zerofox logo
Advisories

ZeroFox Daily Intelligence Brief - May 9, 2023

|by Alpha Team

banner image

ZeroFox Daily Intelligence Brief - May 9, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Brief Highlights

  • QR Codes Present a New Way to Swindle
  • Over One Million Patients’ Personal Data Compromised in NextGen Data Breach
  • MSI Warns Users of Firmware Integrity Risk After Ransomware Attack
  • CVE-2020-26298
  • CVE-2022-28888
  • CVE-2023-27568
  • CVE-2018-10088
  • CVE-2014-4943
  • BreachForums: 4.4M_USA Combolist

QR Codes Present a New Way to Swindle

Scammers have been increasingly exploiting QR codes to steal money from unsuspecting victims. In the United States, scammers are leaving fake QR parking tickets on drivers' windshields that redirect to malicious phishing websites designed to look like official government sites; in the United Kingdom, QR codes are being disguised as "quick pay" parking meter option. Victims are having their personal information and payment credentials stolen when they use these codes to pay for parking or tickets. Meanwhile in Singapore, a woman at a bubble tea shop lost USD 20,000 after scanning a QR code to fill out a “survey.” QR scams are becoming more insidious as scammers use various innovative tactics to lure their victims. Users should be cautious when scanning QR codes and verify their legitimacy before proceeding.

Over One Million Patients’ Personal Data Compromised in NextGen Data Breach

NextGen Healthcare, a U.S.-based electronic health record (EHR) software provider, has confirmed a data breach that affected 1.05 million patients. The breach compromised personal information, including patient names, dates of birth, addresses, and Social Security numbers. The company identified suspicious activity occurring on its network between March 29 and April 14, 2023, and determined that hackers had gained access to a cloud-based EHR and practice management solution (“NextGen Office”) using stolen client credentials. The company notified impacted patients on April 28, 2023, and has offered them 24 months of free fraud detection and identity theft protection. Affected patients should be wary of follow-on phishing attacks disguised as communication from NextGen seeking more confidential data.

MSI Warns Users of Firmware Integrity Risk After Ransomware Attack

In April 2023, Taiwan-based computer hardware manufacturer MSI fell victim to a ransomware attack that led to the company's private code signing keys being leaked on the dark web. The breach package reportedly includes firmware image signing keys associated with 57 PCs and private signing keys for Intel Boot Guard used on 116 MSI products. This development poses a significant risk to firmware integrity checks, allowing threat actors to sign and deploy malicious updates and payloads without raising red flags. MSI has urged users to obtain firmware/BIOS updates only from its official website.

VULNERABILITIES

  • CVE-2020-26298 Redcarpet is a Ruby library for Markdown processing
  • CVE-2022-28888 Spryker Commerce OS 1.4.2 allows Remote Command Execution
  • CVE-2023-27568 SQL injection vulnerability inSpryker Commerce OS 0.9 that allows for access to sensitive data via customer/order

EXPLOITS

BREACHES

Tags: DIB, tlp:green