ZeroFox Daily Intelligence Brief - April 11, 2023

ZeroFox Daily Intelligence Brief - April 11, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Killnet Exhorts Allies to Target NATO Entities En Masse
• SD Worx Shuts Down UK Payroll, HR Services after Cyberattack
• Fast Food Giant Yum! Brands’ Data Breached, Employees Alerted

Killnet Exhorts Allies to Target NATO Entities En Masse

ZeroFox Intelligence observed the pro-Russia threat group Killnet exhorting its affiliates and allies to launch a widespread and coordinated attack on NATO entities. Killnet published a list of NATO entities and IP addresses to target in distributed denial of service (DDoS) attacks. ZeroFox Intelligence also observed chatter about a large-scale attack that was to be Killnet’s last mission; the messages indicated that Killnet intended to disappear just as suddenly as it appeared on the global scene. Responding to Killnet’s clarion call, aligned entities such as ANONYMOUS | RUSSIA, UserSec, Anonymous Sudan, and others started attacking the listed targets. The threat actors claim to have disrupted the operations of a significant percentage of NATO’s electronic infrastructure and breached and exfiltrated personnel data from the NATO Communications and Information Agency; these claims have not been verified. ZeroFox Intelligence has observed an underground channel sharing email addresses and passwords of NATO personnel purportedly stolen during the attack; however, the source of the database is yet to be determined.

Recommendations:

• NATO personnel should update their passwords, both on their work platforms and elsewhere online where they may have used the same or similar login credentials, to mitigate the risk of the claimed breach.
• Organizations should conduct regular audits of their security posture, including monitoring for regular deployment of software updates and patches, control of remote access, and use of unique passwords and their periodic change, as well as multi-factor (MFA) authentication.
• DDoS protection services can help guard against potentially disruptive attacks by less technically sophisticated attackers.
• Follow ZeroFox Intelligence to stay updated on this developing situation.

SD Worx Shuts Down UK Payroll, HR Services after Cyberattack

Belgian HR and payroll management company SD Worx suffered a cyberattack that forced it to close down its IT systems for the United Kingdom and Ireland. SD Worx services 5.2 million employees for over 82,000 businesses in Europe. The company assured customers that it is investigating the incident but has confirmed it was not a ransomware attack; however, customers have expressed concerns that sensitive data may have been stolen. SD Worx has stated there is no evidence to assume any data was compromised and that the shutdown was done to mitigate the impact and assess the threat.

Recommendations:

• SD Worx customers should monitor their credit reports, bank accounts, and financial statements and report any fraudulent activity.
• Regular data backups ensure that files can be restored in the event of a ransomware attack or other type of intrusion.
• Conduct regular pentesting to help identify vulnerabilities in systems and infrastructure before they are exploited by attackers and to ensure that the security measures are effective and up to date.
• Encrypt sensitive data to prevent unauthorized access to it n case of a breach.

Fast Food Giant Yum! Brands’ Data Breached, Employees Alerted

Sensitive and confidential information—including names, driver’s license numbers, and ID card numbers of some employees of Yum! Brands outlets—were compromised following a ransomware attack on January 13, 2023. The fast food giant, which is the brand owner of KFC, Pizza Hut, Taco Bell, and Burger Grill, has notified affected individuals about their personal information being exposed. However, the company said that they found no evidence that the stolen data had been used for identity theft or fraud. Following the ransomware attack that impacted certain IT systems, about 300 restaurants were shut down in the United Kingdom for a day. Yum! Brands and its subsidiaries operate or franchise more than 55,000 restaurants across 155 countries, employing about 36,000 employees worldwide.

Recommendations:

• Affected employees should utilize the complimentary credit monitoring and identity protection services offered by the company for two years. These services include credit monitoring, a USD 1,000,000 insurance reimbursement policy and fully-managed identity restoration in the event of any incidents of identity theft, and dark web monitoring to monitor if the breached data appears in illicit online forums.
• Affected individuals can call Yum! Brand’s helpline number 888-566-0758 between 9 am to 9 pm Eastern Time on weekdays for more information.