zerofox logo
Advisories

ZeroFox Daily Intelligence Brief - May 8, 2023

|by Alpha Team

banner image

ZeroFox Daily Intelligence Brief - May 8, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Brief Highlights

  • ZeroFox Intelligence Advisory: Common Vulnerabilities and Exposure (CVE) Exploits Likely Increased Against Manufacturing Sector in Q1 2023
  • Android Fixes Critical Bugs Exploited in Spyware Attacks
  • Western Digital Temporarily Suspends Its Online Store After Hackers Stole Customers’ Data
  • DragonBreath APT Strikes Across Asia, Targeting Gambling Industry
  • CVE-2023-30018
  • CVE-2023-2554
  • CVE-2023-2553
  • CVE-2007-5082
  • CVE-2018-1999002
  • CVE-2014-5460
  • FREE LOGS LEAK Botnet Breach (120,750 Records) Email address and password
  • 444 Botnet Breach (172,257 Records) Email address and password

ZeroFox Intelligence Advisory: Common Vulnerabilities and Exposure (CVE) Exploits Likely Increased Against Manufacturing Sector in Q1 2023

ZeroFox Intelligence anticipates the threat to the manufacturing sector from Search Engine Optimization (SEO)/Search Engine Results Pages (SERP) poisoning and the leveraging of malicious Google advertisements as a means of disseminating malware will continue on an upward trajectory. As detailed in its Q1 2023 Threat Landscape Report for the Manufacturing Sector, ZeroFox assesses that exploitation of Common Vulnerabilities and Exposures (CVEs) likely increased in Q1 2023. Manufacturing organizations accounted for nearly 12 percent of the victims of Clop’s successful leveraging of a zero-day exploit in GoAnywhere MFT file transfer software. This exploit also resulted in the most incidents recorded in a single month by any extortion collective in ZeroFox Intelligence records.

ZeroFox assesses that developments in the threat facing the manufacturing sector over the next six months will be heavily influenced by pro-Russian threat actors targeting Western nations, organizations, and supply chains seen as unfriendly to Russia in the context of the Russia-Ukraine war. Increased targeting of Asia-based components and manufacturing organizations to disrupt global supply chains is also likely.

Android Fixes Critical Bugs Exploited in Spyware Attacks

The Android security updates for May have addressed a significant security flaw (CVE-2023-0266) that was exploited as a zero-day to install commercial spyware on affected devices. The vulnerability was part of a complex chain of multiple zero-days and n-days in a spyware campaign aimed at Samsung Android phones. These attacks have been linked to Spanish spyware vendor Variston, which is known for targeting the Windows platform with the Heliconia exploit framework. The Android security team also released the May Pixel Update Bulletin, which includes fixes for vulnerabilities in supported Pixel devices and Qualcomm components.

Western Digital Temporarily Suspends Its Online Store After Hackers Stole Customers’ Data

Western Digital (WD) has notified customers that some of their confidential data was breached in a March 2023 cyberattack and announced that it has suspended online store access and online purchases until May 15, 2023. As previously reported in the ZeroFox Daily Intelligence Brief, WD disclosed that it detected unauthorized activity in its network on March 26, 2023. The company has now revealed that an unauthorized party obtained a copy of a WD database that contained limited personal information—including names, billing and shipping addresses, email IDs, telephone numbers, hashed and salted passwords, and partial credit card numbers—of online store customers. As a precautionary measure, the company disconnected its systems and services from the public internet; however, manufacturing and shipping services are reportedly unaffected.

DragonBreath APT Strikes Across Asia, Targeting Gambling Industry

Advanced persistent threat (APT) actor Dragon Breath (also known as APT-Q-27 and Golden Eye) has developed a new double-dip DLL side-loading mechanism to add complexity to its attacks. The attack involves a clean application that side-loads a second clean app that then side-loads a malicious loader DLL, which executes the final payload. Dragon Breath has used tampered installers for apps such as Telegram, LetsVPN, and WhatsApp to initiate the attack chain. The group is known for targeting the online gambling and gaming sectors in Asia, and its attacks have been observed in the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China. The reported campaign highlights the effectiveness of DLL side-loading as an attack tactic.

VULNERABILITIES

  • CVE-2023-30018 Judging Management System v1.0 is vulnerable to SQL Injection. via /php-jms/review_se_result.php?mainevent_id=
  • CVE-2023-2554 External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0.
  • CVE-2023-2553 Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to 2.2.0.

EXPLOITS

  • CVE-2007-5082 CA BrightStor HSM Buffer Overflow
  • CVE-2018-1999002 Jenkins Script Security 1.49 / Declarative 1.3.4 / Groovy 2.60 Remote Code Execution
  • CVE-2014-5460 1) WordPress SlideShow Gallery Authenticated File Upload

BREACHES

Tags: DIB, tlp:green