ZeroFox Weekly Intelligence Brief – May 27, 2024

ZeroFox Weekly Intelligence Brief – May 27, 2024

ZeroFox’s Weekly Intelligence Briefing highlights the major developments and trends across the cyber threat landscape. ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on May 24, 2024; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Read the Brief

View the full report here

YouTube Becomes Latest Battlefront for Phishing, Deepfakes

What happened: Cybersecurity researchers have flagged YouTube as a growing platform for malicious activities, with instances of phishing, malware distribution, and fraudulent investment schemes on the rise. Researchers have identified five potential ways in which threat actors can exploit YouTube: phishing emails targeting creators, compromised video descriptions with malicious links, channel hijacking for spreading threats such as cryptocurrency scams, leading viewers to fake websites and imitating reputable companies to distribute malware, and social engineering through video content to deceive users into downloading malicious software.

SEC Adds New Incident Response Rules for Financial Sector

What happened: The Securities and Exchange Commission (SEC) has announced new data breach reporting regulations for certain financial firms, updating Regulation S-P for the first time in 24 years. These amendments aim to address the evolving risks posed by technology and data breaches in the financial sector, requiring institutions to develop incident response programs and notify affected individuals promptly. Financial organizations are required to notify individuals of data breaches within 30 days, providing details of the incident and the type of data compromised, as well as guidance on how affected customers can safeguard themselves.

BreachForums Returns with New Onion Site

What happened: A week after a law enforcement (LE) operation took down BreachForums, one of the biggest deep and dark web (DDW) forums, ZeroFox observed an update on Telegram channel Jacuzzi 2.0 announcing a new onion site for BreachForums. Soon after the LE takedown, BreachForums’ official Telegram channel confirmed that the clearnet domain for BreachForums had been recovered. Initially, users were unable to create accounts, and old "personas" (credentials) were not being recognized. However, at the time of reporting, the site seems to be letting in users with their original credentials.