ZeroFox Daily Intelligence Brief - November 26, 2023

ZeroFox Daily Intelligence Brief - November 26, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

• ZeroFox Intelligence Brief - APT41 Primer
• SeigedSec Claims Data Breach at Idaho National Laboratory; Details of U.S. National Security Employees Allegedly Exposed
• Government Cybersecurity Agencies Release an Advisory on LockBit Affiliates Leveraging Citrix Bleed Vulnerability

ZeroFox Intelligence Brief - APT41 Primer

APT41 is among the first advanced persistent threat (APT) groups the Chinese government utilized to conduct malicious cyber activities, targeting nations and sectors of strategic relevance to China; however, the group is one of the very few APTs that also conduct cybercrime. China leverages a number of highly competent APT groups in pursuit of its strategic objectives, such as regional and global leadership in economic and security issues, control over claimed territory, and domestic regime stability. The group tends to focus on specific sectors and nations, likely at the direction of the Chinese intelligence service, the Ministry of State Security (MSS).

SeigedSec Claims Data Breach at Idaho National Laboratory; Details of U.S. National Security Employees Allegedly Exposed

ZeroFox Intelligence has observed SeigedSec, a hacktivist group, claiming that it has gained unauthorized access to the Idaho National Laboratory, an institution under the U.S. Department of Energy that is primarily involved in nuclear research. Through a post on its Telegram channel, SeigedSec announced that it has acquired a substantial amount of sensitive data, including personal information such as full names, dates of birth, email addresses, phone numbers, Social Security numbers, addresses, and employment details. ZeroFox has also observed the group selling the allegedly stolen data on BreachForums, an underground forum and marketplace. Last month, ZeroFox had further observed SeigedSec take responsibility for DDoS attacks against Israel’s industrial control systems.

Government Cybersecurity Agencies Release an Advisory on LockBit Affiliates Leveraging Citrix Bleed Vulnerability

U.S. and Australian cybersecurity authorities have released a cybersecurity advisory alerting network defenders about LockBit 3.0 ransomware affiliates and other threat actor groups exploiting Citrix Bleed (CVE-2023-4966). This flaw impacts Citrix's NetScaler ADC and Gateway appliances. LockBit has been known to target diverse sectors, prompting the release of tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to aid network defenders. The authoring agencies advise defenders to respond to compromises as soon as they are detected utilizing methods provided in the advisory, followed by immediate patching efforts.