ZeroFox Daily Intelligence Brief - April 13, 2023

ZeroFox Daily Intelligence Brief - April 13, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Hyundai Warns of Data Breach Exposing Owner Details in France and Italy
• Kyocera Android App Can Be Abused to Deploy Malware
• FBI: Criminals Pose as Chinese Authorities to Target U.S.-based Chinese Community

Hyundai Warns of Data Breach Exposing Owner Details in France and Italy

Personal information—including email and physical addresses, telephone numbers, and vehicle chassis numbers—of Hyundai vehicle owners and individuals who had booked test drives has been compromised in a data breach affecting the French and Italian divisions of Hyundai. While Hyundai claims there is no evidence of the breached data being used for fraudulent purposes, customers were advised to be cautious about unsolicited messages and verify contact attempts from Hyundai Italia or other entities of the Hyundai Group.

Recommendation:

• Individuals whose data has been breached should stay vigilant towards phishing attacks and social-engineering attempts from threat actors leveraging the compromised data.

Kyocera Android App Can Be Abused to Deploy Malware

A security vulnerability was discovered in the KYOCERA Mobile Print for Android application and is being tracked as CVE-2023-25954. Malicious third-party mobile applicants can transmit data via the app, which may result in the download of further malicious files. The flaw requires user action but could still be exploited by an attacker to install further malware on devices as well as to run code. Several other mobile printing apps for Android, including UTAX/TA MobilePrint and Olivetti Mobile Print, are also vulnerable to the improper intent handling bug (CWE-668) due to sharing a similar code base. No attacks utilizing this bug have been confirmed so far.

Recommendations:

• Users of the Kyocera Mobile Print App should upgrade to version 3.2.0.230227 to safeguard their devices from attacks using this bug.
• Updating devices to the upcoming Android 14 operating system can help mitigate improper intent (CWE-668) related exploits.
• Follow ZeroFox Intelligence to remain up-to-date on emerging threats.

FBI: Criminals Pose as Chinese Authorities to Target U.S.-based Chinese Community

The FBI warns of criminals posing as Chinese law enforcement officials or prosecutors to commit financial fraud against the US-based Chinese community. Threat actors use threats of arrest or violence and fraudulent documents to scam victims, sometimes even disguising their phone numbers to appear as trusted sources. These impersonators exploit widely publicized efforts by the People’s Republic of China government to target and facilitate the repatriation of individuals living in the United States to build plausibility for their fraud.

Recommendations:

• Verify the number from where you receive a call. Even if the caller ID appears to be from an official phone number, it's not proof of official action. Scammers may use technology to disguise their number and make it appear as a trusted number.
• If you think that you have been contacted by individuals claiming to be a Chinese authority, contact your local FBI field office. Foreign government officials conducting legitimate law enforcement activity in the United States must act in coordination with US federal authorities.
• Victims should report these types of fraudulent or suspicious activities to the FBI Internet Crime Complaint Center at www.ic3.gov.