ZeroFox Weekly Intelligence Brief

ZeroFox Weekly Intelligence Brief – December 25, 2023

TLP:GREEN

ZeroFox’s Weekly Intelligence Briefing highlights the major developments and trends across the cyber threat landscape. ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on December 22, 2023; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Read the Brief

View the full report here.

3,500 Arrested and USD 300 Million Seized in Interpol-Run Operation HAECHI IV

What happened: A trans-continental police operation against financial cybercrimes, termed Operation HAECHI IV, has resulted in the arrests of 3,500 suspects and the seizure of USD 300 million worth of assets across 34 countries. The six-month operation targeted threat actors involved in seven types of cyber-enabled scams, including voice phishing, romance scams, online sextortion, investment fraud, and money laundering associated with illegal online gambling. Additionally, investigators used INTERPOL’s Global Rapid Intervention of Payments (I-GRIP), a stop-payment mechanism, to detect and freeze more than 82,000 bank accounts related to fraudulent activities.

New Chrome Zero-Day Vulnerability Exploited in the Wild

What happened: Google has published new security updates following reports of a new Chrome zero-day vulnerability CVE-2023-7024 being actively exploited in the wild. The high-severity flaw, a heap-based buffer overflow bug in the WebRTC framework poses risks of program crashes and arbitrary code execution. Users should update to Chrome versions 120.0.6099.129/130 (Windows) and 120.0.6099.129 (macOS and Linux) to mitigate potential threats. Additionally, users of Chromium-based browsers like Microsoft Edge, Brave, Opera, and Vivaldi are advised to apply fixes once available.

Israel-linked Group Claims Cyberattack that Shut Down 70 Percent of Iran’s Gas Stations

What happened: On December 19, 2023, the Israeli hacker group Gonjeshke Darande, also called Predatory Sparrow, admitted to causing significant damage to Iran's gas station infrastructure. They asserted this cyberattack was in retaliation to the aggressive actions of the Islamic Republic and its allies in the area. As a result, 70 percent of the gas stations were unable to operate. Israeli hackers have shared screenshots that demonstrate their involvement in the Iranian gas station network. These screenshots reveal specific details about individual gas stations, payment systems, management systems accessed from the central server, and other related documents.