zerofox logo
Advisories

ZeroFox Daily Intelligence Brief - May 17, 2023

|by Alpha Team

banner image

ZeroFox Daily Intelligence Brief - May 17, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

  • Google Top Level Domain Already Used in Phishing Attacks
  • Unpatched Wemo Smart Plug Bug Opens Networks to Cyberattacks
  • CISA #StopRansomware Advisory: BianLian Ransomware Group
  • CVE-2023-2706
  • CVE-2021-31439
  • CVE-2022-45188
  • CVE-2012-5930
  • Credit Card Data Breach: 2023-5-16
  • BreachForums/Leakbase: Paid Leaf Data Breach
  • XSS: USA_Gov_Emails Data Leak

Google Top Level Domain Already Used in Phishing Attacks

Google recently launched and made available to the public several Top Level Domains (TLDs), including .zip and .mov, which pose concerns due to their association with common file extensions. Phishing sites on .zip domains can deceive unsuspecting individuals, and some software automatically converts .zip links into clickable URLs. Similar risks apply to .mov domains. However, the overall impact may not be catastrophic, as not all programs automatically convert non-standard TLDs, and security concerns limit widespread adoption.

Unpatched Wemo Smart Plug Bug Opens Networks to Cyberattacks

The Wemo Mini Smart Plug V2, used to remotely control devices via a mobile app, contains a buffer-overflow vulnerability that allows cyber attackers to manipulate devices, perform remote command injection, and potentially access internal networks. Belkin, the device maker, has stated that no firmware update will be provided as the product has reached end-of-life. With potentially hundreds of thousands of these devices still in use, businesses are advised to avoid using them within their networks or ensure that Universal Plug-n-Play ports are not exposed remotely.

CISA #StopRansomware Advisory: BianLian Ransomware Group

A joint advisory has highlighted the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with ransomware developer, deployer, and data-extortion group BianLian. The criminal gang, which has targeted the critical infrastructure sectors in the United States and Australia, gains initial access via compromised Remote Desktop Protocol credentials, likely purchased from initial access brokers or obtained through phishing attacks. The advisory recommends measures that critical infrastructure organizations—as well as small- and medium-sized organizations—can implement to reduce the likelihood and impact of BianLian attacks.

VULNERABILITIES

  • CVE-2023-2706 - The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass.
  • CVE-2021-31439 - This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager.
  • CVE-2022-45188 - Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl file.

EXPLOITS

  • CVE-2012-5930 - Novell NetIQ Privileged User Manager 2.3.1 - 'auth.dll' pa_modify_accounts() Remote Code Execution

BREACHES

Tags: DIB, tlp:green