ZeroFox Daily Intelligence Brief - March 24, 2023

ZeroFox Daily Intelligence Brief - March 24, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• CISA Releases “Untitled Goose” to Detect Attacks on Microsoft Azure, Azure Active Directory (AAD), and Microsoft 365 (M365) Environments
• BlackGuard Stealer Targeting 57 Crypto Wallets and Extensions
• WordPress Force Patches WooCommerce Plugin
• Clop Ransomware’s Latest Victim Is the City of Toronto
• Wholesale Pharmaceutical Distributors Supply Chain Disrupted After a Cyberattack in Spain

CISA Releases “Untitled Goose” to Detect Attacks on Microsoft Azure, Azure Active Directory (AAD), and Microsoft 365 (M365) Environments

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has unveiled the Untitled Goose Tool, which is designed to help network security personnel identify potentially malicious activity in Microsoft's Azure, Azure Active Directory (AAD), and Microsoft 365 (M365) environments. The tool features authentication and data-gathering techniques to help analyze the functioning of Microsoft cloud services. Its capabilities include exporting and reviewing AAD sign-in and audit logs, M365 unified audit log, and Azure activity logs, as well as querying, exporting, and investigating AAD, M365, and Azure configurations. Additionally, the tool allows for time bounding of the M365 unified audit log (UAL) and Microsoft Defender for Endpoint (MDE) data and extracting cloud artifacts without extra analytics.

Recommendations:

• Security personnel can refer to the tool’s fact sheet and access the Untitled Goose Tool on CISA's GitHub repository.
• Use the Untitled Goose Tool to regularly review and analyze sign-in and audit logs, activity logs, and alerts for potentially malicious activity in Microsoft cloud services. This will help identify suspicious behavior and enable timely responses to security threats.
• Regularly query, export, and maintain Microsoft cloud product settings (AAD, M365, and Azure) to make sure that they are up to date and configured correctly to prevent potential cloud security breaches.
• The time-bounding facilities of the Untitled Goose Tool can be used to review data from a specific time period or frame, allowing more insight into how specific incidents might have occurred.

BlackGuard Stealer Targeting 57 Crypto Wallets and Extensions

Cybersecurity analysts have identified a new strain of the BlackGuard stealer that has additional capabilities that include USB propagation, loading further payloads from memory, and targeting a wider range of cryptocurrency wallets. BlackGuard is currently active and being improved upon by its operators. The malware attempts to steal cookies and credentials from web browsers, messaging and gaming apps, email clients, and FTP or VPN tools. The new version has a crypto wallet hijacker module as well as the ability to propagate via USB drives, download additional payloads, add itself under the "Run" registry key, and make removal challenging by adding a duplication system. BlackGuard stealer has been observed targeting 57 cryptocurrency browser extensions and wallets, including popular ones such as Binance and Metamask.

Recommendations:

• Avoid downloading executables from untrustworthy websites or clicking on links in suspicious emails; always verify the source of the downloadable file or attachment before opening it.
• To prevent crypto theft and unauthorized access, cryptocurrency enthusiasts should consider using a hardware wallet that is not connected to the internet, avoiding downloads of untrusted wallet apps, and backing up wallet information in a secure location.
• Regularly monitor wallet activity and check for suspicious/unauthorized transactions.

WordPress Force Patches WooCommerce Plugin

To address the actively exploited WordPress payment vulnerability reported in yesterday’s Daily Intelligence Brief, Automattic—the company that owns WordPress—is installing a security update on thousands of websites that rely on WooCommerce Payments for their online stores. The update addresses a critical vulnerability that can give unauthorized attackers full admin access to vulnerable stores. Attackers can exploit this flaw to impersonate an administrator and completely take over a website without any user interaction or social-engineering required.

Recommendations:

• Vulnerable websites hosted on WordPress.com are being updated automatically, while others have to be updated manually. If the site is hosted on an independent server and relies on the WooCommerce payment gateway, make sure to install the required update.
• For organizations using patched versions of WooCommerce Payments (i.e., versions 4.8.2, 4.9.1, 5.0.4, 5.1.3, 5.2.2, 5.3.1, 5.4.1, 5.5.2, and 5.6.2), no further action is required. Users using unpatched versions will receive an update prompt.
• After updating WooCommerce Payments, users should change all admin passwords and rotate payment gateway public/private keys, secret data, and API keys.

Clop Ransomware’s Latest Victim Is the City of Toronto

Latest in the long list of Clop ransomware’s GoAnywhere victims is the City of Toronto, which has confirmed unauthorized access to the city’s data through a third-party vendor. The access was limited to files that could not be processed through the third-party secure file transfer system. The GoAnywhere flaw, tracked as CVE-2023-0669, enables attackers to gain remote code execution on unpatched GoAnywhere MFT instances with their administrative console exposed to internet access. The City of Toronto suffered a previous data breach in April 2021 after the same ransomware group exploited a bug in Accellion's legacy File Transfer Appliance.

Clop claims to have breached more than 130 organizations and exfiltrated confidential data by exploiting this particular vulnerability on organizations’ servers. Prominent victims of the campaign, some of which have been already covered in previous editions of the ZeroFox Daily Intelligence Brief, include Virgin Red, the United Kingdom’s Pension Protection Fund, Hitachi Energy, Saks Fifth Avenue, Rubrik, and Procter & Gamble (P&G). ZeroFox Intelligence has observed that Clop has listed 37 new victims on its leak site in the past 24 hours.

Recommendations:

• Update GoAnywhere MFT software to version 7.1.2 as soon as possible to protect against the exploitation of the zero-day vulnerability.
• Follow ZeroFox Intelligence to remain up-to-date on emerging threats.

Wholesale Pharmaceutical Distributors Supply Chain Disrupted After a Cyberattack in Spain

Alliance Healthcare, a wholesale pharmaceutical distributor in Spain, has suffered a cyberattack that has disrupted its operations. The attackers have blocked access to the company’s servers, denying online access to pharmacists and causing delays in delivery of some medications to pharmacies. Although the attack has not affected the public in general, it has in some cases delayed the procurement of necessary drugs. Since wholesale distributors deal directly with pharmacy offices, there have been no reports of patients’ data being leaked.

Recommendations:

• Healthcare companies should strengthen their server credentials and employ multi-factor authentication to reduce the risk of unauthorized access to corporate systems, as well as regularly update and patch systems to protect against known vulnerabilities.
• Stay informed about emerging threats, vulnerabilities, and security recommendations by following ZeroFox Intelligence.