ZeroFox Weekly Intelligence Brief – May 13, 2024

ZeroFox Weekly Intelligence Brief – May 13, 2024

ZeroFox’s Weekly Intelligence Briefing highlights the major developments and trends across the cyber threat landscape. ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on May 10, 2024; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Read the Brief

View the full report here

Iranian State-Sponsored Hackers Conduct Social Engineering Campaign Mimicking Journalists

APT42, an Iranian state-sponsored cyberespionage group, is impersonating journalists and human rights activists to exfiltrate data and steal cloud operations credentials through spear phishing attacks. The hackers target prominent news outlets using deceptive domains and fake login pages, indicating a wide-ranging campaign since 2021. Researchers have associated the group with the Islamic Revolutionary Guard Corps Intelligence Organisation (IRGC-IO).

United States Releases International Cyberspace Strategy

The U.S. Department of State has introduced the International Cyberspace and Digital Policy Strategy aimed at fostering an innovative, secure, and rights-respecting digital future. This strategy, developed in collaboration with other federal agencies, prioritizes digital solidarity—a collective commitment to shared goals and mutual support. It emphasizes building digital and cyber capacity to enhance security, resilience, and prosperity. Guided by three principles and four areas of action, the strategy promotes an open, inclusive, and secure digital ecosystem; aligns governance approaches with international partners; advances responsible state behavior; and strengthens global digital and cyber capacity to combat cyber threats.

Zscaler Takes Test Environment Offline While Investigating Claims of Cyberattack

Zscaler has discovered an exposed isolated test environment on a test server that it took offline after rumors of a threat actor selling access to its systems spread online. The company has engaged an incident response firm to investigate further.

Physical Security Intelligence: Global

Excluding the United States, there was a 10 percent decrease in mass casualty events this week from the previous week, with the top contributing countries being Palestine, Israel, and Ukraine (in that order); approximately 75 percent of these events were explosions, and 15 percent were bomb threats. General alerts related to the Israel-Hamas war (including protests, raids, and involvement in neighboring countries) increased by 24 percent from the previous week; notably, Palestine and Israel accounted for 43 percent of all international explosions alerted. Conversely, events related to Russia’s war in Ukraine decreased by 32 percent. The top three most-alerted subtypes were explosions, which saw a 2 percent increase from the previous week; gun violence, which decreased by 14 percent; and natural disasters.

Physical Security Intelligence: United States

In the past week, the top three most-alerted incident subtypes were natural disasters, gun violence, and police activity; notably, this is the first time in several weeks that there have been more natural disaster alerts than gun violence alerts. Gun violence alerts are instances in which there is a confirmed or likely confirmed victim (i.e., not simply shots fired). The top two states that had the most gun violence alerts were Illinois and Ohio, which together made up almost one-third of this week’s nationwide total. Gun violence across the United States increased by 2 percent from the week prior. The top three contributors to natural disaster alerts this week were Texas, California, and New York, and natural disaster alerts across the country increased by 8 percent. The police activity subtype is used to alert evacuations, lockdowns, and heavy police presence for which the reason is not yet known at the time of alerting; Texas, California, and Pennsylvania were the top three contributing states this week for this subtype. Nationwide protest activity as a whole increased by 6 percent from the week prior.