ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - April 7, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

Snatch Ransomware Claims Attack on Americana Restaurants—Operator of Over 2,000 Restaurants in the Middle East
United Kingdom’s Criminal Records Office Confirms Cybersecurity Incident
Hackers Use Rilide Browser Extension to Bypass Two-Factor Authentication, Steal Crypto

Snatch Ransomware Claims Attack on Americana Restaurants—Operator of Over 2,000 Restaurants in the Middle East

ZeroFox Intelligence has observed that the Snatch ransomware operation has listed Americana Restaurants, one of the largest integrated food companies in the Middle East, as a victim on its leak site. The company employs over 40,000 people and operates more than 2,100 restaurants encompassing 12 brands—including KFC, Pizza Hut, Hardee's, Costa Coffee, Baskin Robbins, and Krispy Kreme—across the Middle East and North Africa (MENA) region and Kazakhstan. The victim post on the Snatch leak site does not contain any sample files or download links at the time of writing this report.

Recommendations:

Implement robust backup and recovery processes for critical data and systems to minimize downtime and the impact of a ransomware attack.
Employees should be trained to avoid clicking on links in suspicious or unsolicited emails and SMS messages. Periodically conduct social-engineering training to raise awareness of these security risks.

United Kingdom’s Criminal Records Office Confirms Cybersecurity Incident

The UK Criminal Records Office (ACRO) has confirmed that it has experienced a cybersecurity incident that is causing delays in issuing police certificates. ACRO has experienced portal issues and outages since January 17, which it had previously attributed to technical issues; the website has been down since March 31. This has created backlogs for visa applicants and may have potentially exposed customer information. In a statement, ACRO said that it has taken robust action to take the application portal offline to investigate and has emailed all affected individuals. The UK policing body said that identification information and any criminal conviction data was impacted but that there was no conclusive evidence that personal data was affected.

Recommendations:

ACRO users will need to apply for police or child protection certificates via email while the website is down.
Users are advised to stay vigilant of phishing attacks, as criminals often conduct follow-on attacks using compromised data.
Organizations should conduct regular audits of the security posture of their system, ensure regular updates of their software and patches, and adopt multi-factor authentication (MFA) policies.

Hackers Use Rilide Browser Extension to Bypass Two-Factor Authentication, Steal Crypto

Chromium-based browsers like Google Chrome, Brave, Opera, and Microsoft Edge are being targeted via Rilide, a new malicious browser extension that mimics Google Drive extensions and abuses built-in Chrome functionalities to monitor browser activity, take screenshots, and steal cryptocurrency. Two separate campaigns have been observed distributing Rilide: one used Google Ads and Aurora Stealer to load the extension using a Rust loader, whereas the other distributed a malicious extension using the Ekipa remote access trojan (RAT). A prominent feature of Rilide is its two-factor authentication bypassing system, which uses forged dialogs to deceive victims into entering their temporary codes.

Recommendations:

Install Manifest v3 on Chromium-based browsers to improve resistance against malicious extensions.
Review the developer’s website before installing an extension to confirm if it is a legitimate extension from a vetted source.
Use antivirus protection to detect and neutralize malicious code in browser extensions.