zerofox logo
Advisories

Threat Intelligence Bulletin: 03/31/2023 - 04/06/2023

|by Alpha Team

banner image

ZeroFox Weekly Threat Bulletin: 03/31/2023 - 04/06/2023

ZeroFox Daily Intelligence Briefs

ZeroFox Daily Intelligence Brief - March 31, 2023

Key Findings

  • Winter Vivern Hackers Exploit Zimbra Flaw to Steal NATO Emails
  • CISA Orders Federal Agencies to Patch Actively Exploited Zero-days
  • After Mining Cryptocurrencies, AlienFox Malware Is Now Attacking Cloud Services

Report: https://cloud.zerofox.com/intelligence/advisories/20097

ZeroFox Daily Intelligence Brief - April 3, 2023

Key Findings

  • Microsoft Fixes New Azure AD Vulnerability Impacting Bing Search and Major Apps
  • Fake Extortionists Taking Advantage of Data Breaches and Ransomware Incidents in U.S. Companies
  • Personal Data of Over 4.8 Million Customers Compromised In Data Breach at TMX Finance

Report: https://cloud.zerofox.com/intelligence/advisories/20110

ZeroFox Daily Intelligence Brief - April 4, 2023

Key Findings

  • Data Breach at Western Digital
  • Digital Assets Worth USD 112 Million Seized from Cryptocurrency Investment Scammers
  • OpcJacker Malware Targets Users with Fake VPN Service

Report: https://cloud.zerofox.com/intelligence/advisories/20124

ZeroFox Daily Intelligence Brief - April 5, 2023

Key Findings

  • Rorschach Ransomware: Experts Warn of Advanced Evasion Strategies
  • JavaScript Malware Sent Out Through Tax-Filing Platform eFile.com
  • Countries Raise Concerns About Privacy Violations by ChatGPT

Report: https://cloud.zerofox.com/intelligence/advisories/20150

ZeroFox Daily Intelligence Brief - April 6, 2023

Key Findings

  • New Dark Web Market STYX Mainly Deals in Financial Fraud Services
  • Spain’s Most Dreaded Cyber Criminal José Luis Huertas Arrested
  • Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks

Report: https://cloud.zerofox.com/intelligence/advisories/20162

Breach Disclosures: 03/31/2023 - 04/06/2023

Breach Disclosure: Charmboard

An alleged data breach at Charmboard – an India-based online apparel and accessory retail store – exposed 45,859 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20106

Breach Disclosure: Linha Aberta Data Breach

An alleged data breach at Linha Aberta – an U.S.-based Brazilian news magazine – exposed 36,311 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20107

Breach Disclosure: Malakye Data Breach

An alleged data breach at Malakye – an U.S.-based online job posting and networking site for companies and people in the outdoor and lifestyle sectors. – exposed 267,519 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20108

Breach Disclosure: Trackitt Data Breach

An alleged data breach at Trackitt - an online community of green card applicants – exposed 428,383 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20109

Breach Disclosure: Qraved Data Breach

An alleged data breach at Qraved – an Indonesia-based app that provides restaurant information, reviews, and food delivery. – exposed 993,978 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20112

Breach Disclosure: Darth Maul Shop Data Breach

An alleged data breach at Darth Maul Shop - the online marketplace that redirects user to other domain – exposed 261,914 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20113

Breach Disclosure: StarNet

An alleged data breach at StarNet - a Moldova-based internet service provider company – exposed 135,117 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20123

Breach Disclosure: Xbox-Scene

An alleged data breach at Xbox-Scene - a U.S.-based discuss website for game console Xbox– exposed 325,823 email addresses, hashed passwords and/or usernames, which were subsequently shared on several deep web platforms.

Report: https://cloud.zerofox.com/intelligence/advisories/20136

Breach Disclosure: Jagex

Jagex – a U.K.-based online video game developing and publishing platform – exposed 1,557,091 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20137

Breach Disclosure: WarCraftDB Data Breach

An alleged data breach at WarcraftDB - a U.S.-based site that replicates the in-game adventure journal – exposed 228,921 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20138

Breach Disclosure: Snooker Billiards Pool

An alleged data breach at Snooker Billiards Pool - a U.K.-based pool table and snooker table accessories retailer – exposed 15,757 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20139

Breach Disclosure: Ministry of Law and Human Rights Republic of Indonesia

An alleged data breach at Ministry of Law and Human Rights, Republic of Indonesia, exposed 841 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20140

Breach Disclosure: Newsea SIMS

An alleged data breach at Newsea SIMS - a U.S.-based site of SIMS3 SIMS2 custom content – exposed 17,089 email addresses, usernames and hashed passwords, which were subsequently shared on several deep web platforms.

Report: https://cloud.zerofox.com/intelligence/advisories/20141

Breach Disclosure: Online Trade (ОНЛАЙН ТРЕЙД)

An alleged data breach at Online Trade (ОНЛАЙН ТРЕЙД) - a Russia-based online store – exposed 1,405,711 email addresses, which were subsequently shared on several deep web platforms.

Report: https://cloud.zerofox.com/intelligence/advisories/20142

Breach Disclosure: Dojo

Dojo – a U.K.-based online video game developing and publishing platform – exposed 765,200 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20143

Breach Disclosure: Neoseeker

Neoseeker – a U.S.-based online platform that provides news and information related to the gaming industry and computers – exposed 348,322 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20144

Breach Disclosure: APK.TW

APK.TW (apk.tw) – a Taiwan-based online android bulletin board – exposed 2,640,404 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20145

Breach Disclosure: Overblog

An alleged data breach at Overblog – a France-based online photography and blog website – exposed 2,908,547 email addresses, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20146

Breach Disclosure: Atmeltomo

An alleged data breach at Atmeltomo - a Japan-based online bulletin board – exposed 580,087 email addresses, which were subsequently shared on several deep web platforms.

Report: https://cloud.zerofox.com/intelligence/advisories/20147

Breach Disclosure: GameSamba

An alleged data breach at GameSamba - a U.S.-based publisher of online games – exposed 69,727 email addresses, which were subsequently shared on several deep web platforms.

Report: https://cloud.zerofox.com/intelligence/advisories/20148

Breach Disclosure: Three Hills Soap

An alleged data breach at Three Hills Soap – an Ireland-based online handmade soap retail company – exposed 22,076 email addresses, which were subsequently shared on several deep web platforms.

Report: https://cloud.zerofox.com/intelligence/advisories/20149

Breach Disclosure: Games of Desires

An alleged data breach at Games of Desires – a U.S.-based adult entertainment forum - exposed 305,549 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20161

Breach Disclosure: Anime Forum

An alleged data breach at Anime Forum – an Iceland-based online anime fans discussion forum – exposed 232,097 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20163

Breach Disclosure: IwishIfind

An alleged data breach at IwishIfind – a U.S.-based local search engine service – exposed 1,516 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20164

Breach Disclosure: Amplitude-studios

An alleged data breach at Amplitude Studios – a France-based game developing company – exposed 171,736 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20165

Breach Disclosure: Wowhead

An alleged data breach at Wowhead – a U.S.-based educational site for World of Warcraft – exposed 200,001 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20166

Breach Disclosure: ExploreTalent

An alleged data breach at ExploreTalent – a U.S.-based acting/modelling talent agency – exposed 5,749,029 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Report: https://cloud.zerofox.com/intelligence/advisories/20167

Breaking News: 03/31/2023 - 04/06/2023

Winter Vivern hackers exploit Zimbra flaw to steal NATO emails

A Russian hacking group tracked as TA473, aka 'Winter Vivern,' has been actively exploiting vulnerabilities in unpatched Zimbra endpoints since February 2023 to steal the emails of NATO officials, governments, military personnel, and diplomats.

See the full report here: https://www.bleepingcomputer.com/news/security/winter-vivern-hackers-exploit-zimbra-flaw-to-steal-nato-emails/

Ukrainian cyberpolice busts fraud gang that stole USD 4.3 million

Ukraine's cyberpolice has arrested members of a fraud gang that stole roughly USD 4,300,000 from over a thousand victims across the EU. The crime group created over 100 fake "phishing" sites targeting users in France, Spain, Poland, the Czech Republic, Portugal, and other European countries, enticing them with products below market prices.

See the full report here: https://www.bleepingcomputer.com/news/security/ukrainian-cyberpolice-busts-fraud-gang-that-stole-43-million/

CISA orders agencies to patch bugs exploited to drop spyware

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch security vulnerabilities exploited as zero-days in recent attacks to install commercial spyware on mobile devices. The flaws in question were abused as part of several exploit chains in two separate highly-targeted campaigns targeting Android and iOS users.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-orders-agencies-to-patch-bugs-exploited-to-drop-spyware/

Realtek and Cacti flaws now actively exploited by malware botnets

Multiple malware botnets actively target Cacti and Realtek vulnerabilities in campaigns detected between January and March 2023, spreading ShellBot and Moobot malware. The targeted flaws are CVE-2021-35394, a critical remote code execution vulnerability in Realtek Jungle SDK, and CVE-2022-46169, a critical command injection flaw in the Cacti fault management monitoring tool.

See the full report here: https://www.bleepingcomputer.com/news/security/realtek-and-cacti-flaws-now-actively-exploited-by-malware-botnets/

Researchers Detail Severe "Super FabriXss" Vulnerability in Microsoft Azure SFX

Details have emerged about a now-patched vulnerability in Azure Service Fabric Explorer (SFX) that could lead to unauthenticated remote code execution. Tracked as CVE-2023-23383 (CVSS score: 8.2), the issue has been dubbed "Super FabriXss", a nod to the FabriXss flaw (CVE-2022-35829, CVSS score: 6.2) that was fixed by Microsoft in October 2022.

See the full report here: https://thehackernews.com/2023/03/researchers-detail-severe-super.html

Chinese RedGolf Group Targeting Windows and Linux Systems with KEYPLUG Backdoor

A Chinese state-sponsored threat activity group tracked as RedGolf has been attributed to the use of a custom Windows and Linux backdoor called KEYPLUG. RedGolf is a particularly prolific Chinese state-sponsored threat actor group that has likely been active for many years against a wide range of industries globally.

See the full report here: https://thehackernews.com/2023/03/chinese-redgolf-group-targeting-windows.html

New Wi-Fi Protocol Security Flaw Affecting Linux, Android and iOS Devices

A group of academics from Northeastern University and KU Leuven has disclosed a fundamental design flaw in the IEEE 802.11 Wi-Fi protocol standard, impacting a wide range of devices running Linux, FreeBSD, Android, and iOS.

See the full report here: https://thehackernews.com/2023/03/new-wi-fi-protocol-security-flaw.html

AlienFox Malware Targets API Keys and Secrets from AWS, Google, and Microsoft Cloud Services

A new "comprehensive toolset" called AlienFox is being distributed on Telegram as a way for threat actors to harvest credentials from API keys and secrets from popular cloud service providers. The spread of AlienFox represents an unreported trend towards attacking more minimal cloud services, unsuitable for crypto mining, in order to enable and expand subsequent campaigns.

See the full report here: https://thehackernews.com/2023/03/alienfox-malware-targets-api-keys-and.html

Vulkan files leak reveals Putin’s global and domestic cyberwarfare tactics

Thousands of pages of leaked documents reveal how Vulkan’s engineers have worked for Russian military and intelligence agencies to support hacking operations, train operatives before attacks on national infrastructure, spread disinformation and control sections of the internet.

See the full report here: https://www.theguardian.com/technology/2023/mar/30/vulkan-files-leak-reveals-putins-global-and-domestic-cyberwarfare-tactics

New Money Message ransomware demands million dollar ransoms

A new ransomware gang named Money Message has been observed targeting victims worldwide and demanding million-dollar ransoms not to leak data and release a decryptor. The new ransomware was first reported by a victim on March 28, 2023.

See the full report here: https://www.bleepingcomputer.com/news/security/new-money-message-ransomware-demands-million-dollar-ransoms/

Fake ransomware gang targets U.S. orgs with empty data leak threats

Fake extortionists are piggybacking on data breaches and ransomware incidents, threatening U.S. companies with publishing or selling allegedly stolen data unless they get paid. Sometimes the actors add the menace of a distributed denial-of-service (DDoS) attack if the message recipient does not comply with the instructions in the message.

See the full report here: https://www.bleepingcomputer.com/news/security/fake-ransomware-gang-targets-us-orgs-with-empty-data-leak-threats/

Hackers exploit bug in Elementor Pro WordPress plugin with 11M installs

Hackers are actively exploiting a high-severity vulnerability in the popular Elementor Pro WordPress plugin used by over eleven million websites. The issue allows authenticated users, like shop customers or site members, to change the site's settings and even perform a complete site takeover. If your site uses Elementor Pro, it is imperative to upgrade to version 3.11.7 or later (the latest available is 3.12.0) as soon as possible.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-exploit-bug-in-elementor-pro-wordpress-plugin-with-11m-installs/

10-year-old Windows bug with opt-in fix exploited in 3CX attack

A 10-year-old Windows vulnerability (CVE-2013-3900) is still being exploited in attacks to make it appear that executables are legitimately signed, with the fix from Microsoft still opt-in.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/10-year-old-windows-bug-with-opt-in-fix-exploited-in-3cx-attack/

Consumer lender TMX discloses data breach impacting 4.8 million people

TMX Finance and its subsidiaries TitleMax, TitleBucks, and InstaLoan have collectively disclosed a data breach that exposed the personal data of 4,822,580 customers. TitleMax is a lending business operating 1,100 stores across the U.S., TitleBucks is a car title loans service, and InstaLoan is a fast-approval personal loan service for those with bad credit. In a data breach notification letter sent to impacted individuals, the Canadian finance giant informs that hackers breached its systems in early December 2022 but did not detect the breach until February 13th, 2023.

See the full report here: https://www.bleepingcomputer.com/news/security/consumer-lender-tmx-discloses-data-breach-impacting-48-million-people/

Microsoft Fixes New Azure AD Vulnerability Impacting Bing Search and Major Apps

Microsoft has patched a misconfiguration issue impacting the Azure Active Directory (AAD) identity and access management service that exposed several high-impact applications to unauthorized access.

See the full report here: https://thehackernews.com/2023/04/microsoft-fixes-new-azure-ad.html

Cacti, Realtek, and IBM Aspera Faspex Vulnerabilities Under Active Exploitation

Critical security flaws in Cacti, Realtek, and IBM Aspera Faspex are being exploited by various threat actors in hacks targeting unpatched systems. This entails the abuse of CVE-2022-46169 (CVSS score: 9.8) and CVE-2021-35394 (CVSS score: 9.8) to deliver MooBot and ShellBot (aka PerlBot).

See the full report here: https://thehackernews.com/2023/04/cacti-realtek-and-ibm-aspera-faspex.html

ISIS-Linked Hackers Ground Pakistan's National Airline Website

ISIS-affiliated hackers have targeted Pakistan International Airlines (PIA), taking down the national carrier's website, Pia.pk.com. The notorious Team UCC hacker group has claimed responsibility for the cyber onslaught, paralyzing the airline's online operations and leaving countless passengers stranded in the digital realm.

See the full report here: https://www.timesnownews.com/technology-science/isis-linked-hackers-ground-pakistans-national-airline-website-article-99184088

US seizes USD 112 million from cryptocurrency investment scammers

The U.S. Department of Justice seized six virtual currency accounts containing over USD 112 million in funds stolen in cryptocurrency investment schemes. Judges in the Central District of California, the District of Arizona, and the District of Idaho authorized the action. The DOJ says the next step is to return the stolen cryptocurrency to the victims.

See the full report here: https://www.bleepingcomputer.com/news/security/us-seizes-112-million-from-cryptocurrency-investment-scammers/

WinRAR SFX archives can run PowerShell without being detected

Hackers are adding malicious functionality to WinRAR self-extracting archives that contain harmless decoy files, allowing them to plant backdoors without triggering the security agent on the target system.

See the full report here: https://www.bleepingcomputer.com/news/security/winrar-sfx-archives-can-run-powershell-without-being-detected/

Cryptocurrency companies backdoored in 3CX supply chain attack

Some of the victims affected by the 3CX supply chain attack have also had their systems backdoored with Gopuram malware, with the threat actors specifically targeting cryptocurrency companies with this additional malicious payload. VoIP communications company 3CX was compromised by North Korean threat actors tracked as Lazarus Group to infect the company's customers with trojanized versions of its Windows and macOS desktop apps in a large-scale supply chain attack.

See the full report here: https://www.bleepingcomputer.com/news/security/cryptocurrency-companies-backdoored-in-3cx-supply-chain-attack/

Capita cyberattack disrupted access to its Microsoft Office 365 apps

British outsourcing services provider Capita announced that a cyberattack prevented access to its internal Microsoft Office 365 applications. London-based Capita employs 50,000 specialists and offers a wide range of services for clients in the finance, IT, healthcare, education, and government sectors.

See the full report here: https://www.bleepingcomputer.com/news/security/capita-cyberattack-disrupted-access-to-its-microsoft-office-365-apps/

Western Digital discloses network breach, My Cloud service down

Western Digital announced today that its network has been breached and an unauthorized party gained access to multiple company systems.

See the full report here: https://www.bleepingcomputer.com/news/security/western-digital-discloses-network-breach-my-cloud-service-down/

Service NSW breach exposes personal data affecting thousands of customers

The personal information of Service NSW customers has been exposed to other logged-in individuals during a privacy incident, the agency says. Personal information available through linked services that might have been visible included driver’s licence and vehicle registration details, contact information and children’s names.

See the full report here: https://7news.com.au/news/nsw/service-nsw-breach-exposes-personal-data-affecting-thousands-of-customers-c-10240008?&web_view=true

Bank of England Warns of Potential Cyber Attacks on Financial System

The Bank of England has issued a warning to banks, insurers, and market infrastructure companies to take immediate steps to bolster their defences against a potential major cyber attack. The warning comes amid growing concerns that Russian-linked hackers will attempt to disrupt the financial system and cause widespread chaos.

See the full report here: https://cyberwarzone.com/bank-of-england-warns-of-potential-cyber-attacks-on-financial-system/?web_view=true

CISA warns of Zimbra bug exploited in attacks against NATO countries

The Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a Zimbra Collaboration (ZCS) cross-site scripting flaw exploited by Russian hackers to steal emails in attacks targeting NATO countries.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-warns-of-zimbra-bug-exploited-in-attacks-against-nato-countries/

HP to patch critical bug in LaserJet printers within 90 days

HP announced in a security bulletin this week that it would take up to 90 days to patch a critical-severity vulnerability that impacts the firmware of certain business-grade printers. The security issue is tracked as CVE-2023-1707 and it affects about 50 HP Enterprise LaserJet and HP LaserJet Managed Printers models.

See the full report here: https://www.bleepingcomputer.com/news/security/hp-to-patch-critical-bug-in-laserjet-printers-within-90-days/

FBI seizes stolen credentials market Genesis in Operation Cookie Monster

The domains for Genesis Market, one of the most popular marketplaces for stolen credentials of all types, were seized by law enforcement as part of Operation Cookie Monster. The action is an important blow to the cybercriminal world as Genesis was one of the major players offering both consumer and corporate account identities.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-seizes-stolen-credentials-market-genesis-in-operation-cookie-monster/

ALPHV ransomware exploits Veritas Backup Exec bugs for initial access

An ALPHV/BlackCat ransomware affiliate was observed exploiting three vulnerabilities impacting the Veritas Backup product for initial access to the target network. The ALPHV ransomware operation emerged in December 2021 and is considered to be run by former members of the Darkside and Blackmatter programs that shut down abruptly to escape law enforcement pressure.

See the full report here: https://www.bleepingcomputer.com/news/security/alphv-ransomware-exploits-veritas-backup-exec-bugs-for-initial-access/

New Rorschach ransomware is the fastest encryptor seen so far

Following a cyberattack on a U.S.-based company, malware researchers discovered what appears to be a new ransomware strain with technically unique features, which they named Rorschach. Among the capabilities observed is the encryption speed, which, according to tests from the researchers, would make Rorschach the fastest ransomware in operation.

See the full report here: https://www.bleepingcomputer.com/news/security/new-rorschach-ransomware-is-the-fastest-encryptor-seen-so-far/

IRS-authorized eFile.com tax return software caught serving JS malware

eFile.com, an IRS-authorized e-file software service provider used by many for filing their tax returns, has been caught serving JavaScript malware. Security researchers state the malicious JavaScript file existed on eFile.com website for weeks.

See the full report here: https://www.bleepingcomputer.com/news/security/irs-authorized-efilecom-tax-return-software-caught-serving-js-malware/

Arid Viper Hacking Group Using Upgraded Malware in Middle East Cyber Attacks

The threat actor known as Arid Viper has been observed using refreshed variants of its malware toolkit in its attacks targeting Palestinian entities since September 2022. Also known by the names APT-C-23 and Desert Falcon, the hacking group has been linked to attacks aimed at Palestine and the Middle East at least since 2014, and is going to great lengths to maintain a persistent presence on targeted networks.

See the full report here: https://thehackernews.com/2023/04/arid-viper-hacking-group-using-upgraded.html

Uber driver info stolen again

Uber has had more of its internal data stolen from a third party that suffered a security breach. This time, the personal info of the app's drivers was swiped by miscreants reportedly from the IT systems of law firm Genova Burns.

See the full report here: https://www.theregister.com/2023/04/03/uber_drivers_info_stolen/?&web_view=true

New Rilide Malware Targeting Chromium-Based Browsers to Steal Cryptocurrency

Chromium-based web browsers are the target of a new malware called Rilide that masquerades itself as a seemingly legitimate extension to harvest sensitive data and siphon cryptocurrency. Rilide malware is disguised as a legitimate Google Drive extension and enables threat actors to carry out a broad spectrum of malicious activities, including monitoring

See the full report here: https://thehackernews.com/2023/04/new-rilide-malware-targeting-chromium.html

Israeli cyber security website briefly taken down in cyberattack

The website of one of Israel's largest cybersecurity companies, CheckPoint, along with the websites of several prominent Israeli universities were taken down by a group of hackers calling themselves "Anonymous Sudan". The website seem to have returned to operating as normal. The attack is part of a campaign called OPIsrael, in which activists try to attack targets on the Israeli internet in support of Palestine.

See the full report here: https://www.jpost.com/breaking-news/article-736351?&web_view=true

China probes US chip maker for cybersecurity risks as tech tension escalates

The Chinese government will investigate US-based Micron as a potential cyberthreat, in the latest move in an ongoing semiconductor trade dispute that is disrupting the chip supply chain.

See the full report here: https://www.computerworld.com/article/3692435/china-to-probe-micron-over-cybersecurity-in-chip-war-s-latest-battle.html?&web_view=true

CryptoClippy: New Clipper Malware Targeting Portuguese Cryptocurrency Users

Portuguese users are being targeted by a new malware codenamed CryptoClippy that's capable of stealing cryptocurrency as part of a malvertising campaign. The activity leverages SEO poisoning techniques to entice users searching for "WhatsApp web" to rogue domains hosting the malware.

See the full report here: https://thehackernews.com/2023/04/cryptoclippy-new-clipper-malware.html

Hackers can open Nexx garage doors remotely, and there's no fix

Multiple vulnerabilities discovered in Nexx smart devices can be exploited to control garage doors, disable home alarms, or smart plugs. There are five security issues disclosed publicly, with severity scores ranging from medium to critical that the vendor has yet to acknowledge and fix. The most significant discovery is the use of universal credentials that are hardcoded in the firmware and also easy to obtain from the client communication with Nexx's API.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-can-open-nexx-garage-doors-remotely-and-theres-no-fix/

Google TAG Warns of North Korean-linked ARCHIPELAGO Cyberattacks

A North Korean government-backed threat actor has been linked to attacks targeting government and military personnel, think tanks, policy makers, academics, and researchers in South Korea. Security researchers are tracking the cluster under the name ARCHIPELAGO and stated that it is a subset of another threat group tracked under the name APT43.

See the full report here: https://thehackernews.com/2023/04/google-tag-warns-of-north-korean-linked.html

Typhon Reborn Stealer Malware Resurfaces with Advanced Evasion Techniques

The threat actor behind the information-stealing malware known as Typhon Reborn has resurfaced with an updated version (V2) that packs in improved capabilities to evade detection and resist analysis.

See the full report here: https://thehackernews.com/2023/04/typhon-reborn-stealer-malware.html

New dark web market STYX focuses on financial fraud services

A new dark web marketplace called STYX appears to be on its way to becoming a thriving hub for buying and selling illegal services or stolen data. Among the services provided are money laundering, identity theft, distributed denial-of-service (DDoS), bypassing two-factor authentication (2FA), fake or stolen IDs and other personal data, renting malware, using cash-out services, email and telephone flooding, identity lookup, and much more.

See the full report here: https://www.bleepingcomputer.com/news/security/new-dark-web-market-styx-focuses-on-financial-fraud-services/

Spain's most dangerous and elusive hacker now in police custody

The police in Spain have arrested a 19-year-old man who is regarded as the most dangerous hacker in the country. The arrested individual is considered to be responsible for multiple high-profile cyberattacks and for creating a search engine called Udyat (the eye of Horus) dedicated to selling stolen sensitive information in large numbers.

See the full report here: https://www.bleepingcomputer.com/news/security/spains-most-dangerous-and-elusive-hacker-now-in-police-custody/

Developer warns of potential vulnerability in revealed Twitter source code

A security researcher from Argentina has created a post on GitHub claiming that the portion of the Twitter source code published recently by the company revealed a vulnerability of the software to manipulation allowing malicious actors to silence certain accounts on the platform.

See the full report here: https://www.scmagazine.com/brief/vulnerability-management/developer-warns-of-potential-vulnerability-in-revealed-twitter-source-code

Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks

An unknown threat actor used a malicious self-extracting archive (SFX) file in an attempt to establish persistent backdoor access to a victim's environment. SFX files are capable of extracting the data contained within them without the need for dedicated software to display the file contents. It achieves this by including a decompressor stub, a piece of code that's executed to unpack the archive.

See the full report here: https://thehackernews.com/2023/04/hackers-using-self-extracting-archives.html

ZeroFox Intelligence Reports

ZeroFox Intelligence - Masters Tournament 2023 Event Assessment

In this assessment, ZeroFox Intelligence covers various security topics surrounding the 2023 Masters Tournament, including physical security, cyber security, and fraud and scams.

Report: https://cloud.zerofox.com/intelligence/advisories/20125

ZeroFox Intelligence Flash Report – Fate of Genesis Market Uncertain as Rumors of FBI Seizure Remain Unconfirmed

In this flash report, ZeroFox Intelligence provides updates around a recent announcement that the FBI had seized the site of longtime botnet marketplace Genesis Market.

Report: https://cloud.zerofox.com/intelligence/advisories/20151

ZeroFox Intelligence Exploit Profile – CVE-2023-23752

In this exploit profile, ZeroFox Intelligence provides an overview of CVE-2023-23752, which allows a threat actor unauthenticated access to sensitive APIs.

Report: https://cloud.zerofox.com/intelligence/advisories/20152

Tags: tlp:clear,  all industries,  global