ZeroFox Daily Intelligence Brief - April 4, 2023

ZeroFox Daily Intelligence Brief - April 4, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Data Breach at Western Digital
• Digital Assets Worth USD 112 Million Seized from Cryptocurrency Investment Scammers
• OpcJacker Malware Targets Users with Fake VPN Service

Data Breach at Western Digital

Western Digital Corp. (WD) disclosed details of a network security incident that occurred on March 26, 2023, wherein an unauthorized third party gained access to some of the company's systems. WD responded by implementing incident-response measures and enlisting external security and forensics experts to investigate the incident. The company is taking several measures to secure its business operations, including taking systems and services offline and working to restore impacted infrastructure and services. WD believes that the unauthorized party obtained certain data from its systems; the company is investigating the nature and scope of the breach and has revealed that the incident disrupted some of its business operations.

Recommendations:

• WD customers should remain vigilant about suspicious behavior from potential scammers and criminals using the compromised data. Exercise caution when communicating with people claiming to be WD support staff, as it is possible scammers may have gained WD network access and could be controlling these conversations.
• Follow ZeroFox intelligence to stay updated on the latest data breaches and emerging threats.

Digital Assets Worth USD 112 Million Seized from Cryptocurrency Investment Scammers

The U.S. Department of Justice (DOJ) has seized six virtual currency accounts containing over USD 112 million stolen in fraudulent cryptocurrency investment schemes. The scamsters behind the operation primarily used notorious “pig butchering” tactics whereby they approach their victims through dating apps, messaging apps, or social media platforms; build rapport to earn their trust; and lure them to invest in schemes—only to drain their crypto wallets. Following the seizure, the DOJ is planning to return the stolen cryptocurrency to the victims.

Recommendations

• Victims of pig-butchering schemes can report the incident at www.fbi[.]gov/cryptoguard, to their local FBI field office, by calling 1-800-CALL-FBI, or by filing a report at IC3[.]gov. The complaint should reference “Pig Butchering PSA” and include details of the investment platforms, cryptocurrency addresses and transaction hashes, bank account information, and the names and contact information of suspected scammers.
• Stay vigilant to FBI alerts warning the public about fraudulent cryptocurrency investment applications.

OpcJacker Malware Targets Users with Fake VPN Service

A new information-stealing malware called OpcJacker has been discovered as part of a malvertising campaign that has been active since the second half of 2022. OpcJacker's key functions include keylogging, taking screenshots, stealing sensitive data, loading additional modules, and replacing cryptocurrency addresses in the clipboard. The malware is concealed using a crypter called Babadeda, and it uses a configuration file to activate its data harvesting functions. OpcJacker is capable of running arbitrary shellcode and executables, and it can deliver payloads such as NetSupport RAT and a hidden virtual network computing variant. It is believed that the malware's campaigns are financially motivated.

Recommendations:

• Organizations can reduce the risk of being targeted by malware such as OpcJacker by keeping their software up-to-date and implementing a robust network security posture.
• Exercise caution when installing new software; download software only from official sources.