Threat Intelligence Bulletin: 03/10/2023 - 03/17/2023

Microsoft Patch Tuesday 03/15/2023 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may affect our customers.

Report: https://cloud.zerofox.com/intelligence/advisories/19954

ZeroFox Daily Intelligence Brief: 03/10/2023 - 03/16/2023

ZeroFox Daily Intelligence Brief - March 13, 2023

Key Findings

• HC3 Sheds Light on Data Exfiltration Trends in Healthcare Cyberattacks
• SEC Charges Software Company Blackbaud Inc. for Misleading Disclosures About Ransomware Attack that Impacted Charitable Donors
• Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant
• As Many as 3.1 Million Patients’ Sensitive Information Leaked by a California-Based Health Startup
• North Korea Hackers Targeting Security Researchers with Malware Through Job Offers on LinkedIn
• Healthcare Providers Sued over Ransomware Attack and Data Breach In Pennsylvania

Report: https://cloud.zerofox.com/intelligence/advisories/19920

ZeroFox Daily Intelligence Brief - March 14, 2023

Key Findings

• Euler DeFi Protocol Exploited for Nearly USD 200 Million
• AI-Generated YouTube Video Tutorials Spreading Infostealer Malware
• CISA Launches Ransomware Vulnerability Warning Pilot (RVWP)
• Over a Dozen Vulnerabilities Unearthed in Chinese Smart Intercom Devices

Report: https://cloud.zerofox.com/intelligence/advisories/19938

ZeroFox Daily Intelligence Brief - March 15, 2023

Key Findings

• Cybercriminals Exploit Silicon Valley Bank Collapse to Steal Money and Data
• SAP Releases Security Patches for March 2023: 19 Vulnerabilities, Including Five Critical, Patched
• Over USD Two Billion of Cryptocurrency Lost to Cybercriminals
• Rubrik Confirms Breach of Information After GoAnywhere Zero-Day Bug Exploit
• Microsoft Alerts of Large-Scale Use of Phishing Kits to Send Millions of Emails Daily

Report: https://cloud.zerofox.com/intelligence/advisories/19955

ZeroFox Daily Intelligence Brief - March 16, 2023

Key Findings

• Safety Concerns Over OpenAI’s Large Language Model, GPT-4
• U.S. Justice Department Investigation Leads to Takedown of Darknet Cryptocurrency Mixer
• Healthcare Provider Data Breach Puts Personal Information of 4.2 Million at Risk
• WhatsApp Agrees to Implement European Union Rules to Improve Transparency
• Guidance Released on Managing Legacy Medical Tech Security
• Data of 300,000 Customers of Latitude Financial Stolen in a Cyberattack

Report: https://cloud.zerofox.com/intelligence/advisories/19965

Breach Disclosures: 03/10/2023 - 03/16/2023

Breach Disclosure: Intimshop

An alleged data breach at Intimshop – a Russia-based online store for sex toys – exposed 126,884 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19921

Breach Disclosure: SCUF

An alleged data breach at SCUF – a U.S.-based gaming controllers store – exposed 128,911 email addresses, hashed passwords, and/or usernames, which were subsequently shared on several deep web platforms.

Report: https://cloud.zerofox.com/intelligence/advisories/19922

Breach Disclosure: Open Screenplay

An alleged data breach at Open Screenplay – a Canada-based online platform and marketplace – exposed 4,796 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19923

Breach Disclosure: Hoang Do Asia

An alleged data breach at Hoang Do Asia – a Germany-based restaurant – exposed 773 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19937

Breach Disclosure: BigMoneyJobs

An alleged data breach at BigMoneyJobs – a U.S.-based online job seeking website – exposed 36,784 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19947

Breach Disclosure: Спрашивай

An alleged data breach at Спрашивай – a Russia-based social networking site – exposed 3,472,755 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19948

Breach Disclosure: 9lives

An alleged data breach at 9lives – a Belgium – based online gaming site – exposed 109,531 email addresses, hashed passwords and/or usernames, which were subsequently shared on several deep web platforms.

Report: https://cloud.zerofox.com/intelligence/advisories/19949

Breach Disclosure: MeFeedia

An alleged data breach at MeFeedia – a U.S.-based media search website – exposed 1,633,902 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19950

Breach Disclosure: GamerSoul

An alleged data breach at GamerSoul – a Bahamas-based online gaming site – exposed 152,247 email addresses and hashed passwords, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19951

Breach Disclosure: Gainful

An alleged data breach at Gainful – a U.S.-based online personalized protein powder retail company – exposed 102,428 email addresses, which were subsequently shared on several deep web platforms.

Report: https://cloud.zerofox.com/intelligence/advisories/19952

Breach Disclosure: Auphan

An alleged data breach at Auphan – a Canada-based review platform for games, movies etc – exposed 46,897 email addresses, hashed password and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19953

Breaking News: 2023-03-10 - 2023-03-16

Medusa ransomware gang picks up steam as it targets companies worldwide

A ransomware operation known as Medusa has begun to pick up steam in 2023, targeting corporate victims worldwide with million-dollar ransom demands.

See the full report here: https://www.bleepingcomputer.com/news/security/medusa-ransomware-gang-picks-up-steam-as-it-targets-companies-worldwide/

CASPER attack steals data using air-gapped computer's internal speaker

Researchers from Seoul, have presented a new covert channel attack named CASPER can leak data from air-gapped computers to a nearby smartphone at a rate of 20bits/sec.

See the full report here: https://www.bleepingcomputer.com/news/security/casper-attack-steals-data-using-air-gapped-computers-internal-speaker/

Clop ransomware gang begins extorting GoAnywhere zero-day victims

The Clop ransomware gang has begun extorting companies whose data was stolen using a zero-day vulnerability in the Fortra GoAnywhere MFT secure file-sharing solution.

See the full report here: https://www.bleepingcomputer.com/news/security/clop-ransomware-gang-begins-extorting-goanywhere-zero-day-victims/

CISA warns of actively exploited Plex bug after LastPass breach

CISA has added an almost three-year-old high-severity remote code execution (RCE) vulnerability in the Plex Media Server to its catalog of security flaws exploited in attacks. Tracked as CVE-2020-5741, this security flaw allows threat actors with admin privileges to execute arbitrary Python code remotely in low-complexity attacks that don't require user interaction.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-of-actively-exploited-plex-bug-after-lastpass-breach/

Brazil seizing Flipper Zero shipments to prevent use in crime

The Brazilian National Telecommunications Agency is seizing incoming Flipper Zero purchases due to its alleged use in criminal activity, with purchasers stating that the government agency has rejected all attempts to certify the equipment.

See the full report here: https://www.bleepingcomputer.com/news/security/brazil-seizing-flipper-zero-shipments-to-prevent-use-in-crime/

New GoBruteforcer malware targets phpMyAdmin, MySQL, FTP, Postgres

A newly discovered Golang-based botnet malware scans for and infects web servers running phpMyAdmin, MySQL, FTP, and Postgres services. According to cybersecurity researchers, who first spotted it in the wild and dubbed it GoBruteforcer, the malware is compatible with x86, x64, and ARM architectures. GoBruteforcer will brute force accounts with weak or default passwords to hack into vulnerable *nix devices.

See the full report here: https://www.bleepingcomputer.com/news/security/new-gobruteforcer-malware-targets-phpmyadmin-mysql-ftp-postgres/

Security researchers targeted with new malware via job offers on LinkedIn

A suspected North Korean hacking group is targeting security researchers and media organizations in the U.S. and Europe with fake job offers that lead to the deployment of three new, custom malware families.

See the full report here: https://www.bleepingcomputer.com/news/security/security-researchers-targeted-with-new-malware-via-job-offers-on-linkedin/

Blackbaud to pay USD 3M for misleading ransomware attack disclosure

Cloud software provider Blackbaud has agreed to pay USD 3 million to settle charges brought by the Securities and Exchange Commission (SEC), alleging that it failed to disclose the full impact of a 2020 ransomware attack. The organizations impacted by the incident include many entities, such as charities, foundations, non-profits, and universities worldwide, from the U.S., Canada, the U.K., and the Netherlands.

See the full report here: https://www.bleepingcomputer.com/news/security/blackbaud-to-pay-3m-for-misleading-ransomware-attack-disclosure/

Mental health provider Cerebral alerts 3.1M people of data breach

Healthcare platform Cerebral is sending data breach notices to 3.18 million people who have interacted with its websites, applications, and telehealth services. Cerebral is a remote telehealth company that provides online therapy and medication management for various mental health conditions, including anxiety, depression, ADHD, Bipolar Disorder, and substance abuse.

See the full report here: https://www.bleepingcomputer.com/news/security/mental-health-provider-cerebral-alerts-31m-people-of-data-breach/

Xenomorph Android malware now steals data from 400 banks

The Xenomorph Android malware has released a new version that adds significant capabilities to conduct malicious attacks, including a new automated transfer system (ATS) framework and the ability to steal credentials for 400 banks.

See the full report here: https://www.bleepingcomputer.com/news/security/xenomorph-android-malware-now-steals-data-from-400-banks/

Acronis Clarifies Hack Impact Following Data Leak

The CISO of Acronis has downplayed what appeared to be an intrusion into its systems, insisting only one customer was affected, using stolen credentials, and that all other data remains safe.

See the full report here: https://www.theregister.com/2023/03/10/acronis_data_breach_details/

Fortinet: New FortiOS bug used as zero-day to attack govt networks

Attackers used zero-day exploits to exploit a new FortiOS bug, targeting government and large organizations. These attacks have led to OS and file corruption as well as data loss. Fortinet released security updates on March 7, 2023, to address the high-severity security vulnerability (CVE-2022-41328) which allowed threat actors to execute unauthorized code or commands.

See the full report here: https://www.bleepingcomputer.com/news/security/fortinet-new-fortios-bug-used-as-zero-day-to-attack-govt-networks/

LA housing authority discloses data breach after ransomware attack

The Housing Authority of the City of Los Angeles (HACLA) is warning of a data security event after the LockBit ransomware gang targeted the organization and leaked data stolen in the attack. HACLA is a state-chartered agency that provides affordable housing to low-income individuals and families in Los Angeles, California.

See the full report here: https://www.bleepingcomputer.com/news/security/la-housing-authority-discloses-data-breach-after-ransomware-attack/

Hackers steal USD 197 million in crypto in Euler Finance attack

Lending protocol Euler Finance was hit by a cryptocurrency flash loan attack on with the threat actor stealing USD 197 million in multiple digital assets. The cryptocurrency theft involved multiple tokens, including USD 8.75 million worth of DAI, USD 18.5 million in WBTC, USD 33.85 million in USDC, and USD 135.8 million in stETH. The attacker's ETH wallet used to store the stolen funds is being tracked, so it will be challenging for the perpetrator to move the stolen funds around and convert them to a usable form.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-steal-197-million-in-crypto-in-euler-finance-attack/

STALKER 2 game developer hacked by Russian hacktivists, data stolen

GSC Game World, the developer of the highly-anticipated "STALKER 2: Heart of Chornobyl" game warned their systems were breached allowing threat actors to steal game assets during the attack. The Ukrainian game publisher says that a community from a Russian social network was behind the attack and is blackmailing the company by threatening to release data for Stalker 2.

See the full report here: https://www.bleepingcomputer.com/news/security/stalker-2-game-developer-hacked-by-russian-hacktivists-data-stolen/

Zoll Medical says intruders had 1M+ patient, staff records at their fingertips

Medical device and software maker Zoll Medical says the personal and health information of more than a million people, including patients and employees may have been stolen by threat actors.

See the full report here: https://www.theregister.com/2023/03/13/zoll_medical_data_intrusion/

Large-scale Cyber Attack Hijacks East Asian Websites for Adult Content Redirects

Since early September 2022, a broad-reaching malicious cyber operation has hijacked thousands of websites targeting East Asian audiences. Visitors to these sites are redirected to adult-themed content. The ongoing campaign involves injecting malicious JavaScript code into the hacked websites, with the threat actor frequently using legitimate FTP credentials obtained via an unknown method to connect to the target web server.

See the full report here: https://thehackernews.com/2023/03/large-scale-cyber-attack-hijacks-east.html

Fake ChatGPT Chrome Extension Hijacking Facebook Accounts for Malicious Advertising

A fake ChatGPT-branded Chrome browser extension has been found to come with capabilities to hijack Facebook accounts and create rogue admin accounts, highlighting one of the different methods cyber criminals are using to distribute malware.

See the full report here: https://thehackernews.com/2023/03/fake-chatgpt-chrome-extension-hijacking.html

Warning: AI-generated YouTube Video Tutorials Spreading Infostealer Malware

Threat actors have been increasingly using AI-generated YouTube videos to distribute a range of stealer malware, including Raccoon, RedLine, and Vidar. These videos lure users by pretending to be tutorials on how to download cracked versions of licensed software such as Photoshop, Premiere Pro, Autodesk 3ds Max, AutoCAD, and other products that are available only to paid users.

See the full report here: https://thehackernews.com/2023/03/warning-ai-generated-youtube-video.html

Researchers Uncover Over a Dozen Security Flaws in Akuvox E11 Smart Intercom

Over a dozen security flaws have been revealed in Akuvox's E11, a smart intercom product. These vulnerabilities could allow attackers to remotely execute code, enabling them to control the device's camera and microphone, steal video and images, or establish a foothold on the network.

See the full report here: https://thehackernews.com/2023/03/researchers-uncover-over-dozen-security.html

KamiKakaBot Malware Used in Latest Dark Pink APT Attacks on Southeast Asian Targets

The Dark Pink advanced persistent threat (APT) group has been linked to a new series of attacks targeting government and military entities in Southeast Asian countries using a malware called KamiKakaBot.

See the full report here: https://thehackernews.com/2023/03/kamikakabot-malware-used-in-latest-dark.html

BATLOADER Malware Uses Google Ads to Deliver Vidar Stealer and Ursnif Payloads

The malware downloader BATLOADER has been observed exploiting Google Ads to deliver secondary payloads such as Vidar Stealer and Ursnif. The malicious ads are designed to spoof a variety of legitimate apps and services, including Adobe, OpenAPI's ChatGPT, Spotify, Tableau, and Zoom.

See the full report here: https://thehackernews.com/2023/03/batloader-malware-uses-google-ads-to.html

New Version of Prometei Botnet Infects Over 10,000 Systems Worldwide

An updated version of the Prometei botnet malware has infected over 10,000 systems worldwide since November 2022. The targets appear to be random without regard for location or specific targets, with most of the victims reported in Brazil, Indonesia, and Turkey.

See the full report here: https://thehackernews.com/2023/03/new-version-of-prometei-botnet-infects.html

Ransomware Group Claims Hack of Amazon's Ring

A ransomware gang known as ALPHV utilizing the BlackCat malware has claimed responsibility for breaching Ring, a popular security camera company owned by Amazon. The gang is now threatening to release Ring's data. Ring has improved its security practices after hackers exploited weaknesses in the default security settings, although Ring itself was not compromised during the incidents.

See the full report here: https://www.vice.com/en/article/qjvd9q/ransomware-group-claims-hack-of-amazons-ring

Microsoft Warns of Large-Scale Use of Phishing Kits to Send Millions of Emails Daily

An open source adversary-in-the-middle (AiTM) phishing kit has found a number of takers in the cybercrime world for its ability to orchestrate attacks at scale. Microsoft Threat Intelligence is tracking the threat actor behind the development of the kit under the name DEV-1101.

See the full report here: https://thehackernews.com/2023/03/microsoft-warns-of-large-scale-use-of.html

SAP releases security updates fixing five critical vulnerabilities

Software vendor SAP has released security updates for 19 vulnerabilities, five rated as critical, meaning that administrators should apply them as soon as possible to mitigate the associated risks. The flaws though fixed impact many products, but the critical severity bugs affect SAP Business Objects Business Intelligence Platform (CMC) and SAP NetWeaver.

See the full report here: https://www.bleepingcomputer.com/news/security/sap-releases-security-updates-fixing-five-critical-vulnerabilities/

Rubrik confirms data theft in GoAnywhere zero-day attack

Cybersecurity company Rubrik has confirmed that its data was stolen using a zero-day vulnerability in the Fortra GoAnywhere secure file transfer platform.

See the full report here: https://www.bleepingcomputer.com/news/security/rubrik-confirms-data-theft-in-goanywhere-zero-day-attack/

Microsoft fixes Outlook zero-day used by Russian hackers since April 2022

Microsoft has patched an Outlook zero-day vulnerability (CVE-2023-23397) exploited by a hacking group linked to Russia's military intelligence service GRU to target European organizations. The security flaw was exploited in attacks to target and breach the networks of fewer than 15 government, military, energy, and transportation organizations between mid-April and December 2022.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-outlook-zero-day-used-by-russian-hackers-since-april-2022/

FBI warns of spike in "pig butchering" crypto investment schemes

The Federal Bureau of Investigation (FBI) has issued a public service announcement stating that Americans are being increasingly targeted in "pig butchering" cryptocurrency investment schemes. This has resulted in victims in the United States reporting the loss of over USD 2 billion worth of cryptocurrency to cybercriminals.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-spike-in-pig-butchering-crypto-investment-schemes/

Cybercriminals exploit SVB collapse to steal money and data

The collapse of the Silicon Valley Bank (SVB) on March 10, 2023, has provided an opportunity for hackers, scammers, and phishing campaigns. Multiple security researchers have reported that threat actors are already registering suspicious domains, creating phishing pages, and preparing for business email compromise (BEC) attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/cybercriminals-exploit-svb-collapse-to-steal-money-and-data/

YoroTrooper cyberspies target CIS energy orgs, EU embassies

Since at least June 2022, a new threat actor named "YoroTrooper" has been conducting cyber-espionage campaigns targeting government and energy organizations in the Commonwealth of Independent States (CIS) countries.

See the full report here: https://www.bleepingcomputer.com/news/security/yorotrooper-cyberspies-target-cis-energy-orgs-eu-embassies/

Hawaii Announces Security Breach of Death Registry System

The Department of Health has announced that approximately 3,400 death records were accessed without authorization on January 20, 2023. The agency has stated that no death certificates were accessed or generated during this incident.

See the full report here: https://www.governing.com/security/hawaii-announces-security-breach-of-death-registry-system

​​​​​​​Latitude Financial hit by cyber attack, more than 300,000 identity documents stolen

Latitude Financial, a company that issues consumer loans and runs a buy now pay later scheme used by major retailers has revealed hackers have stolen the personal information of more than 300,000 customers, including drivers licences.

See the full report here: https://www.abc.net.au/news/2023-03-16/latitude-hack-300000-identity-documents-stolen/102104424

IP firm IPH is latest Australian company to suffer data breach

IPH Ltd (IPH.AX), an intellectual property (IP) services provider reported a data breach in a portion of its IT systems. IPH said that it detected unauthorised access to document management systems, which include administrative documents, and some client documents and correspondence, at its head office and two member firms, Spruson & Ferguson (Australia) and Griffith Hack.

See the full report here: https://www.reuters.com/technology/australias-iph-detects-breach-it-systems-2023-03-15/

CISA warns of Adobe ColdFusion bug exploited as a zero-day

CISA has added a critical vulnerability impacting Adobe ColdFusion versions 2021 and 2018 to its catalog of security bugs exploited in the wild. This critical arbitrary code execution flaw (CVE-2023-26360) is due to an Improper Access Control weakness, and it can be abused remotely by unauthenticated attackers in low-complexity attacks that don't require user interaction.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-of-adobe-coldfusion-bug-exploited-as-a-zero-day/

LockBit ransomware claims Essendant attack, company says “network outage”

LockBit ransomware has claimed a cyber attack on Essendant, a wholesale distributer of office products after an ongoing outage knocked the company's operations offline. Essendant's wide-spread network outage has been preventing placement or fulfillment of online orders, and impacting both the company's customers and suppliers.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-claims-essendant-attack-company-says-network-outage-/

Hacker selling data allegedly stolen in US Marshals Service hack

A threat actor is selling on a Russian-speaking hacking forum what they claim to be hundreds of gigabytes of data allegedly stolen from U.S. Marshals Service (USMS) servers. USMS is a Justice Department bureau that provides support to the federal justice system by executing federal court orders, assuring the safety of government witnesses and their families, seizing illegally obtained assets, and more.

See the full report here: https://www.bleepingcomputer.com/news/security/hacker-selling-data-allegedly-stolen-in-us-marshals-service-hack/

US federal agency hacked using old Telerik bug to steal data

A U.S. federal agency's Microsoft Internet Information Services (IIS) web server was hacked by exploiting a critical .NET deserialization vulnerability in the Progress Telerik UI for ASP.NET AJAX component. According to a joint advisory issued today by CISA, the FBI, and MS-ISAC, the attackers had access to the server between November 2022 and early January 2023 based on indicators of compromise (IOCs) found on the unnamed federal civilian executive branch (FCEB) agency's network.

See the full report here: https://www.bleepingcomputer.com/news/security/us-federal-agency-hacked-using-old-telerik-bug-to-steal-data/

Healthcare provider ILS warns 4.2 million people of data breach

Independent Living Systems (ILS), a Miami-based healthcare administration and managed care solutions provider, suffered a data breach that exposed the personal information of 4,226,508 individuals. The number of impacted individuals makes this the largest data breach in the healthcare sector disclosed in 2023.

See the full report here: https://www.bleepingcomputer.com/news/security/healthcare-provider-ils-warns-42-million-people-of-data-breach/

ChipMixer platform seized for laundering ransomware payments, drug sales

An international law enforcement operation has seized the cryptocurrency mixing service "ChipMixer" which is said to be used by hackers, ransomware gangs, and scammers to launder their proceeds. The operation was conducted by Europol in coordination with law enforcement in Germany (BKA) and the United States (FBI), allowing the police to seize four servers, 7 TB of data, and USD 46.5 million worth of cryptocurrency (Bitcoin).

See the full report here: https://www.bleepingcomputer.com/news/security/chipmixer-platform-seized-for-laundering-ransomware-payments-drug-sales/

Two Men Charged for Breaching Federal Law Enforcement Database and Posing as Police Officers to Defraud Social Media Companies

Two individuals have been charged with wire fraud and conspiracy to commit computer intrusions in a federal court in Brooklyn. The individuals threatened to release the personal information of victims online after accessing a restricted database maintained by a law enforcement agency using a police officer's stolen password. The database contained records of narcotics and currency seizures, as well as law enforcement intelligence reports. One of the accused also accessed a foreign law enforcement officer's email account and used it to defraud social media companies.

See the full report here: https://www.justice.gov/usao-edny/pr/two-men-charged-breaching-federal-law-enforcement-database-and-posing-police-officers