ZeroFox Daily Intelligence Brief - May 3, 2023
|by Alpha Team
ZeroFox Daily Intelligence Brief - May 3, 2023
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.
Brief Highlights
- Operation SpecTor Nabs 288 Dark Web Drug Vendors and Buyers
- ALPHV Targets Australian Commercial Law Firm, Hacks 4TB Data
- Anonymous Sudan Claims to Have Disrupted Iron Dome Intercepts
- CVE-2023-23920
- CVE-2023-29839
- CVE-2022-4129
- CVE-2017-2921
- CVE-2015-7611
Operation SpecTor Nabs 288 Dark Web Drug Vendors and Buyers
A multiyear international law enforcement operation codenamed “SpecTor” has resulted in the arrest of 288 darknet drug vendors and customers worldwide and police seizure of over USD 50 million in cash and cryptocurrency. The coordinated takedown effort spanned North America, South America, and Europe to disrupt fentanyl and opioid trafficking on the darknet and focused on the Monopoly Market, which sold drugs in exchange for BTC and XMR cryptocurrency. The operation also seized 117 firearms and 850 kilograms of drugs (including 64 kg. of fentanyl or fentanyl-laced narcotics).
Recommendations:
- U.S. residents can report illegal sales/distribution of drugs, suspicious online pharmacies, criminals impersonating Drug Enforcement Administration (DEA) Special Agents, and other drug-distribution-related crimes by calling 877-RxAbuse (877-792-2873).
- Follow ZeroFox Intelligence to remain updated on latest news and threats related to the digital underground.
ALPHV Targets Australian Commercial Law Firm, Hacks 4TB Data
HWL Ebsworth, an Australian commercial law firm, has fallen victim to an attack by Russia-based ransomware group ALPHV/BlackCat, which claims to be in possession of 4TB of the firm’s data. The breached data allegedly includes financial reports, accounting data, client documentation, employee CVs, IDs, credit card information, and complete mapping of the law firm’s networks, including credentials. The law firm stated that there was no evidence that any third party had access to their systems, as there were no signs of encryption detected. ZeroFox Intelligence has observed that ALPHV has removed the firm from its leak site, which could indicate that ransom negotiations are underway or a payout has been made.
Recommendations:
- Companies facing data-extortion and ransomware attacks are not encouraged to pay the demanded ransom, as there is no guarantee that the cybercriminals will adhere to the terms of the negotiation.
- HWL Ebsworth employees and clients should change their passwords, keep an eye on their credit card statements for any fraudulent transactions, and be wary of phishing attempts, as criminals often attempt follow-on attacks using leaked data.
Anonymous Sudan Claims to Have Disrupted Iron Dome Intercepts
Amidst a rocket attack on Israel from Gaza, self-proclaimed pro-Islam hacktivist group Anonymous Sudan claimed responsibility for hacking the Israeli rocket warning systems that facilitate operations of the Iron Dome missile defense system. The group, which has been observed to be an ally of pro-Russia Killnet, said it took down the websites of four rocket warning services and targeted some of their smartphone apps. Anonymous Sudan claimed to have caused such disruption to the alert systems that the Iron Dome did not get its full alerts, causing it to miss interceptions. The group has claimed responsibility for several other cyberattacks against Israel in recent months as part of operation #OpIsrael.
Recommendations:
- Follow ZeroFox Intelligence to remain updated on latest news and threats related to the digital underground.
- Invest in discovery and recovery capabilities and train personnel to analyze trade offs between the security, operational, and economic costs of pursuing defense strategies.
VULNERABILITIES
- CVE-2023-23920 An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. more
- CVE-2023-29839 A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function. more
- CVE-2022-4129 A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. more
EXPLOITS
- CVE-2017-2921 Cesanta Mongoose Websocket Protocol Packet Length Code Execution Vulnerability more
- CVE-2015-7611 Apache James Server 2.3.2 Insecure User Creation / Arbitrary File Write more
BREACHES
Tags: DIB, tlp:green