ZeroFox Daily Intelligence Brief - April 3, 2023

ZeroFox Daily Intelligence Brief - April 3, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Microsoft Fixes New Azure AD Vulnerability Impacting Bing Search and Major Apps
• Fake Extortionists Taking Advantage of Data Breaches and Ransomware Incidents in U.S. Companies
• Personal Data of Over 4.8 Million Customers Compromised In Data Breach at TMX Finance

Microsoft Fixes New Azure AD Vulnerability Impacting Bing Search and Major Apps

Microsoft has fixed a misconfiguration issue in the Azure Active Directory that inadvertently exposed several high-impact applications to unauthorized access. The problem was reported to Microsoft in early 2022, and the responsible researchers received a USD 40,000 bug bounty for reporting their findings. Microsoft has confirmed that there is no evidence of the bug being exploited in the wild. The vulnerability arose due to "Shared Responsibility confusion" in Azure apps being incorrectly configured, which led to unintended access. Furthermore, the bug could also be used to trigger cross-site scripting attacks on Bing.com, exposing sensitive data from users. Other apps such as the Big Trivia App, Mag News, CNS, Contact Center, PoliCheck, Power Automate Blog, and COSMO were also affected by the bug.

Recommendations:

• Organizations should conduct regular penetration testing and vulnerability assessments to identify potential weaknesses in systems and applications and regularly review and patch vulnerabilities in their software and systems.
• Software providers are advised to maintain a responsible disclosure program to incentivize researchers to report vulnerabilities and bugs in a timely and secure manner.

Fake Extortionists Taking Advantage of Data Breaches and Ransomware Incidents in U.S. Companies

A group of cyber scammers called “Midnight” are leveraging reports of ransomware exploits against American companies to masquerade as the attackers and extort money from the victim companies. The scammers impersonate more established cybercriminal groups (including notorious ransomware gangs) and send extortion emails to recent victims of ransomware attacks or data breaches—threatening to sell or publish their data unless a payment is made. They also threaten to conduct disruptive distributed denial-of-service (DDoS) attacks if the targeted companies do not comply with their instructions.

Recommendations:

• Companies receiving extortion emails should carefully analyze all components of the extortion message in order to identify tell-tale signs of fraudulent behavior that would enable them to be dismissed as empty threats.
• Follow ZeroFox Intelligence to track ongoing and emerging cybersecurity scams and frauds.

Personal Data of Over 4.8 Million Customers Compromised In Data Breach at TMX Finance

A data breach at consumer lender TMX Finance and its subsidiaries TitleMax, TitleBucks, and InstaLoan compromised the personal information of more than 4.8 million customers after intruders hacked into the company’s network in early December 2022; the breach was not detected until mid-February 2023. The compromised data includes full names, dates of birth, passport numbers, driver’s license numbers, federal/state identification card numbers, tax identification numbers, Social Security numbers, financial account information, phone numbers, physical addresses, and email addresses. TMX claims to have implemented endpoint protection and monitoring and has reset all employee account passwords to block malicious access after discovering the intrusion.

Recommendations:

• TMX customers are advised to enroll in the free 12-month identity protection service being offered by the company and to request a security freeze.
• Customers are advised to remain vigilant against potential identity theft and fraud by carefully reviewing credit reports and account statements to ensure all activity is valid; they should also be wary of potential phishing attacks by malicious actors using their stolen data.