ZeroFox Daily Intelligence Brief - March 15, 2023

ZeroFox Daily Intelligence Brief - March 15, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Cybercriminals Exploit Silicon Valley Bank Collapse to Steal Money and Data
• SAP Releases Security Patches for March 2023: 19 Vulnerabilities, Including Five Critical, Patched
• Over USD Two Billion of Cryptocurrency Lost to Cybercriminals
• Rubrik Confirms Breach of Information After GoAnywhere Zero-Day Bug Exploit
• Microsoft Alerts of Large-Scale Use of Phishing Kits to Send Millions of Emails Daily

Cybercriminals Exploit Silicon Valley Bank Collapse to Steal Money and Data

Criminals are utilizing the atmosphere of uncertainty surrounding the collapse of the Silicon Valley Bank (SVB)—known for being a banking provider to venture capital (VC)-backed companies and tech startups—to plan cyberattacks on the bank’s depositors. Malicious actors have been observed registering suspicious domains and setting up phishing pages to steal money and account data as well as to deploy malware on the victims’ systems. Threat actors are already conducting business email compromise (BEC) attacks luring customers to send payments to new bank accounts that are in control of the attackers. Another attack vector involves spreading disinformation about SVB sending eligible account holders USDC (a cryptocurrency whose value is pegged to the U.S. dollar) as part of the SVB USDC payback program; however, once a user clicks the “Click here to claim” button, the malicious site tries to compromise the victim’s cryptocurrency wallet.

Recommendations:

• ZeroFox advises SVB account holders to be wary of unsolicited communication from threat actors masquerading as employees or fellow customers of SVB and spreading disinformation as well as links to malicious websites or forms. Block known malicious URLs that have been observed in these attacks, such as login-svb[.]com, svbbailout[.]com, svbcertificates[.]com, and svbclaim[.]com.
• SVB account holders should follow the official communication channels of the U.S. government and the FDIC and confirm any requested payment changes by phone using known contact numbers (versus phone numbers included in emails).

SAP Releases Security Patches for March 2023: 19 Vulnerabilities, Including Five Critical, Patched

Enterprise resource planning (ERP) vendor SAP fixed a total of 19 security bugs in its March 2023 batch of security updates. The fixes include patches for five critical-severity bugs affecting SAP Business Objects Business Intelligence Platform (CMC) and SAP NetWeaver. Considering the widespread use of SAP infrastructure in organizations across the globe, unpatched vulnerabilities in SAP products can provide a significant attack surface for threat actors—posing a threat to proprietary organizational information and sensitive user data.

Recommendations:

• SAP customers should apply the patches at their earliest possibility, available via the SAP Support Portal, to protect their SAP landscape.
• Follow ZeroFox Intelligence to remain updated on the latest security guidelines and vulnerability patches.

Over USD Two Billion of Cryptocurrency Lost to Cybercriminals

The Federal Bureau of Investigation (FBI) has issued a warning alerting citizens of an increase in cryptocurrency scams used to defraud victims out of over USD two billion in 2022. The FBI alert states that fraudsters target their victims using dating apps, social media platforms, professional networking sites, or encrypted messaging apps. Once the threat actors build rapport and gain the victim’s trust, they convince them to invest in cryptocurrency platforms controlled by criminals. The cybercriminals often coach the victims to invest more by showing them fake profits; when the victim attempts to withdraw funds, they are told they must pay fees or taxes in order to access their money. The victims are unable to recoup their money or any purported “taxes and fees” they may have paid.

Recommendations:

• Cryptocurrency enthusiasts are advised to confirm the validity and perform a thorough background check of any investment platforms (traditional or cryptocurrency).
• Do not reveal financial or personal identifying information (PII) or transfer funds to strangers initiating contact via social media, and never invest funds on the advice of an “online-only” relationship.
• Those that have already invested funds and believe they may be a victim of cybercriminals should not pay any additional fees or taxes to withdraw their money or for any services to “reclaim” their lost funds.

Rubrik Confirms Breach of Information After GoAnywhere Zero-Day Bug Exploit

Silicon Valley-based data security company Rubrik has disclosed that it is one of the victims of Fortra's GoAnywhere zero-day vulnerability, which has affected about 100 organizations across the world. In a blog post describing the incident, Rubrik Chief Information Security Officer Michael Mestrovichhas revealed that Rubrik detected unauthorized access to certain data in one of its non-production IT testing environments resulting from the GoAnywhere remote code execution vulnerability. Rubrik’s current investigation indicates the unauthorized access did not include any secured customer data. Rather, the exposed data consists of Rubrik internal sales information, including customer and partner company names, business contact information, and a limited number of purchase orders from Rubrik distributors. The company’s investigation determined that there was no lateral movement of the attackers to other environments. Rubrik has taken the non-production environment offline to contain the threat and undertaken appropriate steps to restore the test environment.

Recommendations:

• Rubrik’s customers and partners should remain alert to phishing attacks, as threat actors typically use compromised user information in follow-on attacks.
• Rubrik should determine whether the compromised environment contained credentials for other systems (such as passwords and keys used to access any external systems with which GoAnywhere is integrated) and revoke those credentials.
• After a data breach on an internal environment, it is advisable to review relevant access logs related to those systems, including passwords and keys used to encrypt files within the system.

Microsoft Alerts of Large-Scale Use of Phishing Kits to Send Millions of Emails Daily

Security researchers are tracking the threat actors operating open source adversary-in-the-middle (AiTM) phishing kits that enable threat actors to operate attacks at scale. In a AiTM phishing attack, a threat actor attempts to steal and intercept a target’s password and session cookies by deploying a proxy server between the user and the website. These attacks are effective, as they can circumvent multi-factor authentication (MFA) protections. DEV-1101 is reportedly the threat actor behind several phishing kits that can be purchased or rented by other cybercriminals and used to mimic Microsoft Outlook and Outlook landing pages, lowering the barriers of entry to cybercrime.

Recommendations:

• Users should be alert for any emails that contain a PDF document link that resolves to a Microsoft sign-in portal preceded by a CAPTCHA step; do not complete the step or provide credential under this type of scenario.
• Organizations should adopt phishing-resistant authentication methods, like FIDO2 security keys, to block suspicious login attempts.
• Security teams should regularly monitor whether employees working from their personal devices have deployed all available security patches. Employees should be trained to identify phishing emails and report them to security.
• Follow ZeroFox Intelligence for guidelines and advisories for emerging threats.