zerofox logo
Advisories

Threat Intelligence Bulletin: 03/24/2023 - 03/30/2023

|by Alpha Team

banner image

ZeroFox Weekly Threat Bulletin: 03/24/2023 - 03/30/2023

ZeroFox Daily Intelligence Brief - March 24, 2023

Key Findings

  • CISA Releases “Untitled Goose” to Detect Attacks on Microsoft Azure, Azure Active Directory (AAD), and Microsoft 365 (M365) Environments
  • BlackGuard Stealer Targeting 57 Crypto Wallets and Extensions
  • WordPress Force Patches WooCommerce Plugin
  • Clop Ransomware’s Latest Victim Is the City of Toronto
  • Wholesale Pharmaceutical Distributors Supply Chain Disrupted After a Cyberattack in Spain

Report: https://cloud.zerofox.com/intelligence/advisories/20034

ZeroFox Daily Intelligence Brief - March 27, 2023

Key Findings

  • New Emotet Phishing Campaign on the Loose This Tax Season
  • FBI Warns Companies of Business Email Compromise (BEC) Attacks from Technically Unsophisticated Threat Actors
  • Ten Victims Targeted in a Month by New Dark Power Ransomware
  • Microsoft Warns of Stealthy Outlook Vulnerability Exploited by Russian Hackers
  • ChatGPT Payment Data Leak Caused by Open Source Bug

Report: https://cloud.zerofox.com/intelligence/advisories/20050

ZeroFox Daily Intelligence Brief - March 28, 2023

Key Findings

  • New MacStealer macOS Malware Steals Passwords from iCloud Keychain
  • U.S. Government Bans Commercial Spyware That Poses Risks to National Security
  • Apples Releases Patches to Fix WebKit Zero-Day Bug in Older Devices
  • Twitter Files DMCA Notice over Source Code Leak on GitHub
  • Improve Mobile Device Security with This HC3 Checklist
  • Update: Latitude Confirms Details of 14 Million Consumers Stolen

Report: https://cloud.zerofox.com/intelligence/advisories/20062

ZeroFox Daily Intelligence Brief - March 29, 2023

Key Findings

  • United Kingdom (UK) Plans to Amend Computer Misuse Act of 1990, Invites Security Community’s Views
  • MetaMask Alerts Users of Scammers Hyping Up March 31 Airdrop Rumor
  • Crown Resorts: Another Victim in the Long List of GoAnywhere Zero-Day Exploit Victims
  • WiFi Protocol Flaw Allows Attackers to Hijack Network Traffic
  • Binance CEO Zhao Sued by CFTC over “Willful Evasion” of U.S. Laws and Unregistered Crypto Derivatives Products

Report: https://cloud.zerofox.com/intelligence/advisories/20073

ZeroFox Daily Intelligence Brief - March 30, 2023

Key Findings

  • Experts Call for a Six-month Pause on Artificial intelligence (AI) Experiments
  • Spyware Vendors Caught Exploiting Zero-Day Vulnerabilities on Android and iOS Devices
  • 3CX Phone System App Compromised by Threat Actors

Report: https://cloud.zerofox.com/intelligence/advisories/20080

Breach Disclosures: 03/24/2023 - 03/30/2023

Breach Disclosure: Card_6.4

ZeroFox Dark Ops team acquired a data breach package allegedly comprising 6,044 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20046

Breach Disclosure: 1.1m_ssn

ZeroFox Dark Ops team acquired a data breach package allegedly comprising 844,246 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20047

Breach Disclosure: Activision Blizzard

An alleged data breach at Activision Blizzard – a U.S.-based multimedia gaming platform – exposed 16,045 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20048

Breach Disclosure: Adosushi

An alleged data breach at Adosushi – Thailand-based importer, manufacturer and distributor of raw materials for making sushi – exposed 7,124 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20049

Breaking News: 2023-03-24 - 2023-03-30

Emotet malware distributed as fake W-9 tax forms from the IRS

A new Emotet phishing campaign is targeting U.S. taxpayers by impersonating W-9 tax forms sent by the Internal Revenue Service and companies the victims work with.

See the full report here: https://www.bleepingcomputer.com/news/security/emotet-malware-distributed-as-fake-w-9-tax-forms-from-the-irs/

OpenAI: ChatGPT payment data leak caused by open-source bug

OpenAI says a Redis client open-source library bug was behind the March 20 ChatGPT outage and data leak, where users saw other users' personal information and chat queries. The company says it is contacting all affected ChatGPT users who had their payment information exposed.

See the full report here: https://www.bleepingcomputer.com/news/security/openai-chatgpt-payment-data-leak-caused-by-open-source-bug/

FBI: Business email compromise tactics used to defraud U.S. vendors

The Federal Bureau of Investigation is warning companies in the U.S. of threat actors using tactics similar to business email compromise that allow less technical actors to steal various goods from vendors. The FBI recommends vendors check the source of an email before agreeing to a transaction.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-business-email-compromise-tactics-used-to-defraud-us-vendors/

New Dark Power ransomware claims 10 victims in its first month

A new ransomware operation named "Dark Power" has been observed targeting various victims, and it has already listed its first victims on a dark web data leak site, threatening to publish the data if a ransom is not paid.

See the full report here: https://www.bleepingcomputer.com/news/security/new-dark-power-ransomware-claims-10-victims-in-its-first-month/

Inaudible ultrasound attack can stealthily control your phone, smart speaker

American university researchers have developed a novel attack called "Near-Ultrasound Inaudible Trojan" (NUIT) that can launch silent attacks against devices powered by voice assistants, like smartphones, smart speakers, and other IoTs.

See the full report here: https://www.bleepingcomputer.com/news/security/inaudible-ultrasound-attack-can-stealthily-control-your-phone-smart-speaker/

SideCopy APT Targets India's Premier Defense Research Agency

Security researchers uncovered a Pakistani cyberespionage group employing fresh tactics to target workers at India's Defense Research and Development Organization and steal sensitive military secrets.

See the full report here: https://www.bankinfosecurity.com/sidecopy-apt-targets-indias-premier-defense-research-agency-a-21512?&web_view=true

GitHub.com rotates its exposed private SSH key

GitHub has rotated its private SSH key for GitHub.com after the secret was accidentally published in a public GitHub repository.

See the full report here: https://www.bleepingcomputer.com/news/security/githubcom-rotates-its-exposed-private-ssh-key/?&web_view=true

Russia’s Rostec allegedly can de-anonymize Telegram users

Russia's Rostec has reportedly bought a platform that allows it to uncover the identities of anonymous Telegram users, likely to be used to tamp down on unfavorable news out of the country.

See the full report here: https://www.bleepingcomputer.com/news/security/russia-s-rostec-allegedly-can-de-anonymize-telegram-users/

A million at risk from user data leak at Korean beauty platform

South Korean beauty content platform, PowderRoom, has leaked users’ phone numbers and email and home addresses, exposing nearly one million people.

See the full report here: https://cybernews.com/security/powder-room-data-leak/

U.K. National Crime Agency Sets Up Fake DDoS-For-Hire Sites to Catch Cybercriminals

The U.K. National Crime Agency (NCA) revealed that it has created a network of fake DDoS-for-hire websites to infiltrate the online criminal underground.

See the full report here: https://thehackernews.com/2023/03/uk-national-crime-agency-sets-up-fake.html

Personal data of 168 million Indians up for sale

Police busted a seven-member gang of cybercriminals that were stealing and selling sensitive personal and financial information of 168 million Indians.The leaked data included those of CEOs, government officials and defence personnel, which the police indicated posed a threat of espionage and jeopardized national security.

See the full report here: https://timesofindia.indiatimes.com/city/hyderabad/personal-data-of-16-8-crore-indians-up-for-sale-7-nabbed/articleshow/98954198.cms

Twitter takes down source code leaked online, hunts for downloaders

Twitter has taken down internal source code for its platform and tools that had been leaked and uploaded to a Github repository. The firm is now using a subpoena to search for those who leaked and downloaded its code. GitHub complied with a DMCA infringement notice issued by Twitter because the leak exposed proprietary source code and internal tools, hence posing a security risk to Twitter.

See the full report here: https://www.bleepingcomputer.com/news/security/twitter-takes-down-source-code-leaked-online-hunts-for-downloaders/

Exchange Online to block emails from vulnerable on-prem servers

Microsoft is introducing a new Exchange Online security feature that will automatically start throttling and eventually block all emails sent from vulnerable Exchange servers 90 days after the admins are pinged to secure them.

See the full report here: https://www.bleepingcomputer.com/news/security/exchange-online-to-block-emails-from-vulnerable-on-prem-servers/

Apple fixes recently disclosed WebKit zero-day on older iPhones

Apple has released security updates to backport patches to address an actively exploited zero-day bug for older iPhones and iPads. The vulnerability (CVE-2023-23529) is a WebKit type confusion issue that the company fixed on newer iPhone and iPad devices on February 13, 2023.

See the full report here: https://www.bleepingcomputer.com/news/apple/apple-fixes-recently-disclosed-webkit-zero-day-on-older-iphones/

New IcedID variants shift from bank fraud to malware delivery

New IcedID variants have been found without the usual online banking fraud functionality and instead focus on installing further malware on compromised systems. These new variants have been seen used by three distinct threat actors in seven campaigns focusing on further payload delivery, most notably ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/new-icedid-variants-shift-from-bank-fraud-to-malware-delivery/

New MacStealer macOS malware steals passwords from iCloud Keychain

A new info-stealing malware named MacStealer is targeting Mac users, stealing their credentials stored in the iCloud KeyChain and web browsers, cryptocurrency wallets, and potentially sensitive files. MacStealer is being distributed as a malware-as-a-service (MaaS), where the developer sells premade builds for USD 100, allowing purchasers to spread the malware in their campaigns.

See the full report here: https://www.bleepingcomputer.com/news/security/new-macstealer-macos-malware-steals-passwords-from-icloud-keychain/

Hackers earn USD 1,035,000 for 27 zero-days exploited at Pwn2Own Vancouver

Pwn2Own Vancouver 2023 has ended with contestants earning USD 1,035,000 and a Tesla Model 3 car for 27 zero-day (and several bug collisions) exploited between March 22 and 24. During the hacking competition, security researchers have targeted devices in the enterprise applications and communications, local escalation of privilege (EoP), virtualization, servers, and automotive categories, all up-to-date and in their default configuration.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-earn-1-035-000-for-27-zero-days-exploited-at-pwn2own-vancouver/

20-Year-Old BreachForums Founder Faces Up to 5 Years in Prison

The 20-year-old founder and the administrator of the now-defunct BreachForums has been formally charged in the U.S. with conspiracy to commit access device fraud. If proven guilty, the perpetrator, who went by the online moniker "pompompurin," faces a maximum penalty of up to five years in prison. He was arrested on March 15, 2023.

See the full report here: https://thehackernews.com/2023/03/20-year-old-breachforums-founder-faces.html

Cyberattack at Puerto Rico water authority under federal probe

The FBI and Cybersecurity and Infrastructure Security Agency have launched an investigation into a cyberattack against the Puerto Rico Aqueduct and Sewer Authority which was confirmed to have compromised the U.S. territory's water agency's customer and employee data but not its critical infrastructure

See the full report here: https://www.scmagazine.com/brief/ransomware/cyberattack-at-puerto-rico-water-authority-under-federal-probe

North Dakota to require cybersecurity education in public schools

North Dakota became the first state in the U.S. to require public schools to teach cybersecurity and computer science. The Republican Governor of the state signed the new law on March 24.

See the full report here: https://www.scmagazine.com/news/careers/north-dakota-require-cybersecurity-education-public-schools

President Joe Biden says US can’t buy spyware that other countries have used against it

The US president has signed an executive order saying that federal agencies are banned from using software that poses ‘significant counterintelligence or security risks’ or that could be used improperly by foreign entities.

See the full report here: https://www.theverge.com/2023/3/27/23658449/spyware-ban-us-government-biden-executive-order

Russian hackers strike French National Assembly website

France's National Assembly website was targeted in a DDoS attack claimed by pro-Russian hackers. Hacker group NoName057(16), which claimed the attack, is known for conducting DDoS attacks on entities in countries supporting Ukraine in the ongoing war.

See the full report here: https://www.politico.eu/article/french-national-assembly-website-russian-cyberattack-hack-kremlin-emmanuel-macron/

Binance, CEO Zhao Sued by CFTC Over 'Willful Evasion' of U.S. Laws, Unregistered Crypto Derivatives Products

The U.S. Commodity Futures Trading Commission (CFTC) sued crypto exchange Binance founder over allegations the company knowingly offered unregistered crypto derivatives products in the U.S. against federal law.

See the full report here: https://www.coindesk.com/business/2023/03/27/binance-and-cz-sued-by-cftc-over-regulatory-violations/

Trojanized Tor browsers target Russians with crypto-stealing malware

A surge of trojanized Tor Browser installers are targeting Russians and Eastern Europeans with clipboard-hijacking malware that steals infected users' cryptocurrency transactions. Cybersecurity analysts warn that while this attack is not new or particularly creative, it's still effective and prevalent, infecting many users worldwide.

See the full report here: https://www.bleepingcomputer.com/news/security/trojanized-tor-browsers-target-russians-with-crypto-stealing-malware/

WiFi protocol flaw allows attackers to hijack network traffic

Cybersecurity researchers have discovered a fundamental security flaw in the design of the IEEE 802.11 WiFi protocol standard, allowing attackers to trick access points into leaking network frames in plaintext form. WiFi frames are data containers consisting of a header, data payload, and trailer, which include information such as the source and destination MAC address, control, and management data.

See the full report here: https://www.bleepingcomputer.com/news/security/wifi-protocol-flaw-allows-attackers-to-hijack-network-traffic/

Crown Resorts confirms ransom demand after GoAnywhere breach

Crown Resorts, Australia's largest gambling and entertainment company, has confirmed that it suffered a data breach after its GoAnywhere secure file-sharing server was breached using a zero-day vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/crown-resorts-confirms-ransom-demand-after-goanywhere-breach/

Two cyberattacks impact Lumen Technologies

Major U.S. telecommunications company Lumen Technologies has disclosed having recently been impacted by two cyberattacks, one of which is a ransomware incident. The company said that it discovered a separate incident involving an intruder accessing and installing malware on internal information technology systems allowing the cybercriminal to steal a limited amount of data.

See the full report here: https://www.scmagazine.com/brief/ransomware/two-cyberattacks-impact-lumen-technologies

Russian hackers attack Slovak governmental websites after country supplies Mig-29s to Ukraine

A Russian cyber attack disabled several websites of Slovak state institutions and departments. The targets of Russian hackers were the websites of the National Council, the National Bank and the Ministry of Defence. The attack came after Slovakia sent its first fighter jets to Ukraine.

See the full report here: https://news.yahoo.com/russian-hackers-attack-slovak-governmental-114604189.html

Newly exposed APT43 hacking group targeting US orgs since 2018

A new North Korean hacking group has been revealed to be targeting government organizations, academics, and think tanks in the United States, Europe, Japan, and South Korea for the past five years. The moderately-sophisticated threat actor is tracked as APT43 and is seen engaging in espionage and financially-motivated cybercrime operations that help fund its activities.

See the full report here: https://www.bleepingcomputer.com/news/security/newly-exposed-apt43-hacking-group-targeting-us-orgs-since-2018/

Latitude Financial data breach now impacts 14 million customers

Australian loan giant Latitude Financial Services (Latitude) is warning customers that its data breach is much more significant than initially stated, taking the number of affected individuals from 328,000 to 14 million.

See the full report here: https://www.bleepingcomputer.com/news/security/latitude-financial-data-breach-now-impacts-14-million-customers/

Safemoon liquidity pair compromised in USD 8.9 million hack

The BNB chain-based exchange Safemoon was compromised by an attacker, resulting in close to USD 9 million being drained from its liquidity pool. A “public burn” reportedly bug allowed an exploiter to burn a majority of SFM tokens in the Safemoon liquidity pool, artificially raising the token’s price so the contract’s WBNB (Wrapped BNB) could be drained in one transaction.

See the full report here: https://www.theblock.co/post/223547/safemoon-liquidity-pair-compromised-in-8-9-million-hack

Hackers compromise 3CX desktop app in a supply chain attack

A digitally signed and trojanized version of the 3CX Voice Over Internet Protocol (VOIP) desktop client is reportedly being used to target the company’s customers in an ongoing supply chain attack. 3CX is a VoIP IPBX software development company whose 3CX Phone System is used by more than 600,000 companies worldwide and has over 12 million daily users.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-compromise-3cx-desktop-app-in-a-supply-chain-attack/

QNAP warns customers to patch Linux Sudo flaw in NAS devices

Taiwanese hardware vendor QNAP warns customers to secure their Linux-powered network-attached storage (NAS) devices against a high-severity Sudo privilege escalation vulnerability. The flaw (tracked as CVE-2023-22809) has been described by security researchers as a sudoers policy bypass.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-warns-customers-to-patch-linux-sudo-flaw-in-nas-devices/

Experts call for pause on AI training citing risks to humanity

Over a thousand people, including professors and AI developers, have co-signed an open letter to all artificial intelligence labs, calling on them to pause the development and training of AI systems more powerful than GPT-4 for at least six months.

See the full report here: https://www.bleepingcomputer.com/news/technology/experts-call-for-pause-on-ai-training-citing-risks-to-humanity/

Google finds more Android, iOS zero-days used to install spyware

Google's Threat Analysis Group (TAG) discovered several exploit chains using Android, iOS, and Chrome zero-day and n-day vulnerabilities to install commercial spyware and malicious apps on targets' devices. The attackers targeted iOS and Android users with separate exploit chains as part of a first campaign spotted in November 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/google-finds-more-android-ios-zero-days-used-to-install-spyware/

Mélofée: Researchers Uncover New Linux Malware Linked to Chinese APT Groups

An unknown Chinese state-sponsored hacking group has been linked to a novel piece of malware aimed at Linux servers. Cybersecurity researchers have found found several samples of the previously documented malicious software that date back to early 2022.

See the full report here: https://thehackernews.com/2023/03/melofee-researchers-uncover-new-linux.html

ZeroFox Intelligence Reports

ZeroFox Intelligence Malware Profile - Microsoft OneNote Malware

ZeroFox has noted a rise in the use of malicious OneNote documents as an initial attack vector since Microsoft disabled Office macros by default in July 2022. Common malware distributed recently via malicious OneNote documents includes Qakbot, Async RAT, Xworm, Redline Infostealer, and Quasar RAT.

Report: https://cloud.zerofox.com/intelligence/advisories/20061

ZeroFox Intelligence Geopolitical Brief for April 2023

In this ZeroFox Intelligence Geopolitical Brief for April 2023, one main area of concern is the worldwide protests, led by those in France, Israel, Germany, and Kenya, that are expected to continue. Another is the slew of forthcoming elections, including in the large emerging economies of Thailand, Greece, and Turkey. There are other upcoming elections in Europe, Latin America, and Asia to consider, which will likely influence the ease of doing business. Finally, the geopolitical dispute between the U.S. and China focused on restricting and controlling access to advanced technologies continues to develop, with retaliation likely against Western states and companies that adhere to U.S.-led initiatives. This topic includes more countries and business sectors and could potentially replace Russia's war in Ukraine as the main area of geopolitical risk.

Report: https://cloud.zerofox.com/intelligence/advisories/20082

ZeroFox Intelligence Flash Report - Threat Actors Poised to Abuse ChatGPT Clone

In this flash report, ZeroFox Intelligence provides updates around the claim that a ChatGPT-like platform without filters has been stood up, which could provide threat actors content to be utilized in a cyberattack.

Report: https://cloud.zerofox.com/intelligence/advisories/20083

Tags: tlp:clear,  all industries, global