zerofox logo
Advisories

ZeroFox Daily Intelligence Brief - May 18, 2023

|by Alpha Team

banner image

ZeroFox Daily Intelligence Brief - May 18, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Brief Highlights

  • ZeroFox Intelligence Event Assessment: G7 Summit
  • Cisco Discloses Critical Bugs in Small Business Series Switches
  • Lemon Cybercrime Group Pre-Installs Malware on Android Phones to Finance Enterprise Activities
  • CVE-2023-2726
  • CVE-2023-20106
  • CVE-2023-26964
  • CVE-2013-0008
  • BreachForums: 500K_Email_Pass Combolist
  • BreachForums: CoinDesk Data Breach
  • Credit Card Data Breach: 2023-5-17

ZeroFox Intelligence Event Assessment: G7 Summit

ZeroFox is tracking developments around the upcoming G7 Summit set to commence in Hiroshima, Japan, on May 19, 2023. While Japan is one of the safest countries, there have been recent attacks on politicians, and a former prime minister was assassinated at a 2022 campaign rally. Moreover, advancements in drone technology have enabled scenarios in which remote drones can carry explosives to isolated locations, necessitating new vectors of vigilance. The number of cybercrimes uncovered in Japan hit a record high in 2022, with a notable growth in ransomware attacks. Because the Russia-Ukraine conflict will be a central topic of discussion, cyberattacks by pro-Russian hacktivists are also expected.

Cisco Discloses Critical Bugs in Small Business Series Switches

Cisco has disclosed four critical vulnerabilities (CVE-2023-20159, CVE-2023-20160, CVE-2023-20161, and CVE-2023-20189) in the web-based user interface of certain Cisco Small Business Series Switches. These vulnerabilities could enable an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on affected devices. The vulnerabilities stem from the inadequate validation of requests sent to the web interface. Cisco has released software updates to address these issues, but no patches are available for Cisco Small Business 200, 300, and 500 Series Smart Switches as they have reached end-of-life.

Lemon Cybercrime Group Pre-Installs Malware on Android Phones to Finance Enterprise Activities

Millions of Android users unknowingly aid the financial success of threat actor Lemon Group by owning devices pre-loaded with malware. The devices typically get tampered with when original equipment manufacturers (OEMs) outsource the addition of features to third-party vendors or during firmware over-the-air (FOTA) updates, allowing the criminal group to steal and sell SMS messages and OTPs, display unwanted ads, create online accounts, and more. Lemon Group has reportedly infected nearly nine million Android devices worldwide, with Asia accounting for over half the affected devices. This growing problem affects not only Android phones but also Android Smart TVs, set-top boxes, entertainment systems, and children's watches.

VULNERABILITIES

  • CVE-2023-2726 - Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious web app to bypass install dialog via a crafted HTML page.
  • CVE-2023-20106 - Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system.
  • CVE-2023-26964 - An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames.

EXPLOITS

  • CVE-2013-0008 - MS13-005 HWND_BROADCAST Low to Medium Integrity Privilege Escalation

BREACHES

Tags: DIB, tlp:green