ZeroFox Intelligence Flash Report - NATO Data Leak Shared on Deep Web Forum

Product Serial: F-2024-05-24a

TLP:CLEAR

In this Flash Report, ZeroFox researchers report on a recent deep web forum announcement by a threat actor named Sumo, who claims to have conducted a data breach against a NATO school.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

On May 19, 2024, threat actor “Sumo” announced a data leak pertaining to a NATO school’s e-learning platform on the Russian-speaking deep web forum Cronos.
It is likely that the data breach originated from an SQL injection vulnerability that was privately advertised for sale on Telegram in January 2024. The vulnerability allegedly implicated an unknown NATO entity.
It is very likely that the intended use of this data is social engineering and other fraudulent activity, with a likely chance it has already been leveraged in attacks by financially-motivated threat actors.