ZeroFox Daily Intelligence Brief - March 10, 2023

ZeroFox Daily Intelligence Brief - March 10, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Iranian Hackers Target Women Involved in Human Rights and Middle East Politics
• About Nine Million Customers of AT&T Data Breached After Vendor Hack
• Criminals Steal Cryptocurrency through Play-to-Earn Games
• Media and Entertainment Sectors’ Linux Enterprise Networks Targeted by IceFire Ransomware

Iranian Hackers Target Women Involved in Human Rights and Middle East Politics

A threat actor group called Cobalt Illusion, which is believed to have ties to Iran's Islamic Revolutionary Guard Corps, is using a sneaky tactic to target social science researchers in the Middle East. They are impersonating members of the Atlantic Council, a U.S. think tank, to lure researchers into thinking they are contributing to a report. Once the researchers are hooked, the threat actors attempt to steal their login credentials, which they then use to access Gmail, Yahoo, and Outlook accounts to steal more data. Cobalt Illusion also uses specialized malware, including a C++-based Telegram tool, to harvest data from Telegram accounts. The group's primary targets include academics, activists, diplomats, journalists, politicians, and researchers.

Recommendations:

• Researchers and think-tank employees should verify new contacts who claim to be high-profile individuals associated with reputable institutions or claim to be able to offer help.
• It is advisable to use official and recognized communication channels whenever possible.
• Organizations, administrators, and individuals who are likely targets should consider blocking any identified malware domains to prevent data theft and credential harvesting. This can help limit the damage caused by cyberattacks and reduce the risk of compromised sensitive data.

About Nine Million Customers of AT&T Data Breached After Vendor Hack

Personal data of about nine million customers of AT&T, including their first names, wireless account numbers, wireless phone numbers, and email addresses, was compromised after a market vendor was breached in January 2023. Although the leaked data does not contain any credit card information, SSN, or account passwords, details including rate-plan name, past due amount, monthly payment amount, various monthly charges, and minutes used have been exposed for some customers. AT&T has stated that it has notified federal law enforcement about the breach and unauthorized access to CPNI (Customer Proprietary Network Information), as required by the Federal Communications Commission.

Recommendations:

• AT&T recommends that customers take steps to reduce their exposure to potential data breaches by toggling off CPNI data sharing on their accounts.
• Customers whose data are exposed should be wary of phishing calls or emails and be careful not to click on suspicious links.
• Customers should be alert not to make any unsolicited telecom payments through unsafe channels.

Criminals Steal Cryptocurrency through Play-to-Earn Games

Law enforcement authorities in the United States are issuing warnings about scammers targeting cryptocurrency enthusiasts with fraudulent "play-to-earn" games offering rewards in the form of cryptocurrency to players who reach certain milestones within the game. Malicious actors are befriending unsuspecting victims in online forums and inviting them to participate in fake play-to-earn games that have bugs preventing players from claiming their rewards. Once lured in, the victims are coaxed into paying fees or taxes to gain access to their rewards, but these payments are redirected to wallets controlled by the threat actors, resulting in the players losing all their funds.

Recommendations:

• It is important for cryptocurrency enthusiasts to be vigilant and cautious when participating in online games and to verify the legitimacy of the gaming platform before making any payments.
• ZeroFox advises linking a separate wallet with only a minimal amount of digital assets and not their primary cryptocurrency wallet to the gaming platform.
• Conduct periodic checks on your cryptocurrency wallet to identify the access/permissions allowed to various platforms and revoke the unnecessary ones.

Media and Entertainment Sectors’ Linux Enterprise Networks Targeted by IceFire Ransomware

Linux enterprise networks belonging to several media and entertainment organizations in Turkey, Iran, Pakistan, and UAE are the latest victims of the IceFire ransomware. The ransomware operation exploits the recently disclosed deserialization vulnerability in IBM Aspera Faspex file-sharing software (CVE-2022-47986; CVSS score: 9.8). The ransomware binary targeting Linux is a 2.18 MB 64-bit ELF file installed on CentOS hosts running a vulnerable version of IBM Aspera Faspex file server software. Compared to Windows, Linux is more difficult to deploy ransomware against, particularly at scale. Threat actors often aim to exploit application vulnerabilities in Linux systems because typical infection vectors like phishing or drive-by download are less effective on Linux systems.

Recommendations

• Media and entertainment personnel in the affected countries must be extremely cautious of potential phishing calls and emails as threat actors could abuse the data exfiltrated in the ransomware attacks to conduct follow-on attacks.
• Organizations still using vulnerable versions of IBM Aspera Faspex file server software should update to the latest available version at the earliest possible.
• Follow ZeroFox Intelligence for updates on vulnerabilities and corresponding mitigation measures.