ZeroFox Daily Intelligence Brief - March 20, 2023

ZeroFox Daily Intelligence Brief - March 20, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• BreachForums Founder Pompompurin Arrested in New York
• TikTok Banned on Devices Linked to New Zealand’s Government Network
• Hitachi Energy Latest Victim of Clop GoAnywhere Cyberattack
• New GoLang-Based HinataBot Exploiting Router and Server Flaws for DDoS Attacks
• NBA Alerts Fans of Data Breach Exposing Personal Information
• Telegram and WhatsApp Trojanized to Target Cryptocurrency Wallets

BreachForums Founder Pompompurin Arrested in New York

U.S. law-enforcement agents have arrested Conor Brian Fitzpatrick, who is believed to be “Pompompurin,” the owner and administrator of notorious hacking forum BreachForums. “Pompompurin” is a prominent name in underground forums; before founding BreachForums, he was an active poster in RaidForums—a similar platform that was seized by the Federal Bureau of Investigation (FBI) in April 2022. BreachForums was recently in the news after a forum user claimed to be selling data obtained from a massive breach at DC Health Link, a health insurance firm in Washington, DC. Two federal cases were filed against Pompompurin on March 15, 2023; he was reportedly released on an unsecured USD 300,000 bond co-signed by his parents and will appear in federal court in the Eastern District of Virginia on March 24.

ZeroFox Intelligence has observed significant chatter in the deep and dark web concerning the arrest. Operators of the Telegram channel Hydra Market REBUILD have accused BreachForums admins of being negligent in operational security and of exposing the IP addresses of forum users. They even claim to have forwarded the admins’ IP details to law enforcement and are now trying to lure the underground hacking community to their marketplace instead, touting it as more secure and private than BreachForums, a common practice within the hacking communities when a rival forum is facing increased scrutiny from law enforcement.

Recommendations:

• Follow ZeroFox Intelligence to remain updated on the latest happenings in the cyber underworld.
• There are concerns among the underground community that their BreachForums user details are in possession of law enforcement. In such a scenario, more arrests and a further crackdown on threat actors involved in illegal information sharing and illicit cyber activity are likely.
• The vacuum created by the possible shutdown of BreachForums (both the clearnet and the TOR versions of the website are inaccessible at the time of writing) could be leveraged by a new platform by announcing its arrival with a bang–possibly by posting a large data leak package.

TikTok Banned on Devices Linked to New Zealand’s Government Network

The New Zealand government took a stand to ban the Chinese video-sharing app TikTok on all devices with access to the country’s parliamentary network by the end of March. Cyber concerns are mounting globally over TikTok’s potential to allow the Chinese government to access its users’ location and contact data through ByteDance, TikTok’s parent company. Concerns increased last week when the Biden Administration demanded ByteDance divest its stakes or face a U.S. TikTok ban. Britain banned use of the app on government phones last week, and U.S. government agencies have until the end of March to delete the app from official devices. Reacting to the recent bans, TikTok has rejected spying allegations and has indicated they are based on “fundamental misconceptions” driven by wider geopolitics, stressing the company has spent more than USD 1.5 billion on rigorous data-security efforts. A Chinese foreign ministry spokesperson stated that Britain and New Zealand should “stop over-extending and abusing the concept of national security, and provide a fair and non-discriminatory environment to companies from all countries.”

Recommendations:

• Consider the privacy risks associated with TikTok and whether it is worth having the app installed on your devices.
• If you elect to use TikTok, do not give the app permission to access your phone, opt out of personalized ads, create a private profile versus a public one, and ensure no sensitive or personal data is listed in account bios.

Hitachi Energy Latest Victim of Clop GoAnywhere Cyberattack

Japanese engineering and technology giant Hitachi Energy is the latest victim of the Clop ransomware gang’s exploitation of the GoAnywhere zero-day vulnerability. Hitachi issued a statement noting it has disconnected the third-party system and engaged forensic IT experts to help analyze the nature and scope of the attack. Hitachi has also informed employees that may have been affected and notified applicable data privacy, security, and law-enforcement authorities. At this time, Hitachi does not believe its network operations or the security of its customer data has been compromised. The Fortra GoAnywhere MFT (Managed File Transfer) zero-day vulnerability (CVE-2023-0669) was first disclosed on February 3, 2023, and has affected more than 100 organizations across the globe.

Recommendations:

• Update GoAnywhere MFT software to version 7.1.2 as soon as possible to protect against the exploitation of the zero-day vulnerability.
• Follow ZeroFox Intelligence to remain up-to-date on emerging threats.

New GoLang-Based HinataBot Exploiting Router and Server Flaws for DDoS Attacks

HinataBot, a new Golang-based botnet, has been observed exploiting known flaws to compromise routers and servers and use them to stage distributed denial-of-service (DDoS) attacks. The malware binaries have been named after a character from the TV anime series Naruto. The threat actors have been active since December 2022; newer artifacts have been detected this month, indicating that HinataBot is still in active development and evolving. While early versions of the botnet utilized various protocols, the latest iteration is limited to HTTP and UDP.

Recommendations:

• Regularly patch systems and devices to mitigate the risk of exploitation by malware like HinataBot.
• Implement multi-layered security measures to protect against DDoS attacks. These measures should include firewalls, intrusion detection and prevention systems, and anti-malware software.
• It is also essential to monitor network traffic for suspicious activity and be prepared to respond quickly in the event of an attack.

NBA Alerts Fans of Data Breach Exposing Personal Information

The NBA has reported its third-party newsletter service suffered a security breach, potentially compromising the personal data of its fans. In the notice sent to an undisclosed number of affected fans, the NBA assured its users that their login credentials had not been affected in the breach; however, their names and email addresses were obtained by the threat actors. The NBA has hired cybersecurity experts to investigate the incident and analyze the scope of the impact.

Recommendations:

• NBA fans should be wary of communications that appear to be from the NBA or its partners, as these could be phishing or other social engineering attacks using the breached information; the NBA will never send notifications seeking fans’ account information, such as usernames or passwords.
• Organizations should carefully vet and monitor third-party service providers that handle sensitive data, such as personal information, to ensure they have adequate security measures in place.
• Affected NBA should verify any incoming emails are sent from a legitimate "@nba.com" email address, check that embedded links point to a trusted website, and never open email attachments they are not expecting to receive.

Telegram and WhatsApp Trojanized to Target Cryptocurrency Wallets

Security researchers have discovered dozens of websites distributing malicious versions of WhatsApp and Telegram installers that target Android and Windows. These malicious apps use clipper malware to steal or modify the contents of the Android clipboard, with the aim of stealing victims’ cryptocurrency funds. Some of the apps abused optical character recognition to extract mnemonic phrases from images saved on victims’ devices. While several of these apps were trivial to modify for the threat actors as they were open source, WhatsApp's source code was not publicly available and required attackers to perform an in-depth analysis before repackaging the application with malicious code. The researchers also found that Windows versions of the malware included remote access trojans, which could potentially grant attackers control over victims’ machines. The malicious apps mainly targeted Chinese-speaking users.

Recommendations:

• Avoid downloading apps from third-party websites; only download apps from official app stores or trusted sources.
• Keep operating systems and software up to date. Regularly check for software updates and patches to ensure devices are protected from known vulnerabilities that cyber criminals may exploit.
• Use a reputable antivirus to scan devices for malicious software at regular intervals to detect and remove malware before it can cause harm to a device or steal sensitive information.