ZeroFox Daily Intelligence Brief - October 30, 2023

ZeroFox Daily Intelligence Brief - October 30, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

• ZeroFox Intelligence: November 2023 Geopolitical Brief
• LockBit Claims Ransomware Attack on Boeing
• CISA Announces Launch of “Logging Made Easy”
• Data broker / initial-access broker / hacktivist group: BreachForums user Desec0x and Anonymous Sudan
• Vulnerabilities: CVE-2007-10003 and CVE-2023-5721
• Exploits: CVE-2022-39066
• Breaches: Combolist: '[Mined.to]-260.000_mix_base.txt'

ZeroFox Intelligence: November 2023 Geopolitical Brief

In this Geopolitical Brief for November 2023, the war in Gaza is the primary topic. There is potential for the conflict to spread across the Middle East and disrupt energy supply chains. The conflict is also harming the sense of security in Europe, where travel restrictions, protests, and an escalation in terror attacks are likely through November. November 2023 will also likely see further developments in retaliatory trade restrictions between the United States and China. Both states have announced new restrictions due to go into place before 2024, which will harm global trade and pose added security threats for multinationals in China. There are also key elections in India, Argentina, and the Netherlands next month.

LockBit Claims Ransomware Attack on Boeing

ZeroFox Intelligence has observed Russia-linked ransomware group LockBit list Boeing as a victim on its darknet leaksite. The group claims to have stolen “a tremendous amount of sensitive data'' from the company and has threatened to publish all the data by November 2, unless the company contacts it (to negotiate ransom demands). LockBit hasn’t disclosed details of the type of data it exfiltrated, the systems it supposedly compromised, or how long it managed to remain persistent in the network. Boeing is reported to be currently investigating Lockbit’s claims.

CISA Announces Launch of “Logging Made Easy”

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has launched a new version of Logging Made Easy (LME), a free and “straightforward” log-management tool for Windows-based devices. CISA’s version of the tool builds upon a previous iteration of the technology developed by the United Kingdom’s National Cyber Security Centre (NCSC). LME is intended to help both public and private organizations, especially those with limited resources, strengthen their cybersecurity while reducing their log-management burden.

THREAT ACTIVITY: INITIAL-ACCESS BROKERS, DATA BROKERS, AND HACKTIVISTS

• BreachForums user Desec0x: Selling a database allegedly stolen from the Ministry Of Information, Kuwait
• Anonymous Sudan: Claims DDoS attacks on CNN, the New York Post, the Washington Post, and the Daily Mail

VULNERABILITIES

• CVE-2007-10003: A critical vulnerability has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress.
• CVE-2023-5721: It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay.

EXPLOITS

• CVE-2022-39066: SQL injection vulnerability in ZTE MF286R

BREACHES

• Combolist: 'Mined[.]to-260.000_mix_base.txt' (267,934 Records) Email address and password