ZeroFox Daily Intelligence Brief - March 27, 2023

ZeroFox Daily Intelligence Brief - March 27, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• New Emotet Phishing Campaign on the Loose This Tax Season
• FBI Warns Companies of Business Email Compromise (BEC) Attacks from Technically Unsophisticated Threat Actors
• Ten Victims Targeted in a Month by New Dark Power Ransomware
• Microsoft Warns of Stealthy Outlook Vulnerability Exploited by Russian Hackers
• ChatGPT Payment Data Leak Caused by Open Source Bug

New Emotet Phishing Campaign on the Loose This Tax Season

U.S. taxpayers should be aware of the new Emotet malware being distributed via fake W-9 tax forms purportedly sent by either an “Inspector” from the Internal Revenue Service (IRS) or business partners of the recipient. The Emotet operators are sending phishing emails with titles like “IRS Tax Forms W-9” that contain malicious Word documents in a ZIP archive called “W-9 form.zip.” The Word documents are inflated to over 500 MB, making it tricky for security software to identify it as malicious. Additionally, now that Microsoft is blocking macros by default, the threat actors are bypassing those restrictions by utilizing Microsoft OneNote documents with embedded VBScript files that install the Emotet malware. After infection, the malware will steal the victim’s emails and contacts and await other malicious payloads.

Recommendations:

• Users that receive any email containing W-9 or other tax forms should first scan the documents with antivirus software. Do not upload these forms to cloud-based scanning services like VirusTotal, as they typically contain sensitive financial information.
• Tax forms are typically emailed in a PDF format; W-9 documents that arrive as Word or OneNote attachments should be considered suspicious.
• Those expecting W-9s via email should contact the sender via another channel, such as a known phone number, and confirm any documents sent are legitimate and safe to open.
• Follow ZeroFox Intelligence to remain up-to-date on emerging threats.

FBI Warns Companies of Business Email Compromise (BEC) Attacks from Technically Unsophisticated Threat Actors

The Federal Bureau of Investigation (FBI) has alerted U.S. companies of the increasing prevalence of threat actors using business email compromise (BEC) tactics to initiate bulk purchase of goods from vendors, such as construction materials, agricultural supplies, technology hardware products, and solar energy products. Such attacks do not require distinctive technical proficiency and are typically adopted by less sophisticated threat actors. The attackers use spoofed email domain addresses of U.S.-based companies and display the names of legitimate current or former employees associated with the businesses in these impersonations. The targeted victim is tricked into thinking that the purchase order email has been sent from a legitimate business contact and fulfills the purchase order. The threat actors also apply for delayed repayment terms from the vendors (Net-30 and Net-60 terms) using fake credit references and fraudulent W-9 forms, hindering the prompt discovery of the fraud and allowing them to initiate additional purchase orders without providing upfront payment. Victims typically learn that they have been duped only when they contact the legitimate business in an attempt to collect payment and realize that the purchase order email was fraudulent.

Recommendations:

• Vendors should verify whether the email domain address is associated with the business that it claims to be from and should not click on any links provided in emails; instead, type in the URL of the business directly.
• Vendors should confirm the legitimacy of all purchase orders by calling the business on a direct line found in advertised channels (versus using a phone number provided in the email received).
• Provide employees with regular cybersecurity training to keep them vigilant about and protect the business from BEC schemes.
• Companies that may have fallen victim to this type of BEC scheme can file a report with the FBI Internet Crime Complaint Center at www.ic3.gov.

Ten Victims Targeted in a Month by New Dark Power Ransomware

A new ransomware gang named Dark Power has breached at least 10 organizations in just over a fortnight, demanding a relatively small payment of USD 10,000 in the form of the Monero (XMR) cryptocurrency from each victim. Dark Power’s selection of targets appears random; it has victimized multiple sectors—agriculture, education, healthcare, IT, and manufacturing—across several countries, including the United States, Czech Republic, and Israel. Like other ransomware groups, Dark Power uses social engineering to infect systems, encrypt files, demand ransoms, and engage in double extortion by threatening to release sensitive data. Dark Power's use of the cross-platform language Nim highlights a growing trend among cybercriminals to employ alternative programming languages, adding to the challenges faced by defenders as the cost to keep up is higher than the attacker’s required skill to learn a new language.

Recommendations:

• Enterprises can protect themselves by implementing strong backup and recovery systems and deploying the latest official, available security updates on their systems. Training employees to deal with phishing and other forms of social engineering attacks is also essential.
• Organizations should use software tools that can detect malicious md5 hashes/binaries from relatively obscure programming languages.
• Organizations should be aware that paying the ransom does not ensure file decryption while still benefiting ransomware groups; victims should avoid paying and instead report the attack to law enforcement agencies and seek assistance from trustworthy security professionals to restore their files.

Microsoft Warns of Stealthy Outlook Vulnerability Exploited by Russian Hackers

Microsoft has provided guidance to customers to help them identify indicators of compromise (IoCs) related to a recently patched Outlook vulnerability (CVE-2023-23397). The critical flaw allowed external attackers to launch a privilege escalation attack without requiring any user interaction. Malicious actors can exploit this bug to steal NT Lan Manager hashes and launch a relay attack. The vulnerability was resolved in Microsoft's March 2023 Patch Tuesday updates. However, Russia-based threat actors had already weaponized the flaw in attacks on the military, energy, transportation, and government sectors in Europe. Microsoft advises organizations to review SMBClient event logging and other network telemetry to detect potential exploitation.

Recommendations:

• Organizations should update Microsoft Outlook to the latest version as soon as possible. They should also review suspicious messages, calendar items, or tasks reported by users.
• Organizations can block TCP 445/SMB outbound from their network through an environment firewall, local firewall, or VPN settings.
• Disable unnecessary services on Exchange and NTLM (Windows New Technology LAN Manager) to further mitigate risks.

ChatGPT Payment Data Leak Caused by Open Source Bug

OpenAI has confirmed that a bug in the Redis client open-source library was responsible for the March 20 outage and data leak on its ChatGPT service. The bug caused the service to expose users' personal information and chat queries. OpenAI said the leak affected approximately 1.2 percent of ChatGPT Plus subscribers who were active during a specific nine-hour window. Before the ChapGPT was taken offline, it is possible that active users were able to see other users’ first and last names, email addresses, payment addresses, last four credit card number digits (only), and credit card expiration dates; the company is contacting affected users whose payment information was exposed. OpenAI CEO Sam Altman expressed his regrets over the incident in a tweet, confirming that a fix had been released. The company has also published a post-mortem report on the issue.

Recommendations:

• Affected ChatGPT users should monitor their credit card accounts for any signs of fraudulent activity and be wary of any unexpected emails they may receive containing links or attachments or seekling personal data, as these could be follow-on attacks utilizing the leaked information.
• As the first message of newly-created conversations were visible to other users due to this bug, it is important to avoid sharing personally sensitive information to mitigate such risks.
• Regularly updating software and libraries can help organizations address known security vulnerabilities and prevent potential cyberattacks.