ZeroFox Daily Intelligence Brief - April 5, 2023

ZeroFox Daily Intelligence Brief - April 5, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Rorschach Ransomware: Experts Warn of Advanced Evasion Strategies
• JavaScript Malware Sent Out Through Tax-Filing Platform eFile.com
• Countries Raise Concerns About Privacy Violations by ChatGPT

Rorschach Ransomware: Experts Warn of Advanced Evasion Strategies

Researchers have uncovered a new strain of ransomware called Rorschach that is highly customizable and technically advanced, making it one of the fastest ransomware strains observed in terms of its encryption speed. The malware was observed being deployed against an U.S.-based company and appears to have no connection to previously known ransomware actors. The strain has been spotted in Asia, Europe, and the Middle East targeting small to medium-sized companies and industrial firms with ransom demands ranging between USD 50,000 to USD 1 million.

Recommendations:

• As ransomware attacks continue to grow in frequency and complexity, it is essential for organizations to remain vigilant and take preemptive measures against such threats; continuous monitoring and analysis of new ransomware samples will aid in these efforts. Follow ZeroFox Intelligence to remain updated on emerging threats.
• Regularly backing up data ensures that organizations can still access critical data even if their systems get infected by ransomware. It is important to keep backups offline or on a separate network to prevent them from becoming compromised.

JavaScript Malware Sent Out Through Tax-Filing Platform eFile.com

Amidst the ongoing U.S. tax season, a strain of JavaScript malware was distributed through tax return filing software provider eFile.com. Almost every page of the website propagated the backdoor malware, which allowed threat actors to remotely access an infected device; this could allow a successful attacker to gain initial access to corporate networks for further attacks, including deploying additional malware, stealing credentials, spreading laterally on a network, or stealing data for extortion. The malicious codes appear to have been removed from eFile.com as of April 4, 2023.

Recommendations:

• The full scope of the attack is not yet known; eFile.com customers should consider changing their account passwords and monitoring their credit reports and financial statements for any signs of irregularity.
• Users should not click on links prompting them to update their browsers or other software, as doing so could result in downloading malicious files to their systems. Always download software directly from official sources.

Countries Raise Concerns About Privacy Violations by ChatGPT

Several European countries have expressed concerns over the use of personal information in training giant generative AI models such as ChatGPT. Italy’s data regulator, Garante per la Protezione dei Dati Personali, recently issued a temporary emergency decision demanding that Open AI (the company behind Chat GPT) stop using the personal data of its citizens. According to the regulator, Open AI does not have the legal right to use people’s personal information in ChatGPT; other countries—including France, Germany, and Ireland—are seeking more details from Garante on its findings. Italy’s Garante alleges that ChatGPT potentially violates four GDPR rules, as it has no age restrictions on its use, may provide inaccurate personal data, does not inform people that their data is being collected, and lacks a legal basis for collecting the data.

Recommendation:

• Follow ZeroFox Intelligence to remain up-to-date on the legal and regulatory landscape surrounding LLMs.