ZeroFox Daily Intelligence Brief - March 13, 2023

ZeroFox Daily Intelligence Brief - March 13, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• HC3 Sheds Light on Data Exfiltration Trends in Healthcare Cyberattacks
• SEC Charges Software Company Blackbaud Inc. for Misleading Disclosures About Ransomware Attack that Impacted Charitable Donors
• Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant
• As Many as 3.1 Million Patients’ Sensitive Information Leaked by a California-Based Health Startup
• North Korea Hackers Targeting Security Researchers with Malware Through Job Offers on LinkedIn
• Healthcare Providers Sued over Ransomware Attack and Data Breach In Pennsylvania

HC3 Sheds Light on Data Exfiltration Trends in Healthcare Cyberattacks

The U.S. Health Sector Cybersecurity Coordination Center (H3C) has issued a cybersecurity advisory highlighting the tactics used by cybercriminals for data exfiltration from healthcare organizations and recommending mitigation measures. The advisory names LockBit, ALPHV/BlackCat, and Hive as the most prolific groups targeting critical infrastructure, including healthcare, in the past year. Several provided case studies showcase the use of diverse info stealers and data exfiltrators (such as Rclone by Hive, Conti, and Darkside; Exbyte by BlackByte; and StealBit by LockBit affiliates) in prominent attacks on healthcare organizations. The advisory also details how conventional ransomware attacks are being supplanted by double and triple extortion attacks involving data theft, digital extortion, and cyberespionage, as well as insider threats and attacks on cloud backups.

Recommendations:

• Healthcare organizations should utilize the resources provided via the Cybersecurity and Infrastructure Security Agency (CISA)’s #stopransomware initiative to guard against and respond to malicious cyber activities.
• Basic cyber hygiene at the organizational level—regularly deploying software updates, following the principle of least privilege in information access, revoking permissions granted to old and inactive profiles, using a strong password policy with periodic changes and multi-factor authentication (MFA), and regular training of personnel—goes a long way in guarding against cyberattacks.
• The CISA Insider Threat Mitigation Guide and the Department of Health & Human Services (HHS) Insider Threats in Healthcare advisories provide specific guidelines on addressing insider threats in healthcare organizations.
• Regular data backup to secure cloud infrastructure—designed to minimize downtime and limit the effects to the rest of the network in the event of a data breach—is crucial for business continuity after a cyberattack.

SEC Charges Software Company Blackbaud Inc. for Misleading Disclosures About Ransomware Attack that Impacted Charitable Donors

Donor data management software provider Blackbaud has agreed to pay USD 3 million to settle charges of misleading disclosures about a 2020 ransomware attack that impacted over 13,000 customers. The U.S. Securities and Exchange Commission (SEC) determined that Blackbaud failed to disclose that attackers had accessed sensitive information such as donor bank account information and Social Security numbers. The SEC found Blackbaud guilty of violating several provisions and rules under the Securities Act of 1933 and the Securities Exchange Act of 1934.

Recommendations:

• Companies must establish effective controls and procedures to ensure the timely and accurate disclosure of all material information to investors, as failure to do so can lead to serious consequences for both the company and its investors.
• Follow ZeroFox Intelligence for news on cybersecurity and data privacy from around the world.

Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant

A new version of the Android banking trojan Xenomorph, called "Xenomorph 3rd generation," has been observed in malware campaigns. The new variant features a powerful runtime engine for accessibility services that enable it to implement an Automated Transfer System (ATS) framework to complete fraudulent transactions. Additionally, the malware can extract authenticator codes and perform account takeover attacks. Xenomorph targets over 400 banking and financial entities, including cryptocurrency wallets, and has been distributed through communication platform Discord's Content Delivery Network (CDN).

Recommendations:

• Android users should exclusively download apps from reputable and trusted developers and limit the number of applications on their mobile devices to minimize the attack surface. They should also regularly update their Android operating system and all apps to the latest version to ensure that known security vulnerabilities are patched.
• Users should regularly monitor bank and other financial accounts for any suspicious activity or transactions and report any unauthorized activity immediately to the appropriate financial institution.
• Phones should be regularly scanned by a mobile security service that can detect and mitigate any malicious apps or activity on the device.

As Many as 3.1 Million Patients’ Sensitive Information Leaked by a California-Based Health Startup

Sensitive information relating to mental-health patients was inadvertently exposed by Cerebral, a California-based firm that connects people with mental health professionals via video calls. Some of the exposed data included answers to online self-assessments, such as questions on panic attacks, personality disorders, and alcohol abuse. The data exposure was observed three years after the firm started using pixel trackers to monitor user behavior for marketing purposes; in this duration, the trackers were sharing client and user data to third-party firms and subcontractors. Cerebral claims to be unaware of any misuse of the exposed health information.

Recommendations

• Customers who have used the services of Cerebral should be wary of potential phishing attacks and must not click links on unsolicited messages.
• Healthcare firms must verify how user data is used and rule out any possibility of data exposure before deploying marketing tools. Health-related startups must prioritize customers’ privacy as they deal with sensitive customer information.
• Online healthcare consumers should be aware of the terms of service of sites they visit and the possibility that their sensitive data may be collected and shared with other entities.

North Korea Hackers Targeting Security Researchers with Malware Through Job Offers on LinkedIn

North Korean threat group Lazarus is using social-engineering tactics to lure security researchers and media personnel in the United States and Europe with fake job offers and deploy malware on their systems. The hackers first approach their target on LinkedIn, posing as job recruiters, and then move their chat to Whatsapp and share Word documents embedded with malicious macros. The macros in the Word documents are used for remote-template injection to fetch a trojanized version of remote desktop software TightVNC from compromised WordPress sites that serve as the attacker’s command and control servers. The ultimate malware deployed in the attacks is PlanWalk, a C++ backdoor that helps them establish a foothold in the target’s corporate environment.

Recommendations:

• Security researchers and media personnel in the United States and Europe should be cautious regarding any job offers sent through LinkedIn, particularly those that suggest taking the conversation to another platform or that send links or documents to open.
• Those that believe they may have been approached with a fake job offer should run anti-malware scans on their systems and regularly deploy available software updates to prevent threat actors from leveraging vulnerabilities.
• Follow ZeroFox Intelligence for indicators of compromise of ongoing malware attacks.

Healthcare Providers Sued over Ransomware Attack and Data Breach In Pennsylvania

A lawsuit has been filed against a large Pennsylvania healthcare provider for an alleged data leak in which customers were not sent timely breach notifications. In January 2023, Maternal & Family Health Services (MFHS) notified 461,000 current and former patients of a security breach. MFHS said that sophisticated ransomware was discovered in April 2022, and forensic investigation revealed that the attackers had access to its network from August 2021 to April 2022. The attackers had access to names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial accounts, and payment card details. The lead plaintiff claims that after his information was stolen in the breach, at least five credit card accounts have been opened in his name in Florida and that he has had to pay accrued interest charges on those accounts. The lawsuit also questions why MFHS took nine months to notify affected patients about the breach.

Recommendations:

• MFHS patients should be alert for possible phishing attempts, as threat actors typically conduct follow-on attacks using leveraged data.
• Data-protection services, such as those provided by ZeroFox’s IDX, can alert victims of any misuse of their personal information.