zerofox logo
Advisories

Threat Intelligence Bulletin: 05/12/2023 - 05/18/2023

|by Alpha Team

banner image

ZeroFox Weekly Threat Bulletin: 05/12/2023 - 05/18/2023

ZeroFox Daily Intelligence Briefs:

ZeroFox Daily Intelligence Brief - May 18, 2023

Brief Highlights

  • ZeroFox Intelligence Event Assessment: G7 Summit
  • Cisco Discloses Critical Bugs in Small Business Series Switches
  • Lemon Cybercrime Group Pre-Installs Malware on Android Phones to Finance Enterprise Activities
  • CVE-2023-2726
  • CVE-2023-20106
  • CVE-2023-26964
  • CVE-2013-0008
  • BreachForums: 500K_Email_Pass Combolist
  • BreachForums: CoinDesk Data Breach
  • Credit Card Data Breach: 2023-5-17

Report: https://zerofox.com/advisories/20586

ZeroFox Daily Intelligence Brief - May 17, 2023

Brief Highlights

  • Google Top Level Domain Already Used in Phishing Attacks
  • Unpatched Wemo Smart Plug Bug Opens Networks to Cyberattacks
  • CISA #StopRansomware Advisory: BianLian Ransomware Group
  • CVE-2023-2706
  • CVE-2021-31439
  • CVE-2022-45188
  • CVE-2012-5930
  • Credit Card Data Breach: 2023-5-16
  • BreachForums/Leakbase: Paid Leaf Data Breach
  • XSS: USA_Gov_Emails Data Leak

Report: https://zerofox.com/advisories/20571

ZeroFox Daily Intelligence Brief - May 16, 2023

Brief Highlights

  • The Philadelphia Inquirer Scrambling to Resume Normal Operations After Attack
  • PharMerica Leaks Nearly Six Million Deceased Users' Private Data
  • Stealthy Merdoor Malware Uncovered After Five Years of Attacks
  • CVE-2023-32233
  • CVE-2023-32309
  • CVE-2023-32308
  • CVE-2014-9322
  • Credit Card Data Breach: 2023-5-15

Report: https://zerofox.com/advisories/20558

ZeroFox Daily Intelligence Brief - May 15, 2023

Brief Highlights

  • Toyota Allowed Passwordless Access to Car-Location Data for 10 Years
  • XWorm Malware Exploits Follina Vulnerability in New Wave of Attacks
  • Discord Discloses Data Breach After Support Agent Hacked
  • CVE-2023-2698
  • CVE-2023-2697
  • CVE-2023-2692
  • CVE-2020-1170
  • CVE-2017-5586
  • CVE-2018-1335
  • Credit Card Data Breach: 2023-5-13
  • Credit Card Data Breach: 2023-5-12
  • Credit Card Data Breach: 2023-5-14

Report: https://zerofox.com/advisories/20549

ZeroFox Daily Intelligence Brief - May 12, 2023

Brief Highlights

  • Automation Firm Falls Victim to Black Basta
  • ALPHV Claims Access to Confidential Data in Several Fortune 500 Companies
  • Brightly Warns of SchoolDude Data Breach Exposing Credentials
  • CVE-2023-2590
  • CVE-2023-23863
  • CVE-2023-23793
  • CVE-2007-2356
  • CVE-2019-10719
  • CVE-2018-8120
  • Credit Card Data Breach: 2023-5-11
  • 387 Botnet Breach (45,931 Records)
  • @cloudlogss (158-161) Botnet Breach

Report: https://zerofox.com/advisories/20541

Breach Disclosures:

Breach Disclosure: Citizen

Summary

An alleged data breach at Citizen – a U.S.-based nonprofit consumer advocacy organization – exposed 53,458 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20574

Breach Disclosure: CourseToBuy

Summary

An alleged data breach at CourseToBuy – an Iceland-based online paid courses website – exposed 5,585 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20573

Breach Disclosure: Europe_Ceos Data Leak

Summary

An alleged data breach at Europe_Ceos – a data package containing company and personal details of several European CEOs – exposed 65,513 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20572

Breach Disclosure: CIASC

Summary

An alleged data breach at CIASC – a Brazil-based public company responsible for providing information technology services and automation solutions to the government of Santa Catarina – exposed 27,249 email addresses, which were subsequently shared on a deep web platform.

Report: https://zerofox.com/advisories/20570

Breaking News:

Lemon Group Uses Millions of Pre-Infected Android Phones to Enable Cybercrime Enterprise

Millions of Android phone users around the world are contributing daily to the financial wellbeing of an outfit called the Lemon Group, merely by virtue of owning the devices. Unbeknownst to those users, the operators of the Lemon Group have pre-infected their devices before they even bought them. Now, they're quietly using their phones as tools for stealing and selling SMS messages and one-time passwords (OTPs), serving up unwanted ads, setting up online messaging and social media accounts, and other purposes. Lemon Group itself has claimed it has a base of nearly 9 million Guerrilla-infected Android devices that its customers can abuse in different ways.

See the full report here: https://www.darkreading.com/threat-intelligence/threat-actor-millions-pre-infected-android-phones-cybercrime-enterprise

State-Sponsored Sidewinder Hacker Group's Covert Attack Infrastructure Uncovered

Cybersecurity researchers have unearthed previously undocumented attack infrastructure used by the prolific state-sponsored group SideWinder to strike entities located in Pakistan and China. This comprises a network of 55 domains and IP addresses used by the threat actor. The identified phishing domains mimic various organizations in the news, government, telecommunications, and financial sectors. SideWinder has been known to be active since at least 2012, with attack chains primarily leveraging spear-phishing as an intrusion mechanism to obtain a foothold into targeted environments.

See the full report here: https://thehackernews.com/2023/05/state-sponsored-sidewinder-hacker.html

OilAlpha: Emerging Houthi-linked Cyber Threat Targets Arabian Android Users

A hacking group dubbed OilAlpha with suspected ties to Yemen's Houthi movement has been linked to a cyber espionage campaign targeting development, humanitarian, media, and non-governmental organizations in the Arabian peninsula. OilAlpha used encrypted chat messengers like WhatsApp to launch social engineering attacks against its targets. It has also used URL link shorteners.

See the full report here: https://thehackernews.com/2023/05/oilalpha-emerging-houthi-linked-cyber.html

Hackers use Azure Serial Console for stealthy access to VMs

A financially motivated cybergang tracked as "UNC3944" is using phishing and SIM swapping attacks to hijack Microsoft Azure admin accounts and gain access to virtual machines. From there, the attackers abuse the Azure Serial Console to install remote management software for persistence and abuse Azure Extensions for stealthy surveillance. UNC3944 has been active since at least May 2022, and their campaign aims at stealing data from victim organizations using Microsoft's cloud computing service. UNC3944 was previously attributed to creating the STONESTOP (loader) and POORTRY (kernel-mode driver) toolkit to terminate security software. The threat actors utilized stolen Microsoft hardware developer accounts to sign their kernel drivers.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-azure-serial-console-for-stealthy-access-to-vms/

FBI confirms BianLian ransomware switch to extortion only attacks

A joint Cybersecurity Advisory from government agencies in the U.S. and Australia, and published by the Cybersecurity and Infrastructure Security Agency (CISA,) is warning organizations of the latest tactics, techniques, and procedures (TTPs) used by the BianLian ransomware group. BianLian is a ransomware and data extortion group that has been targeting entities in the U.S. and Australian critical infrastructure since June 2022. Part of the #StopRansomware effort, the advisory is based on investigations from the Federal Bureau of Investigation (FBI) and Australian Cyber Security Centre (ACSC) as of March 2023. It aims to provide defenders with information that allows them to adjust protections and strengthen their security stance against BianLian ransomware and other similar threats.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-confirms-bianlian-ransomware-switch-to-extortion-only-attacks/

ScanSource says ransomware attack behind multi-day outages

Technology provider ScanSource has announced it has fallen victim to a ransomware attack impacting some of its systems, business operations, and customer portals. ScanSource is a U.S.-based cloud service and SaaS connectivity and network communications provider that also offers special PoS (point of sale) and payments, security, and AIDC (automatic identification and data capture) solutions. The firm is also the owner of the cloud service provider and education platform Intelisys, and cloud distributor and managed services provider intY.

See the full report here: https://www.bleepingcomputer.com/news/security/scansource-says-ransomware-attack-behind-multi-day-outages/

Malicious Microsoft VSCode extensions steal passwords, open remote shells

Cybercriminals are starting to target Microsoft's VSCode Marketplace, uploading three malicious Visual Studio extensions that Windows developers downloaded 46,600 times. The malware enabled the threat actors to steal credentials, system information, and establish a remote shell on the victim's machine. The extensions were discovered and reported on May 4, 2023, and they were subsequently removed from the VSCode marketplace on May 14, 2023. However, any software developers still using the malicious extensions must manually remove them from their systems and run a complete scan to detect any remnants of the infection.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-microsoft-vscode-extensions-steal-passwords-open-remote-shells/

Cisco warns of critical switch bugs with public exploit code

Cisco warned customers of four critical remote code execution vulnerabilities with public exploit code affecting multiple Small Business Series Switches. All four security flaws received almost maximum severity ratings with CVSS base scores of 9.8/10. Successful exploitation allows unauthenticated attackers to execute arbitrary code with root privileges on compromised devices. The vulnerabilities—tracked as CVE-2023-20159, CVE-2023-20160, CVE-2023-20161, and CVE-2023-20189—are caused by improper validation of requests sent to the targeted switches' web interfaces. Attackers can exploit them via maliciously crafted requests sent through targeted devices' web-based user interfaces in low-complexity attacks that don't require user interaction.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-switch-bugs-with-public-exploit-code/

MalasLocker ransomware targets Zimbra servers, demands charity donation

A new ransomware operation is hacking Zimbra servers to steal emails and encrypt files. However, instead of demanding a ransom payment, the threat actors claim to require a donation to charity to provide an encryptor and prevent data leaking. The ransomware operation, dubbed MalasLocker, began encrypting Zimbra servers towards the end of March 2023, with victims reporting that their emails were encrypted.

See the full report here: https://www.bleepingcomputer.com/news/security/malaslocker-ransomware-targets-zimbra-servers-demands-charity-donation/

Police warn against fake ScamShield app used in phishing scams

The Singapore Police Force issued a warning against a phishing scam involving the download of a fake ScamShield mobile application. The ScamShield application, launched on iOS in 2020 and on Android in 2022, checks incoming calls against a list maintained by the police to see if the number has been used for illegal purposes and blocks it.

See the full report here: https://www.channelnewsasia.com/singapore/police-warn-fake-scamshield-app-phishing-scam-download-malware-3492626

Attackers Target macOS With "Geacon" Cobalt Strike Tool

Threat actors are now deploying a Go-language implementation of Cobalt Strike called Geacon that first surfaced on GitHub four years ago and had remained largely under the radar. They are using the red-teaming and attack-simulation tool to target macOS systems in much the same way they have used Cobalt Strike for post-exploit activity on Windows platforms the past few years. Security researchers reported the activity after spotting several Geacon payloads appearing on VirusTotal in recent months. Analysis of the samples showed some were likely related to legitimate enterprise red-team exercises, while others appeared to be artifacts of malicious activity.

See the full report here: https://www.darkreading.com/attacks-breaches/attackers-use-geacon-as-new-cobalt-strike-for-macos-systems

Unpatched Wemo Smart Plug Bug Opens Countless Networks to Cyberattacks

The Wemo Mini Smart Plug V2, which allows users to remotely control anything plugged into it via a mobile app, has a security vulnerability that allows cyberattackers to throw the switch on a variety of bad outcomes. Those include remotely turning electronics on and off, and the potential for moving deeper into an internal network, or hop-scotching to additional devices. The flaw (CVE-2023-27217) is a buffer-overflow vulnerability that affects model F7C063 of the device and allows remote command injection, according to researchers who discovered it.

See the full report here: https://www.darkreading.com/ics-ot/belkins-wemo-smart-plug-opens-networks-cyberattacks

CopperStealer Malware Crew Resurfaces with New Rootkit and Phishing Kit Modules

The threat actors behind the CopperStealer malware resurfaced with two new campaigns in March and April 2023 that are designed to deliver two novel payloads dubbed CopperStealth and CopperPhish. Researchers are tracking the financially motivated group under the name Water Orthrus. The adversary is also assessed to be behind another campaign known as Scranos which was detailed in 2019. Active since at least 2021, Water Orthrus has a track record of leveraging pay-per-install (PPI) networks to redirect victims landing on cracked software download sites to drop an information stealer codenamed CopperStealer.

See the full report here: https://thehackernews.com/2023/05/water-orthrus-copperstealer-malware.html

Inside Qilin Ransomware: Affiliates Take Home 85% of Ransom Payouts

Ransomware affiliates associated with the Qilin ransomware-as-a-service (RaaS) scheme earn anywhere between 80% to 85% of each ransom payment, according to new findings. Cybersecurity researchers said they were able to infiltrate the group in March 2023, uncovering details about the affiliates' payment structure and the inner workings of the RaaS program following a private conversation with a Qilin recruiter who goes by the online alias Haise.

See the full report here: https://thehackernews.com/2023/05/inside-qilin-ransomware-affiliates-take.html

Parental control app with 5 million downloads vulnerable to attacks

Kiddowares "Parental Control – Kids Place" app for Android is impacted by multiple vulnerabilities that could enable attackers to upload arbitrary files on protected devices, steal user credentials, and allow children to bypass restrictions without the parents noticing. The Kids Place app is a parental control suite with 5 million downloads on Google Play, offering monitoring and geolocation capabilities, internet access and purchasing restrictions, screen time management, harmful content blocking, remote device access, and more.

See the full report here: https://www.bleepingcomputer.com/news/security/parental-control-app-with-5-million-downloads-vulnerable-to-attacks/

Russian ransomware affiliate charged with attacks on critical infrastructure

The U.S. Justice Department has filed charges against a Russian citizen named Mikhail Pavlovich Matveev (also known as Wazawaka, Uhodiransomwar, m1x, and Boriselcin) for involvement in three ransomware operations that targeted victims across the United States. Matveev's association with Russia-linked ransomware variants—including Hive, LockBit, and Babuk—has drawn the attention of law enforcement due to their global impact and substantial financial losses.

See the full report here: https://www.bleepingcomputer.com/news/security/russian-ransomware-affiliate-charged-with-attacks-on-critical-infrastructure/

Hackers use Azure Serial Console for stealthy access to VMs

A financially motivated cybergang tracked as "UNC3944" is using phishing and SIM swapping attacks to hijack Microsoft Azure admin accounts and gain access to virtual machines. From there, the attackers abuse the Azure Serial Console to install remote management software for persistence and abuse Azure Extensions for stealthy surveillance. Researchers reports that UNC3944 has been active since at least May 2022, and their campaign aims at stealing data from victim organizations using Microsoft's cloud computing service. UNC3944 was previously attributed to creating the STONESTOP (loader) and POORTRY (kernel-mode driver) toolkit to terminate security software.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-use-azure-serial-console-for-stealthy-access-to-vms/

Hackers infect TP-Link router firmware to attack EU entities

A Chinese state-sponsored hacking group named "Camaro Dragon" infects residential TP-Link routers with a custom "Horse Shell" malware used to attack European foreign affairs organizations. The backdoor malware is deployed in a custom and malicious firmware designed specifically for TP-Link routers so that the hackers can launch attacks appearing to originate from residential networks. The attack is not aimed specifically at sensitive networks, but rather at regular residential and home networks. The deployed malware allows the threat actors full access to the device, including running shell commands, uploading and downloading files, and using it as a SOCKS proxy to relay communication between devices.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-infect-tp-link-router-firmware-to-attack-eu-entities/

New ZIP domains spark debate among cybersecurity experts

Cybersecurity researchers and IT admins have raised concerns over Google's new ZIP and MOV Internet domains, warning that threat actors could use them for phishing attacks and malware delivery. Google recently introduced eight new top-level domains (TLD) that could be purchased for hosting websites or email addresses: .dad, .esq, .prof, .phd, .nexus, and .foo. While the ZIP and MOV TLDs have been available since 2014, it wasn't until this month that they became generally available. These domains could be perceived as risky as the TLDs are also extensions of files commonly shared in forum posts, messages, and online discussions, which will now be automatically converted into URLs by some online platforms or applications.

See the full report here: https://www.bleepingcomputer.com/news/security/new-zip-domains-spark-debate-among-cybersecurity-experts/

CLR SqlShell Malware Targets MS SQL Servers for Crypto Mining and Ransomware

Poorly managed Microsoft SQL (MS SQL) servers are the target of a new campaign that's designed to propagate a category of malware called CLR SqlShell that ultimately facilitates the deployment of cryptocurrency miners and ransomware. Similar to web shell, which can be installed on web servers, SqlShell is a malware strain that supports various features after being installed on an MS SQL server, such as executing commands from threat actors and carrying out all sorts of malicious behavior.

See the full report here: https://thehackernews.com/2023/05/clr-sqlshell-malware-targets-ms-sql.html

New "MichaelKors" Ransomware-as-a-Service Targeting Linux and VMware ESXi Systems

A new ransomware-as-service (RaaS) operation called MichaelKors has become the latest file-encrypting malware to target Linux and VMware ESXi systems as of April 2023. The development points to cybercriminal actors increasingly setting their eyes on the ESXi. This trend is especially noteworthy given the fact that ESXi, by design, does not support third-party agents or AV software.

See the full report here: https://thehackernews.com/2023/05/new-michaelkors-ransomware-as-service.html

Industrial Cellular Routers at Risk: 11 New Vulnerabilities Expose OT Networks

Several security vulnerabilities have been disclosed in cloud management platforms associated with three industrial cellular router vendors that could expose operational technology (OT) networks to external attacks. The 11 vulnerabilities allow "remote code execution and full control over hundreds of thousands of devices and OT networks - in some cases, even those not actively configured to use the cloud."

See the full report here: https://thehackernews.com/2023/05/industrial-cellular-routers-at-risk-11.html

New RA Group ransomware targets U.S. orgs in double-extortion attacks

A new ransomware group named "RA Group" is targeting pharmaceutical, insurance, wealth management, and manufacturing firms in the United States and South Korea. The new ransomware operation started in April 2023, when they launched a data leak site on the dark web to publish victims' details and stolen data, engaging in the typical 'double-extortion' tactic used by most ransomware gangs. While the extortion portal was launched on April 22, 2023, the first batch of victimized organizations was published on April 27, including sample files, a description of the type of content that was stolen, and links to stolen data.

See the full report here: https://www.bleepingcomputer.com/news/security/new-ra-group-ransomware-targets-us-orgs-in-double-extortion-attacks/

Airline exposes passenger info to others due to a 'technical error'

airBaltic, Latvia's flag carrier has acknowledged that a technical error exposed reservation details of some of its passengers to other airBaltic passengers. Passengers also reported receiving unexpected emails which addressed them by the name of another customer.

See the full report here: https://www.bleepingcomputer.com/news/security/airline-exposes-passenger-info-to-others-due-to-a-technical-error/

Stealthy MerDoor malware uncovered after five years of attacks

A new APT hacking group dubbed Lancefly uses a custom "Merdoor" backdoor malware to target government, aviation, and telecommunication organizations in South and Southeast Asia. Lancefly has been deploying the stealthy Merdoor backdoor in highly targeted attacks since 2018 to establish persistence, execute commands, and perform keylogging on corporate networks. Researchers observed it being used in some activity in 2020 and 2021, as well as this more recent campaign, which continued into the first quarter of 2023. The motivation behind both these campaigns is believed to be intelligence gathering.

See the full report here: https://www.bleepingcomputer.com/news/security/stealthy-merdoor-malware-uncovered-after-five-years-of-attacks/

Ransomware gang steals data of 5.8 million PharMerica patients

Pharmacy services provider PharMerica has disclosed a massive data breach impacting over 5.8 million patients, exposing their medical data to hackers. PharMerica is a pharmacy services provider in 50 U.S. states, operating 180 local and 70,000 backup pharmacies, and serving 3,100 medical facilities nationwide. According to a data breach notification submitted to the Office of the Maine Attorney General, hackers breached PharMerica's system on March 12th, 2023, stealing the full names, addresses, dates of birth, social security numbers (SSNs), medications, and health insurance information of 5,815,591 people.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-steals-data-of-58-million-pharmerica-patients/

Philadelphia Inquirer operations disrupted after cyberattack

The Philadelphia Inquirer daily newspaper is working on restoring systems impacted by what was described as a cyberattack that hit its network over the weekend. The incident was the greatest publication disruption to Pennsylvania's largest news organization since the blizzard of January 7-8, 1996, and it came just days before the city's mayoral primary election. The news organization detected the attack after the content management system went down, days after it was alerted of "anomalous activity" by cybersecurity researchers that manage the Inquirer's network security.

See the full report here: https://www.bleepingcomputer.com/news/security/philadelphia-inquirer-operations-disrupted-after-cyberattack/

Hackers stole passwords of Worldcoin Orb operators

Hackers have installed password-stealing malware on the devices of multiple Worldcoin Orb operators, giving them full access to the Worldcoin operator dashboard. A security researcher indicated that the credentials of at least seven Orb operators had been listed on the dark web in the past six months. These include credentials that give hackers full access to the Worldcoin Orb operator dashboard, which does not require any form of two-factor or multi-factor authentication.

See the full report here: https://techcrunch.com/2023/05/12/hackers-stole-passwords-of-worldcoin-orb-operators/

New Stealthy Variant of Linux Backdoor BPFDoor Emerges from the Shadows

A previously undocumented and mostly undetected variant of a Linux backdoor called BPFDoor has been spotted in the wild, cybersecurity researchers indicated in a recently published report. BPFDoor retains its reputation as an extremely stealthy and difficult-to-detect malware with this latest iteration. BPFDoor (aka JustForFun) is a passive Linux backdoor associated with a Chinese threat actor called Red Menshen (aka DecisiveArchitect or Red Dev 18), which is known to single out telecom providers across the Middle East and Asia since at least 2021. The malware is specifically geared towards establishing persistent remote access to compromised target environments for extended periods of time, with evidence pointing to the hacking crew operating the backdoor undetected for years.

See the full report here: https://thehackernews.com/2023/05/new-variant-of-linux-backdoor-bpfdoor.html

XWorm Malware Exploits Follina Vulnerability in New Wave of Attacks

Cybersecurity researchers have discovered an ongoing phishing campaign that makes use of a unique attack chain to deliver the XWorm malware on targeted systems. which is tracking the activity cluster under the name MEME#4CHAN, said some of the attacks have primarily targeted manufacturing firms and healthcare clinics located in Germany. The attack campaign has been leveraging rather unusual meme-filled PowerShell code, followed by a heavily obfuscated XWorm payload to infect its victims.

See the full report here: https://thehackernews.com/2023/05/xworm-malware-exploits-follina.html

Capita warns customers they should assume data was stolen

Business process outsourcing firm Capita is warning customers to assume that their data was stolen in a cyberattack that affected its systems in early April 2023. Almost six weeks after the attack was disclosed, Capita warned Universities Superannuation Scheme (USS), the largest private pension scheme in the UK, to react to the incident under the assumption that their members' data was stolen. USS manages the pensions of over 500,000 members from UK universities and Higher Education institutions (and their families), investing GBP 82.2 billion (over USD 102 billion) on their behalf. Capita told USS that servers accessed by the hackers held roughly 470,000 active, deferred, and retired members' personal information, including names, dates of birth, National Insurance numbers, and USS member numbers.

See the full report here: https://www.bleepingcomputer.com/news/security/capita-warns-customers-they-should-assume-data-was-stolen/

FBI: Bl00dy Ransomware targets education orgs in PaperCut attacks

The FBI and CISA issued a joint advisory to warn that the Bl00dy Ransomware gang is now also actively exploiting a PaperCut remote-code execution vulnerability to gain initial access to networks. The U.S. Cybersecurity & Infrastructure Security Agency mentions that the threat actor has focused their attacks on the education sector, which has a significant public exposure of the flaw. In early May 2023, according to FBI information, the Bl00dy Ransomware Gang gained access to victim networks across the Education Facilities Subsector where PaperCut servers vulnerable to CVE-2023-27350 were exposed to the internet. Some of these operations led to data exfiltration and encryption of victim systems.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-bl00dy-ransomware-targets-education-orgs-in-papercut-attacks/

Toyota: Car location data of 2 million customers exposed for ten years

Toyota Motor Corporation disclosed a data breach on its cloud environment that exposed the car-location information of 2,150,000 customers for ten years, between November 6, 2013, and April 17, 2023. According to a security notice published in the company's Japanese newsroom, the data breach resulted from a database misconfiguration that allowed anyone to access its contents without a password.

See the full report here: https://www.bleepingcomputer.com/news/security/toyota-car-location-data-of-2-million-customers-exposed-for-ten-years/

Discord discloses data breach after support agent got hacked

Discord is notifying users of a data breach that occurred after the account of a third-party support agent was compromised. The security breach exposed the agent's support ticket queue, which contained user email addresses, messages exchanged with Discord support, and any attachments sent as part of the tickets. Discord says it immediately addressed the breached support account by disabling it once the incident was discovered.

See the full report here: https://www.bleepingcomputer.com/news/security/discord-discloses-data-breach-after-support-agent-got-hacked/

U.S. Probing Cybersecurity Risks of Rockwell Automation's China Operations

Several departments of the US government are involved in an investigation focusing on the potential cybersecurity risks posed by the Chinese operations of American industrial giant Rockwell Automation. Information obtained by the publication from documents and officials showed that the focus of the investigation is Rockwell’s facility in Dalian, China, where employees might have access to information that could be used to compromise the systems of the company’s customers. China could see Rockwell Automation as a valuable hacking target considering that the company’s products are widely used in critical infrastructure, government, military, and energy sectors in the United States.

See the full report here: https://www.securityweek.com/us-probing-cybersecurity-risks-of-rockwell-automations-china-operations-report/

Former Ubiquiti dev who extorted the firm gets six years in prison

A former senior developer of Ubiquiti, was sentenced to six years in prison for stealing company data, attempting to extort his employer, and aiding the publication of misleading news articles that severely impacted the firm's market capitalization. In January 2021, network device manufacturer Ubiquiti announced that it suffered a data breach at a third-party cloud provider on December 2020, informing all its customers that they needed to reset their passwords and enable 2FA on their accounts. While allegedly working as part of the incident response, the Department of Justice says Sharp posed as the anonymous hacker, demanding that Ubiquity pay 50 Bitcoin (USD 1.9 million at the time) to learn of the exploited vulnerability and for the stolen data to be deleted.

See the full report here: https://www.bleepingcomputer.com/news/security/former-ubiquiti-dev-who-extorted-the-firm-gets-six-years-in-prison/

WordPress Elementor plugin bug let attackers hijack accounts on 1M sites

One of WordPress's most popular Elementor plugins, "Essential Addons for Elementor," was found to be vulnerable to an unauthenticated privilege escalation that could allow remote attacks to gain administrator rights on the site. Essential Addons for Elementor is a library of 90 extensions for the 'Elementor' page builder, used by over one million WordPress sites. The flaw, which PatchStack discovered on May 8, 2023, is tracked as CVE-2023-32243 and is an unauthenticated privilege escalation vulnerability on the plugin's password reset functionality, impacting versions 5.4.0 to 5.7.1.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-elementor-plugin-bug-let-attackers-hijack-accounts-on-1m-sites/

Babuk code used by 9 ransomware gangs to encrypt VMWare ESXi servers

An increasing number of ransomware operations are adopting the leaked Babuk ransomware source code to create Linux encryptors targeting VMware ESXi servers. Researchers observed this rising trend after spotting a rapid succession of nine Babuk-based ransomware variants that surfaced between the second half of 2022 and the first half of 2023. There is a noticeable trend that actors increasingly use the Babuk builder to develop ESXi and Linux ransomware. This is particularly evident when used by actors with fewer resources, as these actors are less likely to significantly modify the Babuk source code.

See the full report here: https://www.bleepingcomputer.com/news/security/babuk-code-used-by-9-ransomware-gangs-to-encrypt-vmware-esxi-servers/

Brightly warns of SchoolDude data breach exposing credentials

U.S. tech company and Siemens subsidiary Brightly Software is notifying customers that their personal information and credentials were stolen by attackers who gained access to the database of its SchoolDude online platform. SchoolDude is a cloud-based platform for managing work orders used by over 7,000 colleges, universities, and K-12 schools from school districts of up to 600,000 students. The companies' other SaaS solutions are being used by more than 12,000 organizations worldwide, most from the United States, Canada, the United Kingdom, and Australia.

See the full report here: https://www.bleepingcomputer.com/news/security/brightly-warns-of-schooldude-data-breach-exposing-credentials/

Multinational tech firm ABB hit by Black Basta ransomware attack

Swiss multinational company ABB, a leading electrification and automation technology provider, has suffered a Black Basta ransomware attack, reportedly impacting business operations. Headquartered in Zurich, Switzerland, ABB employs approximately 105,000 employees and has USD 29.4 billion in revenue for 2022. As part of its services, the company develops industrial control systems (ICS) and SCADA systems for manufacturing and energy suppliers.

See the full report here: https://www.bleepingcomputer.com/news/security/multinational-tech-firm-abb-hit-by-black-basta-ransomware-attack/

Andoryu Botnet Exploits Critical Ruckus Wireless Flaw for Widespread Attack

A nascent botnet called Andoryu has been found to exploit a now-patched critical security flaw in the Ruckus Wireless Admin panel to break into vulnerable devices. The flaw, tracked as CVE-2023-25717 (CVSS score: 9.8), stems from improper handling of HTTP requests, leading to unauthenticated remote code execution and a complete compromise of wireless Access Point (AP) equipment. Andoryu was first documented by Chinese cybersecurity researcers earlier in February 2023, detailing its ability to communicate with command-and-control (C2) servers using the SOCKS5 protocol. While the malware is known to weaponize remote code execution flaws in GitLab (CVE-2021-22205) and Lilin DVR for propagation, the addition of CVE-2023-25717 shows that Andoryu is actively expanding its exploit arsenal to ensnare more devices into the botnet.

See the full report here: https://thehackernews.com/2023/05/andoryu-botnet-exploits-critical-ruckus.html

New APT Group Red Stinger Targets Military and Critical Infrastructure in Eastern Europe

A previously undetected advanced persistent threat (APT) actor dubbed Red Stinger has been linked to attacks targeting Eastern Europe since 2020. Military, transportation, and critical infrastructure were some of the entities being targeted, as well as some involved in the September East Ukraine referendums. Depending on the campaign, attackers managed to exfiltrate snapshots, USB drives, keyboard strokes, and microphone recordings. Red Stinger overlaps with a threat cluster revealed under the name Bad Magic in April 2023 as having targeted government, agriculture, and transportation organizations located in Donetsk, Lugansk, and Crimea.

See the full report here: https://thehackernews.com/2023/05/new-apt-group-red-stinger-targets.html

ZeroFox Intelligence Reports:

ZeroFox Intelligence Event Assessment – G7 Summit

Summary In this Event Assessment for the upcoming G7 Summit, the ZeroFox Geopolitical Working Group provides an overview of possible physical and cybersecurity risks and threats to the event, along with an analysis of the recent unusual criminal activity in Japan.

Report: https://zerofox.com/advisories/20559

Tags: tlp:clear,  all industries,  global