ZeroFox Daily Intelligence Brief - April 28, 2023
|by Alpha Team
ZeroFox Daily Intelligence Brief - April 28, 2023
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.
Key Findings
- Linux Version of RTM Locker Ransomware Targets VMware ESXi Servers
- Israel Facing Wave of Cyberattacks in Lead-Up to 75th Independence Day Celebrations
- PaperCut Says Hackers Are Exploiting Critical Security Flaws in Unpatched Servers
Linux Version of RTM Locker Ransomware Targets VMware ESXi Servers
RTM Locker, a cybercrime gang that has been active in financial fraud since 2015, has launched a new ransomware-as-a-service (RaaS) operation that deploys Linux encryptors on VMware ESXi servers. The group has recently begun recruiting affiliates, including from the Conti cybercrime syndicate. Security researchers have found that RTM Locker's Linux variant is based on the leaked source code of the Babuk ransomware and is designed to attack VMware ESXi systems specifically. The encryptor contains references to commands used to manage virtual machines.
Recommendations:
- Organizations should implement strict access controls and limit administrative privileges to only necessary personnel to reduce the likelihood of attackers obtaining the required permissions to execute the locker.
- Implement robust backup and recovery processes for critical data and systems to minimize downtime and the impact of a ransomware attack.
- Follow ZeroFox Intelligence to remain updated on emerging threats.
Israel Facing Wave of Cyberattacks in Lead-Up to 75th Independence Day Celebrations
Israeli Prime Minister Benjamin Netanyahi’s Facebook account was hacked and personal information of thousands of students was leaked following a cyberattack on the Atid group, one of the largest educational companies in Israel. The hacker group Sharpboys hacked into servers of the Atid group and claims to have exfiltrated personal information of more than 500,000 students and teachers. The stolen information, which includes names, identity cards, addresses, matriculation certificates, and Israel Defense Forces documents about military services, is reportedly being offered for sale. The hackers also broadcast audio content in Arabic and Persian from Prime Minister Netanyahu’s Facebook account; the content was promptly taken down minutes after the hack. Atid group has said that it managed to thwart the attack and that very little information was leaked.
Israel has been facing a spree of attacks in the lead-up to its 75th Independence Day celebrations. ZeroFox Intelligence notes that Israel has been relentlessly targeted by self-proclaimed Islamic hacktivist groups such as Anonymous Sudan and Mysterious Team Bangladesh over the past month as part of what is being referred to as #OpIsrael. Israel’s port companies, broadcasting authority, banks, telecommunication companies, and government agencies have been targeted by the Anonymous Sudan hacker group and its allies.
Recommendations:
- Victims of the data leak should stay alert for potential phishing emails, fraudulent calls, or other suspicious communications, as these could be follow-on attacks using the breached information.
- Victims should consider using data-protection services, such as those provided by ZeroFox’s IDX, to alert them of any misuse of their personal information following the data leak.
PaperCut Says Hackers Are Exploiting Critical Security Flaws in Unpatched Servers
Papercut has released an advisory detailing two vulnerabilities in its print management software applications PaperCut MF and PaperCut NG. Successful exploitation of the first vulnerability (CVE-2023–27350 / ZDI-CAN-18987) could permit an attacker to remotely execute code on a PaperCut Application Server without the need for authentication. The second vulnerability, (CVE-2023–27351 / ZDI-CAN-19226), could allow an attacker to remotely extract user information—including usernames, full names, email addresses, card numbers, and office and department information. Malicious actors exploiting this vulnerability can also retrieve hashed passwords from internal PaperCut-created user accounts. The advisory notes that unpatched servers are being exploited in the wild and warns users to be cautious.
Recommendations:
- Organizations should upgrade to PaperCut versions 20.1.7, 21.2.11, 22.0.9, or later to address the vulnerabilities.
- If a server is suspected to have been compromised, it is recommended to take server backups, wipe the server, and rebuild it from a safe backup point.
VULNERABILITIES
- CVE-2022-28346 An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. … more
- CVE-2022-28347 A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. … more
- CVE-2022-34265 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. … more
EXPLOITS
Tags: DIB, tlp:green