ZeroFox Daily Intelligence Brief - March 31, 2023

ZeroFox Daily Intelligence Brief - March 31, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Winter Vivern Hackers Exploit Zimbra Flaw to Steal NATO Emails
• CISA Orders Federal Agencies to Patch Actively Exploited Zero-days
• After Mining Cryptocurrencies, AlienFox Malware Is Now Attacking Cloud Services

Winter Vivern Hackers Exploit Zimbra Flaw to Steal NATO Emails

Russian hacking group “Winter Vivern” (also tracked as TA473) has been exploiting vulnerable Zimbra endpoints since February 2023. The hackers initiate the attack by scanning for webmail platforms unpatched for CVE-2022-27926 using the Acunetix vulnerability scanner. Phishing emails from compromised addresses are then sent to targeted NATO officials, governments, military personnel, and diplomats to steal information such as usernames, passwords, and tokens. The attackers can also use the breached accounts to carry out lateral phishing attacks and further infiltrate target organizations. Winter Vivern is not known for its technical sophistication, but its operational approach has been effective even against high-profile targets.

Recommendations:

• Employees should be trained to guard themselves against phishing attempts and to verify the source of an email before opening any attachment—especially if it purports to be from a high-profile sender asking for specific sensitive information.
• Organizations are advised to set up appropriate email security protocols, run periodic security audits, and properly configure and secure internet-facing network devices.
• Organizations that rely on Zimbra should update their software to Zimbra Collaboration 9.0.0 P24 released in April 2022.

CISA Orders Federal Agencies to Patch Actively Exploited Zero-days

The Cybersecurity and Infrastructure Security Agency (CISA) has added 10 new vulnerabilities to its Known Exploited Vulnerabilities Catalog and ordered Federal Civilian Executive Branch (FCEB) agencies to deploy patches for these vulnerabilities by April 20, 2023. Some of these bugs were part of multiple exploit chains in two separate, highly-targeted campaigns aimed at Android and iOS users. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Recommendations:

• Even though the directive applies only to FCEB agencies, all organizations should deploy the available patches to fortify their systems against cyberattacks.
• Follow ZeroFox Intelligence to remain up to date on emerging threats.

After Mining Cryptocurrencies, AlienFox Malware Is Now Attacking Cloud Services

The AlienFox toolkit is being distributed on Telegram and can be used to harvest sensitive information like API keys and other sensitive data. Threat actors have been observed using AlienFox to identify and collect credentials from misconfigured or exposed services. AlienFox is used in these attacks to collect lists of misconfigured hosts from platforms such as Amazon Web Service and Microsoft Office 365, using scanning tools like LeakIX and SecurityTrails to steal sensitive information.

Recommendations:

• Organizations should conduct regular audits to determine adherence to configuration best practices and the principle of least privilege in information access.
• Organizations can monitor the creation of new accounts or service profiles in cloud services to detect suspicious activity running with elevated privileges.
• Follow ZeroFox Intelligence to remain up-to-date on emerging threats.