ZeroFox Weekly Intelligence Brief – March 8, 2025

ZeroFox Weekly Intelligence Brief – March 8, 2025

ZeroFox’s Weekly Intelligence Briefing highlights the major developments and trends across the threat landscape, including digital, cyber, and physical threats. ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 6:00 AM (EST) on March 6, 2025; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Read the Brief

View the full report here

Cybercriminals Use Tech Support Scam to Deploy Ransomware

What we know:

• Cybercriminals have been impersonating tech support to gain access to victims’ systems via emails and popular collaboration applications and deploy ransomware from groups like Black Basta and Cactus.
• The scam involves bombarding the target systems with emails, following which the owner of the system gets a call, seemingly from IT support, asking them to grant the support assistant access to the system.
• Once the attacker (disguised as the support assistant) gains access to the system, they download harmless-looking malicious files that deploy a backdoor called BackConnect, giving the attacker complete control over the system.

Operator of Darknet Market Nemesis Sanctioned for Synthetic Opioid Sales

What we know:

• The U.S. Treasury Department has sanctioned the sole administrator of darknet market Nemesis, which facilitated the sale of nearly USD 30 million worth of drugs around the world between 2021 and 2024—including to the United States.

Polish Space Agency POLSA Hit by Cyberattack

What we know:

• The Polish Space Agency (POLSA) experienced a cyberattack in which threat actors reportedly gained unauthorized access to its IT infrastructure.