Cyber Security Reports
2023.01

NTT Security Japan Inc.
OSINT Monitoring Team, Consulting Services Department

Information Asset Classiﬁcation: Public© NTT Security Holdings 13 February 2023

1

Content
1.
1.1.
1.2.
1.3.
1.4.
2.
2.1.
2.2.
2.3.
2.4.
2.5.
2.6.
3.
3.1.
3.2.
3.3.
3.4.

Unauthorized access to password management services.......................................................... 4
A spate of security incidents involving password management services.................................. 4
What is a password management service?................................................................................... 4
Case Summary.................................................................................................................................5
Summary.......................................................................................................................................... 5
Leveraging ChatGPT and Cyber Attacks........................................................................................ 6
Overview...........................................................................................................................................6
What is ChatGPT?............................................................................................................................7
The supposed abuse of ChatGPT in cyberattacks........................................................................ 7
The search for the use of cyberattacks......................................................................................... 8
Use for security measures.............................................................................................................. 10
Summary.......................................................................................................................................... 11
Ransomware attack on Royal Mail................................................................................................ 12
Overview.......................................................................................................................................... 12
Ransomware attack wreaks havoc in the UK................................................................................ 12
LockBit’s involvement in the attack............................................................................................... 13
Summary.......................................................................................................................................... 15
Sources............................................................................................................................................ 16

Cyber Security Reports 2023.01

2

About this report
This report selects and summarizes 3 topics that are considered to be especially importantamongst information security incidents and events that occurred during January 2023 andchanges in the surrounding environment. These topics can be summarized as follows.

CHAPTER 1

Unauthorized access to password management services• On January 9, it was discovered that Gen Digital’s password management service may have been compromisedin a list-based attack on Norton user accounts. On December 22, 2022, LastPass also disclosed that personal
information and credentials may have been compromised in its password management service.
• While using a password management service is convenient because it prevents users from setting a simple
password or setting a single password across multiple services, it also requires users to use services whichhave a strong security posture.
• Having a unique authentication system for each site and service creates a password management problem.
We need to eliminate the password-dependent authentication problem across the industry by promoting identity
federation, which permits the use of a single, strongly protected, identity across multiple platforms or services

CHAPTER 2

Leveraging ChatGPT and Cyber Attacks• ChatGPT, a generative AI that OpenAI released to the public at the end of 2022, is getting a lot of attention.
There are also concerns about its use in cyberattacks because it provides accurate responses to a varietyof genre topics.
• Experiments by security researchers have demonstrated that it can create email text and attachmentsfor phishing attacks, and attackers are also exploring its use for malware development and other purposes.
• The use of interactive AI is being examined not only for cyberattacks but also for defense. It has thepotential to change cybersecurity in the future, both offensively and defensively.

CHAPTER 3‘Ransomware attack on Royal Mail’• Royal Mail, Britain’s largest postal service, has been hit by an attack from the LockBit ransomware groupthat has halted international shipments of letters and packages for a week.
• The attack did not fall under the rules of the LockBit group, which prohibits attacks on power plants,
pipelines, public schools and hospitals. In the past, the group has apologized and provided decryption keys
when it attacked prohibited targets.
• If an organization is attacked by LockBit and is classed as a “prohibited target”, it could negotiate for theprovision of decryption keys.

3

1. Unauthorized access to password
management services
1.1.

A spate of security incidents involving password management services

A spate of security incidents has occurred involving password management services.
On January 9, Gen Digital, the company best known for its Norton security brand, announced
that starting around December 1, 2022, list-based attacks were launched against its user
accounts, potentially stealing the personal information of logged-in users. [*]1 In addition,
users of the company’s password management service may have been able to access otherservices’ IDs, passwords and other credentials stored in the service.
Elsewhere, on December 22, 2022, LastPass disclosed that its password management
service may have exposed users’ personal information, encrypted passwords and other data in
an unauthorized access that began in August. [*]2

1.2.

What is a password management service?

A password management service provides functions such as encrypting passwords,
storing them together in a secure state, and automatically entering them when logging in.
[*]3 Many of them are available not only as extensions to PC software and browsers, but also asapps for smartphones, allowing users to manage passwords for a variety of services all at once.
Whether they have more ID and password credentials or complicated passwords for eachservice, users only need to remember the master password needed to use the password
management service. As a result, you can avoid setting a simple password or setting a single
password on multiple services.

Vault of saved
passwords

Figure 1 Schematic diagram of a password management service

1.3.

Summary of the incident

NortonStarting around December 1, 2022, attackers were attempting to log into Norton’s user
accounts using lists of usernames and passwords apparently obtained from the dark web andCyber Security Reports 2023.01

4elsewhere. [*]4 This appears to have been a list-type attack aimed at users who are reusing
passwords. On December 12, Norton (Gen Digital) launched an investigation after detecting
an unusually large number of failed login attempts. By December 22, users’ accounts wereconfirmed to have been compromised, although no damage was done to Norton’s systems.
Users using a password manager operated by the company may have also had access topasswords stored in the password manager if they had a master password that was the sameas Norton’s account. Norton asked the affected customers to change the passwords of all
accounts stored in the password manager and use multi-factor authentication. [*]5

LastPass
In August 2022, unauthorized access to LastPass, which has more than 30 million users
worldwide, led to the takeover of one of the developer’s accounts and the theft of some sourcecode and technical information from the company’s password manager. At the time, thecompany announced that no customer data or stored credentials had been accessed. [*]6
But in November, an investigation began after an anomaly was detected in the cloud storage
the company was using. It was found that someone had used information stolen in August
to access customer information This was announced by LastPass on the 30th of the samemonth. [*]7 In addition, on December 22, the company updated its customer notification page
to announce that after the attacks in February and August, another employee’s account had
also been hijacked. Credentials and keys that could decrypt data and parts of the cloud storage
used for backup of production and other purposes had been stolen. [*]8In the initial response, experts blamed LastPass for its poor handling of the situation and its
security systems, including the fact that the company failed to prevent the November attacks
because it underestimated the risk resulting from the August breach. This lapse on the part ofLastpass ultimately resulted in increased damage. [*]9Using this backup data, the attackers may have obtained the username, address, phone
number, email address and other credentials that were encrypted with the master password ofeach individual user.
Since LastPass itself does not store the user’s master password, an attacker would have tosomehow obtain the master password separately or attempt a brute-force attack to decrypt
this data. Since the attackers gained access to the user’s contact and personal information
mentioned above, LastPass warned that phishing and social engineering could be used against
the user in the future to obtain the master password.

1.4.

Summary

Passwords can be hard for humans to remember if they are long and complicated to makethem more secure, and they can actually induce password reuse. Password management
services are a handy way to manage long and complex passwords. On the other hand, users
need to use and select services which have a strong security track record.
Having a unique authentication system for each site and service creates password
management problems. We need to eliminate password-dependent authentication problems
across the industry by promoting identity federation, which links identities.

52. Leveraging ChatGPT and Cyber Attacks
2.1.

Overview

At the end of 2022, OpenAI released its ChatGPT generative AI technology to the public.
ChatGPT’s ability to provide credible answers to a variety of genre topics has attracted
considerable attention since its release, and big tech companies such as Google are also
opening up their interactive AI services.
There are concerns that ChatGPT could be exploited in cyberattacks. Experiments haveshown that it can generate phishing emails comparable to those used in actual attacks. In
addition, attackers are beginning to explore techniques like generating malware source codeusing ChatGPT. Meanwhile, research has begun to see if generative AI can be used for defense
as well as cyberattacks.

Cyber Security Reports 2023.01

6

2.2.

What is ChatGPT?

ChatGPT is an interactive AI released by OpenAI. [*]10 When you ask a question in natural
language (human speech) on a chat screen, it generates a sentence that feels as if a human
has answered it, without feeling uncomfortable. [*]11“GPT” stands for Generative Pre-trained Transformer, a model of AI that can automaticallygenerate answers through massive data learning. ChatGPT is powered by GPT-3.5, an AI model
developed by OpenAI. ChatGPT is optimized for interaction by training with vast amountsof data collected from the Internet, plus human-to-human reinforcement learning. [*]12
The AI model is employed and trained to deliver non-straightforward interactions, such as being
able to answer questions in a flow of interaction “If you ask a question with a false premise,
you raise an objection before you answer it” and refusing to answer inappropriate questions.
However, while it can generate sentences from the data of the associations of things, it is notcapable of judging the validity of the answers themselves. Since it often generates incorrect
answers, the adoption of the results requires human judgment. [*]13
Soon after its public launch at the end of November 2022, ChatGPT made headlines for its
accurate answers to a variety of genres of questions, including philosophical questions andcollege-level reports. When a professor at a U.S. university conducted an experiment in which
it was asked to answer a mock final exam for a masters degree in business administration(MBA), it was confirmed that the response achieved a passing mark. [*]14 On the other hand,
the New York City Department of Education banned ChatGPT access from school organizations
under its jurisdiction because of concerns about cheating and copying. [*]15
Big Tech has also been eyeing generative AI, moving to open its interactive AI services to the
public after ChatGPT came into the spotlight. [*]16 Microsoft, an OpenAI investor, said it has
added interactivity to its Bing search engine and Edge web browser by integrating OpenAI’s
new AI model, GPT-4. [*]17 Google, for its part, has announced that its interactive AI, Bard, is on
the way. [*]18 Elsewhere, China’s Baidu has announced that it will integrate its interactive AI,
Wen Xin Wan (Ernie Bot), into its search service for the public. [*]19

2.3.

Use of ChatGPT in cyberattacks

Security researchers have said they believe ChatGPT can be applied to cyberattacks.
[*]20 [*]21 [*]22 Its developer, OpenAI, has banned antisocial use of ChatGPT and prevented
it from answering questions that could lead to abuse. Questions about how to conduct acyberattack are also warned without answers. But it has been found that people can get answers
by asking questions or using threatening language that seems unrelated to the cyberattack.
Here’s a broad breakdown of the various potential exploits:

Using generated sentences for social hacking
If you use ChatGPT to generate text that humans are easily fooled by, you can use it
for phishing emails. Since it is good at interacting with humans and can be adjusted toimpersonate a specific person, expert, etc., such as imitating a style or tone, it is expected to be
used for scams, etc., where people interact with humans via messaging apps.

Development of Malware
ChatGPT stores a variety of information about program development. So, in addition to natural

7

language answers, you can throw in ideas for a program and it will return the appropriate
source code. Researchers fear that you can apply this ability to efficiently develop code thatcan be used for cyberattacks.

Fake News
Targeted attacks such as the two above, as well as attacks in which generative AI affects theentire internet, are of concern.
ChatGPT has proven to be an easy way to generate plausible fake news mixed with lies like
conspiracy theories as natural-tone sentences. A mass spread of such information across theinternet could also obscure real news. It is also thought that generative AI that learns from theinternet might learn fake news content and not be able to return factually correct content. [*]23

2.4.

The Search for the Use of Cyber Attacks

Its use in cyberattacks is being demonstrated in experiments by researchers.
Security firm Check Point Software Technologies says ChatGPT can be used to carry out email
phishing attacks. The company generated email drafts, used them to refine drafts to deceive
recipients, and demonstrated that they could be used to develop VBA code embedded inattached Excel macro files (Figure 3). [*]24 other researchers have been able to get ChatGPT

Figure 3 VBA code generated by ChatGPT in response to a question

Cyber Security Reports 2023.01

8

to write ransomware code that finds and steals Office files from a victim and then encrypts
them. [*] 25
Threat actors are also interested in making use of ChatGPT. On the hacking forums where
they exchange information, several posts boasting about using ChatGPT to steal informationand develop ransomware and other malware have been uncovered. “Designating (to ChatGPT)
what the program should do and what steps it should take is key to getting it to produce what
it wants.” said an attacker who claims to have successfully generated code for informationstealing malware. (Figure 4). [*]26

Figure 4 Information theft malware created using ChatGPT
Writing to hacking forums

9

2.5.

Leveraging for security measures

Attempts are also being made to develop security measures against threat actors by leveraging
generative AI such as ChatGPT. ChatGPT has already begun to be used for tailored security
education, drafting security reports, and security tool development. [*]27 In the future, ChatGPT
is expected to be extended to help analyze malware and find vulnerabilities in software byhaving generative AI read and decode the source code of programs. [*]28
Generative AI is expected to play an important role not only in engineering fields but also insecurity consulting. [*]29 ChatGPT at this point also has the ability to answer questions about
security measures (Figure 5, Figure 6). with further development, generative AI could be used tospot unknown cyberattacks and even suggest security measures to combat them.

Figure 5 Email Sentences ChatGPT Answers Can Use for Phishing

Cyber Security Reports 2023.01

10

Figure 6 Anti-Phishing Sentences ChatGPT Answers Following Figure 5

2.6.

Summary

ChatGPT has no ability to judge right from wrong. ChatGPT, which can be used both offensively
and defensively, could find unexpected uses that haven’t been discovered yet as cybersecurity
use cases become more common. Generative AI will become more accessible to the public as
Big Tech and others enter into a race to invest in it and develop its practical applications.
GPT-4, which is the next evolution in generative AI developed by OpenAI for ChatGPT isfollowing very fast on the heels of GPT-3.5. With both rapid adoption and development,
generative AI may hold the key to cybersecurity in the future.

11

3. Ransomware attack on Royal Mail
3.1.

Overview [*]30

On January 13, 2023, Royal Mail, Britain’s largest postal service, announced that it had
been attacked by a cybercrime group believed to be a ransomware group. The attack halted
international shipments of letters and packages from Britain for about a week. Ransom
notes implicated the LockBit ransomware group in the attack. On a crime forum, the LockBit
operator’s account initially denied any involvement in the attack, but then admitted involvement
to a group associate.

3.2.

Ransomware attack wreaks havoc in the UK

According to the Telegraph, a PC used to print customs labels on packages for internationaldelivery had been infected with ransomware, causing the disruption of more than 500,000
international mail deliveries. [*]31
Simon Thompson, the CEO of Royal Mail, told a British Parliament hearing that residents andbusinesses in the country are still unable to ship letters and packages overseas and a solution
to restore service was being worked on. [*]32

Figure 7 Royal Mail Twitter [*]33

Figure 8 Royal Mail CEO Simon
Thompson Testifying at a
Parliament hearing

Retailers dependent on factories or warehouses outside the UK were particularly badly affectedby the attack. The owner of a jewelry maker lamented that he couldn’t track the items he sent
overseas. [*]34 “There is no indication of when things will be fixed, It could be a week, it could
be a month, it could be six months.“ said a used-record dealer, with about 45% of his customers
overseas. [*]35
International mail shipments resumed on January 21, about a week after the incident wasannounced. In February, it was announced that international priority mail and other services
had been restored. [*]36

3.3.

LockBit’s involvement in the attack

On January 10, three days before the incident was made public, sorting staff at the Royal Mail
distribution centre saw a large amount of documents emerge from a printer. They were notes

Cyber Security Reports 2023.01

12

demanding a ransom, along with the string “LockBit Black Ransomware” and the URL of a TOR
site to which ransom negotiations had been directed 31.

LockBit Black Ransomware
Your Data are stolen and encrypted. The data will
be published on TOR website … and … if you do not
pay the ransom. You can contact us and decrypt
one file for free on these TOR sites.
Decryption ID….

Figure 9 Ransom note 31

Security technology news publication Bleeping Computer reached out to the LockBit operator’s
account on a crime forum and was told that they did not conduct the attack, but that it was
performed using a leaked version of their builder. [*]37 Lockbit subsequently confirmed thatit had been responsible for the attack through one of its affiliates. The Lockbit operators may
have been unaware of the attack when they were initially contacted by Bleeping Computer as
they might have been unaware which affiliate was responsible for the attack.

Figure 10 LockBit post confirms the attack was taking place13

LockBit Affiliates
One characteristic of LockBit’s operations is that affiliates, not the group’s operators, negotiate
directly with victims and receive ransom payments. As a result, affiliates have more freedom
than other ransomware groups in deciding which organizations to target and setting ransom
amounts. Is this a factor? The LockBit group has seen an uncontrolled phenomenon, with
attacks being carried out against organizations in areas designated as off-limits by theoperators (see below). We speculate that this is due to the fact that affiliates indiscriminately
infect organizations using vulnerable VPNs with ransomware, so they are unable to verify if thetarget organization is off-limits at the time of infection.
LockBit’s off-limits
LockBit has set up an affiliate bylaws page on its exposure site. In it, it prohibits attacks on
critical infrastructure such as power plants, oil pipelines and life-and-death medical facilities.
The ban is thought to be a reflection of cases like the DarkSide group, which was disbanded
after being investigated by the US government for paralyzing US oil pipelines with attacks on
major oil companies. It is speculated that LockBit is afraid that it will stand out too much andthat government agencies will take action against it. After an attack on the Hospital for Sick

Figure 11 Rules for Affiliates on Exposure Sites

Children (SickKids) in Toronto in December 2022, LockBit issued an extraordinary apology andprovided tools to decrypt the encrypted data (Figure 12). [*]38

Figure 12 Apology posted by LockBit on a TOR site

Cyber Security Reports 2023.01

14

3.4.

Summary

We infer that LockBit has a low level of involvement with affiliates, and as a result, has gained
a lot of support by providing an environment in which affiliates can easily operate without
scrutiny, thus securing a top share in the industry.
The Royal Mail attack, which disrupted many in the UK by halting international maildelivery for more than a week, does not appear to have run afoul of the no-attack rules. In thepast, however, Lockbit has apologized and provided decryption keys for attacks on banned
organisations. If your organization is hit by a LockBit attack and you are in a vertical which
Lockbit prohibits its affiliates from attacking, you may have the option of negotiating adecryption key.

Disclaimer
While we do our best to be accurate in the content of this article, we do not guarantee its
accuracy and do not compensate you for any damages or losses arising from your use ofthis article. If you have any questions or concerns regarding typographical errors, errors incontent, or other matters pointed out in the article, please contact us at the address below.
Contact: NTT Security Holdings – https://www.security.ntt/contact
OSINT Monitoring Team, Consulting Services Department

15

Sources
1. Source: Office of the Vermont Attorney General “2023 - 01 - 09 - NortonLifeLock - Gen - Digital - Data - Breach - Notice to - Consumers”
https://ago.vermont.gov/sites/ago/files/2023-01/2023-01-09-NortonLifeLock-Gen-Digital-Data-Breach-Notice-to-Consumers.pdf
2. Source: LastPass, Notice of Recent Security Incident
https://blog.lastpass.com/2022/12/notice-of-recent-security-incident
3. Source: PC Watch “4 best password management apps + alpha. Introducing free Bitwarden and more”
https://pc.watch.impress.co.jp/docs/topic/feature/1320678.html
4. Source: Bleeping Computer “NortonLifeLock warnings that hackers broke Password Manager accounts”
https://www.bleepingcomputer.com/news/security/nortonlifelock-warns-that-hackers-breached-password-manager-accounts
5. Source: Cybernews “Norton Password Manager breach: nearly one million users targeted”
https://cybernews.com/security/hackers-compromise-norton-password-manager
6. Source: Mado no Mori “Password manager LastPass hacked, leaked source code and proprietary technology”
https://forest.watch.impress.co.jp/docs/news/1435104.html
7. Source: Bleeping Computer “Lastpass says hackers accessed customer data in new breach”
https://www.bleepingcomputer.com/news/security/lastpass-says-hackers-accessed-customer-data-in-new-breach
8. Source: TECH�“Unauthorized access to the backup environment of the password management service “LastPass””
https://news.mynavi.jp/techplus/article/20221223-2544442
9. Source: THE VERGE “The LastPass disclosure of leaked password vaults is being torn apart by security experts”
https://www.theverge.com/2022/12/28/23529547/lastpass-vault-breach-disclosure-encryption-cybersecurity-rebuttal
10. Source: OpenAI “ChatGPT: Optimizing Language Models for Dialogue”
https://openai.com/blog/chatgpt
11. Source: Nikkei Crostech (xTECH) “ChatGPT stole the show shortly after its release, but in what areas could it be used?”https://xtech.nikkei.com/atcl/nxt/keyword/18/00002/010500220
12. Source: OpenAI ChatGPT FAQ
https://help.openai.com/en/articles/6783457-chatgpt-faq
13. Source: NHK “Can AI ChatGPT do homework for programming fiction writing school?”
https://www3.nhk.or.jp/news/html/20221209/k10013917101000.html
14. Source: Mack Institute for Innovation Management “Would Chat GPT Get a Wharton MBA? New White Paper By Christian Terwiesch”
https://mackinstitute.wharton.upenn.edu/2023/would-chat-gpt3-get-a-wharton-mba-new-white-paper-by-christian-terwiesch
15. Source: ZDNET “ChatGPT was just blocked by the biggest US school district. Here’s why”
https://www.zdnet.com/article/chatgpt-was-just-blocked-by-the-biggest-us-school-district-heres-why
16. Source: NHK, “Competition to develop AI technology intensifies as Google AI interactive software becomes generally available”
https://www3.nhk.or.jp/news/html/20230207/k10013973051000.html
17. Source: Impress Watch “Microsoft unveils new AI search ‘Bing’ more capable than ChatGPT”
https://www.watch.impress.co.jp/docs/news/1476776.html
18. Source: Google “Google AI updates: Bard and new AI features in Search”
https://blog.google/technology/ai/bard-google-ai-search-updates
19. Source: Bloomberg “Baidu to Launch ChatGPT-Like Service Named Ernie”
https://www.bloomberg.co.jp/news/articles/2023-02-07/RPOWU4T0AFB401
20. Source: Revatech Lab “Will ChatGPT become a threat to the security of the Internet world?”
https://levtech.jp/media/article/news/detail_190
21. Source: With Secure “WithSecure Research ChatGPT Could Be Used in Cyberattacks”
https://prtimes.jp/main/html/rd/p/000000350.000001340.html

Cyber Security Reports 2023.01

16

22. Source: Practical application of ChatGPT by Kaspersky
https://usa.kaspersky.com/blog/chatgpt-cybersecurity/27719
23. Source: MIT Tech Review “What’s to stop an internet tainted by AI-generated content?”
https://www.technologyreview.jp/s/293619/how-ai-generated-text-is-poisoning-the-internet
24. Source: Check Point Software Technologies “Check Point Research raises awareness of ChatGPT-powered malicious email and code
attacks” https://prtimes.jp/main/html/rd/p/000000166.000021207.html
25. Source: Revatech Lab “Will ChatGPT become a threat to the security of the Internet world?”
https://levtech.jp/media/article/news/detail_190
26. Source: Check Point Research “OPWNAI: Cybercriminals Starting to Use ChatGPT”
https://research.checkpoint.com/2023/opwnai-cybercriminals-starting-to-use-chatgpt
27. Source: Revatech Lab “Will ChatGPT become a threat to the security of the Internet world?”
https://levtech.jp/media/article/news/detail_190
28. Source: Practical application of ChatGPT by Kaspersky
https://usa.kaspersky.com/blog/chatgpt-cybersecurity/27719
29. Source: Revatech Lab “Will ChatGPT become a threat to the security of the Internet world?”
https://levtech.jp/media/article/news/detail_190
30. Source: THE FINANCIAL TIMES “Royal Mail hit by ransomware attack by plastic hacker gang”
https://www.ft.com/content/2ab26050-6b17-4b10-96d1-faeb664f4501
31. Source: THE Telegraph “Russia-linked hackers behind Royal Mail cyber attack”
https://www.telegraph.co.uk/business/2023/01/12/russia-linked-hackers-behind-royal-mail-cyber-attack
32. Source: THE FINANCIAL TIMES “How Royal Mail’s hacker became the world’s most profitable ransomware group”
https://www.ft.com/content/5d53c9fe-ce36-444b-bcf0-f55f81cff93d
33. Source: Royal Mail on Twitter
https://twitter.com/RoyalMail/status/1613556388399124480
34. Source: THE FINANCIAL TIMES “Small businesses count cost of Royal Mail’s cyber attack”
https://www.ft.com/content/2664ca9b-df6f-45c2-b71d-547d707af62c
35. Source: BBC “How cyber-attack on Royal Mail has left films in limbo”
https://www.bbc.com/news/business-64291272
36. Source: Royal Mail on Twitter
https://twitter.com/RoyalMail/status/1616480676986880035
https://twitter.com/RoyalMail/status/1623713336524263425
37. Source: Bleeping Computer “Royal Mail cyberattack linked to LockBit ransomware operation”
https://www.bleepingcomputer.com/news/security/royal-mail-cyberattack-linked-to-lockbit-ransomware-operation
38. Source: The Hospital for Sick Children (SickKids) �Update on SickKids response to cybersecurity incident�
https://www.sickkids.ca/en/news/archive/2022/update-on-sickkids-response-to-cybersecurity-incident

17Cyber Security Reports 2023.01

18