ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - March 21, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

Ferrari Customers’ Data Leaked, Ransom Demanded
Project Claiming to be “AI-Powered” Drains Nearly a Million Dollars from Users
Over 90,000 Credentials Stolen from Almost 18,000 Websites by Mispadu Trojan
Google Pixel Flaw Allowed Recovery of Redacted, Cropped Images
New DotRunpeX Malware Delivers Multiple Malware Families via Malicious Ads

Ferrari Customers’ Data Leaked, Ransom Demanded

Names, postal and email addresses, and telephone numbers of customers of Italian luxury carmaker Ferrari have been compromised after a ransomware attack on the company’s IT systems. The company also confirmed that the breach has had no impact on its operational functions and that no payment details, bank account numbers, payment information, or details of Ferrari cars owned or ordered were accessed. Ferrari has refused to pay any ransom and has asserted that doing so funds criminal activity and encourages threat actors to perpetuate their attacks. The company is working with third-party experts to reinforce its systems.

Recommendations:

Ferrari owners should be wary of potential phishing attempts, as threat actors typically use compromised information in follow-on attacks.
Data protection services, such as those provided by ZeroFox’s IDX, can alert victims of any misuse of their personal information.
Organizations that retain customer data should follow basic cyber hygiene to protect it: deploying software updates and patches, following the principle of least privilege information access, using a strong password policy with periodic changes, and enabling multi-factor authentication (MFA).

Project Claiming to be “AI-Powered” Drains Nearly a Million Dollars from Users

A cryptocurrency project called Harvest Keeper promised users an automated trading platform powered by artificial intelligence (AI) that would generate a 101 percent return on investments within three weeks. Unsurprisingly, the project turned out to be a scam, with the operators disappearing after stealing over USD 930,000 of user funds. ZeroFox Intelligence notes that criminals often launch scam cryptocurrency projects that claim to be associated with globally-trending topics of the moment; the spike in popularity of AI, led by the growing adoption of ChatGPT, has encouraged cybercriminals to incorporate “AI” as a lure while creating fraudulent crypto projects. During the last crypto bull run in 2020-21, scammers used the spectacular rise of Dogecoin (in part due to Elon Musk’s endorsement of the coin) to create similar, fraudulent dog-themed coins. While some like Shiba Inu generated significant profits for early investors, most such projects turn out to be scams benefitting only the project team at the investors’ expense.

Recommendations:

Cryptocurrency enthusiasts should avoid investing in topic-of-the-moment themed projects, as they are likely to be fraudulent offers. Due diligence is crucial while investing in cryptocurrency.
Revoke all wallet permissions granted to known malicious platforms.
Be wary of all communications from people purporting to be administrators of Harvest Keeper or any other defunct projects. Scammers often conduct follow-on attacks using compromised user details.
Never reveal backup codes or seed phrases to anyone, as this code can be used to gain total control over digital assets.

Over 90,000 Credentials Stolen from Almost 18,000 Websites by Mispadu Trojan

Cybersecurity researchers have identified 20 different spam campaigns that use the Mispadu banking trojan to target victims in Latin America. The campaign commenced in August 2022 and has stolen 90,518 credentials of users in Bolivia, Chile, Mexico, Peru, and Portugal from 17,595 unique websites—including 105 government websites in Chile, 431 in Mexico, and 265 in Peru. Mispadu is reportedly capable of perpetrating monetary and credential theft and acting as a backdoor by taking screenshots and capturing keystrokes. The trojan features novel techniques to facilitate infection and maintain persistence that include fake certificates to obfuscate initial state malware, new NET-based backdoor-enabling screenshot capabilities, and phony pop-up windows that prompt victims to click on specific links.

Recommendations:

Users should be wary of opening HTML attachments received from unknown senders and entering credentials into pop-up windows on websites they visit.
Website operators should ensure they maintain up-to-date versions of all software in order to mitigate the risk of compromise by threat actors seeking to make use of legitimate sites.
Although infection rates of corporate users are currently low, organizations should anticipate these campaigns will eventually slip through antivirus protections and work on fortifying their detection and response capabilities.

Google Pixel Flaw Allowed Recovery of Redacted, Cropped Images

The "Acropalypse" flaw (CVE-2023-21036) in Google Pixel's Markup tool allowed attackers to recover edited or redacted images from the past five years. The flaw allowed roughly 80 percent of the original image to be recoverable, which could expose sensitive information redacted using the Markup tool. Google fixed the issue via an update released on March 13, 2023; however, images shared in the past five years are vulnerable, and there is no remedy for this. The flaw affects all Pixel models running Android 9 Pie and could affect non-Pixel smartphones that use the Markup tool for screenshot/image editing.

Recommendations:

Update Android devices to the patched version released by Google on March 13, 2023, to mitigate this security flaw. It is important to keep devices and software up-to-date to ensure they have the latest security features and bug fixes and to protect against newly-discovered vulnerabilities.
Follow ZeroFox Intelligence to remain up-to-date on emerging threats.

New DotRunpeX Malware Delivers Multiple Malware Families via Malicious Ads

Researchers have identified a new strain of malware called dotRunpeX that is being used to distribute well-known malware families, including Agent Tesla, Ave Maria, BitRAT, FormBook, LokiBot, NetWire, Raccoon Stealer, RedLine Stealer, Remcos, Rhadamanthys, and Vidar. This new injector is written in .NET and employs the Process Hollowing technique to infect systems. It is usually deployed via a downloader transmitted through phishing emails as malicious attachments or through malicious Google Ads. The findings suggest that dotRunpeX could be affiliated with Russian-speaking actors based on language references in the code.

Recommendations:

DotRunpeX targets specific anti-malware processes to disable them. Ensure that anti-malware software is always up-to-date to reduce the risk of malware infiltration.
As DotRunpeX is often deployed via phishing emails as malicious attachments, verify the source of an email before opening any attachment—especially if it is unexpected or from an unknown sender.