ZeroFox Daily Intelligence Brief - April 24, 2023

ZeroFox Daily Intelligence Brief - April 24, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• American Bar Association Data Breached, Over 1.4 Million Members Alerted
• Conti Team is Distributing Bumblebee Malware Through Google Ads
• Decoy Dog Malware Toolkit Found After Analyzing 70 Billion DNS Queries

American Bar Association Data Breached, Over 1.4 Million Members Alerted

The American Bar Association (ABA) has been compromised following a data breach that was detected on March 17, 2023. The hackers gained access to credentials (usernames and hashed and salted passwords) of 1,466,000 legacy ABA members used to access the website prior to 2018 or the ABA Career Center since 2018. The ABA noted that no other data was taken, and there have been no indications the data was misused. While members were asked to update their credentials in 2018 when the ABA changed its website, there are concerns about users’ cyber hygiene; some may still be using default passwords assigned to their ABA accounts when they were created or repeated their pre-2018 site passwords when they created their credentials for the new member system.

Recommendations:

• ABA members are advised to immediately change their passwords on the ABA site and any other account where they used the same or similar login credentials.
• Members are also advised to watch out for any spear-phishing emails impersonating the ABA, as threat actors may use them to attempt to gather additional personal information.
• Follow ZeroFox Intelligence to remain updated on emerging threats.

Conti Team is Distributing Bumblebee Malware Through Google Ads

Bumblebee malware is being distributed through Google Ads and SEO poisoning that promote software like Zoom, ChatGPT, and Citrix Workspace. Researchers have found that a new campaign using Google advertisements is promoting trojanized versions of popular apps to deliver the malware loader to unsuspecting victims. The trojanized software is mainly targeting corporate users and may be the first step in breaching devices for purposes of a ransomware attack. Based on review of threat actor behavior once a device has been compromised, it appears the operators are interested in identifying accessible network points, pivoting to other machines, exfiltrating data, and eventually deploying ransomware.

Recommendations:

• Only source applications and software from official websites or established app stores, such as Google Play or the Apple Store; do not click on Google advertisement links to download software or apps.
• Maintain an antivirus or anti-malware program to provide additional device and data protection.
• Access the ZeroFox platform’s Intelligence Search interface to investigate Indicators of Compromise (IOCs) and metadata related to Malware and Ransomware.

Decoy Dog Malware Toolkit Found After Analyzing 70 Billion DNS Queries

Researchers have discovered a new malware toolkit called "Decoy Dog" that uses domain aging and DNS query dribbling to evade standard detection methods. The malware establishes a good reputation with security vendors before initiating malicious activity. The DNS fingerprint of the malware is unique, making it easier to track. Investigation into the malware's infrastructure revealed several Command and Control (C2) domains linked to the same operation. The operation has been active since April 2022, and the Pupy RAT deployed by the toolkit is popular among state-sponsored threat actors.

Recommendations:

• Organizations can use cloud-based protective DNS systems to detect suspicious DNS-related activity and prevent attacks.
• Collaboration among security vendors and network providers is necessary to understand the entire scope of these attacks and identify the underlying cause of malware similar in complexity to Decoy Dog.
• Organizations can manually add the Decoy Dog IOCs shared by the researchers to blocklists to protect against this malware toolkit.