ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - March 22, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
New ShellBot DDoS Malware Variants Targeting Poorly Managed Linux Servers
Notorious Hacking Forum Shuts Down After Administrator Gets Arrested
Ransomware Will Likely Target OT Systems in EU Transport Sector
Sharing Sensitive Business Data with ChatGPT Could Be Risk

Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products

Several serious vulnerabilities have been identified in human-machine interface (HMI) and supervisory control and data acquisition (SCADA) products from UK-based industrial software maker Aveva. Security advisories published by Aveva and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) inform users about three vulnerabilities in the InTouch Access Anywhere HMI and Plant SCADA Access Anywhere products. Software updates to patch the vulnerabilities are available.

The most severe vulnerability, CVE-2022-23854, allows an unauthenticated attacker with network access to read files on the system outside the secure gateway web server. InTouch Access Anywhere Gateway instances are often exposed to the internet, making them vulnerable to remote attackers. Other flaws include a critical OpenSSL bug and a medium-severity issue related to the use of a vulnerable version of jQuery.

Recommendations:

Update the affected Aveva software to the latest version to patch all vulnerabilities.
Limit network access to the secure gateway, especially from the internet.
Monitor systems for any signs of unauthorized access or intrusion.
Ensure regular security audits and vulnerability assessments are conducted on HMI and SCADA systems.
Use ZeroFox Intelligence to stay informed about new vulnerabilities and advisories from Aveva, CISA, and other relevant agencies.

New ShellBot DDoS Malware Variants Targeting Poorly Managed Linux Servers

Linux SSH servers with poor management are being targeted in a new campaign that deploys various versions of ShellBot malware. ShellBot, also known as PerlBot, is a distributed denial-of-service (DDoS) bot malware developed in Perl that uses the internet relay chat (IRC) protocol to communicate with its command and control server. It is installed on servers with weak credentials after threat actors use scanner malware to identify systems with an open SSH port 22.ShellBot can execute DDoS attacks and exfiltrate harvested data upon receiving commands. The campaign coincides with a reported increase in DDoS attacks targeting healthcare organizations that are hosted on Microsoft Azure.

Recommendations:

Strengthen SSH server credentials and employ multi-factor authentication to reduce the risk of unauthorized access.
Regularly update and patch systems to protect against known vulnerabilities.
Monitor network traffic for unusual or unauthorized activities, particularly related to IRC protocol.
Limit access to SSH port 22, and close any unnecessary open ports.
Stay informed about emerging threats, vulnerabilities, and security recommendations by following ZeroFox.

Notorious Hacking Forum Shuts Down After Administrator Gets Arrested

After the FBI’s arrest of "Pompompurin," the administrator of notorious cybercrime website BreachForums, its new administrator, "Baphomet," announced the forum's permanent shutdown. BreachForums was created after a coalition of international law enforcement agencies seized another infamous cybercrime forum, RaidForums. Despite shutting down BreachForums, Baphomet claimed that they would be back with something new and better for the community.

Recommendations:

Use ZeroFox to monitor online forums and communication channels for updates on the new forum or community promised by Baphomet.
Stay vigilant for potential new cybercrime forums emerging in the aftermath of BreachForums' shutdown.

Ransomware Will Likely Target OT Systems in EU Transport Sector

Ransomware has become the top threat to the European Union (EU) transport sector, with an increase in cyberattacks targeting aviation, maritime, railway, and road transport organizations between January 2021 and October 2022. The European Union Agency for Cybersecurity (ENISA) warns that ransomware groups are likely to target and disrupt operational technology (OT) systems in the near future. Financial gain, operational disruption, and espionage are the primary motivations for these attacks, with cybercriminals accounting for 54 percent of the incidents.

Recommendations:

Strengthen cybersecurity measures and protocols within transport organizations to protect against ransomware and other cyber threats.
Implement regular employee training on cyber threats and prevention, focusing on ransomware, phishing, and other attack vectors.
Keep software and systems up to date, patching known vulnerabilities to reduce the risk of exploitation by threat actors.
Implement robust backup and recovery processes for critical data and systems to minimize downtime and the impact of a ransomware attack.

Sharing Sensitive Business Data with ChatGPT Could Be Risky

ChatGPT's potential to expose sensitive business data has raised concerns among security experts. Although ChatGPT does not store users' input data, the data may still be visible to the organization providing the large language model (LLM), such as OpenAI, and may be used for future model development. According to experts, sensitive data currently makes up 11 percent of what employees paste into ChatGPT, with the average company leaking sensitive data to ChatGPT hundreds of times each week.

Recommendations:

Educate users about the potential risks of sharing sensitive information with ChatGPT and establish clear guidelines on what data should not be disclosed.
Update information protection policies to specify acceptable applications for handling confidential data.
Implement secure web gateways and data loss prevention policies to monitor and control the data submitted to AI tools like ChatGPT.