ZeroFox Daily Intelligence Brief - April 21, 2023

ZeroFox Daily Intelligence Brief - April 21, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Daggerfly Cyberattack Campaign Targets African Telecom Services Providers
• “GhostToken,” a Security Vulnerability in Google’s Cloud Platform, Patched Before Being Exploited
• Two Critical Flaws Found in Alibaba Cloud's PostgreSQL Databases

Daggerfly Cyberattack Campaign Targets African Telecom Services Providers

Cybersecurity researchers have issued an advisory stating that African telecommunications organizations are being targeted with MgBot malware plugins by the advanced persistent threat (APT) group Daggerfly. The malicious campaign was first detected in November 2022 and is believed to be ongoing. The attackers also used a PlugX loader and AnyDesk remote desktop software. The researchers identified several information-gathering capabilities in the plugins, including a Chrome and Firefox infostealer, a logging module, and an Active Directory enumeration tool. The malware designs indicate that the attackers' main goal was information gathering.

Recommendations:

• Blacklist the IP addresses of botnet devices that are the source of illicit traffic during organized hacking campaigns. Strong security measures should be implemented for all devices linked to the internet.
• After an attack or disruption has occurred, organizations should carry out a careful investigation to identify the weaknesses that the attackers had taken advantage of and put precautions in place to stop similar attacks in the future.
• Techniques such as those attempting to locate the point of origin and to lessen its effects—such as traffic redirection, malicious traffic blocking, and the deployment of additional resources to provide services to legitimate users—can help mitigate the impact of attacks.

“GhostToken,” a Security Vulnerability in Google’s Cloud Platform, Patched Before Being Exploited

A security vulnerability in Google Cloud Platform dubbed “GhostToken” has been patched before being exploited. Researchers found the zero-day flaw in June 2022, which could have allowed cyberattackers to hide a malicious app inside a victim's Google account and infect it permanently, facilitating access to Gmail, documents in the drive, the calendar, and tracking locations. Google rolled out a global patch addressing these vulnerabilities on April 7, 2023. Although researchers have not found any active exploitation of the vulnerability, they have advised Google Workspace administrators to look for applications that may have attacked users before the patch was initiated.

Recommendations:

• Google Workspace administrators can look for applications whose client ID is the same as the “displayText” field and remove their access if they prove to be malicious. Inspect the OAuth log events in the “Audit and Investigation” feature of Google Workspace for token activity of any such apps. While the malicious app would disappear from a victim’s application management page, users should still be alert for indications of GhostToken—such as known files disappearing from Google Drive or receiving unexpected responses to emails never sent by the user.

Two Critical Flaws Found in Alibaba Cloud's PostgreSQL Databases

Two critical flaws have been disclosed in Alibaba Cloud's ApsaraDB RDS for PostgreSQL and AnalyticDB for PostgreSQL. The vulnerabilities were dubbed “BrokenSesame” and allow unauthorized access to customer PostgreSQL databases and the breach of tenant isolation protections. The weaknesses were reported to Alibaba Cloud in December 2022, and the company deployed fixes on April 12, 2023. An attacker could elevate privileges to root within the container, escape to the underlying Kubernetes node, and obtain unauthorized access to the API server. These flaws could allow a supply-chain attack to take place, allowing access to other customer databases on the shared node.

Recommendations:

• When designing services with multiple containers, it is important to restrict activity to prevent lateral attacker movement within the operational containers.
• The Kubelet service account was over-privileged and could access other tenants’ resources.Scoping Kubelet permissions is critical to limiting adversary access.
• The service environment contained sensitive secrets left over from the build process. Environment hygiene is critical to security: a single secret leak could enable an attacker to compromise internal service resources and perform lateral movement within the service cloud environment. 
• Linux containers are a legitimate but insufficient security barrier. Service builders should consider using projects like Gvisor or Kata containers to prevent compromise.