ZeroFox Daily Intelligence Brief - May 2, 2023
|by Alpha Team
ZeroFox Daily Intelligence Brief - May 2, 2023
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.
Brief Highlights
- ZeroFox Advisory May 2023 Geopolitical Brief
- FDA Warns of Potential Risks from Vulnerability in Illumina DNA Sequencing Instruments
- Ransomware Attack on Health Insurance Care Affecting Patients
- LOBSHOT, a New Windows Remote-Access Malware, Exploits Google Ads for Its Distribution
- CVE-2022-28005 Vulnerability
- CVE-2023-2004 Vulnerability
- CVE-2023-2033 Vulnerability
- CVE-2016-9565 Exploit
- CVE-2019-9153 Exploit
- Telegram: YouTube (9) Botnet Breach
- Telegram: YouTube (4) Botnet Breach
- Telegram: YouTube (3) Botnet Breach
ZeroFox Advisory May 2023 Geopolitical Brief
The ZeroFox Intelligence Geopolitical Brief for May 2023 includes predictions on important elections in Thailand, Greece, and Turkey, as well as local elections in the United Kingdom and India. The most important G-7 meeting in years, where renewed supply chain disruptors are being proposed, is also covered. In addition, Sudan's crisis and how it can impact global operations are discussed. In Europe, physical security updates are the primary concern, including ongoing French protests and a key local election followed by the coronation of King Charles.
FDA Warns of Potential Risks from Vulnerability in Illumina DNA Sequencing Instruments
The U.S. Food and Drug Administration (FDA) is warning health care providers and laboratory personnel about a cybersecurity vulnerability affecting Universal Copy Service (UCS) software used in Illumina MiSeqDx, NextSeq 550Dx, iScan, iSeq 100, MiniSeq, MiSeq, NextSeq 500, NextSeq 550, NextSeq 1000/2000, and NovaSeq 6000 medical devices. An unauthorized user could exploit this vulnerability to remotely take control of these devices, alter settings or data, and potentially breach patient genomic data, resulting in incorrect or altered results. Illumina has developed a software patch to address this vulnerability.
Recommendations:
- Download and install the software patch for all affected Illumina instruments.
- More information about Illumina’s cybersecurity vulnerability is available within the Cybersecurity and Infrastructure Security Agency (CISA) published advisory, ICSMA-23-117-01 Illumina Universal Copy Service.
Ransomware Attack on Health Insurance Care Affecting Patients
A ransomware attack on Harvard Pilgrim Health Care (HPHC) has affected the processing of health insurance claims, significantly inconveniencing patients. Point32Health, HPHC’s parent organization and the second-largest health insurer in Massachusetts, is waiving prior authorization for most medical and behavioral health-covered services and cannot accept submissions for HPHC commercial members at this time. Malicious activity on the network was detected on April 17, but Point32Health has not yet observed evidence that protected health information was compromised. The attack has affected systems that support HPHC’s commercial and Medicare Advantage Stride℠ (HMO)/(HMO-POS) plans.
Recommendations:
- HPHC Medicare Advantage StrideSM (HMO)/(HMO-POS) plan members can call 888-609-0692 (TTY: 711) for assistance while HPHC’s system is offline.
- Organizations should implement robust backup and recovery processes for critical data and systems to minimize downtime and the impact of a ransomware attack.
LOBSHOT, a New Windows Remote-Access Malware, Exploits Google Ads for Its Distribution
LOBSHOT, a new remote-access malware, is being distributed through Google Ads promoting legitimate AnyDesk software. When victims click on the Google Ads, they are led to a fake AnyDesk website that pushed a malicious MSI file that executed a PowerShell command to download a DLL from download-cdn[.]com, a domain previously known to be associated with the TA505/Clop ransomware gang. The malware includes an hVNC module that allows threat actors to remotely control a Windows desktop computer without the victim's knowledge, giving them complete control over the device. LOBSHOT's hVNC module has a built-in GUI menu, enabling attackers to quickly run a range of commands, including ones to start new Windows processes, browsers, and the explorer.exe; terminate existing explorer.exe processes; modify DPI Awareness settings; and tamper with Windows sound settings or clipboard text.
Recommendations:
- Monitor for any suspicious network traffic of the known LOBSHOT C2 IP address (95.217.125.200), and also check the system's registry run keys and startup folder for any unauthorized additions.
- If not required for personal/professional use, consider disabling remote services such as VNC.
VULNERABILITIES
- CVE-2022-28005 An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL more
- CVE-2023-2004 An integer overflow vulnerability was discovered in Freetype in tt_hvadvance_adjust() function in src/truetype/ttgxvar.c. more
- CVE-2023-2033 Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) more
EXPLOITS
- CVE-2016-9565 #!/usr/bin/env python# Source: https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html more
- CVE-2019-9153 SEC Consult Vulnerability Lab Security Advisory < 20190822-0 morehttps://cloud.zerofox.com/intelligence/vulnerabilities/491833)
BREACHES
Tags: DIB, tlp:green