zerofox logo
Advisories

ZeroFox Daily Intelligence Brief - October 19, 2023

|by Alpha Team

banner image

ZeroFox Daily Intelligence Brief - October 19, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

  • Navigating the Mis- and Disinformation Minefield in the Current Israel-Hamas War
  • Russia and China-Backed Hackers Exploiting WinRAR Zero-Day Bug
  • Israel-Hamas War Monitoring: October 18, 2023 (ZeroFox Situation Report)
  • Data broker / initial-access broker / hacktivist group: Team One Piece and Soldiers Of Solomon
  • Vulnerabilities: CVE-2019-9514 and CVE-2023-37503
  • Exploits: CVE-2023-0297 and CVE-2023-3640
  • Data Breach: BreachForums: Breeze Systems Forum Data Breach and BreachForums: Fuerteadventure Excursions Data Breach

Navigating the Mis- and Disinformation Minefield in the Current Israel-Hamas War

The proliferation of mis- and disinformation adds another layer of complexity to an already sensitive issue. ZeroFox Intelligence has detailed how an information war is raging on online platforms amidst the Israel-Hamas war. While the frontline is amorphous, the impact is deeply consequential. The advisory elaborates the recurring themes of mis/disinformation in the current situation and highlights some prominent examples. ZeroFox recommends exercising skepticism and verifying information through official channels before accepting it as truth.

Russia and China-Backed Hackers Exploiting WinRAR Zero-Day Bug

Researchers have uncovered evidence of state-backed hackers from Russia and China exploiting a recently patched WinRAR vulnerability (CVE-2023-38831). The vulnerability allowed attackers to conceal malicious scripts in seemingly harmless archive files. Despite the fix in WinRAR version 6.23, multiple state-sponsored hacking groups, including Sandworm and Fancy Bear, continue to exploit the flaw. Researchers have emphasized that slow patching rates make known vulnerabilities highly effective for attackers, stressing the need for timely updates.

Israel-Hamas War Monitoring: October 18, 2023 (ZeroFox Situation Report)

An explosion at Gaza's al-Ahli Baptist Hospital raised tensions in the region and triggered protests around the world, several of which escalated to violence. The cause of the explosion was highly disputed; while initial media (and Hamas) reports stated an Israeli airstrike was to blame, the Israeli government has asserted that the explosion was caused by a misfired “Islamic Jihad” rocket. The U.S. State Department has raised the travel advisory for Lebanon to Level 4 (the highest level), urging people not to travel to the country. Also, Jordan has canceled a planned October 18 peace summit between U.S. President Joe Biden and Arab leaders in Amman.

THREAT ACTIVITY: INITIAL-ACCESS BROKERS, DATA BROKERS, AND HACKTIVISTS

  • Team One Piece:: IBM has reportedly found no evidence to support the pro-Palestinian group’s claim of breaching IBM Israel and stealing data, including ciphers for the Iron Dome.
  • Soldiers Of Solomon:: Claims to have taken control of more than 50 servers, security cameras, and smart-city management system in Nevatim military area; exfiltrated 25 GB data; and deployed Crucio ransomware

VULNERABILITIES

  • CVE-2019-9514:: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
  • CVE-2023-37503:: HCL Compass is vulnerable to insecure password requirements.

EXPLOITS

BREACHES

Tags: DIB, tlp:green