ZeroFox Daily Intelligence Brief - March 11, 2025
ZeroFox Daily Intelligence Brief - March 11, 2025
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.
Brief Highlights
- New Polymorphic Attack Clones Browser Extensions to Steal Credentials
- X Suffers Downtime; Now Back Again
- Hacktivist Group Anonymous Sudan Announces Return to Telegram
New Polymorphic Attack Clones Browser Extensions to Steal Credentials
Source: https://thehackernews.com/2025/03/researchers-expose-new-polymorphic.html
What we know: Cybersecurity researchers have revealed a polymorphic technique that enables malicious browser extensions to impersonate any installed add-on and steal user credentials.
Context: The attack targets all Chromium-based web browsers by creating pixel-perfect replicas of legitimate extensions, including icons, popups, and workflows, while temporarily disabling the real extension to deceive users.
Analyst note: The credentials stolen through the polymorphic attack could be exploited to gain unauthorized access to sensitive personal and financial information—likely leading to phishing attacks, identity theft, data breaches, or more targeted attacks.
X Suffers Downtime; Now Back Again
What we know: Social media platform X is reportedly back online after users experienced massive outages in three waves worldwide on March 11, while hacktivist group “Dark Storm” claimed to have targeted X in a distributed denial-of-service (DDoS) attack on its Telegram channel.
Context: Elon Musk called this event “a massive cyberattack,” speculating the involvement of a large group or even a country. Musk has further stated that the IP addresses involved in conducting the attack were traced in the “Ukraine area.”
Analyst note: Dark Storm Team’s claims of conducting a DDoS attack remain unsubstantiated, save the screenshots on its telegram channel. The outages likely impacted real-time coverage of global events since X is one of the most widely used platforms in disseminating information to millions of users—including government agencies.
Hacktivist Group Anonymous Sudan Announces Return to Telegram
Source: https://www.zerofox.com/advisories/31121/
What we know: Hacktivist collective Anonymous Sudan has allegedly made a comeback on Telegram app as “Anonymous Sudan Second Battalion.”
Context: The pro-Russian and pro-Palestine hacktivist group seemingly ceased activity in October 2024, following the indictment of two individuals linked to the group and its Telegram channel also disabled. However, in January 2025, the group claimed via its new telegram channel at least 12 DDoS attacks.
Analyst note: It is likely that the new Telegram channel is legitimate, especially given the inclusion of check-host links. Even though no new attack claims have been observed, given the group’s history of targeting the U.S. government, Israeli-linked entities, and U.S. critical infrastructure globally, there is a roughly even chance that it will resume the attacks.
DEEP AND DARK WEB INTELLIGENCE
BreachForums user MIYAK000: Well-regarded threat actor "MIYAK000" has advertised VPN access to an unnamed U.S.-based law firm. Threat actors could leverage this to access the firm’s networks to establish a foothold and exfiltrate sensitive client and business data.
VULNERABILITY AND EXPLOIT INTELLIGENCE
CVE-2024-13159: Absolute path traversal in specific versions of Ivanti EPM allows a remote unauthenticated attacker to leak sensitive information. This vulnerability could enable attackers to access and exploit sensitive system files, potentially leading to further attacks or data breaches.
Affected products: Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update