Monthly threat updates fromF-Secure
December 2022

Discover the latest
threat updates. Packedwith insights from theexperts at F-Secure.
Delivered every month.
In this year-end edition of F-Alert, we review thelatest cyber security threats and data breaches fromDecember. Discover how cyber criminals see new
Artificial Intelligence tools. Find out why our data is
worth billions on dark web marketplaces. And learn
how the month's biggest breaches might affect you
and your data.

Monthly threat report from F-Secure | December 2022

2New bot previews AI risks
Laura Kankaala
Threat Intelligence
LeadA remarkable new chatbot from OpenAI could foreshadow how
cyber criminals can weaponize artificial intelligence in the future.

Helsinki, Finland

expert tip
As always, be on the lookout for scams. No matter
what's the context or how well the scam messages
have been written, criminals want you to act. Don’t
give out your credentials, install malware or transfer
money or cryptocurrency to suspicious destinations.

More than a million people havealready sampled the power of acomputer delivering intelligent,crafted human-like text at incredible
speeds thanks to a new chatbot
released in early December by theresearch laboratory OpenAI.
With the increasing prevalence ofAI, concerns about robots taking ourjobs—or just taking over—continue
to gain momentum. But the reality ismore prosaic, as AI is already being
used in multiple ways, affecting manyof our digital moments.

“When it comes to cyber crime,
the benefits of AI have not yet
been realized.”“Moderation of our social media feeds
and our recommendations for music
and shopping are already leveragingAI,” said Laura Kankaala, F-Secure’s
Threat Intelligence Lead.” Even
industrial optimizations are alreadyleveraging the technology.”

AI and cyber crime
ChatGPT has already been used for avariety of impressive tasks, including
personalized education, drafting
newspaper articles, and writing
computer code. And the questionof whether it could be employed bycyber criminals is attracting moreinterest.
“When it comes to cyber crime, thebenefits of AI have not yet beenrealized,” Kankaala said. “But thatcould change with the availabilityof models like ChatGPT, which isquite good at generating text andparticipating in conversations.”

AI is everywhere
Fully automated attacks generated
by ChatGPT are not yet feasible. But,
as with other emerging technologies,
Kankaala only sees it as a matter oftime before cyber criminals get on theAI bandwagon.
“We know that an easy-to-use toolthat automates scams and phishingemails are bound to appear,”Kankaala said. “Because it’s too goodof an opportunity to pass up.” But for
now, the overall ‘killchain,’ or how
the attack plays out, will not change.
“The scams may look fancier, but —fortunately—defending against thesethreats is nothing new,” Kankaalaconcludes.
3

Good apps glued to badDark web service hides infostealers in real apps to infectAndroid or Windows users.

Amit Tambe
Researcher
Helsinki, Finland

A new cyber crime campaign,identified as Zombinder, attaches
malware to legitimate Android apps
to entice victims into installing themalicious payload on their devices orPCs. According to reports, security
analysts found the platform on thedarknet during investigations into acampaign promoting different typesof malware that focused on Androidand Windows users.

Who can resist ‘free’?
Zombinder, a dark web
service, takes advantageof this simple psychology
by offering lures suchas “free” Wi-Fi, video
downloads, orsports streaming
services.

“The temptation of ‘free stuff’ isirresistible for many internet users.
Especially those in search of a Wi-Fi
connection,” said Amit Tambe, a
researcher at F-Secure. “And thethreat actors take the con one stepfurther, they actually deliver thepromised functionality,” Tambe
added. “However, the real app comeswith a malicious app ‘glued’ to it byZombinder.”During installation, theuser is presented with aprompt for a plugin, which
installs an infostealer in thebackground.

Crossing apps andplatforms
This campaign’s marketing
also seeks to make thecorrupted apps appeal to thelargest possible audience. And thishas helped the campaign infectthousands of users with a variety ofstealers since the binding technique
first appeared in March 2022.
“Some of the malicious sites fromthe campaign offer the option to
download the apps on either Androidor Windows platforms,” Tambe said.
“This sort of malware targets victims’
personal information and accounts. It
could go after cryptocurrency wallets,
emails from the Gmail app, or even
two-factor authentication codes.”expert tip
The Internet is filled with cracked software, modded
APKs, and application hacks. Often, these sorts ofriskware are fake and may contain malicious trojans
or malware that will infect your computer. Always
download from trusted websites and avoid shadywebsites.

“The threat actors take the con one
step further, they actually deliver
the promised functionality.”

Breach reports
Bookcrossing

Football Guys

Cointracker

Washington State Food Worker
CourseDiscovered: 10/11/2022

Discovered: 1/12/2022

Discovered: 15/12/2022

Discovered: 15/12/2022

Affected people:
Nearly 1.9 million

Affected people:
More than 500,000

Affected people:
More than 1.5 million

Affected people:
Nearly 1.9 million

Breach severity:

Breach severity:

Breach severity:

Breach severity:

Data from Bookcrossing, an online bookclub, was leaked to a hacker forum. The
data being privately shared on the internet
contains IPs, passwords, usernames,
email addresses and additional personallyidentifiable information. Breaches likethis fuel criminals’ attempts to carry out
automated account takeovers. Affected
users should change any account thatuses the password, or any variation of thepassword used for this site.

Data from this U.S. fantasy football site
was leaked on a hacker site. While thisdataset only includes usernames andpasswords, it is still useful to criminals
due to password reuse. If Internet users
used strong, unique credentials for all
their accounts, this would eliminate
countless acts of cyber crime.

In November 2022, data belonging tothis cryptocurrency tax and portfolio
management software service wasleaked on a hacking forum. Affected
users, and all consumers who have had
their financial data leaked, should contact
their financial institutions to check for
fraudulent transactions and monitor theircredit report continuously.

User data leaked from this virtual
education platform includes names,
email addresses, passwords, phone
numbers, and driver’s license numbers.
While this breached data will typicallyresult in account takeover attempts orspearphishing attacks, affected users
should also be mindful of the risks thatcome from exposed driver’s license
numbers, which can be used to apply forother services and are extremely difficult,if not impossible, to replace.

Want to know if you were affected by any of these breaches?
Check out our F-Secure Identity Theft Checker!
Monthly threat report from F-Secure | December 2022

5

Dark web marketplaces thrive
Joel Latto
Threat Advisor

New research explains how criminals make big bucks sellingstolen data with little fear of the law.

Helsinki, Finland

expert tip
Time between initial data breach and criminals
abusing stolen data seems to be shortening. That’s
why you need a service like F-Secure ID PROTECTION
to scour through dark web marketplaces and alert you
as soon as your data shows up there. Then you cantake steps to secure your data immediately.

New research has found that dark
web marketplaces raked in morethan $140 million in just eight months,
selling stolen data across a “highlyconnected” ecosystem.

Where stolen data goes
The study outlines the “supply chain”
that keeps dark web marketplaces
stocked with an abundance of
personally identifiable information.
“We all hear about breaches leading
to data being stolen from corporate
servers,” said Joel Latto, F-Secure“The revenue of the top
marketplaces is comparable to thosefrom midsize American companies.”

Threat Advisor. “But we rarely hear
about what happens to your data
next.”

vendors appearing on multiple
marketplaces.

Breached files are given to brokers tosell in dark web marketplaces. Other
criminals buy the data for fraudulent
credit card transactions, identity theft,and phishing attacks.

“Buyers and sellers all use cloaking
software like Tor to reach themarketplaces,” he said. “In addition,these sites use authorization codes
to try to vet buyers and only takecryptocurrency.”“The revenue of the top marketplaces
is comparable to those from midsize
American companies, many of whichhave valuations of billions of dollars,”said Latto. “Remember that next time
you think your data has no value.”

Since identifying these criminals andshutting down these marketplaces is
so difficult, the researchers suggest
making stolen data worthless bymaking it extremely difficult tocommit fraud.

Beyond the law’s grasp
In the eight months studied, over
2,000 vendors registered morethan 600,000 sales across 30
marketplaces, with many of the“Their idea is to use artificial
intelligence to provide law
enforcement with the tools to prevent
identity crimes—but at this point,that’s just science fiction.”

6

Scammers exploit TikTok trend
Cyber criminals used the titillation of a TikTok challenge to spreadmalware that steals credentials, crypto, and credit cards.

Yik HanResearcherPuchong, Malaysia

TikTok users were tricked into
installing malware by the false
promise of a tool that would reveal
nude bodies blurred for the app’s
popular “invisible challenge.”

Down the rabbit hole
TikTok users participate in thischallenge, which began
in April 2020, by filming
themselves undressed
and applying a filter thatblends their silhouettes
into a neutral backgroundfor an “invisible” effect.
And the initial ‘lure’
was a TikTokpost promisingfilter removal.
“Cyber criminals
weaponized users’

curiosity to create a multi-layer social
engineering scam that led victims
to infecting their own devices,”
explained Yik Han, a researcher atF-Secure. “The victim was told to joina Discord server, where they received
a message from a bot pointing themto GitHub for the download along with
instructions in a YouTube video.”

their respective platforms, the TikTokvideos racked up more than 1 million
views, more than 35,000 people
have joined the Discord server, theGitHub repository has 103 stars, andthe YouTube video was viewed 2,000
times. And this scam shows how
social media can be weaponized tofool users into making bad decisions.

But once installed, the tool does
not remove any filter.

“The criminals used multiple tricks tomake their GitHub repository seem
legitimate,” Han said. “These bignumbers made it hard for a user torealize that each element was part ofa trap to spread malware.”“However, the executed
malware will steal personal
files—Including Discordcredentials, crypto walletpasswords, and credit
card details.”

Seems legit
Before all the content
was removed fromexpert tip
Don’t be fooled by big numbers on social media. Cybercriminals are figuring out how to game platforms tobuild up the views, likes, and shares that make theircontent seem credible. Always research an app when
you download with a search and look through thereviews.

“Cyber criminals weaponizedusers’ curiosity ... that led victims toinfecting their own devices.”About F-Secure
F-Secure makes every digital moment more secure, for everyone.
We deliver brilliantly simple, frictionless security experiences thatmake life easier for the tens of millions of people we protect andour 170 partners.
For more than 30 years, we’ve led the cyber security industry,
inspired by a pioneering spirit born out of a shared commitment to
do better by working together.
For more information visit F-Secure today!