zerofox logo
Advisories

Threat Intelligence Bulletin: 04/07/2023 - 04/13/2023

|by Alpha Team

banner image

ZeroFox Weekly Threat Bulletin: 04/07/2023 - 04/13/2023

ZeroFox Daily Intelligence Briefs: 04/07/2023 - 04/13/2023

ZeroFox Daily Intelligence Brief - April 7, 2023

Key Findings

  • Snatch Ransomware Claims Attack on Americana Restaurants—Operator of Over 2,000 Restaurants in the Middle East
  • United Kingdom’s Criminal Records Office Confirms Cybersecurity Incident
  • Hackers Use Rilide Browser Extension to Bypass Two-Factor Authentication, Steal Crypto

Report: https://cloud.zerofox.com/intelligence/advisories/20173

ZeroFox Daily Intelligence Brief - April 10, 2023

Key Findings

  • FBI: For-Profit Companies Charging Sextortion Victims for Assistance and Using Deceptive Tactics to Elicit Payments
  • Apple Fixes Two Actively Exploited Zero-Day Bugs
  • Iran-Based Hackers Conducting Destructive Attacks Under Ransomware Guise

Report: https://cloud.zerofox.com/intelligence/advisories/20186

ZeroFox Daily Intelligence Brief - April 11, 2023

Key Findings

  • Killnet Exhorts Allies to Target NATO Entities En Masse
  • SD Worx Shuts Down UK Payroll, HR Services after Cyberattack
  • Fast Food Giant Yum! Brands’ Data Breached, Employees Alerted

Report: https://cloud.zerofox.com/intelligence/advisories/20195

ZeroFox Daily Intelligence Brief - April 12, 2023

Key Findings

  • Zero-Click Apple Spyware Abuses Calendar Events
  • FBI Issues Alerts on “Juice Jacking” and Warns Against Using Charging Phones at Free Charging Stations
  • SAP Releases Security Updates to Fix Critical-Severity Vulnerabilities

Report: https://cloud.zerofox.com/intelligence/advisories/20205

ZeroFox Daily Intelligence Brief - April 13, 2023

Key Findings

  • Hyundai Warns of Data Breach Exposing Owner Details in France and Italy
  • Kyocera Android App Can Be Abused to Deploy Malware
  • FBI: Criminals Pose as Chinese Authorities to Target U.S.-based Chinese Community

Report: https://cloud.zerofox.com/intelligence/advisories/20214

Breach Disclosures: 04/07/2023 - 04/13/2023

Breach Disclosure: Aritic - April 7, 2023

Summary Aritic, a U.S.-based marketing automation software platform, in which 4,164 email addresses were leaked, which were subsequently shared on a deep web platform. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Report: https://cloud.zerofox.com/intelligence/advisories/20168

Breaking News: 2023-04-07 - 2023-04-13

Telegram now the go-to place for selling phishing tools and services

Security researchers have observed a surge in activity from creators of phishing bots and kits on Telegram. Threat actors are increasingly utilizing the platform to to market their products to a larger audience or to recruit helpers.

See the full report here: https://www.bleepingcomputer.com/news/security/telegram-now-the-go-to-place-for-selling-phishing-tools-and-services/

UK criminal records office confirms cyber incident behind portal issues

The UK's Criminal Records Office (ACRO) has confirmed that online portal issues experienced since January 17 resulted from a cyber security incident. Users are asked to apply for police or international child protection certificates via email, with the agency to reach out later for payment.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-criminal-records-office-confirms-cyber-incident-behind-portal-issues/

Money Message ransomware gang claims MSI breach, demands USD 4 million

The Money Message ransomware group has mentioned Taiwanese PC parts maker MSI (Micro-Star International) on its leak site and has claimed to have stolen source code from the company's network. The gang has threatened to release the hardware vendor's CTMS and ERP databases and files containing software source code, private keys, and BIOS firmware, unless the demanded ransom is paid.

See the full report here: https://www.bleepingcomputer.com/news/security/money-message-ransomware-gang-claims-msi-breach-demands-4-million/

Microsoft and Fortra crack down on malicious Cobalt Strike servers

Microsoft, Fortra, and the Health Information Sharing and Analysis Center (Health-ISAC) have announced a legal crackdown against servers hosting cracked copies of Cobalt Strike, in order to disrupt infrastructure that threat actors can use in attacks. On March 31, the U.S. District Court for the Eastern District of New York issued a court order allowing Microsoft and Fortra to seize the domain names and take down the IP addresses of servers hosting cracked versions of Cobalt Strike.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-and-fortra-crack-down-on-malicious-cobalt-strike-servers/

Tesla Retail Tool Vulnerability Led to Account Takeover

A vulnerability in the Tesla Retail Tool (TRT) application allowed a researcher to take over the accounts of former employees. The researcher discovered not only that accounts of past employees were still lurking in Tesla’s internal systems, but also that it was possible to register an external account with the internal email of a former employee, and then access TRT with the privileges of that employee’s account.

See the full report here: https://www.securityweek.com/tesla-retail-tool-vulnerability-led-to-account-takeover/?web_view=true

Ransomware Attack at NJ County Police Department Locks Up Criminal Investigative Files

The Camden County Police Department in New Jersey experienced a ransomware attack that has been locking many criminal investigative files and day-to-day internal administration abilities, several law enforcement officials said. Investigators said the attack started in March 2023 and technicians continue working to try to get all systems back up and running. A police spokesman confirmed the cyber intrusion but stressed the ransomware attack did not impact 911 call systems or other public safety responses.

See the full report here: https://www.nbcnewyork.com/news/local/ransomware-attack-at-nj-county-police-department-locks-up-criminal-investigative-files/4219341/?&web_view=true

Taiwanese PC Company MSI Falls Victim to Ransomware Attack

Taiwanese PC company MSI (Micro-Star International) officially confirmed it was the victim of a cyber attack on its systems. The company indicated that it initiated incident response and recovery measures after detecting network anomalies. It also said it alerted law enforcement agencies of the matter. MSI did not disclose any specifics about when the attack took place and if it entailed the exfiltration of any proprietary information, including source code.

See the full report here: https://thehackernews.com/2023/04/taiwanese-pc-company-msi-falls-victim.html

DDoS attacks rise as pro-Russia groups attack Finland, Israel

The pro-Russia hacker group NoName057(16) reportedly claimed it was behind Denial of Service (DoS) attacks against the Finnish parliament’s website, the day the country joined NATO. The country’s Technical Research Centre of Finland was also hacked, according to Finnish news site, YLE.

See the full report here: https://www.techrepublic.com/article/ddos-attacks-finland-israel/?web_view=true

All Dutch govt networks to use RPKI to prevent BGP hijacking

The Dutch government will upgrade the security of its internet routing by adopting before the end of 2024 the Resource Public Key Infrastructure (RPKI) standard. RPKI, or Resource Certification protects against erroneous rerouting of internet traffic, maliciously or not, through cryptographic verification of the routes.

See the full report here: https://www.bleepingcomputer.com/news/security/all-dutch-govt-networks-to-use-rpki-to-prevent-bgp-hijacking/

Breached shutdown sparks migration to ARES data leak forums

A threat group called ARES is gaining notoriety on the cybercrime scene by selling and leaking databases stolen from corporations and public authorities. The actor emerged on Telegram in late 2021 and has been associated with the RansomHouse ransomware operation and the data leak platform, KelvinSecurity, and the network access group Adrastea. ARES Group manages its own site with database leaks and a forum, which may fill the void left by the now defunct Breached forum.

See the full report here: https://www.bleepingcomputer.com/news/security/breached-shutdown-sparks-migration-to-ares-data-leak-forums/

Western Digital struggles to fix massive My Cloud outage, offers workaround

Five days into a massive outage impacting its cloud services, Western Digital provided customers with a workaround to access their files. Since April 2, 2023, the outage has prevented users from accessing files stored on their WD NAS devices, as it required access to the company's cloud services. The complete list of services that were down throughout this week includes My Cloud, My Cloud Home, My Cloud Home Duo, My Cloud OS 5, SanDisk ibi, and SanDisk Ixpand Wireless Charger, together with linked mobile, desktop, and web apps.

See the full report here: https://www.bleepingcomputer.com/news/technology/western-digital-struggles-to-fix-massive-my-cloud-outage-offers-workaround/

CISA Warns of Critical ICS Flaws in Hitachi, mySCADA, ICL, and Nexx Products

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published eight Industrial Control Systems (ICS) advisories warning of critical flaws affecting products from Hitachi Energy, mySCADA Technologies, Industrial Control Links, and Nexx. Topping the list is CVE-2022-3682 (CVSS score: 9.9), impacting Hitachi Energy's MicroSCADA System Data Manager SDM600 that could allow an attacker to take remote control of the product.

See the full report here: https://thehackernews.com/2023/04/cisa-warns-of-critical-ics-flaws-in.html?&web_view=true

Researchers Discover Critical Remote Code Execution Flaw in vm2 Sandbox Library

The maintainers of the vm2 JavaScript sandbox module have shipped a patch to address a critical flaw that could be abused to break out of security boundaries and execute arbitrary shellcode. The flaw, which affects all versions, including and prior to 3.9.14, was reported by researchers on April 6, 2023, prompting vm2 to release a fix with version 3.9.15. The vulnerability has been assigned the identified CVE-2023-29017 and is rated 9.8 on the CVSS scoring system.

See the full report here: https://thehackernews.com/2023/04/researchers-discover-critical-remote.html

Iran-Based Hackers Caught Carrying Out Destructive Attacks Under Ransomware Guise

The Iranian nation-state group known as MuddyWater has been observed carrying out destructive attacks on hybrid environments under the guise of a ransomware operation. Researchers discovered the threat actor targeting both on-premises and cloud infrastructures in partnership with another emerging activity cluster dubbed DEV-1084. While the threat actors attempted to masquerade the activity as a standard ransomware campaign, the unrecoverable actions show destruction and disruption were the ultimate goals of the operation.

See the full report here: https://thehackernews.com/2023/04/iran-based-hackers-caught-carrying-out.html

Hacking multi-tool Flipper Zero gets banned from Amazon, classified for card skimming

Flipper Zero, a device which allows users to locate, troubleshoot, test, and debug different types of digital interfaces and hardware devices via radio, radio frequency identification (RFID), near field communication (NFC), infrared, Bluetooth, and other protocols. Based on this capability, Amazon sees the Flipper Zero's NFC capabilities as a potential policy-breaking security risk, as many bank and credit cards that offer contactless transactions utilize NFC communication.

See the full report here: https://www.techspot.com/news/98248-hacking-multi-tool-flipper-zero-gets-banned-amazon.html

Pro-Russian hackers claim to have targeted Canada’s gas pipeline infrastructure: leaked documents

A hacking group under the guidance of Russia’s Federal Security Service may have compromised the I.P. address of a Canadian gas pipeline company in February 2023 and caused damage to its infrastructure, according to leaked Pentagon documents. If the attack by the cybercriminal group, Zarya, succeeded, the intelligence report indicated that it would mark the first time the United States intelligence community observed a pro-Russia-hacking group execute a disruptive attack against Western industrial control systems.

See the full report here: https://www.nytimes.com/explain/2023/russia-ukraine-war-documents-leak#hacking-canada-pipeline

KFC, Pizza Hut owner discloses data breach after ransomware attack

Yum! Brands, the brand owner of the KFC, Pizza Hut, and Taco Bell fast food chains, is sending data breach notification letters to an undisclosed number of individuals whose personal information was stolen in a January 2023 ransomware attack. This comes after the company said that although some data was stolen from its network, it has no evidence that the attackers exfiltrated any customer information.

See the full report here: https://www.bleepingcomputer.com/news/security/kfc-pizza-hut-owner-discloses-data-breach-after-ransomware-attack/

CISA orders govt agencies to update iPhones, Macs by May 1st

The Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch two security vulnerabilities actively exploited in the wild to hack iPhones, Macs, and iPads. According to a binding operational directive (BOD 22-01) issued in November 2022, Federal Civilian Executive Branch Agencies (FCEB) agencies are required to patch their systems against all security bugs added to CISA's Known Exploited Vulnerabilities catalog.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-orders-govt-agencies-to-update-iphones-macs-by-may-1st/

SD Worx shuts down UK payroll, HR services after cyberattack

Belgian HR and payroll giant SD Worx has suffered a cyberattack causing them to shut down all IT systems for its UK and Ireland services. SD Worx is a European HR and payroll management company based out of Belgium that services 5.2 million employees for over 82,000 companies, according to its website. SD Worx began notifying customers that its UK and Ireland division suffered a cyberattack leading them to shut down IT systems to contain the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/sd-worx-shuts-down-uk-payroll-hr-services-after-cyberattack/

Estonian National Charged in U.S. for Acquiring Electronics and Metasploit Pro for Russian Military

An Estonian national has been charged in the U.S. for purchasing U.S.-made electronics on behalf of the Russian government and military. The perpetrator has been indicted with 18 counts of conspiracy and other charges. Court documents allege that the individual operated front companies that were used to import sensitive electronics from U.S. manufacturers. The goods were then shipped to Russia, bypassing export restrictions.

See the full report here: https://thehackernews.com/2023/04/estonian-national-charged-in-us-for.html

Hackers Flood NPM with Bogus Packages Causing a DoS Attack

Threat actors flooded the npm open source package repository for Node.js with bogus packages that briefly even resulted in a denial-of-service (DoS) attack. The threat actors create malicious websites and publish empty packages with links to those malicious websites, taking advantage of open-source ecosystems' good reputation on search engines, The attacks caused a denial-of-service (DoS) that made NPM unstable with sporadic 'Service Unavailable' errors.

See the full report here: https://thehackernews.com/2023/04/hackers-flood-npm-with-bogus-packages.html

Over 1 Million WordPress Sites Infected by Balada Injector Malware Campaign

Over one million WordPress websites are estimated to have been infected by an ongoing campaign to deploy malware called Balada Injector since 2017. The massive campaign leverages all known and recently discovered theme and plugin vulnerabilities to breach WordPress sites.

See the full report here: https://thehackernews.com/2023/04/over-1-million-wordpress-sites-infected.html

SAP releases security updates for two critical-severity flaws

Enterprise software vendor SAP has released its April 2023 security updates for several of its products, which includes fixes for two critical-severity vulnerabilities that impact the SAP Diagnostics Agent and the SAP BusinessObjects Business Intelligence Platform. In total, SAP has released 24 notes, 19 of which concern new issues of varying importance, and five are updates to previous bulletins.

See the full report here: https://www.bleepingcomputer.com/news/security/sap-releases-security-updates-for-two-critical-severity-flaws/

Hacked sites caught spreading malware via fake Chrome updates

Hackers are compromising websites to inject scripts that display fake Google Chrome automatic update errors that distribute malware to unaware visitors. The campaign has been underway since November 2022, and according to security analysts, it shifted up a gear after February 2023, expanding its targeting scope to cover users who speak Japanese, Korean, and Spanish.

See the full report here: https://www.bleepingcomputer.com/news/security/hacked-sites-caught-spreading-malware-via-fake-chrome-updates/

Windows zero-day vulnerability exploited in ransomware attacks

Microsoft has patched a zero-day vulnerability in the Windows Common Log File System (CLFS), actively exploited by cybercriminals to escalate privileges and deploy Nokoyawa ransomware payloads. In light of its ongoing exploitation, CISA also added the CVE-2023-28252 Windows zero-day to its catalog of Known Exploited Vulnerabilities, ordering Federal Civilian Executive Branch (FCEB) agencies to secure their systems against it by May 2nd.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-zero-day-vulnerability-exploited-in-ransomware-attacks/

iPhones hacked via invisible calendar invites to drop QuaDream spyware

Cybersecurity researchers discovered commercial spyware made by an Israel-based company QuaDream used to compromise the iPhones of high-risk individuals using a zero-click exploit named ENDOFDAYS. The attackers targeted a zero-day vulnerability affecting iPhones running iOS 1.4 up to 14.4.2 between January 2021 and November 2021, using what researchers described as backdated and "invisible iCloud calendar invitations."

See the full report here: https://www.bleepingcomputer.com/news/security/iphones-hacked-via-invisible-calendar-invites-to-drop-quadream-spyware/

Kodi discloses data breach after forum database for sale online

The Kodi Foundation has disclosed a data breach after hackers stole the organization's MyBB forum database containing user data and private messages and attempted to sell it online. Kodi is a cross-platform open-source media player, organizer, and streaming suite, that supports a vast array of third-party add-ons enabling the users to access content from various sources or customize their experience.

See the full report here: https://www.bleepingcomputer.com/news/security/kodi-discloses-data-breach-after-forum-database-for-sale-online/

3CX confirms North Korean hackers behind supply chain attack

VoIP communications company 3CX confirmed that a North Korean hacking group was behind a supply chain attack that occurred in March 2023. The attackers infected 3CX systems with malware known as Taxhaul (or TxRLoader), which deployed a second-stage malware downloader named Coldcat by cybersecurity researchers. The malware achieved persistence on compromised systems through DLL side-loading via legitimate Microsoft Windows binaries, making it harder to detect.

See the full report here: https://www.bleepingcomputer.com/news/security/3cx-confirms-north-korean-hackers-behind-supply-chain-attack/

Cybercriminals charge USD 5K to add Android malware to Google Play

Malware developers have created a thriving market promising to add malicious Android apps to Google Play for USD 2,000 to USD 20,000, depending on the type of malicious behavior cyber criminals request. The exact price for these services is negotiated on a case-by-case basis on hacker forums or Telegram channels, allowing cybercriminals to customize malicious Android apps with their own malware or functionality.

See the full report here: https://www.bleepingcomputer.com/news/security/cybercriminals-charge-5k-to-add-android-malware-to-google-play/

Ukrainian hackers say they have compromised Russian spy who hacked Democrats in 2016

Ukrainian hackers claim to have broken into the emails of a senior Russian military spy wanted by the Federal Bureau of Investigation for hacking the Hillary Clinton campaign and other senior U.S. Democrats ahead of Donald Trump's election to the presidency in 2016.

See the full report here: https://www.reuters.com/world/ukrainian-hackers-say-they-have-compromised-russian-spy-who-hacked-democrats-2023-04-11/

DDoS attacks shifting to VPS infrastructure for increased power

Hyper-volumetric DDoS (distributed denial of service) attacks in the first quarter of 2023 have shifted from relying on compromised IoT devices to leveraging breached Virtual Private Servers (VPS). According to cybersecurity researchers, the newer generation of botnets gradually abandoned the tactic of building large swarms of individually weak IoT devices and are now shifting towards enslaving vulnerable and misconfigured VPS servers using leaked API credentials or known exploits.

See the full report here: https://www.bleepingcomputer.com/news/security/ddos-attacks-shifting-to-vps-infrastructure-for-increased-power/

Kyocera Android app with 1M installs can be abused to drop malware

A Kyocera Android printing app is vulnerable to improper intent handling, allowing other malicious applications to abuse the flaw to download and potentially install malware on devices. According to a security notice by JVN (Japanese Vulnerability Notes), a state-supported portal dedicated to raising awareness on matters of security, the issue, the flaw is tracked as CVE-2023-25954 and impacts the following apps: KYOCERA Mobile Print v3.2.0.230119 and earlier, UTAX/TA Mobile Print v3.2.0.230119 and earlier, and Olivetti Mobile Print v3.2.0.230119 and earlier (10k downloads on Google Play)

See the full report here: https://www.bleepingcomputer.com/news/security/kyocera-android-app-with-1m-installs-can-be-abused-to-drop-malware/

Microsoft shares guidance to detect BlackLotus UEFI bootkit attacks

Microsoft has shared guidance to help organizations check if hackers targeted or compromised machines with the BlackLotus UEFI bootkit by exploiting the CVE-2022-21894 vulnerability. Organizations and individuals can also use Microsoft’s advice to recover from an attack and to prevent threat actors using BlackLotus from achieving persistence and evading detection. BlackLotus has been available since 2022 on hacking forums, advertised as a piece of malware that evades antivirus detection, resists removal attempts, and can disable various security features (e.g. Defender, HVCI, BitLocker).

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-shares-guidance-to-detect-blacklotus-uefi-bootkit-attacks/

Hyundai data breach exposes owner details in France and Italy

Hyundai has disclosed a data breach impacting Italian and French car owners and those who booked a test drive, warning that hackers gained access to personal data. The disclosure letter also clarifies that the hacker who accessed Hyundai’s database did not steal financial data or identification numbers.

See the full report here: https://www.bleepingcomputer.com/news/security/hyundai-data-breach-exposes-owner-details-in-france-and-italy/

US cyber chiefs warn of threats from China and AI

Bots like ChatGPT may help criminal gangs and nation-state hackers develop some attacks against IT systems, according to the director of the NSA's Cybersecurity Directorate. The malicious usage includes Russian and Chinese cyber spies using AI to scan the internet for exploitable vulnerabilities. The two nations are known to use automation to spread disinformation across social media channels.

See the full report here: https://www.theregister.com/2023/04/12/us_chatgpt_threat/?&web_view=true

Biden Administration Seeks Input on AI Safety Measures

President Joe Biden’s administration wants stronger measures to test the safety of artificial intelligence tools such as ChatGPT before they are publicly released, though it hasn’t decided if the government will have a role in doing the vetting. The U.S. Commerce Department said it will spend the next 60 days fielding opinions on the possibility of AI audits, risk assessments, and other measures that could ease consumer concerns about these new systems.

See the full report here: https://www.securityweek.com/biden-administration-seeks-input-on-ai-safety-measures/

Criminals Pose as Chinese Authorities to Target US-based Chinese Community

The FBI warns of criminal actors posing as Chinese law enforcement officials or prosecutors in financial fraud schemes targeting the US-based Chinese community. Criminals tell victims they are suspects in financial crimes and threaten them with arrest or violence if they do not pay the criminals. Criminals typically call victims, sometimes using spoofed numbers to appear as if the call is from the Chinese Ministry of Public Security, one of its localized Public Security Bureaus, or a US-based Chinese Consulate.

See the full report here: https://www.ic3.gov/Media/Y2023/PSA230410?&web_view=true

Pakistan-based Transparent Tribe Hackers Targeting Indian Educational Institutions

The Transparent Tribe threat actor has been linked to a set of weaponized Microsoft Office documents in intrusions directed against the Indian education sector to deploy a continuously maintained piece of malware called Crimson RAT. While the suspected Pakistan-based threat group is known to target military and government entities in the country, the activities have since expanded to include the education sector.

See the full report here: https://thehackernews.com/2023/04/pakistan-based-transparent-tribe.html

New Python-Based "Legion" Hacking Tool Emerges on Telegram

An emerging Python-based credential harvester and a hacking tool named Legion is being marketed via Telegram as a way for threat actors to break into various online services for further exploitation. Legion includes modules to enumerate vulnerable SMTP servers, conduct remote code execution (RCE) attacks, exploit unpatched versions of Apache, and brute-force cPanel and WebHost Manager (WHM) accounts. The malware is said to bear similarities to another malware family called AndroxGh0st that was first documented in December 2022.

See the full report here: https://thehackernews.com/2023/04/new-python-based-legion-hacking-tool.html

RTM Locker: Emerging Cybercrime Group Targeting Businesses with Ransomware

Cybersecurity researchers have detailed the tactics of a rising cybercriminal gang called "Read The Manual" (RTM) Locker that functions as a private ransomware-as-a-service (RaaS) provider and carries out opportunistic attacks to generate illicit profit. The "Read The Manual" Locker gang uses affiliates to ransom victims, all of whom are forced to abide by the gang's strict rules.

See the full report here: https://thehackernews.com/2023/04/rtm-locker-emerging-cybercrime-group.html

Alleged Pentagon classified documents leaker arrested

The FBI has detained a 21-year-old Air National Guardsman suspected of leaking a trove of classified Pentagon documents on Discord. The suspect was being held in connection with an investigation into alleged unauthorized removal, retention, and transmission of classified national defense information. The individual controlled a private Discord server, and allegedly posted photographs of the classified Pentagon documents to impress the private group's 25 members, which included netizens in Europe, Asia, and South America.

See the full report here: https://www.theregister.com/2023/04/13/alleged_pentagon_leaker_arrested/

Phishing attack targets accountants as Tax Day approaches

Microsoft is warning of a phishing campaign targeting accounting firms and tax preparers with remote access malware allowing initial access to corporate networks. With the USA reaching the end of its annual tax season, accountants are scrambling to gather clients' tax documents to complete and file their tax returns. Due to this, it makes it an ideal time for threat actors to target tax preparers, hoping that they mistakenly open malicious files that they would generally be more careful with when less busy.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-phishing-attack-targets-accountants-as-tax-day-approaches/

Dutch Police mails RaidForums members to warn they’re being watched

The Dutch Police is sending emails to former RaidForums members, asking them to delete stolen data and stop illegal cyber activities and warning that they are not anonymous. RaidForums was a very popular and notorious hacking and data leak forum known for hosting, leaking, and selling stolen data obtained from breached organizations. Threat actors who frequented the forum would hack into websites or access exposed database servers to steal customer information.

See the full report here: https://www.bleepingcomputer.com/news/security/dutch-police-mails-raidforums-members-to-warn-theyre-being-watched/

Five arrested after 33,000 victims lose USD 98 million to online investment fraud

Europol and Eurojust announced the arrest of five individuals believed to be part of a massive online investment fraud ring with at least 33,000 victims who lost an estimated EUR 89 million (roughly USD 98 million). The coordinated action took place across two action days in March and involved the search of 15 locations (including five illegal call centers) across Bulgaria, Romania, and Israel.

See the full report here: https://www.bleepingcomputer.com/news/security/five-arrested-after-33-000-victims-lose-98m-to-online-investment-fraud/

Russian hackers linked to widespread attacks targeting NATO and EU

Poland's Military Counterintelligence Service and its Computer Emergency Response Team have linked APT29 state-sponsored hackers, part of the Russian government's Foreign Intelligence Service (SVR), to widespread attacks targeting NATO and European Union countries. As part of this campaign, the cyberespionage group (also tracked as Cozy Bear and Nobelium) aimed to harvest information from diplomatic entities and foreign ministries.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-hackers-linked-to-widespread-attacks-targeting-nato-and-eu/

Legion: New hacktool steals credentials from misconfigured sites

A new Python-based credential harvester and SMTP hijacking tool named "Legion" is being sold on Telegram that targets online email services for phishing and spam attacks. Legion is sold by cybercriminals who use the “Forza Tools” moniker and operate a YouTube channel with tutorials and a Telegram channel with over a thousand members.

See the full report here: https://www.bleepingcomputer.com/news/security/legion-new-hacktool-steals-credentials-from-misconfigured-sites/

German Superyacht Maker Lürssen Hit by Ransomware Cyber Attack

German shipbuilder Lürssen, which makes military vessels as well as luxury yachts, has become the target of a ransomware cyberattack. The Bremen-based company was attacked over the Easter holiday period. The attack brought large parts of Lürssen’s shipyard operations to a standstill.

See the full report here: https://www.insurancejournal.com/news/international/2023/04/12/716262.htm

ZeroFox Intelligence Reports: 04/07/2023 - 04/13/2023

ZeroFox Intelligence Brief - Synthetic Media Notable Attacks

Summary In this brief, ZeroFox Intelligence provides an overview of notable synthetic media attacks. As synthetic media creation tools become increasingly sophisticated, accessible, and affordable, threat actors will be more likely to utilize this technology to enhance and diversify existing threats.

Report: https://cloud.zerofox.com/intelligence/advisories/20206

Tags: tlp:clear,  all industries,  global