023

Key Findings

Chinese Threat Actors Targeting Southeast Asian Government Entities with Their Cyber Espionage Campaign
Names, Email IDs, and Family Details of U.S. Lawmakers Stolen and Sold on the Dark Web
CISA Adds Three Known Exploited Vulnerabilities to Catalog
New Critical Flaw in FortiOS and FortiProxy Could Give Hackers Remote Access
Students’ Data Stolen from Minneapolis Public Schools

Report: https://cloud.zerofox.com/intelligence/advisories/19890

Breach Disclosures: 03/03/2023 - 03/09/2023

Breach Disclosure: tinychef

An alleged data breach at tinychef – a U.S.-based marketing platform for cooking content – exposed 15,057 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19844

Breach Disclosure: BidenCash (493,926 Records)

ZeroFox Dark Ops team acquired a data breach package allegedly comprising 2.1 million records, from which ZeroFox extracted 493,926 email addresses.

Report: https://cloud.zerofox.com/intelligence/advisories/19845

Breach Disclosure: BasharaCare

An alleged data breach at BasharaCare – a UAE-based online store for men and women skin care products – exposed 45,274 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19880

Breach Disclosure: Coppel

An alleged data breach at Coppel – a Mexico-based retail store for household products – exposed 4,042 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19881

Breach Disclosure: Faucetduck

An alleged data breach at Faucetduck – a U.S.-based bitcoin faucet website – exposed 946 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19882

Breach Disclosure: Deepam Cinemas

An alleged data breach at Deepam Cinemas – a Seychelles-based movie screening centre – exposed 8,960 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19883

Breach Disclosure: ZimbaEye

An alleged data breach at ZimbaEye – a Zimbabwe-based news website – exposed 51,387 email addresses, usernames, and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19884

Breach Disclosure: China Airlines

An alleged data breach at China Airlines – a China-based airline company – exposed 3,053 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19885

Breach Disclosure: ExVagos

An alleged data breach at ExVagos – a Spain-based discussion forum – exposed 2,122,271 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19886

Breach Disclosure: The Law Enforcement Times

An alleged data breach at The Law Enforcement Times – a U.S.-based publication website that share information related to the law enforcement – exposed 717 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19887

Breach Disclosure: Microsoft_55m

¦ ZeroFox Dark Ops team acquired a Microsoft data breach package allegedly comprising 55 million records, from which ZeroFox extracted 54,262,979 email addresses.

Report: https://cloud.zerofox.com/intelligence/advisories/19888

Breaking News: 2023-03-03 - 2023-03-09

New FiXS ATM Malware Targeting Mexican Banks

A new strain of ATM malware, named FiXS, has been discovered targeting Mexican banks since the beginning of February 2023. This malware is concealed within a seemingly innocuous program, making it difficult to detect.

See the full report here: https://thehackernews.com/2023/03/new-fixs-atm-malware-targeting-mexican.html

New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices

A pair of serious security defects has been disclosed in the Trusted Platform Module (TPM) 2.0 reference library specification that could potentially lead to information disclosure or privilege escalation.

See the full report here: https://thehackernews.com/2023/03/new-flaws-in-tpm-20-library-pose-threat.html

Ransomware gang leaks data stolen from City of Oakland

The Play ransomware gang has started to release data from the City of Oakland, California, which was obtained during a recent cyber attack. The initial data leak comprises a 10GB multi-part RAR archive purportedly containing sensitive documents, employee information, passports, and IDs.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-leaks-data-stolen-from-city-of-oakland/

BidenCash market leaks over 2 million stolen credit cards for free

In celebration of its first anniversary, a carding marketplace called BidenCash has released a free database of 2,165,700 debit and credit cards. The threat actors chose to advertise this massive leak on an underground cybercrime forum to reach a wider audience and attract as much attention as possible, rather than keeping it concealed.

See the full report here: https://www.bleepingcomputer.com/news/security/bidencash-market-leaks-over-2-million-stolen-credit-cards-for-free/

Southeastern Louisiana University disrupted by potential cyberattack

On February 23, 2023, Southeastern Louisiana University experienced a possible cyberattack, which led to the shutdown of its network. As a consequence, students faced challenges in completing their coursework, and the university had to shift to remote classes.

See the full report here: https://www.scmagazine.com/brief/breach/southeastern-louisiana-university-disrupted-by-potential-cyberattack

Indian startup Yes Madam exposed sensitive data of customers and gig workers

Indian at-home salon platform Yes Madam exposed the sensitive data of its customers and gig workers due to a server-side misconfiguration. Yes Madam operates in more than 30 cities in the country, according to the firm’s website.

See the full report here: https://techcrunch.com/2023/03/03/yes-madam-india-data-exposed/

Polish mayor targeted by Pegasus spyware-media

According to media reports, a Polish mayor linked to the opposition had his phone hacked using Pegasus spyware. There are allegations that the country's special services have used this technology against government opponents.

See the full report here: https://www.reuters.com/world/europe/polish-mayor-targeted-by-pegasus-spyware-media-2023-03-03/

FBI and CISA warn of increasing Royal ransomware attack risks

CISA and the FBI have jointly released an advisory to underscore the threat posed by the ongoing Royal ransomware attacks, which are targeting a range of critical infrastructure sectors in the United States. These sectors include healthcare, communications, and education.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-and-cisa-warn-of-increasing-royal-ransomware-attack-risks/

Old Windows "Mock Folders" UAC bypass used to drop malware

A new phishing campaign is targeting organizations in Eastern European countries with the Remcos RAT malware, aided by an old Windows User Account Control bypass. Cybersecurity researchers suggests that system administrators configure Windows UAC to "Always Notify." Admins should also monitor for suspicious file creations or process executions in trust filesystem paths with trailing spaces, especially folders containing the string "\Windows".

See the full report here: https://www.bleepingcomputer.com/news/security/old-windows-mock-folders-uac-bypass-used-to-drop-malware/

Sandbox blockchain game breached to send emails linking to malware

The Sandbox blockchain game is warning its community that a security incident has caused some users to receive fraudulent emails impersonating the game in an attempt to infect them with malware.

See the full report here: https://www.bleepingcomputer.com/news/security/sandbox-blockchain-game-breached-to-send-emails-linking-to-malware/

New malware infects business routers for data theft, surveillance

An ongoing hacking campaign called Hiatus is targeting DrayTek Vigor router models 2960 and 3900 to steal data from victims and build a covert proxy network. DrayTek Vigor devices are business-class VPN routers used by small to medium-sized organizations for remote connectivity to corporate networks.

See the full report here: https://www.bleepingcomputer.com/news/security/new-malware-infects-business-routers-for-data-theft-surveillance/

Core DoppelPaymer ransomware gang members targeted in Europol operation

Europol has announced that law enforcement in Germany and Ukraine targeted two individuals believed to be core members of the DoppelPaymer ransomware group. The operation consisted of raiding multiple locations in the two countries and was the result of a coordinated effort involving Europol, the FBI, and the Dutch Police.

See the full report here: https://www.bleepingcomputer.com/news/security/core-doppelpaymer-ransomware-gang-members-targeted-in-europol-operation/

Experts Reveal Google Cloud Platform's Blind Spot for Data Exfiltration Attacks

A new research has found that malicious actors can take advantage of forensic visibility into Google Cloud Platform (GCP) to exfiltrate sensitive data. Google has since provided mitigation recommendations, which range from Virtual Private Cloud (VPC) Service Controls to using organization restriction headers to limit cloud resource requests.

See the full report here: https://thehackernews.com/2023/03/experts-reveal-google-cloud-platforms.html

Experts Discover Flaw in U.S. Govt's Chosen Quantum-Resistant Encryption Algorithm

A group of researchers has revealed what they say is a vulnerability in a specific implementation of CRYSTALS-Kyber, one of the encryption algorithms chosen by the U.S. government as quantum-resistant.

See the full report here: https://thehackernews.com/2023/03/experts-discover-flaw-in-us-govts.html

Alleged security breach leaves millions of dollars missing from Flutterwave accounts

Flutterwave, Africa’s largest startup by private valuation, was involved in a hack that resulted in more than USD 4.2 million being missing from its accounts. Police investigations are ongoing, and Flutterwave, through legal counsel and law enforcement parties, has filed a motion seeking to freeze accounts across 27 financial institutions that interacted with the missing funds.

See the full report here: https://techcrunch.com/2023/03/05/alleged-security-breach-leaves-millions-of-dollars-missing-from-flutterwave-accounts/?&web_view=true

Cyberattack hits major hospital in Spanish city of Barcelona

A ransomware cyberattack on one of Barcelona's main hospitals has crippled the center's computer system and forced the cancellation of 150 non-urgent operations and up to 3,000 patient checkups.

See the full report here: https://abcnews.go.com/Health/wireStory/cyberattack-hits-major-hospital-spanish-city-barcelona-97653391

New malware variant has “radio silence” mode to evade detection

The Sharp Panda cyber-espionage hacking group is targeting high-profile government entities in Vietnam, Thailand, and Indonesia with a new version of the Soul malware framework. This version reportedly features a “radio silence” mode that allows the actors to blend their communication flow into general traffic and decrease the chances of being detected.

See the full report here: https://www.bleepingcomputer.com/news/security/new-malware-variant-has-radio-silence-mode-to-evade-detection/

Android March 2023 update fixes two critical code execution flaws

Google has released March 2023 security updates for Android, delivering fixes for a total of 60 flaws via two separate security patch levels: 2023-03-01 and 2023-03-05. The bugs fixed include two critical-severity remote code execution (RCE) vulnerabilities impacting Android Systems running versions 11, 12, and 13. Users should update their Android devices to deploy the patches and secure their devices.

See the full report here: https://www.bleepingcomputer.com/news/security/android-march-2023-update-fixes-two-critical-code-execution-flaws/

Proof-of-Concept released for critical Microsoft Word RCE bug

Proof-of-concept exploit code has been released for a critical vulnerability in Microsoft Word (CVE-2023-21716, CVSS score: 9.8/10). Microsoft patched this bug in the February 2023 Patch Tuesday security updates. There is no indication that the vulnerability is being exploited in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/proof-of-concept-released-for-critical-microsoft-word-rce-bug/

Emotet malware attacks return after three-month break

The Emotet malware operation has been observed spamming malicious emails after a three-month hiatus. Instead of using reply-chain emails like in older campaigns, the operation is using emails that pretend to be invoices.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-attacks-return-after-three-month-break/

Acer confirms breach after 160 GB of data for sale on hacking forum

Acer confirmed that it suffered a data breach after threat actors hacked a server hosting private documents used by repair technicians. However, initial investigations indicate that customer data is not affected, the company stated. A threat actor began selling alleged data from the company — including technical manuals, software tools, backend infrastructure details, product model documentation for phones, tablets, and laptops, BIOS images, ROM files, ISO files, and replacement digital product keys (RDPK) — on a popular hacking forum.

See the full report here: https://www.bleepingcomputer.com/news/security/acer-confirms-breach-after-160gb-of-data-for-sale-on-hacking-forum/

SYS01stealer: New Threat Using Facebook Ads to Target Critical Infrastructure Firms

A new information stealer, SYS01stealer, is targeting critical government infrastructure employees, manufacturing companies, and other sectors. The campaign is targeting Facebook business accounts by using Google ads and fake Facebook profiles that promote games, adult content, and cracked software to lure victims into downloading malicious files. The stealer harvests Facebook cookies from Chromium-based web browsers, exfiltrates the victim's Facebook information to a remote server, and downloads and runs files.

See the full report here: https://thehackernews.com/2023/03/sys01stealer-new-threat-using-facebook.html

Transparent Tribe Hackers Distribute CapraRAT via Trojanized Messaging Apps

A suspected Pakistan-aligned advanced persistent threat (APT) group known as Transparent Tribe (APT36, Operation C-Major, and Mythic Leopard) has been linked to an ongoing cyber espionage campaign targeting Indian and Pakistani Android users with a backdoor called CapraRAT. Up to 150 victims, likely with military or political leanings, are estimated to have been targeted in the campaign.

See the full report here: https://thehackernews.com/2023/03/transparent-tribe-hackers-distribute.html

Shein's Android App Caught Transmitting Clipboard Data to Remote Servers

An older version of Chinese online fast fashion retailer Shein's Android application had a bug that periodically captured and transmitted clipboard contents to a remote server. The bug existed in version 7.9.2 of the app that was released on December 16, 2021 and has since been addressed as of May 2022.

See the full report here: https://thehackernews.com/2023/03/sheins-android-app-caught-transmitting.html

Brazilian Conglomerate Suffers 3TB Data Breach

Hackers have reportedly stolen several terabytes of corporate and employee information from Brazilian multi-national firm Andrade Gutierrez. The leaked data reportedly includes names, email addresses, passport details, payment details, tax ID numbers, and health insurance information on over 10,000 employees.

See the full report here: https://www.infosecurity-magazine.com/news/brazilian-conglomerate-3tb-data/

India's HDB Financial Services flags data breach at service provider

HDB Financial Services, the non-bank lending unit of India's top private lender HDFC Bank, disclosed a data breach at one of its service providers which processes customer information. HDFC Bank said it was not affected by the incident.

See the full report here: https://www.thehindu.com/business/indias-hdb-financial-services-flags-data-breach-at-service-provider/article66593034.ece

Commonwealth Bank of Australia's Indonesian arm hit by cyber attack

Commonwealth Bank of Australia disclosed that its Indonesian unit, PT Bank Commonwealth (PTBC), was hit by a cyber incident that involved the unauthorised access of a web-based software application used for project management. Commonwealth Bank of Australia’s systems are segregated from PTBC’s systems, and PT Bank Commonwealth services continue to operate as normal.

See the full report here: https://www.reuters.com/technology/commonwealth-bank-australias-indonesian-arm-hit-by-cyber-attack-2023-03-08/

FBI investigates data breach impacting U.S. House members and staff

The FBI is investigating a data breach affecting U.S. House of Representatives members and staff after their account and sensitive personal information was stolen from DC Health Link's servers.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-investigates-data-breach-impacting-us-house-members-and-staff/

Bitwarden flaw can let hackers steal passwords using iframes

Bitwarden's credentials autofill feature contains a risky behavior that could allow malicious iframes embedded in trusted websites to steal people's credentials and send them to an attacker.

See the full report here: https://www.bleepingcomputer.com/news/security/bitwarden-flaw-can-let-hackers-steal-passwords-using-iframes/

Fortinet warns of new critical unauthenticated RCE vulnerability

Fortinet has disclosed a "Critical" vulnerability impacting FortiOS and FortiProxy, which allows an unauthenticated attacker to execute arbitrary code or perform denial of service (DoS) on the GUI of vulnerable devices using specially crafted requests.

See the full report here: https://www.bleepingcomputer.com/news/security/fortinet-warns-of-new-critical-unauthenticated-rce-vulnerability/

Veeam fixes bug that lets hackers breach backup infrastructure

Veeam urged customers to patch a high-severity Backup Service security vulnerability impacting its Backup & Replication software. The flaw (tracked as CVE-2023-27532) was reported by a security researcher in mid-February 2023, and it affects all Veeam Backup & Replication (VBR) versions.

See the full report here: https://www.bleepingcomputer.com/news/security/veeam-fixes-bug-that-lets-hackers-breach-backup-infrastructure/

Jenkins Security Alert: New Security Flaws Could Allow Code Execution Attacks

A pair of severe security vulnerabilities have been disclosed in the Jenkins open source automation server that could lead to code execution on targeted systems. The flaws, tracked as CVE-2023-27898 and CVE-2023-27905, impact the Jenkins server and Update Center, and have been collectively christened CorePlague by cloud security firm Aqua. All versions of Jenkins versions prior to 2.319.2 are vulnerable and exploitable.

See the full report here: https://thehackernews.com/2023/03/jenkins-security-alert-new-security.html

CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three security flaws: CVE-2022-35914 (CVSS score: 9.8), CVE-2022-33891 (CVSS score: 8.8) and CVE-2022-28810 (CVSS score: 6.8) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

See the full report here: https://thehackernews.com/2023/03/cisas-kev-catalog-updated-with-3-new.html

Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity

The North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice.

See the full report here: https://thehackernews.com/2023/03/lazarus-group-exploits-zero-day.html

Hackers post video of MPS students and staff data

The hackers who shut down several Minneapolis Public Schools IT systems have posted a video on Vimeo showing them accessing personal staff and student data.

See the full report here: https://www.axios.com/local/twin-cities/2023/03/07/hackers-data-minneapolis-schools-publish-video-vimeo