zerofox logo
Advisories

ZeroFox Daily Intelligence Brief - May 12, 2023

|by Alpha Team

banner image

ZeroFox Daily Intelligence Brief - May 12, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Brief Highlights

  • Automation Firm Falls Victim to Black Basta
  • ALPHV Claims Access to Confidential Data in Several Fortune 500 Companies
  • Brightly Warns of SchoolDude Data Breach Exposing Credentials
  • CVE-2023-2590
  • CVE-2023-23863
  • CVE-2023-23793
  • CVE-2007-2356
  • CVE-2019-10719
  • CVE-2018-8120
  • Credit Card Data Breach: 2023-5-11
  • 387 Botnet Breach (45,931 Records)
  • @cloudlogss (158-161) Botnet Breach

Automation Firm Falls Victim to Black Basta

ABB, a Swiss multinational company working with electrification and automation technology, has suffered a Black Basta ransomware attack. The attack targeted ABB's Windows Active Directory and disrupted the company's operations, delaying projects and impacting its factories. The company has terminated its customer VPN connections to prevent the ransomware's spread to other networks. ZeroFox Intelligence notes that the group accounted for the third-highest number of ransomware incidents among the notable strains from April 2022 (when Black Basta launched its Ransomware-as-a-Service operation) to January 2023, targeting over 150 organizations globally across multiple industries—particularly the manufacturing, retail, and construction industries.

ALPHV Claims Access to Confidential Data in Several Fortune 500 Companies

The Russia-linked ALPHV ransomware group has claimed to have gained initial access to several Fortune 500 companies after stealing credentials from outsourcing company ResultsCX. The group has allegedly “put a lock on” over 60 ESXi environments in one victim company and indicated that it would disrupt operations of other dependent organizations, especially those within the American healthcare industry. The ALPHV group is notoriously callous, even among ransomware groups; while some groups refrain from attacking educational institutes or hospitals, ALPHV—in a bid to extract its ransom without delay—leaked unclothed photographs of female cancer patients after attacking a healthcare center in March this year.

Brightly Warns of SchoolDude Data Breach Exposing Credentials

Brightly Software, a U.S. tech company and Siemens subsidiary, has notified users of a data breach after hackers gained access to the database of its SchoolDude online platform. The SchoolDude platform is used by over 7,000 colleges, universities, and K-12 schools from districts with up to 600,000 students. The breach may have exposed account information, including names, emails, passwords, phone numbers, and school district names. Brightly reset all SchoolDude passwords and advised users to choose new ones and not reuse passwords on other accounts. The company reported the incident to law enforcement and has hired third-party security experts to investigate.

VULNERABILITIES

  • CVE-2023-2590: Missing Authorization in GitHub repository answerdev/answer prior to 1.0.9.
  • CVE-2023-23863: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Black and White Digital Ltd TreePress – Easy Family Trees & Ancestor Profiles plugin <= 2.0.22 versions
  • CVE-2023-23793: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eightweb Interactive Read More Without Refresh plugin <= 3.1 versions.

EXPLOITS

  • CVE-2007-2356 GIMP 2.2.14 (Windows x86) - '.ras' Download/Execute Buffer Overflow
  • CVE-2019-10719 BlogEngine.NET 3.3.6 / 3.3.7 dirPath Directory Traversal / Remote Code Execution
  • CVE-2018-8120 Microsoft Windows SetImeInfoEx Win32k NULL Pointer Dereference

BREACHES

Tags: DIB, tlp:green