ZeroFox Daily Intelligence Brief - April 6, 2023

ZeroFox Daily Intelligence Brief - April 6, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• New Dark Web Market STYX Mainly Deals in Financial Fraud Services
• Spain’s Most Dreaded Cyber Criminal José Luis Huertas Arrested
• Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks

New Dark Web Market STYX Mainly Deals in Financial Fraud Services

Over the past year, STYX has become a popular hub for buying and selling illegal services or stolen data, and is growing in popularity within the cyber underground. The market for illegal services continues to be a lucrative business, and the new platform is a draw for financially-motivated cybercriminals—especially in light of the rumored FBI crackdown on Genesis Market. STYX provides services that facilitate money laundering, identity theft, distributed denial-of service (DDoS), bypassing two-factor authentication (2FA), sharing fake or stolen IDs, renting malware, using cash-out services, email and telephone flooding, and identity lookup, among others. STYX also provides the prerequisites and tools needed to commit financial frauds.

Recommendations:

• Digital banks, online payment platforms, and e-commerce systems should upgrade their Know Your Customer (KYC) checks and fraud protections to undermine the effectiveness of the services sold in these criminal marketplaces.
• Follow ZeroFox Intelligence to remain up-to-date on emerging threats.

Spain’s Most Dreaded Cyber Criminal José Luis Huertas Arrested

Nineteen-year-old José Luis Huertas (aka "Alcaseca," "Mango," and “chimichuri”) was arrested by police in Spain after an investigation and manhunt that started in November 2022. The investigation was launched after Spain’s Council of the Judiciary (CGPJ) was breached and data belonging to 575,000 taxpayers was stolen. Huertas is accused of impersonating Paolo Vasile, the CEO of Gestevision Telecinco/Mediaset España, and stealing EUR 300,000 from him. Though Huetas was using cryptocurrency in his dealings, the Spanish police followed the money trail and traced the payments with the help of experts at the National Cryptologic Center.

Recommendation:

• Follow ZeroFox Intelligence to remain up-to-date on emerging threats.

Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks

An identified threat actor used malicious SFX files to establish persistent backdoor access to their victim's system environment. SFX files can be used to spread malware without making it apparent to the recipient and to extract data without the need for dedicated software, making them a popular choice for attackers. The malware was able to abuse compromised credentials to run a legitimate Windows accessibility application, Utility Manager (utilman[.]exe), and launch a password-protected SFX file. The file was engineered to run PowerShell, Command Prompt, and Task Manager with SYSTEM privileges upon execution,

Recommendations:

• Use detection tools that analyze the behavior of files and processes rather than just looking for malicious files, as newer strains of malware employ more sophisticated methods to avoid detection.
• To mitigate the threats posed by SFX archives, use capable software to analyze and identify any suspicious scripts or binaries that are set to extract and run upon execution.