ZeroFox Daily Intelligence Brief - April 27, 2023
|by Alpha Team
ZeroFox Daily Intelligence Brief - April 27, 2023
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.
Key Findings
- U.S. Federal Agencies Express Concern Over the Method of Developing AI Systems
- Threat Actors Are Hacking into AT&T Emails to Steal Cryptocurrency
- Charming Kitten's New BellaCiao Malware Discovered in Multi-Country Attacks
U.S. Federal Agencies Express Concern Over the Method of Developing AI Systems
Various U.S. federal agencies have expressed concern that the use of artificial intelligence (AI) may increase the risk of bias and civil rights violations. In a joint statement, the agencies have said that even though AI offers the promise of advancement, its use also has the potential to perpetuate unlawful bias, automate unlawful discrimination, and produce harmful outcomes, particularly in sectors such as lending, employment and housing. Since AI systems rely on vast amounts of data to find patterns or correlations, they also have the potential to produce outcomes that result in unlawful discrimination through their choice of data and dataset; model opacity; and access, design, and use. The agencies stress the need to monitor the development and use of AI and to promote responsible innovation.
Recommendations:
- AI researchers and developers must keep the principles of civil rights, non-discrimination, fair competition, and consumer protection in mind while creating AI systems and selecting the training data.
- Follow ZeroFox Intelligence to remain up to date on AI developments.
Threat Actors Are Hacking into AT&T Emails to Steal Cryptocurrency
A gang of cybercriminals are breaking into AT&T email accounts and using them to further hack into victims’ cryptocurrency exchange accounts and steal their digital assets. The hackers are targeting users with att[.]net, sbcglobal[.]net, bellsouth[.]net, and other AT&T email addresses because they allegedly have access to part of AT&T’s internal network, which allows them to create mail keys for any user. Mail keys are unique credentials that AT&T email account holders can use to log into their accounts using email apps such as Thunderbird or Outlook without having to enter their passwords. Although some account holders have complained of losing thousands of dollars in cryptocurrency and of unauthorized access into their accounts, AT&T denies that hackers have access to internal company systems and has suggested that the bad actors used API access. However, AT&T did lock some email accounts as a precautionary measure.
Recommendations:
- AT&T email users are advised to secure their cryptocurrency funds by transferring them to platforms that are not linked to their potentially-compromised accounts.
- Follow ZeroFox Intelligence to remain up to date on the latest breach reporting and cryptocurrency hacks.
Charming Kitten's New BellaCiao Malware Discovered in Multi-Country Attacks
An Iranian nation-state group, Charming Kitten, is targeting victims across the United States, Europe, the Middle East, and India with a new custom-developed malware referred to as “BellaCiao,” which is much harder to detect than traditional malware. Researchers discovered that the personalized dropper contains hard-coded information related to particular victims, such as company names, subdomains, or associated public IP addresses. Charming Kitten, also referred to as APT35, Cobalt Illusion, Educated Manticore, ITG18, Mint Sandstorm, TA453, and Yellow Garuda, has previously used various methods to deploy backdoors in different industry verticals. The targets tend to be poorly-maintained systems with outdated software or security patches, weak passwords, or smaller companies that lack detection and response capabilities.
Recommendations:
- Organizations should deploy defense-in-depth architecture, limit entry points, and regularly patch vulnerabilities; automate protection controls by measures such as IP, domain, and URL reputation; and use Indicators of Compromise (IOCs) as criteria to detect suspicious incidents.
- Establish a security operations center (SOC) for monitoring and responding to security incidents, employ advanced threat-hunting techniques, and coordinate with stakeholders to minimize the impact of attacks.
VULNERABILITIES
- CVE-2022-1941 A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. … more
- CVE-2022-3171 A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. … more
- CVE-2023-28856 Redis is an open source, in-memory database that persists on disk. Authenticated users can use the
HINCRBYFLOATcommand to create an invalid hash field that will crash Redis on access in affected versions. … more
EXPLOITS
Tags: DIB, tlp:green