ZeroFox Daily Intelligence Brief - May 10, 2023

ZeroFox Daily Intelligence Brief - May 10, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Brief Highlights

• International Operation Takes Down FSB’s “Snake” Malware Network
• Researchers Create Proof-of-Concept Exploit for New Linux Kernel NetFilter Flaw
• Sysco Data Breach Exposes Employee and Customer Data

International Operation Takes Down FSB’s “Snake” Malware Network

Law enforcement authorities from the Five Eyes alliance (Australia, Canada, New Zealand, the United Kingdom, and the United States) have dismantled the “Snake” malware network—reportedly the most sophisticated, long-term cyber espionage malware linked to the notorious Unit 16 of Russian security agency FSB. Snake has been used to spy on government networks, research facilities, journalists, educational organizations, financial services, critical manufacturing firms, and communication entities in over 50 countries worldwide, including in the United States and Russia itself. The FBI has reportedly neutralized compromised systems within the United States and is coordinating with its counterparts in other countries on remedial actions.

Researchers Create Proof-of-Concept Exploit for New Linux Kernel NetFilter Flaw

A Linux NetFilter kernel flaw (CVE-2023-32233) allows local users to gain root-level privileges, giving them complete control over the system. While the bug’s severity level is yet to be determined, it potentially allows an attacker to perform arbitrary reads and writes in the kernel memory. The vulnerability is caused by Netfilter nf_tables accepting invalid updates to its configuration, leading to the corruption of the subsystem's internal state. Security researchers have created a proof-of-concept exploit that will be made public on May 15, 2023, to demonstrate the vulnerability, which affects multiple Linux kernel releases—including the current stable version. However, attackers must have local access to a Linux device to exploit the vulnerability. The Linux kernel team has submitted a code commit to fix the problem.

Sysco Data Breach Exposes Employee and Customer Data

Global food distribution company Sysco has disclosed that a data breach compromised sensitive information, including U.S. and Canadian customer and supplier information, as well as personal data of U.S. employees. In breach-notification letters sent to affected individuals, the company revealed that the incursion began on January 14, 2023, and Sysco became aware of the breach on March 5. There is reportedly no ongoing threat to the network, and the incident did not affect business operations or customer service.