ZeroFox Cyber Intelligence Daily Brief - April 7, 2024

ZeroFox Cyber Intelligence Daily Brief - April 7, 2024

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

• ZeroFox Intelligence Flash Report: Actor Seeks Access to Government and Critical Infrastructure Networks
• Indian Government Rescues 250 Citizens Forced into Cybercrime in Cambodia
• AT&T Confirms Data Breach; 73 Million Customer Data Exposed

ZeroFox Intelligence Flash Report: Actor Seeks Access to Government and Critical Infrastructure Networks

On March 27, untested threat actor “Nikazon” posted in the deep and dark web (DDW) forum RAMP advertising their search for affiliates able to provide illicit access to the networks of industrial, military, justice, and political targets. ZeroFox observed an approximately 55 percent increase in the number of ransomware and digital extortion (R&DE) attacks targeting organizations within the defense, government, and critical infrastructure sectors between Q1 2023 and Q1 2024. This advertisement is likely supportive of an ongoing shift in DDW norms manifested by financially-motivated R&DE threat actors punitively seeking victim organizations—the targeting of which would traditionally be frowned upon by other groups, affiliates, and platform moderators.

Indian Government Rescues 250 Citizens Forced into Cybercrime in Cambodia

The Indian government has rescued and repatriated 250 citizens in Cambodia who were forced into conducting cybercrime. The Indian nationals were lured with employment opportunities in Cambodia but were forced to undertake illegal cyber work. According to sources, there are more than 5,000 Indians stuck in Cambodia and are forced to launch scams to extort money. The U.S. Department of State has called out China-based organized crime syndicates for posing as labor brokers to recruit people with English proficiency from Africa and Asia via social media with the promise of offering them lucrative jobs in Southeast Asia. An investigation is ongoing into locating and repatriating more victims.

AT&T Confirms Data Breach; 73 Million Customer Data Exposed

AT&T has released a statement confirming that a data set released on a dark web forum comprises AT&T data-specific fields and affects 7.6 million current and 65.4 million former customers. It has stated that a “robust investigation” is underway. Meanwhile, the company has begun communicating proactively with impacted customers and is offering free credit monitoring. This announcement comes after AT&T denied that the leaked data set was associated with it, as reported in ZeroFox’s Cyber Intelligence Daily Brief on March 18. ZeroFox has also observed threat actor MajorNelson claiming to leak a database associated with AT&T.