ZeroFox Daily Intelligence Brief - April 17, 2023

ZeroFox Daily Intelligence Brief - April 17, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• CISA Orders Federal Agencies to Patch Android Zero-Day Abused by Chinese App Pinduoduo
• LockBit Ransomware Encryptors Designed to Target Mac Devices
• Hospitality Services Affected by ALPHV Ransomware Attack

CISA Orders Federal Agencies to Patch Android Zero-Day Abused by Chinese App Pinduoduo

The U.S. Cybersecurity Infrastructure Security Agency (CISA) has issued a warning against a high-severity Android zero-day vulnerability (CVE-2023-20963) reportedly being exploited by Chinese app Pinduoduo to spy on users. This Android Framework security flaw allows attackers to escalate privileges after updating an app to a higher Target SDK, with no additional execution privileges needed. Although Google addressed the bug in security updates, there were indications that this vulnerability may be under limited, targeted exploitation. Pinduoduo was suspended from the Play Store on March 21 after Google discovered malware in off-Play versions of the app enabling “unauthorized access” to the data of over 750 million monthly active users. The U.S. Federal Civilian Executive Branch (FCEB) agencies have been given until May 4, 2023, to secure their devices against the vulnerability.

Recommendations:

• Avoid downloading apps from third-party sources; use known and trusted app stores, such as Apple Store and Google Play, where apps are vetted.
• Even though the CISA directive applies only to FCEB agencies, all organizations should instruct their employees to deploy the available patches in order to protect their systems.
• Follow ZeroFox Intelligence to remain up to date on emerging threats.

LockBit Ransomware Encryptors Designed to Target Mac Devices

The LockBit ransomware gang has released new ransomware encryptors targeting Macs, making it the first major ransomware operation to do so. A cybersecurity researcher discovered the new ransomware encryptors while scanning a ZIP archive on VirusTotal. The archive contained new encryptors for macOS, ARM, FreeBSD, MIPS, and SPARC CPUs—including one named “locker_Apple_M1_64” that targets newer Macs running on Apple Silicon. However, the encryptor is not yet ready for deployment in actual attacks against devices, as it appears to be a test build lacking encryption functionality. In a blog post, the researcher stated that the malware crashes due to a code bug. The ransomware source code included strings related to Windows artifacts, revealing that the code was initially designed for Windows. Furthermore, some of these strings were used in other versions targeting various platforms, indicating that the malware shares a common codebase.

Recommendations:

• Users should follow standard cyber hygiene best practices to keep their devices safe: keep operating systems updated, avoid opening unknown attachments and executables, and use strong and unique passwords.
• To mitigate the effects of a ransomware attack and maintain business continuity, organizations should create offline backups of essential data at regular intervals.

Hospitality Services Affected by ALPHV Ransomware Attack

Hospitality services have been affected by a ransomware attack on technology-solutions provider NCR that led to an outage affecting its Aloha point-of-sale (POS) platform. NCR stated that a single data center outage has impacted a limited number of ancillary Aloha applications for a subset of its hospitality customers. However, some Aloha customers have posted on social media regarding needing to use pen and paper to submit data to the head office, while others have expressed concerns about preparing payroll on time, as data has to be pulled manually from files. NCR claims to be providing customers with dedicated assistance and workarounds to support their operations until services can be restored.

Recommendations:

• NCR customers should change their login credentials immediately.
• Implement whitelisting to allow only required services to run on a POS system to mitigate the risk of malware infections web browsers or downloads.
• Maintain regular offline backups of platform data, and segment any networks utilized by POS systems.
• Follow ZeroFox Intelligence to remain up-to-date on emerging threats.