ZeroFox Daily Intelligence Brief - March 17, 2023

ZeroFox Daily Intelligence Brief - March 17, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• #StopRansomware Cybersecurity Advisory: LockBit 3.0
• FTC Seeks Screening Methods Used by Social Media Platforms to Identify Misleading Advertisements
• U.K. Aims to Reduce “Pointless Paperwork” to Save Billions of Dollars via New GDPR
• FCC to Bring New Licensing Rules to Ease the Development of Direct Satellite Links to Handheld Devices
• Adobe Acrobat Sign Abused to Push Redline Info-Stealing Malware
• HC3 Shares Black Basta Ransomware Threat Intelligence Data
• 18 Zero-Day Vulnerabilities Found in Samsung Exynos Chipsets

#StopRansomware Cybersecurity Advisory: LockBit 3.0

U.S. law-enforcement agencies have published a joint cybersecurity advisory detailing the tactics, techniques, and procedures (TTP) used by the LockBit 3.0 ransomware operation to attack a wide range of businesses and critical infrastructure organizations and have recommended mitigation measures as part of the #StopRansomware initiative. The advisory describes how LockBit 3.0 (“LockBit Black”) is more modular and evasive than its previous versions, with a Safe Mode feature to circumvent endpoint antivirus and detection. Moreover, LockBit 3.0 infects only those systems that do not have language settings matching a defined exclusion list, which includes Romanian (Moldova), Arabic (Syria), and Tatar (Russia). The report further explains how LockBit 3.0 affiliates first gain initial access to victim networks (via remote desktop protocol exploitation, drive-by compromise, phishing campaigns, abuse of valid accounts, and exploitation of public-facing applications) and describes the execution and infection processes.

Recommendations:

• Network security personnel should enforce a strong password policy involving the use of adequately long passwords stored in hashed formats in reputable software managers and preventing password reuse. Disable password “hints” and enable multi-factor authentication (MFA) whenever possible.
• Software tools should be regularly updated (with prioritized patching of known exploited security bugs), and administrator credentials should be mandated for software installation.
• Network segmentation and regular data backup is crucial, alongside a proper incident-response mechanism.
• Employees should be trained on defending themselves against phishing and other forms of social-engineering attacks.
• Follow the resources disseminated as part of the #StopRansomware initiative of the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing & Analysis Center (MS-ISAC) to remain updated on active ransomware threats. The indicators of compromise (IOCs) included in the joint cybersecurity advisory reports could help block, detect, and deal with prevalent ransomware campaigns.

FTC Seeks Screening Methods Used by Social Media Platforms to Identify Misleading Advertisements

The U.S. Federal Trade Commission (FTC) is cracking down on social media and streaming firms to scrutinize and restrict paid commercial advertising that is deceptive or exposes consumers to ineffective or harmful “healthcare” products, financial scams, counterfeit and fake goods, or fraud. The FTC has sought details on the screening methods adopted by these platforms to curb misleading advertisements. The platforms under scrutiny include most social media and streaming sites, including TikTok, which have been known to tout sham products and other consumer scams in recent years. Some of these platforms have been mandated to provide information about ad revenue and number of views, particularly in categories of products and services more prone to deception. The FTC aims to ensure that these platforms are proactively working towards keeping scammers and deceptive ads away from their networks. This development comes after a recent FTC mandate on Twitter to turn over some internal communication material relating to its owner and certain business decisions as part of an investigation.

Recommendations:

• Social media users should be wary and alert while purchasing products through these platforms.
• Users should check online reviews of the sellers and service providers, taking steps to verify their quality and legitimacy. Payments should be made via traceable methods only that provide consumer protections in the event of theft or fraud, such as major credit cards.
• Social media and streaming platforms should incorporate dedicated, user-friendly services to register complaints from users who have been duped by online fraudsters.
• Thorough vetting methods must be adopted before approving retailers for advertising their products on such platforms. The FTC should ensure that these platforms are following basic principles of scrutinization while allowing sellers to advertise their products.*

U.K. Aims to Reduce “Pointless Paperwork” to Save Billions of Dollars via New GDPR

The new draft United Kingdom (UK) General Data Protection Regulation (GDPR) replacement aims to cut down on “pointless paperwork” for businesses and reduce cookie pop-ups. In an attempt to balance a pro-business stance with user privacy, the new regulation draft calls for less record-keeping requirements for businesses. While the Data Protection and Digital Information Bill aims to cut down on the required record-keeping of UK businesses, the reduced oversight could lessen the Information Commissioner’s Office’s ability to proactively address data breaches or any other privacy violations. The Department of Science, Innovation and Technology (DSIT) has stated that the new UK GDPR draft will save GBP 4 billion over the coming decade.

Recommendations:

• UK citizens should be aware that, if passed as drafted, the UK GDPR may reduce the privacy standards they are currently accustomed to under the EU GDPR.
• Follow ZeroFox Intelligence for the latest cybersecurity and threat intelligence-related news from across the world.

FCC to Bring New Licensing Rules to Ease the Development of Direct Satellite Links to Handheld Devices

The Federal Communications Commission (FCC) has agreed to propose a new licensing rule that would ease the development of direct satellite links to handheld devices, including phones and tablets for 5G communications. The FCC is requesting industry representatives to advise them on a plan that would allow satellites to use radio frequency spectrum that is now used by providers of terrestrial mobile wireless communications. The U.S. Department of Defense is keen to utilize the direct satellite links, as it would help address their problem of maintaining expensive terminals that have proprietary systems.

Recommendations:

• The change would allow mobile phone companies to expand their services via satellite links primarily in remote areas, where access is difficult or non-existent, and increase the availability of emergency communications to consumers.
• Follow ZeroFox Intelligence for the latest cybersecurity and threat intelligence-related news from across the world.

Adobe Acrobat Sign Abused to Push Redline Info-Stealing Malware

Cybercriminals are using Adobe Acrobat Sign, the free cloud-based e-signature service, to distribute info-stealing malware via malicious emails that appear to be from the software company. This strategy is similar to recent abuses of other legitimate services such as PayPal invoices and Google Docs comments. Threat actors register with the service and send messages containing a link to a document hosted on Adobe's servers, which in turn leads to a website requesting that users solve a CAPTCHA before serving them a ZIP archive containing Redline malware. This method helps bypass security layers and tricks victims into downloading malware, which can then steal credentials, cryptocurrency wallets, credit cards details, and other sensitive information.

Recommendations:

• Users should be wary of unexpected emails that prompt them to click on a link and/or solve a CAPTCHA in order to access an Adobe Acrobat document.
• Maintain an antivirus or anti-malware program to provide additional device and data protection.

HC3 Shares Black Basta Ransomware Threat Intelligence Data

The Health Sector Cybersecurity Coordination Center (HC3) has issued a warning on the Black Basta ransomware group, highlighting its ransomware and extortion attacks, double extortion tactics, and targeting of healthcare and public sector organizations. The group is believed to consist of former members of the Conti and BlackMatter ransomware operations and has conducted at least 20 attacks in its first two weeks of operation. Black Basta is highly skilled and uses a variety of attack methods, including purchasing access to systems, exploiting vulnerabilities, and using remote access tools. It has targeted critical infrastructure entities, primarily focusing on victims in the United States, but has also recently targeted other nations. While the group's motives are believed to be primarily financial, there may be political motivations behind the targets as well.

Recommendations:

• Refer to the ZeroFox advisory on the Black Basta ransomware group for more details on the group’s operations.
• Organizations should back up their data regularly to ensure they can restore a copy in the event it is encrypted by ransomware or stolen in a data breach. Backups should be stored off-site and tested regularly to ensure the data can be restored when needed.

18 Zero-Day Vulnerabilities Found in Samsung Exynos Chipsets

Security researchers have discovered 18 zero-day vulnerabilities in Samsung's Exynos chipsets that are used in mobile devices, wearables, and cars. Four of these vulnerabilities, including CVE-2023-24033, allow for internet-to-baseband remote code execution, which could remotely compromise vulnerable devices without user interaction. The only information required for these attacks is the victim's phone number. Experienced attackers can easily create an exploit that can compromise affected devices silently and remotely. The researchers have delayed disclosure of the four most severe vulnerabilities to prevent potential attackers from gaining access to information that could be used to exploit the vulnerabilities and compromise devices. This delay allows time for Samsung to address the vulnerabilities and release security patches to protect vulnerable devices.

Recommendations:

• Affected end users should update their devices as soon as possible to ensure that they are running the latest builds that fix both disclosed and undisclosed security vulnerabilities.
• Users with affected devices can protect themselves from the baseband remote code execution vulnerabilities by turning off Wi-Fi calling and VoLTE in their device settings.
• Although this may limit connectivity options, it can prevent attackers from exploiting these vulnerabilities.
• As the only information required for the attacks to be performed is the victim's phone number, users should exercise caution when sharing their phone numbers with unknown or suspicious sources.
• Users with vulnerable devices should temporarily avoid answering calls or messages from unknown numbers, as the calls may be part of a phishing or social engineering attack.