ZeroFox Weekly Intelligence Brief

ZeroFox Weekly Intelligence Brief - May 20, 2024

ZeroFox’s Weekly Intelligence Briefing highlights the major developments and trends across the cyber threat landscape. ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on May 17, 2024; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Read the Brief

View the full report here.

CYBERSECURITY NEWS

Europol: No Operational Information Stolen: Europol is investigating a data breach impacting its Europol Platform for Experts (EPE) wherein a threat actor exfiltrated For Official Use Only (FOUO) documents containing classified data. At the time of reporting, the website is offline and displays a message that the service is “not available at the moment due to maintenance activities.” A threat actor going by the moniker “IntelBroker” has claimed responsibility for the breach. The agency revealed that the threat actor reportedly gained access to the data using stolen credentials and not by exploiting a vulnerability or a misconfiguration. Europol has also conveyed to news outlets that “only a small and limited part of the EPE (closed user group) could be accessed" utilizing the stolen credentials. Hack of French Sports Minister’s X Account Highlights Olympics Cyberthreats: French Sports Minister Amélie Oudéa-Castéra’s X account (formerly Twitter) was hacked. Her profile photo was changed and bizarre messages were sent out, prompting concerns and intervention from both X and France's cybersecurity agency (ANSSI) as Paris prepares to host the 2024 Olympics. The hack was immediately detected, and the account has been restored. Hacktivists and threat actors across the world view events such as the Olympics as prime targets to leave a mark on the global stage, aiming to steal sensitive data, conduct distributed denial-of-service (DDoS) or ransomware attacks paralyzing key systems, carry out phishing schemes targeting officials and participants, or make political statements.

UPDATES FROM THE DEEP AND DARK WEB

GhostSec Shifts from Cybercrime to Hacktivism: On May 15, 2024, threat actor group GhostSec, which has previously been involved in financially motivated cybercrimes, announced it would be returning to its original focus on hacktivism. As part of this transition, the group will discontinue its services; close its ransomware product, Ghostlocker; and provide its code to its ally Stormous, ensuring a smooth exit without scams. The threat actor announced that it has gathered sufficient funds through its past activities to support its operations moving forward. GhostSec stated it may offer a hacking course in the future as well.

PHYSICAL SECURITY INTELLIGENCE

Excluding the United States, there was a 2 percent decrease in mass casualty events this week from the previous week, with the top contributing countries being Palestine, Ukraine, and Israel (in that order); approximately 68 percent of these events were explosions. In the past week in the United States, the top three most-alerted incident subtypes were natural disasters, gun violence, and police activity, in that order; this is the second week in a row that natural disasters have outnumbered gun violence alerts. Natural disasters outnumbering gun violence as the most alerted incident type this week is likely due to several instances of severe weather; Florida was the top contributor to this incident subtype due to several powerful thunderstorms, strong winds, and tornado warnings throughout the week.