zerofox logo
Advisories

ZeroFox Cyber Intelligence Daily Brief - April 11, 2024

|by Alpha Team

banner image

ZeroFox Cyber Intelligence Daily Brief - April 11, 2024

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

  • Medusa Gang Strikes Again, Hits Nearly 300 Fort Worth Property Owners
  • Cyberespionage Malware Campaign Targets Android Users in South Asia
  • FortiClient Linux Remote Code Execution Due to Dangerous Nodejs Configuration

Medusa Gang Strikes Again, Hits Nearly 300 Fort Worth Property Owners

ZeroFox has observed the Medusa ransomware gang claim responsibility for the March cyberattack on the Tarrant County Appraisal District that affected around 300 individuals. The group has threatened to leak 218 GB of stolen data unless a USD 100,000 ransom is paid. The FBI has been notified of the attack. Tarrant County Appraisal District has taken steps to secure the network and has been working with cybersecurity experts to assist with the investigation, response, and restoration process. The Impacted individuals are advised to report any suspicious activity.

Cyberespionage Malware Campaign Targets Android Users in South Asia

Cybersecurity researchers have discovered an active cyberespionage malware campaign targeting Android users in South Asia, specifically India and Pakistan. The campaign involves the distribution of malware via dedicated websites and apps on Google Play Store. The fake apps, which are functional, are disguised as messaging services, food ordering applications, and even a legitimate Indian hospital called Specialist Hospital. The malware strain deployed via these apps can take pictures, enumerate files in several directories, and gather sensitive data, including messages and GPS locations.

FortiClient Linux Remote Code Execution Due to Dangerous Nodejs Configuration

Fortinet has released security patches for a critical FortiClientLinux vulnerability (CVE-2023-45590; CVSS score: 9.4). Users are advised to upgrade to the fixed versions listed in the advisory. The vulnerability can allow threat actors to execute unauthorized code or commands by tricking users to visit malicious sites.

THREAT ACTIVITY: INITIAL-ACCESS BROKERS, DATA BROKERS, AND HACKTIVISTS

VULNERABILITIES

  • CVE-2024-3620: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /control/adds.php. The manipulation of the argument name/gender/dob/email/mobile/address leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260276.
  • CVE-2024-3619: A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /control/addcase_stage.php. The manipulation of the argument cname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260275.

BREACHES

Tags: DIB, tlp:green