zerofox logo
Advisories

ZeroFox Daily Intelligence Brief - May 11, 2023

|by Alpha Team

banner image

ZeroFox Daily Intelligence Brief - May 11, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Brief Highlights

  • ZeroFox Intelligence: CryptNet: Ransomware-as-a-Service Being Promoted on Russian Underground Forum RAMP
  • Industrial Cybersecurity Company Discloses Data Breach Attempt
  • RapperBot DDoS Malware Adds Cryptojacking as New Revenue Stream
  • Experts Detail New Zero-Click Windows Vulnerability That Enables NTLM Credential Theft
  • CVE-2023-30944
  • CVE-2023-30943
  • CVE-2023-31223
  • CVE-2018-8120
  • CVE-2013-2143
  • CVE-2007-2772
  • тут миллиард Botnet Breach (29,522 Records) Email addresses and passwords
  • сновымгодом Botnet Breach (100,936 Records) Email addresses and passwords
  • свежак Botnet Breach (986 Records) Email addresses and passwords

CryptNet: Ransomware-as-a-Service Being Promoted on Russian Underground Forum RAMP

ZeroFox Intelligence assesses that CryptNet, a new ransomware-as-a-service (RaaS) promoted on Russian underground forum RAMP, is likely to become a notable player within the RaaS ecosystem. The ransomware strain is supposedly fast and fully undetectable, with the ability to delete shadow copies, disable backup services, and achieve offline encryption. CryptNet allegedly offers its affiliates a 90 percent profit share from each successful attack and provides support during ransom negotiations. “Shrinbaba,” the threat actor publicly observed to be associated with the service, is assessed to be credible threat actor, and the strain’s touted advanced capabilities and attractive profit-share offering will likely be attractive to affiliates. Two CryptNet victims have been identified to date.

Industrial Cybersecurity Company Discloses Data Breach Attempt

Cybersecurity company Dragos disclosed details of a data breach and subsequent extortion attempt by a criminal group that managed to compromise the personal email address of a soon-to-join employee. The hackers used the stolen credentials to initiate the onboarding process, masquerading as the new employee. This allowed the criminals to access some information accessible to the new employee on SharePoint and the Dragos contract management system, including a report with IP addresses associated with a customer. The company stated that the criminals were stopped from accomplishing lateral movement, escalating privileges, establishing persistent access, or making any changes to the infrastructure. Implementing separation of duties across a company and applying the principle of least privilege to all systems and services helps to reduce the scope of illicit information access in the unfortunate event of a data breach.

RapperBot DDoS Malware Adds Cryptojacking as New Revenue Stream

RapperBot, a Mirai-based botnet malware that targets Linux SSH servers, has now added cryptojacking capability to mine cryptocurrency on victim Intel x64 machines. The latest RapperBot variant uses the XMRig Monero miner, which is integrated and obfuscated with double-layer XOR encoding and primarily targeting Internet of Things (IoT) devices. The botnet is configured to use multiple mining pools and wallets for redundancy, and it terminates competitor miners to maximize mining performance. To stay protected, users are advised to keep software updated and use firewalls to block unauthorized requests.

Experts Detail New Zero-Click Windows Vulnerability That Enables NTLM Credential Theft

Researchers have disclosed details of a patched security flaw in Windows MSHTML, which could allow attackers to bypass integrity protections on targeted machines, resulting in NTLM credentials theft. The vulnerability, CVE-2023-29324, is a zero-click attack that affects all Windows versions except Microsoft Exchange servers that have been updated with the March 2023 patch. The issue was resolved by Microsoft as part of its May 2023 Patch Tuesday updates. Users should install Internet Explorer cumulative updates to fully protect themselves from exploitation of this bug.

VULNERABILITIES

  • CVE-2023-30944 The vulnerability was found in Moodle which exists due to insufficient sanitization of user-supplied data in the external Wiki method for listing pages.
  • CVE-2023-30943 The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders.
  • CVE-2023-31223 Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.

EXPLOITS

  • CVE-2018-8120 Microsoft Windows SetImeInfoEx Win32k NULL Pointer Dereference
  • CVE-2013-2143 Katello (Red Hat Satellite) users/update_roles Missing Authorization
  • CVE-2007-2772 CA BrightStor Backup 11.5.2.0 - 'caloggderd.exe' Denial of Service

BREACHES

Tags: DIB, tlp:green