ZeroFox Cyber Intelligence Daily Brief - May 10, 2024
|by Alpha Team
ZeroFox Cyber Intelligence Daily Brief - May 10, 2024
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.
Brief Highlights
- Dell Customer Order Database Stolen, Now up for Sale on Dark Web
- British Columbia Investigating Cyberattacks on Government Networks
- IntelBroker Targets Financial Organizations
Dell Customer Order Database Stolen, Now up for Sale on Dark Web
Source: https://www.theregister.com/2024/05/09/dell_data_stolen/
What happened: Dell has confirmed a data breach where customer information from one of its portals was stolen, including names, addresses, and details of Dell purchases, affecting potentially 49 million customers. The stolen data has been advertised for sale on the dark web.
Why it matters: The compromised data could be leveraged by threat actors to conduct targeted phishing attacks, posing as Dell representatives to trick customers into revealing further sensitive information or installing malware. Additionally, the detailed information on Dell hardware and orders could facilitate sophisticated social engineering schemes or even enable future cyberattacks targeting specific individuals or organizations.
British Columbia Investigating Cyberattacks on Government Networks
What happened: British Columbia is investigating a series of cyberincidents that reportedly affected its government networks. The investigations have not revealed the full scale of the impact yet, but officials are working toward implementing mitigations to safeguard systems, at the time of writing.
Why it matters: Recently LockBit claimed the Wichita cyberattack where it encrypted certain city services. This year, many Canadian government entities have been targeted in high profile cyberattacks like the attack on the Royal Canadian Mounted Police, which LockBit claimed. The attacks on British Columbia share similarities to these past attacks in which Lockbit targeted public infrastructure like the Canadian province’s government networks causing citywide disruption.
IntelBroker Targets Financial Organizations
Source: https://cloud.zerofox.com/intelligence/advanced_dark_web/63933
What happened: ZeroFox Intelligence has observed IntelBroker uploading databases belonging to two notable universal banks, one of which is Barclays. The leaked package allegedly contains 512,000 lines of data comprising databases, certificate files, source code, SQL files, JSON config files, and compiled jar files.
Why it matters: Other threat actors are likely to leverage the leaked data package allegedly from the two banks for targeted spearphishing attacks, extortion schemes, and further disruption of bank network infrastructure, leading to further financial losses for customers. Recently, IntelBroker has seemingly leveled up its attacks targeting notable organizations, including one of the largest cybersecurity companies, Zscaler.
DEEP AND DARK WEB INTELLIGENCE
- Anonymous Collective and Dark Strom Team: On May 8 and May 9, Threat actor groups Anonymous Collective and Dark Strom Team DDoS attacked various entities in Egypt. The alleged motive for the attack is that the request for aid to refugees from Gaza was rejected by Egypt.
VULNERABILITY AND EXPLOIT INTELLIGENCE
- CVE-2024-31497: Biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. An adversary may already have enough signature information to compromise a victim's private key, even if there is no further use of vulnerable PuTTY versions.
Affected products: PuTTY Versions 0.68 through 0.80 before 0.81.
Tags: DIB, tlp:green