ZeroFox Cyber Intelligence Daily Brief

ZeroFox Cyber Daily Intelligence Brief - December 24, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

ZeroFox Intelligence Flash Report: ALPHV Ransomware and Digital Extortion Operations Disrupted
3,500 Arrested and USD 300 Million Seized in Interpol-Run Operation HAECHI IV
Xfinity Confirms Data Breach After October Cyberattack

ZeroFox Intelligence Flash Report: ALPHV Ransomware and Digital Extortion Operations Disrupted

ZeroFox Intelligence has highlighted a joint international law enforcement effort to seize the victim leak site (and other associated websites) of the ALPHV/BlackCat ransomware group. This operation follows numerous incidents of ALPHV victim site disruption in December 2023, which has very likely contributed to the significantly reduced attack tempo observed by ZeroFox and the pivoting of affiliates toward other Ransomware-as-a-Service (RaaS) offerings. One seized website is ALPHV’s previous leak site, where the details and data belonging to victim organizations would be published. While ALPHV affiliates may continue to conduct attacks, the collective is likely to remain less prominent moving into 2024. ALPHV has publicly downplayed the significance of the operation, claiming the seized infrastructure is not used and is outdated.

3,500 Arrested and USD 300 Million Seized in Interpol-Run Operation HAECHI IV

A trans-continental police operation against financial cybercrimes, termed Operation HAECHI IV, has resulted in the arrests of 3,500 suspects and the seizure of USD 300 million worth of assets across 34 countries. The six-month operation targeted threat actors involved in seven types of cyber-enabled scams, including voice phishing, romance scams, online sextortion, investment fraud, and money laundering associated with illegal online gambling. Additionally, investigators used INTERPOL’s Global Rapid Intervention of Payments (I-GRIP), a stop-payment mechanism, to detect and freeze more than 82,000 bank accounts related to fraudulent activities.

Xfinity Confirms Data Breach After October Cyberattack

Xfinity has confirmed that an October cyberattack has exposed customer information, including usernames, hashed passwords, and the last four digits of Social Security numbers. An investigation into the attack revealed that threat actors had gained unauthorized access to Xfinity’s internal systems through a then-unpatched vulnerability in its Citrix software system. The company has asked customers to enable two-factor or multi-factor authentication to secure their Xfinity account.