zerofox logo
Advisories

ZeroFox Daily Intelligence Brief - May 16, 2023

|by Alpha Team

banner image

ZeroFox Daily Intelligence Brief - May 16, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with to give you and your clients an advantage over the adversary.

Brief Highlights

  • The Philadelphia Inquirer Scrambling to Resume Normal Operations After Attack
  • PharMerica Leaks Nearly Six Million Deceased Users' Private Data
  • Stealthy Merdoor Malware Uncovered After Five Years of Attacks
  • CVE-2023-32233
  • CVE-2023-32309
  • CVE-2023-32308
  • CVE-2014-9322
  • Credit Card Data Breach: 2023-5-15

The Philadelphia Inquirer Scrambling to Resume Normal Operations After Attack

A cyberattack has disrupted operations of The Philadelphia Inquirer, one of the oldest, continuously-operating daily newspapers in the United States. The identity of the attackers and the scope of the attack have not been disclosed as of the time of writing.The attack has forced the company to close the newsroom temporarily, affecting publication of the print version of the newspaper. Even the online version, inquirer[.]com, has reportedly faced delays in posting and publishing.

PharMerica Leaks Nearly Six Million Deceased Users' Private Data

PharMerica Healthcare has disclosed a March 2023 breach wherein an unauthorized party accessed its systems, exposing personal information such as names, addresses, Social Security numbers, medication details, and health insurance information of over 5.8 million deceased individuals, which could be used for identity theft and medical benefits fraud. PharMerica has reportedly reviewed the incident and taken steps to enhance its security measures. ZeroFox Intelligence notes that the Money Message ransomware group named PharMerica as a victim on its leak site in late March 2023 and provided download links to access some of the stolen data.

Stealthy Merdoor Malware Uncovered After Five Years of Attacks

A new advanced persistent threat (APT) group dubbed Lancefly has been using a backdoor malware called "Merdoor" since 2018 to target government, aviation, and telecommunication organizations in South and Southeast Asia. The group focuses on extended cyber espionage to gather intelligence from its victims’ networks. The ZXShell rootkit used in the attacks loosely links Lancefly to other Chinese APT groups (such as APT17 and APT41). However, the link is weak due to the rootkit's source code being publicly available for years. It is unclear if this is intentional misdirection to complicate attribution.

VULNERABILITIES

  • CVE-2023-32233 In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory.
  • CVE-2023-32309 In affected versions an arbitrary file read is possible when using include file syntax.
  • CVE-2023-32308 Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781.

EXPLOITS

  • CVE-2014-9322 Linux Kernel 3.17.5 - IRET Instruction #SS Fault Handling Crash (PoC)

BREACHES

Tags: DIB, tlp:green