ZeroFox Weekly Intelligence Brief – December 16, 2024
ZeroFox Weekly Intelligence Brief – December 16, 2024
TLP:GREEN
ZeroFox’s Weekly Intelligence Briefing highlights the major developments and trends across the threat landscape, including digital, cyber, and physical threats. ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EST) on December 13, 2024; per cyber hygiene best practices, caution is advised when clicking on any third-party links.
Read the Brief
View the full report here
U.S. Treasury Issues Sanctions Against PRC Firm for Hacking Firewalls and Attempted Ransomware Attacks
What happened: The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned cybersecurity company Sichuan Silence and one of its employees, both based in the People’s Republic of China (PRC), for their roles in the April 2020 compromise of tens of thousands of firewalls worldwide. Many of the victims were U.S. critical infrastructure companies. The sanctioned employee exploited a zero-day vulnerability in a firewall product to deploy malware on approximately 81,000 firewalls worldwide, stealing credentials and attempting to deploy the Ragnarok ransomware variant.
Romania Elections Annulled; Integrity Compromised
What happened: A Romanian constitutional court annulled the first round of votes in Romania’s presidential election due to allegations of Russian interference, forcing a complete restart of the electoral process. This incident follows allegations that a pro-Russian TikTok influence campaign was actively promoting one of the candidates, who won the first round of the elections. Intelligence revealed USD 381,000 in undeclared spending on unmarked political content and linked cyberattacks to state-sponsored actors targeting electoral data. Disinformation amplified pro-Russian narratives, leveraging influencers and bypassing platform controls. The European Union (EU) intervened via the Digital Services Act, compelling TikTok to preserve records and escalating monitoring during the electoral process.
Ukraine’s Military Companies Baited with Doctored Emails
What happened: Ukraine’s CERT-UA confirmed that hacking group “UNC4221” targeted defense and military companies with phishing emails from a Ukrainian business organization. The campaign aimed to compromise employees of Ukraine’s defense contractors and forces. This group is suspected to be linked to Russia and has been observed targeting messaging services, such as Telegram and Whatsapp, and military systems like Kropyva.