ZeroFox Cyber Intelligence Daily Brief - December 16, 2024
ZeroFox Cyber Intelligence Daily Brief - December 16, 2024
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.
Brief Highlights
- CISA and EPA’s Advisory on Internet-Exposed HMIs Risks to WWS Sector
- Clop Ransomware Claims Responsibility for Cleo Data Theft Attacks
- Germany Disrupts BADBOX Malware on 30,000 Devices Using Sinkhole Action
CISA and EPA’s Advisory on Internet-Exposed HMIs Risks to WWS Sector
What happened: CISA and the Environmental Protection Agency (EPA) released a joint fact sheet providing Water and Wastewater Systems (WWS) facilities with recommendations for limiting the exposure of Human Machine Interfaces (HMIs) and securing them against malicious cyber activity. EPA and CISA urge WWS facilities to inventory internet-exposed devices, disconnect them from the internet when possible, secure those that remain connected with strong usernames and passwords, and more.
Why it matters: The WWS sector is vulnerable to various threats, including physical attacks, cyberattacks, and contamination with harmful agents. Such incidents could result in widespread illness, casualties, and service disruptions, likely significantly impacting public health and economic stability. In the past, threat actors have demonstrated the capability to find and exploit internet-exposed HMIs with cybersecurity weaknesses easily, making strengthening HMIs essential.
Clop Ransomware Claims Responsibility for Cleo Data Theft Attacks
What happened: The Clop ransomware gang has claimed responsibility for recent data thefts targeting Cleo software with a critical zero-day vulnerability (CVE-2024-50623). These attacks involved deploying a JAVA backdoor to steal data and gain deeper access to victim networks, despite Cleo's initial attempts to patch the vulnerability.
Why it matters: CVE-2024-50623 is a zero-day flaw in Cleo’s LexiCom, VLTransfer, and Harmony software where an unrestricted file upload and download can likely lead to remote code execution. This vulnerability has been actively exploited by threat actors, impacting at least 24 businesses, likely including consumer product companies, logistics firms, and food suppliers. Clop has now claimed to have deleted sensitive data belonging to government entities, hospitals, and research institutions reportedly in accordance with its regulations.
Germany Disrupts BADBOX Malware on 30,000 Devices Using Sinkhole Action
Source: https://thehackernews.com/2024/12/germany-disrupts-badbox-malware-on.html
What happened: German authorities disrupted the BADBOX malware operation, which infected 30,000 devices including phones, tablets, and smart home devices. This malware, pre-installed on devices, collected data, installed other malware, and was used for ad fraud and creating fake accounts.
Why it matters: According to Germany's Federal Office of Information Security (BSI), the BADBOX malware exploited outdated Android systems. This sophisticated operation—likely originating from China—turned infected devices into proxies for other cybercriminals, enabling them to evade detection. The BSI has urged internet providers to block malicious traffic and users to disconnect affected devices.
DEEP AND DARK WEB INTELLIGENCE
China-linked Winnti: Winnti has been observed targeting China and U.S. entities, and several cybercriminal groups, by deploying a PHP backdoor called Glutton. The malware is reportedly capable of exfiltrating system information and data from a file system.
VULNERABILITY AND EXPLOIT INTELLIGENCE
CVE-2024-11858: A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. Maliciously crafted inputs can inject shell commands during command parsing, leading to unintended behavior during file processing.
Affected products: Radare2 Pebble Application file versions from 0.9.7 before 5.9.9