zerofox logo
Advisories

ZeroFox Daily Intelligence Brief - May 5, 2023

|by Alpha Team

banner image

ZeroFox Daily Intelligence Brief - May 5, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Brief Highlights

  • ZeroFox Intelligence Advisory: Vulnerabilities Exploitation and Ransomware Threats Likely Increased Against the Financial Sector in Q1
  • Russian Hackers Linked to Sandstorm Group Wipe Ukrainian State Agency’s Data
  • CISA’s New Draft Attestation Form Sparks Several Concerns from Experts
  • Cisco Warns Users Against Critical Vulnerability, Advises to Eliminate SPA 112 2-Port Phone Adapter from Work Environments
  • CVE-2023-2468
  • CVE-2023-2467
  • CVE-2023-2464
  • CVE-2010-0359
  • CVE-2016-4264
  • Telegram: @cloudlogss (170-179) Botnet Breach (441,422 Records) Email address and password
  • Credit Card Data Breach: 2023-5-4
  • Telegram: Архив WinRAR (0-10) Botnet Breach (107,452 Records)) Email address and password

ZeroFox Intelligence Advisory: Vulnerabilities Exploitation and Ransomware Threats Likely Increased Against the Financial Sector in Q1

ZeroFox Intelligence has released its Q1 2023 Quarterly Threat Landscape Report for the Financial Sector, which focuses on risks and threats to the industry observed over the past quarter. Vulnerabilities and exploits, as well as ransomware, maintain the highest risk to financial services organizations, particularly as the Clop ransomware gang has been successfully leveraging the zero-day exploit in GoAnywhere MFT file transfer software. ZeroFox Intelligence anticipates that the threat from ransomware and digital extortion operations may fall in Q2 2023 but will likely remain above 2022 levels as threat actors are galvanized by recent successes. ZeroFox Intelligence anticipates an increase in low-sophistication social engineering campaigns leveraging financial market instability to steal money and account data, conduct business email compromise attacks, or infect targets with malware, as well as a sustained high threat from smishing and vishing campaigns.

Russian Hackers Linked to Sandstorm Group Wipe Ukrainian State Agency’s Data

The Ukrainian Computer Emergency Response Team (CERT-UA) has disclosed that the Russia-based Sandworm group was responsible for an attack on Ukrainian state networks that abused WinRar to delete data on government devices. Sandworm gained entry to critical systems by compromising VPN accounts. The malware used the "RoarBat" script to search and archive files and then deleted them with the WinRar "-df" option. On Linux machines, it used a Bash script with the "dd" utility to erase file contents. The attack was facilitated by the lack of multi-factor authentication to secure VPN connections and the absence of network segmentation and filtering.

Recommendations:

  • Organizations should implement multi-factor authentication when providing remote access to VPN and/or corporate services such as e-mail and document management.
  • Ensure a secure environment by regularly securing and analyzing the external VPN perimeter by eliminating vulnerabilities, disabling unnecessary services, limiting access to management interfaces, and implementing strict network filtering measures for the incoming, outgoing, and inter-segment flow of information.

CISA’s New Draft Attestation Form Sparks Several Concerns from Experts

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently released a draft “self-attestation” form for vendors, a significant step forward in the government’s secure software development initiative. While experts and industry representatives believe that the practices outlined in the draft form are important in securing federal software, they have raised concerns about the document as well. Additionally, there are broader concerns about how agencies will collect and use the data included in the forms and the factors that would allow agencies to request additional information. The agency is accepting feedback on the form until June 26, 2023.

Recommendations:

  • Impacted parties should submit their feedback on the document before the June 26 deadline to ensure that CISA has adequate time to address their concerns and facilitate the formation of a more effective process to secure federal software.
  • Follow ZeroFox Intelligence to remain updated on CISA’s progress around the development of this form.

Cisco Warns Users Against Critical Vulnerability, Advises to Eliminate SPA 112 2-Port Phone Adapter from Work Environments

Cisco warned users about a critical remote code execution vulnerability (CVE-2023-20126; CVSS score: 9.8) affecting SPA 112 2-Port phone adapters, which have reached end-of-life (EOL). An attacker can exploit this vulnerability by upgrading an affected device to a crafted version of firmware, and a successful exploit can allow the attacker to execute arbitrary code on the affected device with full privileges. These phone adapters are popular for incorporating analog phones into VoIP networks without upgrading. There has been no security update or mitigation for this vulnerability since the devices reached EOL.

Recommendations:

  • Users are advised to migrate to Cisco ATA 190 Series Analog Telephone Adapter, which has a designated end-of-life date on March 31, 2024.
  • Organizations should consider eliminating the SPA112 2-Port phone adapters from their environment as soon as possible to secure their operational environments.

VULNERABILITIES

  • CVE-2023-2468 Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who had compromised the renderer process to obfuscate the security UI via a crafted HTML page.
  • CVE-2023-2467 Inappropriate implementation in Prompts in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to bypass permissions restrictions via a crafted HTML page.
  • CVE-2023-2464 Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to perform an origin spoof in the security UI via a crafted HTML page.

EXPLOITS

  • CVE-2010-0359 Zeus Web Server 4.x - 'SSL2_CLIENT_HELLO' Remote Buffer Overflow (PoC)
  • CVE-2016-4264 Adobe ColdFusion < 11 Update 10 - XML External Entity Injection

BREACHES

Tags: DIB, tlp:green