ZeroFox Daily Intelligence Brief - March 14, 2023

ZeroFox Daily Intelligence Brief - March 14, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Euler DeFi Protocol Exploited for Nearly USD 200 Million
• AI-Generated YouTube Video Tutorials Spreading Infostealer Malware
• CISA Launches Ransomware Vulnerability Warning Pilot (RVWP)
• Over a Dozen Vulnerabilities Unearthed in Chinese Smart Intercom Devices

Euler DeFi Protocol Exploited for Nearly USD 200 Million

Decentralized-finance (DeFi) lending protocol Euler Finance suffered a flash loan attack that led to a loss of nearly USD 200 million in several forms of cryptocurrencies. In DeFi platforms, a flash loan allows a user to borrow cryptocurrency from a lending protocol without pledging any collateral. In the attack on Euler Finance, the threat actor exploited flash loans from several DeFi platforms and manipulated the Euler Finance protocol into sending him nearly USD 400 million worth of cryptocurrencies; the attacker then repaid approximately half of the original debt amount, pocketing close to USD 197 million in the heist. The ZeroFox Intelligence Collection team observed social media chatter indicating that the same actor was responsible for exploiting a DeFi protocol on the Binance Smart Chain recently and using Tornado Cash (a cryptocurrency “mixer” that has been sanctioned by the U.S. government) to launder the stolen cryptocurrency.

Recommendations:

• DeFi protocols should use reputable oracle services (data feeds that provide reliable off-chain data to on-chain entities like smart contracts), such as Chainlink, to prevent flash loan attackers from manipulating on-chain asset prices.
• Follow ZeroFox Intelligence to remain up-to-date on emerging threats.

AI-Generated YouTube Video Tutorials Spreading Infostealer Malware

There is a growing trend of videos featuring AI-generated personas being used for recruitment, education, and promotional material across different languages and platforms. However, this trend has also been co-opted by threat actors to distribute stealer malware such as Raccoon, RedLine, and Vidar. The threat actors create videos masquerading as tutorials on downloading cracked versions of software like Photoshop and Autodesk and lure users into clicking on links to download the malware. The malware is spread through YouTube, using obfuscated links and hosting sites like Google Drive and Discord. The threat actors also hijack legitimate YouTube accounts to increase their reach. Such videos also use search engine optimization (SEO) poisoning techniques as well as an exhaustive list of tags to appear at the top of search results.

Recommendations:

• Users are reminded to always obtain their software from trusted, vetted sources; refrain from downloading pirated software to reduce risks of malware infection.
• Suspicious YouTube videos should be reported to the platform immediately to help mitigate the spread of stealer malware.

CISA Launches Ransomware Vulnerability Warning Pilot (RVWP)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has launched the Ransomware Vulnerability Warning Pilot (RVWP) program, which scans critical infrastructure entities' networks for vulnerabilities that are typically exploited by ransomware operators. The program aims to identify exposed systems and notify system owners of security vulnerabilities to enable timely mitigation before damaging intrusions occur. RVWP is part of CISA's broader efforts to fend off the escalating ransomware threat that started two years ago. CISA has also released the Ransomware Readiness Assessment (RRA) and published guidance to help at-risk government and private sector organizations prevent ransomware data breaches. Additionally, CISA has launched the Joint Cyber Defense Collaborative (JCDC) to protect U.S. critical infrastructure from ransomware and other cyber threats.

Recommendations:

• Security administrators of at-risk government and private sector organizations should adhere to CISA guidelines on preventing ransomware attacks. These guidelines include updating software regularly, implementing strong access controls, using multi-factor authentication, and backing up critical data.
• Critical infrastructure entities should implement a management program to identify vulnerabilities in their information systems. This program should include regular scans of their networks to identify flaws on internet-exposed systems.
• Organizations should develop and test incident response plans to ensure they can respond effectively to ransomware attacks. Additionally, organizations should participate in information-sharing programs such as the JCDC to share threat intel in order to mitigate ransomware attacks.

Over a Dozen Vulnerabilities Unearthed in Chinese Smart Intercom Devices

As many as 13 vulnerabilities were found in E11 smart intercom devices manufactured by Chinese company Akuvox. The security vulnerabilities in the smart intercom system were found to allow remote code execution (RCE), network access, and other forms of attack. Researchers found three different attack vectors: RCE within the local area network, remote activation of the device’s camera and microphone, and access to an external, insecure FTP server. The first threat vector relies on two flaws related to missing authentication for a critical function (CVE-2023-0353) and command injection vulnerability (CVE-2023-0351), respectively. The vulnerability tied to microphone and web cam takeover can be leveraged remotely and transfer data back to the attacker, and the FTP server access could allow threat actors to download images from Akuvox intercoms running anywhere.

Recommendations:

• Akuvox has responded to the security researchers indicating it will update firmware for the affected devices before March 20, 2023. Users should install these updates once they become available on the Akuvox Knowledge Base.
• Until the updates are issued, customers should consider discontinuing using Akuvox smart intercoms or not exposing their Akuvox device to the internet to evade any potential attack by threat actors.
• Akuvox users should periodically change their device password to minimize the chances of attacks.