ZeroFox Daily Intelligence Brief - April 10, 2023

ZeroFox Daily Intelligence Brief - April 10, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• FBI: For-Profit Companies Charging Sextortion Victims for Assistance and Using Deceptive Tactics to Elicit Payments
• Apple Fixes Two Actively Exploited Zero-Day Bugs
• Iran-Based Hackers Conducting Destructive Attacks Under Ransomware Guise

FBI: For-Profit Companies Charging Sextortion Victims for Assistance and Using Deceptive Tactics to Elicit Payments

The Federal Bureau of Investigation (FBI) has issued an alert to victims of sextortion to be wary of for-profit companies offering “assistance” services to them. The FBI alert revealed that these companies charge exorbitant fees for their services, whereas law enforcement and non-profit agencies provide assistance to victims free of charge. The for-profit companies use deceptive tactics—including threats, manipulation, and providing false information—to get victims to pay for their offered services, such as sending cease and desist orders to the extorters; however, these service actions are often not legally enforceable. Moreover, these predatory companies discourage victims from reporting the sextortion incidents to law enforcement in lieu of victims depending upon their “assistance,” which indicates that some of them could be directly or indirectly part of the sextortion racket.

Recommendations:

• Sextortion victims should not accept solicitations by for-profit companies offering paid remediation services and should instead rely on law enforcement and non-profit agencies that provide the necessary services free of charge.
• Beware of red flags such as a company using high-pressure or scare tactics to secure your business, requiring you to sign a contract for their assistance services, advertising sextortion assistance in exchange for fees but discouraging you from contacting law enforcement, and claiming to be connected to government or law-enforcement officials.
• Victims of sextortion are advised to submit a tip to the FBI’s Internet Crime Complaint Center (IC3) at www.ic3.gov or call 1-800-CALL-FBI (225-5324) for assistance.

Apple Fixes Two Actively Exploited Zero-Day Bugs

Apple has addressed two zero-day vulnerabilities in iOS 16.4.1, iPadOS 16.4.1, macOS Venture 13.3.1, and Safari 16.4.1. One of the zero-day bugs (CVE-2023-28206) is an IOSurfaceAccelerator out-of-bounds write that can lead to corruption of data, a crash, or code execution. The other bug (CVE-2023-28205) is a WebKit use after free weakness that allows data corruption or arbitrary code execution when reusing freed memory. The Apple products affected by these bugs include iPhone 8 and later, iPad Pro (all models), iPad Air third generation and later, iPad fifth generation and later, iPad mini 5th generation and later, and Macs running macOS Ventura.

Recommendations:

• Users of the affected device models should install the latest security updates as soon as possible to guard their systems against these vulnerabilities.
• Follow ZeroFox Intelligence to remain up to date on the latest software patches and security guidelines.

Iran-Based Hackers Conducting Destructive Attacks Under Ransomware Guise

Security researchers have observed Iranian state-sponsored threat group MERCURY conducting destructive attacks in alliance with an emerging entity tracked as DEV-1084 and disguising their activities as ransomware attacks. Researchers suspect that MERCURY operators exploited known vulnerabilities in unpatched applications for initial access and then passed off access to their partner actor, DEV-1084, to perform extensive reconnaissance and discovery, establish persistence, and move laterally throughout the network. DEV-1084 has been observed performing large-scale deletion of cloud resources, including server farms, virtual machines, storage accounts, and virtual networks.

MERCURY (also known as Boggy Serpens, Cobalt Ulster, Earth Vetala, ITG17, Muddywater, Seedworm, Static Kitten, TEMP.Zagros, and Yellow Nix) has been linked to Iran's Ministry of Intelligence and Security (MOIS) and is known for targeting Middle Eastern nations, with intrusions exploiting the Log4Shell flaw to breach Israeli entities.

Recommendations:

• Use access control security best practices to secure the Azure AD environment.
• Turn on cloud-delivered antivirus protection and add folders to the protected folders list to help prevent files from being altered or encrypted by ransomware.
• Investigate and remediate alerts related to Log4j 2 exploitation or post-exploitation activity immediately. Follow ZeroFox Intelligence to stay updated on emerging threats and corresponding indicators of compromise.