ZeroFox Cyber Intelligence Daily Brief - January 4, 2025
|by Alpha Team
ZeroFox Cyber Intelligence Daily Brief - January 4, 2025
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.
Brief Highlights
- Ransomware Group Warns of Upcoming Attacks Against Vulnerable Companies
- Critical LDAP Flaw Exposes Servers to Crashes and Remote Takeovers
- 7-Zip Vulnerability Confusion; May Have Been AI
Ransomware Group Warns of Upcoming Attacks Against Vulnerable Companies
Source: https://cloud.zerofox.com/intelligence/advanced_dark_web/78547
What happened: ZeroFox has observed a post on the Rhysida ransomware leak site stating that no company's data is available for auction at present. The group emphasized that it is actively searching for its next victim. Additionally, the group hinted at future disclosures, warning that more companies will be revealed soon.
Why it matters: The rise in cybercrime has shifted corporate responsibility, with executives and IT teams aligning strategies with data protection best practices to better equip themselves against cyberattacks. As a result, companies are more cautious and proactive, driven by awareness of potential consequences such as financial penalties, legal risks, and data loss. However, the group’s warning reveals the vulnerability of organizations that neglect strong cybersecurity practices, which can lead to cyberattacks.
Critical LDAP Flaw Exposes Servers to Crashes and Remote Takeovers
What happened: Researchers have discovered that a critical Lightweight Directory Access Protocol (LDAP) denial-of-service (DoS) flaw, CVE-2024-49113, can expose unpatched systems to remote code execution. Patched in December 2024, the bug affects domain controllers linked to Domain Name System (DNS) servers connected to the internet.
Why it matters: The bug enables threat actors to take immediate control over unpatched systems by bypassing usual defenses and escalating directly to domain controllers that store critical credentials. Attackers can then likely crash multiple servers or gain remote code execution. Even though there is no evidence of threat actors exploiting the bug in the wild, the exploit cybersecurity researchers have released for the bug is likely to invite threat actor activity.
7-Zip Vulnerability Confusion; May Have Been AI
Source: https://hackread.com/fake-7-zip-exploit-code-ai-generated-misinterpretation/
What happened: 7-Zip creator and other researchers are now debunking claims of a 7-Zip zero-day exploit, which could enable attackers to execute arbitrary code on a victim’s system through buffer overflow. It is likely that this misinformation stemmed from AI-generated code.
Why it matters: AI-generated code is useful to developers, but its limitations can lead to inaccuracies and misunderstandings. In the 7-Zip exploit claim, it is likely that AI-generated code referenced a nonexistent issue in a function, leading to confusion among researchers. Without rectification, such misinformation could have likely enabled threat actors to take advantage of the confusion and circulate malware in the guise of a security patch.
DEEP AND DARK WEB INTELLIGENCE
BreachForums user miyako: Well-regarded threat actor "miyako" advertised VPN access with root rights to an unnamed U.S.-based Bank company on predominantly English language Dark Web forum BreachForums.
VULNERABILITY AND EXPLOIT INTELLIGENCE
CVE-2024-9140: Moxa’s cellular routers, secure routers, and network security appliances are affected. This vulnerability allows OS command injection due to improperly restricted commands, potentially enabling attackers to execute arbitrary code.
Affected products:
- EDR-8010 Series affected from 1.0 through 3.13.1
- EDR-G9004 Series affected from 1.0 through 3.13.1
- EDR-G9010 Series affected from 1.0 through 3.13.1
- EDF-G1002-BP Series affected from 1.0 through 3.13.1
- NAT-102 Series affected from 1.0 through 1.0.5
- OnCell G4302-LTE4 Series affected from 1.0 through 3.13
- TN-4900 Series affected from 1.0 through 3.13
Tags: DIB, tlp:green