ZeroFox Daily Intelligence Brief - April 18, 2023

ZeroFox Daily Intelligence Brief - April 18, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Business Emails Targeted Through Banking Trojan, Spread Via Malware
• CommScope Data Published After Ransom Negotiation Fails
• Ex-Conti Members and FIN7 Threat Actors Develop New Domino Malware

Business Emails Targeted Through Banking Trojan, Spread Via Malware

The malware QBot (also known as Qakbot or Pinkslipbot) is being deployed in business correspondence hijacks that leverage reply-chain emails to trick unsuspecting victims into installing the malware on their systems. The campaign, which weaponizes PDFs and Windows Script Files, is targeting victims primarily from Western Europe, Russia, North Africa, and the United States. Distributed through phishing campaigns, the malware steals passwords and cookies from web browsers and acts as a backdoor to inject next-stage payloads such as Cobalt Strike or ransomware. QBot comes with anti-virtual machine, anti-debugging, and anti-sandbox techniques to evade detection.

Recommendations:

• Maintain an antivirus or anti-malware program to provide additional device and data protection.
• Follow ZeroFox Intelligence for indicators of compromise of ongoing malware attacks.

CommScope Data Published After Ransom Negotiation Fails

The Vice Society ransomware gang has published sensitive employee data from U.S. network infrastructure giant CommScope after the gang’s ransom demand was not met. The hackers have published Social Security numbers and bank account details of thousands of employees, including full names, postal and email addresses, personal numbers, and scans of employees passports and visa documentation, along with internal documents, invoices, and technical drawings. The hackers reportedly exfiltrated backups of data pertaining to the MyCommScope customer portal and its internal intranet. CommScope stated that the company has seen no evidence that customer information was accessed during the breach.

ZeroFox Intelligence has observed close to 120 entities being targeted by the Vice Society ransomware in the past year, approximately 40 percent of which are from the educational sector.

Recommendations:

• CommScope employees should consider using data-protection services, such as those provided by ZeroFox’s IDX, to alert them of any misuse of their personal information following this attack.
• Victims should remain alert for potential phishing exploits, as threat actors are known to conduct follow-on attacks using leaked data.
• Employees should follow standard cyber hygiene best practices to keep their corporate devices safe: keep operating systems updated, avoid opening unknown attachments and executables, and use strong and unique passwords.

Ex-Conti Members and FIN7 Threat Actors Develop New Domino Malware

Researchers have reported the discovery of a new strain of malware called Domino, which is believed to have been developed by a group affiliated with the FIN7 cybercrime syndicate in collaboration with the now-defunct Conti ransomware gang. The malware has been tracked since February 2023 and is designed to facilitate the exploitation of compromised systems by deploying an information stealer known as Project Nemesis. This malware consists of two components: a backdoor named Domino Backdoor, which drops a “Domino Loader” that injects an info-stealing malware DLL into the memory of another process.

Recommendations:

• Organizations should keep their security software up-to-date and deploy available patches on all enterprise software.
• Implementing MFA can help prevent unauthorized access to sensitive information. Organizations should also ensure that their employees use unique and strong passwords for each account.
• Conducting regular cybersecurity training can help prevent employees from falling victim to these criminal tactics.
• Follow ZeroFox Intelligence to remain updated on emerging threats.