ZeroFox Daily Intelligence Brief - April 19, 2023

ZeroFox Daily Intelligence Brief - April 19, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• UK and U.S. Cybersecurity Authorities Warn of State-Backed Hackers Targeting Cisco Routers
• YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader
• Security Scaled Up After U.S. Intelligence Data Leak

UK and U.S. Cybersecurity Authorities Warn of State-Backed Hackers Targeting Cisco Routers

Cybersecurity authorities from the United States and the United Kingdom have issued a joint advisory about Russian state-sponsored hacker group APT28 deploying custom malware called “Jaguar Tooth” to exploit a flaw (patched in 2017) in Cisco IOS routers. The malware allows unauthenticated access to the device and is injected directly into the memory of routers running older firmware versions to provide backdoor access and extract information from it. The warning comes in response to a growing trend for state-sponsored threat actors to target edge network devices for cyber espionage and surveillance that do not support endpoint detection and response (EDR) solutions, making them a convenient target. The hackers exploit an old Simple Network Management protocol (SNMP) flaw to deploy the malware and use weak SNMP community strings to gain access to the device.

Recommendations:

• Admins are advised to upgrade their routers, switch from SNMP to NETCONF/RESTCONF, configure allow and deny lists, and revoke all keys associated with a device if there is suspicion of it being compromised.
• Use logging tools such as TACACS+ and Syslog to record activity on network devices. Use these logs to highlight suspicious events, and keep a record of events to support an investigation if the device’s integrity is ever in question.
• Enforce a strong password policy on routers and avoid default passwords/reuse of the same password for multiple devices. Avoid legacy password-based authentication, and implement two-factor authentication based on public-private key.

YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader

The in2al5d p3in4er loader, created using Embarcadero RAD Studio, has been used to distribute the Aurora information stealer malware. The loader targets endpoint workstations using advanced anti-virtual machine techniques and queries the vendor ID of a system's graphics card, proceeding only if it matches a specified vendor ID. The loader then injects the decrypted payload into a legitimate system process called sihost.exe or invokes it from memory. The malware loader's ability to generate executables for multiple platforms, as well as its technique of process hollowing, allows it to evade detection by conventional detection tools. Aurora is distributed via YouTube and fake cracked software websites.

Recommendations:

• Avoid clicking on links in YouTube video descriptions or cracked software download websites, as these are common distribution channels for malware.
• Organizations should educate employees on social engineering tactics to prevent the initial foothold of an attack by malware loaders such as in2al5d p3in4er.
• Ensure that graphics card drivers are kept up-to-date, as loaders such as in2al5d p3in4er target endpoint workstations, and check the graphics card vendor ID before proceeding.
• To defend against in2al5d p3in4er and other evasive loaders, use proactive security solutions like Moving Target Defense and those that detect advanced malware techniques. Reactive technologies may not be effective, as even VirusTotal has a low detection rate against this malware.

Security Scaled Up After U.S. Intelligence Data Leak

After highly classified military documents pertaining to the Russia-Ukraine war and other sensitive intel-related topics were shared in a chat room and later more broadly across the internet, American defense and intelligence systems are reportedly augmenting their security. Following the arrest of Jack Teixeira, a Massachusetts Air National Guardsman, for allegedly leaking highly sensitive information, the agencies have tightened access to sensitive intelligence and are reviewing their practice of granting security clearance and sharing classified information, focusing on the principle of “need to know.” The U.S. Department of Defense is in the process of reviewing the intelligence access, accountability, and control procedures within the department to facilitate its efforts to prevent the recurrence of such incidents.

Recommendations:

• Agencies should conduct regular audits to determine adherence to the principle of least privilege in accessing sensitive intelligence information. Organizations should also periodically revoke permissions granted to old and inactive profiles.
• Follow ZeroFox Intelligence to remain updated on emerging threats.