Threat Intelligence Bulletin: 03/17/2023 - 03/23/2023

ZeroFox Daily Intelligence Brief: 03/17/2023 - 03/23/2023

ZeroFox Daily Intelligence Brief - March 20, 2023

Key Findings

• BreachForums Founder Pompompurin Arrested in New York
• TikTok Banned on Devices Linked to New Zealand’s Government Network
• Hitachi Energy Latest Victim of Clop GoAnywhere Cyberattack
• New GoLang-Based HinataBot Exploiting Router and Server Flaws for DDoS Attacks
• NBA Alerts Fans of Data Breach Exposing Personal Information
• Telegram and WhatsApp Trojanized to Target Cryptocurrency Wallets

Report: https://cloud.zerofox.com/intelligence/advisories/19989

ZeroFox Daily Intelligence Brief - March 21, 2023

Key Findings

• Ferrari Customers’ Data Leaked, Ransom Demanded
• Project Claiming to be “AI-Powered” Drains Nearly a Million Dollars from Users
• Over 90,000 Credentials Stolen from Almost 18,000 Websites by Mispadu Trojan
• Google Pixel Flaw Allowed Recovery of Redacted, Cropped Images
• New DotRunpeX Malware Delivers Multiple Malware Families via Malicious Ads

Report: https://cloud.zerofox.com/intelligence/advisories/20001

ZeroFox Daily Intelligence Brief - March 22, 2023

Key Findings

• Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
• New ShellBot DDoS Malware Variants Targeting Poorly Managed Linux Servers
• Notorious Hacking Forum Shuts Down After Administrator Gets Arrested
• Ransomware Will Likely Target OT Systems in EU Transport Sector
• Sharing Sensitive Business Data with ChatGPT Could Be Risk

Report: https://cloud.zerofox.com/intelligence/advisories/20014

ZeroFox Daily Intelligence Brief - March 23, 2023

Key Findings

• Hackers Using New Methods to Steal Credit Card Detail by Injecting Malicious Scripts into Payment Gateway
• Netgear’s Orbi 750 Series Routers’ PoC Exploits for Vulnerabilities Released
• CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management
• Nexus, an Emerging Android Banking Trojan Targets 450 Financial Apps

Report: https://cloud.zerofox.com/intelligence/advisories/20024

Breach Disclosures: 03/17/2023 - 03/23/2023

Breach Disclosure: LititApp

An alleged data breach at LititApp – a U.S.-based social media app – exposed 309,645 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19991

Breach Disclosure: iD Tech

An alleged data breach at iD Tech – a U.S.-based technology summer camp – exposed 416,517 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19992

Breach Disclosure: Tradebit

An alleged data breach at Tradebit – a U.S.-based digital content marketplace – exposed 5,032 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/19993

Breaking News: 2023-03-17 - 2023-03-23

New "HinataBot" botnet could launch massive 3.3 Tbps DDoS attacks

A new malware botnet was discovered targeting Realtek SDK, Huawei routers, and Hadoop YARN servers to recruit devices into DDoS swarm with the potential for massive attacks. Security researchers spotted the campaign exploiting old flaws such as CVE-2014-8361 and CVE-2017-17215.

See the full report here: https://www.bleepingcomputer.com/news/security/new-hinatabot-botnet-could-launch-massive-33-tbps-ddos-attacks/

Emotet malware now distributed in Microsoft OneNote files to evade defenses

The Emotet malware is now distributed through Microsoft OneNote email attachments, aiming to bypass Microsoft security restrictions and infect more targets.This access is used to conduct cyberattacks against the company, which could include ransomware attacks, data theft, cyber espionage, and extortion.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-now-distributed-in-microsoft-onenote-files-to-evade-defenses/

Alleged BreachForums owner Pompompurin arrested on cybercrime charges

U.S. law enforcement arrested a New York man believed to be Pompompurin, the owner of the BreachForums hacking forum. According to court documents, he was charged with one count of conspiracy to solicit individuals to sell unauthorized access devices.

See the full report here: https://www.bleepingcomputer.com/news/security/alleged-breachforums-owner-pompompurin-arrested-on-cybercrime-charges/

NBA alerts fans of a data breach exposing personal information

The NBA (National Basketball Association) is notifying fans of a data breach after some of their personal information held by a third-party newsletter service, was stolen. In "Notice of Cybersecurity Incident" emails sent to an unknown number of fans, NBA says its systems were not breached, and the affected fans' credentials were not impacted in this incident. However, some fans' personal information was stolen.

See the full report here: https://www.bleepingcomputer.com/news/security/nba-alerts-fans-of-a-data-breach-exposing-personal-information/

Hitachi Energy confirms data breach after Clop GoAnywhere attacks

Hitachi Energy confirmed it suffered a data breach after the Clop ransomware gang stole data using a zero-day GoAnywhere zero-day vulnerability. Hitachi Energy is a department of Japanese engineering and technology giant Hitachi focused on energy solutions and power systems. The attack was made possible by exploiting a zero-day vulnerability in the Fortra GoAnywhere MFT (Managed File Transfer), first disclosed on February 3, 2023, and now tracked as CVE-2023-0669.

See the full report here: https://www.bleepingcomputer.com/news/security/hitachi-energy-confirms-data-breach-after-clop-goanywhere-attacks/

RAT developer arrested for infecting 10,000 PCs with malware

Ukraine's cyberpolice has arrested the developer of a remote access trojan (RAT) malware that infected over 10,000 computers while posing as game applications. The 25-year-old offender was exposed by employees of the Khmelnychchyna Cybercrime Department together with the regional police investigative department and the SBU regional department.

See the full report here: https://www.bleepingcomputer.com/news/security/rat-developer-arrested-for-infecting-10-000-pcs-with-malware/

Microsoft shares script to fix WinRE BitLocker bypass flaw

Microsoft has released a script to make it easier to patch a BitLocker bypass security vulnerability in the Windows Recovery Environment (WinRE). This PowerShell script (KB5025175) simplifies the process of securing WinRE images against attempts to exploit the CVE-2022-41099 flaw that enables attackers to bypass the BitLocker Device Encryption feature system storage devices. According to Microsoft, the vulnerability cannot be exploited if the user has enabled BitLocker TPM+PIN protection.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-shares-script-to-fix-winre-bitlocker-bypass-flaw/

Chinese Hackers Exploit Fortinet Zero-Day Flaw for Cyber Espionage Attack

The zero-day exploitation of a now-patched medium-severity security flaw in the Fortinet FortiOS operating system has been linked to a suspected Chinese hacking group. The activity cluster is reportedly part of a broader campaign designed to deploy backdoors onto Fortinet and VMware solutions and maintain persistent access to victim environments.

See the full report here: https://thehackernews.com/2023/03/chinese-hackers-exploit-fortinet-zero.html

FakeCalls Vishing Malware Targets South Korean Users via Popular Financial Apps

An Android voice phishing malware campaign known as FakeCalls has resumed the targeting of South Korean users under the guise of over 20 popular financial apps. FakeCalls malware possesses the functionality of a Swiss army knife, able not only to conduct its primary aim but also to extract private data from the victim's device.

See the full report here: https://thehackernews.com/2023/03/fakecalls-vishing-malware-targets-south.html

Winter Vivern APT Group Targeting Indian, Lithuanian, Slovakian, and Vatican Officials

The advanced persistent threat known as Winter Vivern has been linked to campaigns targeting government officials in India, Lithuania, Slovakia, and the Vatican since 2021. The threat actor has engaged in steady activity and expanded its targeting to include prominent businesspeople and high-profile individuals that have either made large donations to Ukrainian humanitarian efforts or those making public statements about Russian disinformation and propaganda

See the full report here: https://thehackernews.com/2023/03/winter-vivern-apt-group-targeting.html

Ferrari discloses data breach after receiving ransom demand

Ferrari has disclosed a data breach following a ransom demand received after attackers gained access to some of the company's IT systems. The Italian luxury sports car maker says customer information exposed in the incident includes names, addresses, email addresses, and telephone numbers.

See the full report here: https://www.bleepingcomputer.com/news/security/ferrari-discloses-data-breach-after-receiving-ransom-demand/

General Bytes Bitcoin ATMs hacked using zero-day, USD 1.5 Million stolen

The Bitcoin ATM manufacturer General Bytes revealed that hackers used a zero-day vulnerability in its BATM management platform to steal cryptocurrency from the company and its customers. The attackers remotely uploaded a Java application via ATM's master service interface and exploited a zero-day vulnerability, which was traced as BATM-4780 and ran it with "batm" user privileges.

See the full report here: https://www.bleepingcomputer.com/news/security/general-bytes-bitcoin-atms-hacked-using-zero-day-15m-stolen/

Hackers target .NET developers with malicious NuGet packages

Cybersecurity researchers have reported that threat actors are targeting and infecting .NET developers with cryptocurrency stealers via the NuGet repository, using typosquatting to impersonate multiple legitimate packages. Researchers discovered that three of these packages were downloaded over 150,000 times within a month in an ongoing campaign.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-target-net-developers-with-malicious-nuget-packages/

New DotRunpeX Malware Delivers Multiple Malware Families via Malicious Ads

A new injector called dotRunpeX written in .NET is being used to distribute multiple known malware families such as Agent Tesla, Ave Maria, BitRAT, FormBook, LokiBot, NetWire, Raccoon Stealer, RedLine Stealer, Remcos, Rhadamanthys, and Vidar. There are signs that dotRunpeX could be affiliated to Russian-speaking actors based on the language references in the code.

See the full report here: https://thehackernews.com/2023/03/new-dotrunpex-malware-delivers-multiple.html

Mispadu Banking Trojan Targets Latin America: 90,000+ Credentials Stolen

A banking trojan called Mispadu has been linked to various spam campaigns targeting Bolivia, Chile, Mexico, Peru, and Portugal to steal credentials and deliver other payloads. Mispadu is equipped to gather the list of antivirus solutions installed on the compromised host, siphon credentials from Google Chrome and Microsoft Outlook, and facilitate the retrieval of additional malware.

See the full report here: https://thehackernews.com/2023/03/mispadu-banking-trojan-targets-latin.html

Meta Manager Was Hacked With Spyware and Wiretapped in Greece

Artemis Seaford, a dual U.S.-Greek national, was targeted with a cyberespionage tool while also under a wiretap by the Greek spy agency in a case that shows the spread of illicit snooping in Europe. The disclosure is the first known case of an American citizen being targeted in a European Union country by the advanced snooping technology, the use of which has been the subject of a widening scandal in Greece.

See the full report here: https://www.nytimes.com/2023/03/20/world/europe/greece-spyware-hacking-meta.html

Atlanta man sentenced to federal prison in connection with a multimillion-dollar international cyber and fraud scheme

An individual who organized a multi-million-dollar cyber-fraud scheme, has been sentenced to 7 years and 3 months in prison. The scheme involved email phishing, credential harvesting, and invoice fraud, and aimed to scam companies out of more than USD 12 million. The perpetrator also committed hundreds of thousands of dollars of COVID-19-related loan fraud by using stolen identities to submit 40 fraudulent applications for COVID-19 Economic Injury Disaster loans.

See the full report here: https://www.justice.gov/usao-ndga/pr/atlanta-man-sentenced-federal-prison-connection-multimillion-dollar-international

New ShellBot DDoS Malware Variants Targeting Poorly Managed Linux Servers

Poorly managed Linux SSH servers are being targeted as part of a new campaign that deploys different variants of a malware called ShellBot. ShellBot, also known as PerlBot, is a DDoS Bot malware developed in Perl and characteristically uses IRC protocol to communicate with the C&C server.

See the full report here: https://thehackernews.com/2023/03/new-shellbot-ddos-malware-targeting.html?&web_view=true

Hackers use new PowerMagic and CommonMagic malware to steal data

Security researchers have discovered attacks from an advanced threat actor that used a previously unseen malicious framework called CommonMagic and a new backdoor called PowerMagic. Both malware pieces have been used since at least September 2021 in operations that continue to this day and target organizations in the administrative, agriculture, and transportation sectors for espionage purposes.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-new-powermagic-and-commonmagic-malware-to-steal-data/

LockBit ransomware gang now also claims City of Oakland breach

Another ransomware operation, the LockBit gang, now threatens to leak what it describes as files stolen from the City of Oakland's systems. However, the gang has yet to publish any proof that they've stolen any files from the West Coast port city's network.

See the full report here: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-now-also-claims-city-of-oakland-breach/

Breached hacking forum shuts down, fears it's not 'safe' from FBI

The notorious Breached hacking forum has shut down after the remaining administrator, Baphomet, disclosed that they believe law enforcement has access to the site's servers. Breached was a popular hacking and data leak forum notorious for hosting, leaking, and selling data obtained from breached companies, governments, and various organizations.

See the full report here: https://www.bleepingcomputer.com/news/security/breached-hacking-forum-shuts-down-fears-its-not-safe-from-fbi/

Coinbase Wallet 'Red Pill' flaw allowed attacks to evade detection

Coinbase is a leading cryptocurrency exchange that offers a crypto wallet app for users to store, manage, and interact with a wide range of digital assets they can purchase from the platform, including Bitcoin, Ethereum, and ERC-20 tokens. Security researchers have discovered that dapps, including the Coinbase Wallet, were vulnerable to a new attack that allows smart contracts to hide malicious behavior during transaction simulations.

See the full report here: https://www.bleepingcomputer.com/news/security/coinbase-wallet-red-pill-flaw-allowed-attacks-to-evade-detection/

Clop ransomware claims Saks Fifth Avenue, retailer says mock data stolen

The Clop ransomware gang claims to have attacked Saks Fifth Avenue on its dark web leak site. The cyber security incident is among Clop's ongoing attacks against vulnerable GoAnywhere MFT servers belonging to established enterprises. Although the company states no real customer data is impacted, it did not address if corporate or employee data was stolen.

See the full report here: https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-saks-fifth-avenue-retailer-says-mock-data-stolen/

GOP lawmakers want additional details on CMS subcontractor breach timeline

Republican lawmakers are seeking additional details from the Centers for Medicare and Medicaid Services about the length of time it took the agency to notify Congress about a subcontractor breach that exposed the information of 254,000 Medicare beneficiaries.

See the full report here: https://fedscoop.com/cms-subcontractor-breach-timeline/?&web_view=true

Google Suspends Chinese Shopping App Amid Security Concerns

Google has suspended the Chinese shopping app Pinduoduo on its app store after malware was discovered in versions of the app from other sources. Google said in a statemen that it suspended the Pinduoduo app on the Google Play app store out of security concerns and that it was investigating the matter.

See the full report here: https://techcrunch.com/2023/03/20/google-flags-apps-made-by-popular-chinese-e-commerce-giant-as-malware/

Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products

Organizations that use human-machine interface (HMI) and supervisory control and data acquisition (SCADA) products from UK-based industrial software maker Aveva have been informed about the existence of several potentially serious vulnerabilities.

See the full report here: https://www.securityweek.com/organizations-notified-of-remotely-exploitable-vulnerabilities-in-aveva-hmi-scada-products/

Cyberattack disrupts Lansing Community College

Michigan-based Lansing Community College experienced a cyberattack which resulted in the disruption of its campus Wi-Fi system and online courses. However, the college has been working to restore its systems.

See the full report here: https://www.scmagazine.com/brief/breach/cyberattack-disrupts-lansing-community-college

IRS Calls Out Email And Text Scams As Part Of Its Annual Dirty Dozen List

The IRS is warning taxpayers about phishing and smishing schemes as part of this 2023's Dirty Dozen. The "Dirty Dozen" is an annual list of common scams that taxpayers may encounter, with many of these schemes peaking during tax filing season as people prepare their returns or hire someone to help with their taxes.

See the full report here: https://www.forbes.com/sites/kellyphillipserb/2023/03/21/irs-calls-out-email-and-text-scams-as-part-of-its-annual-dirty-dozen-list/?sh=53fb124915de

Expert speaks out after City of Allen Park hit with ransomware attack

Hackers are threatening the City of Allen Park, demanding officials pay up or face a public release of all the city's data. The ransomware threat by LockBit 3.0 was announced on the hacking group's website on the dark web. Officials in Allen Park have not publicly commented on the threat and the Allen Park Mayor's office has not returned calls for comment.

See the full report here: https://www.cbsnews.com/detroit/news/allen-park-ransonware-threat/

NAPLISTENER: New Malware in REF2924 Group's Arsenal for Bypassing Detection

The threat group tracked as REF2924 has been observed deploying previously unseen malware in its attacks aimed at entities in South and Southeast Asia. The malware, dubbed NAPLISTENER, is an HTTP listener programmed in C# and is designed to evade network-based forms of detection.

See the full report here: https://thehackernews.com/2023/03/new-naplistener-malware-used-by-ref2924.html

CISA Alerts on Critical Security Vulnerabilities in Industrial Control Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released eight Industrial Control Systems (ICS) advisories warning of critical flaws affecting equipment from Delta Electronics and Rockwell Automation. This includes 13 security vulnerabilities in Delta Electronics' InfraSuite Device Master, a real-time device monitoring software. All versions prior to 1.0.5 are affected by the issues.

See the full report here: https://thehackernews.com/2023/03/cisa-alerts-on-critical-security.html

Windows 11, Tesla, Ubuntu, and macOS hacked at Pwn2Own 2023

On the first day of Pwn2Own Vancouver 2023, security researchers successfully demoed Tesla Model 3, Windows 11, and macOS zero-day exploits and exploit chains to win USD 375,000 and a Tesla Model 3. After zero-day vulnerabilities are demoed and disclosed during Pwn2Own, vendors have 90 days to create and release security fixes for all reported flaws before Trend Micro's Zero Day Initiative publicly discloses them.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-11-tesla-ubuntu-and-macos-hacked-at-pwn2own-2023/

Hackers inject credit card stealers into payment processing modules

A new credit card stealing hacking campaign is hiding their malicious scripts inside the "Authorize.net" payment gateway module for WooCommcerce, allowing the breach to evade detection by security scans. These scripts will then steal the input from fields such as credit card numbers, expiration dates, CVV numbers, addresses, phone numbers, and email addresses.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-inject-credit-card-stealers-into-payment-processing-modules/

Dole discloses employee data breach after ransomware attack

Fresh produce giant Dole Food Company has confirmed threat actors behind a February ransomware attack have accessed the information of an undisclosed number of employees. The company revealed that the cyberattack directly impacted its employees' information in the annual report filed with the U.S. Securities and Exchange Commission (SEC) .

See the full report here: https://www.bleepingcomputer.com/news/security/dole-discloses-employee-data-breach-after-ransomware-attack/

Facebook accounts hijacked by new malicious ChatGPT Chrome extension

A trojanized version of the legitimate ChatGPT extension for Chrome is gaining popularity on the Chrome Web Store, accumulating over 9,000 downloads while stealing Facebook accounts. The extension is a copy of the legitimate popular add-on for Chrome named "ChatGPT for Google" that offers ChatGPT integration on search results. However, this malicious version includes additional code that attempts to steal Facebook session cookies.

See the full report here: https://www.bleepingcomputer.com/news/security/facebook-accounts-hijacked-by-new-malicious-chatgpt-chrome-extension/

North Korean hackers using Chrome extensions to steal Gmail emails

A joint cybersecurity advisory from the German Federal Office for the Protection of the Constitution (BfV) and the National Intelligence Service of the Republic of Korea (NIS) warn about threat group Kimsuky's use of Chrome extensions to steal target's Gmail emails.

See the full report here: https://www.bleepingcomputer.com/news/security/north-korean-hackers-using-chrome-extensions-to-steal-gmail-emails/

PoC exploits released for Netgear Orbi router vulnerabilities

Proof-of-concept exploits for vulnerabilities in Netgear’s Orbi 750 series router and extender satellites have been released, with one flaw a critical severity remote command execution bug. Netgear Orbi is a popular network mesh system for home users, providing strong coverage and high throughput on up to 40 simultaneously connected devices across spaces between 5,000 and 12,500 square feet.

See the full report here: https://www.bleepingcomputer.com/news/security/poc-exploits-released-for-netgear-orbi-router-vulnerabilities/

NYC Special Needs Students' Records Found Exposed on Web

Tens of thousands of documents containing personal information of special education students within New York City's public school system were held in an unsecured database exposed to the internet. It is unclear how long the documents were left unsecured on the database and how the incident occurred

See the full report here: https://www.bankinfosecurity.com/nyc-special-needs-students-records-found-exposed-on-web-a-21489?&web_view=true