ZeroFox Daily Intelligence Brief - April 14, 2023

ZeroFox Daily Intelligence Brief - April 14, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Legion: A New Python-Based Hacking Tool Promoted on Telegram
• Russian Hackers Linked to Widespread Attacks Targeting NATO and EU
• Civil Liberty Groups Express Data-Privacy Concerns in European Union Child Protection Bill

Legion: A New Python-Based Hacking Tool Promoted on Telegram

Legion, a new Python-based credential harvester and hacking tool, is being promoted on Telegram. The promoters claim that Legion can enable users to exploit web servers running CMS, PHP, or PHP-based frameworks for spamming or phishing campaigns. The tool includes modules that can exploit vulnerable SMTP servers, execute remote code, and brute force cPanel and WebHost Manager accounts. Although the identity of the threat actor behind Legion is unknown, comments in the source code suggest that the developer may be from Indonesia.

Recommendation:

• To prevent the exploit of web servers, admins should evaluate security configurations and make sure that credentials/secrets are stored appropriately. Storing credential-containing .env files securely from the rest of the web-server directory is recommended to prevent their compromise.
• Recent research has revealed that the actor responsible for Legion changed the IAM user registration code by adding an "Owner" tag with the hardcoded value of "ms.boharas." AWS administrators must be alert to new user accounts being created under this tag.

Russian Hackers Linked to Widespread Attacks Targeting NATO and EU

The Polish Military Counterintelligence Service and CERT Polska have observed a widespread espionage campaign linked to Russian intelligence services targeting foreign ministries and diplomatic entities in NATO member states and the European Union. The ongoing campaign utilizes spear phishing techniques and shares similarity with activity previously attributed to the actor, such as the “NOBELIUM” and “APT29” campaigns. However, the observed campaign includes software unique to this operation and employs new tools to maintain a high operational pace. The actor used various techniques to deliver the malware, including IMG and ISO files, and DLL sideloading.

Additionally, ZeroFox Intelligence has observed that in connection with the Russia-Ukraine conflict, a pro-Russia group called Killmilk has claimed to have access to data from the NATO Learning Management System. The group is demanding 3 BTC (approximately USD 90,000 at current rates) in exchange for not selling the data.

Recommendations:

• Blocking the automatic mounting of disk image files can stop this malware from running, especially in organizations where regular users do not need to download and mount (.ISO) or (.IMG) files. Organizations can log the mounting of disk image files by users and monitor them for further suspicious activity.
• Targeted entities should configure their Software Restriction Policy to block the start-up of executables (ISO, IMG, and DLL files) from suspicious sources such as temp directories, %localappdata%, and its subdirectories or external devices.

Civil Liberty Groups Express Data-Privacy Concerns in European Union Child Protection Bill

Civil liberty groups and privacy advocates have expressed concerns about potential data compromise hazards and breach of personal freedom via the Child Sexual Abuse Material (CSAM) Bill proposed by the European Parliament. The Bill mandates digital communication services, such as instant messenger apps, scan for CSAM, which does not complement end-to-end encryption. The objectors opined that the only realistic way to detect CSAM is by scanning the device of the user using specific software, which would increase the attack surface and potentially create new vulnerabilities that could be leveraged for data compromise. European tech associations have also criticized the proposal, citing the fundamental position that encryption occupies in ensuring safe and secure private communications, strong cybersecurity, and data protection.

Recommendations:

• Organizations behind such implementations should make sure to formulate and publish consumer data retention and minimization policies.
• Efforts should be made to avoid false positives as well as bias in such implementations, as such technology is often prone to errors.
• Follow ZeroFox Intelligence to remain up-to-date on global news relating to data privacy and cybersecurity.