Security News – Week 33

A critical security vulnerability has been detected in the Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software that could allow an unauthenticated threat actor to gain access to the RSA Private Key. ASA software is the core operating system of Cisco’s ASA security appliances that protect data centers and corporate networks, while FTD software provides next-generation firewall (NGFW) service.

The vulnerability with code CVE-2022-20866 is caused by a logic error caused by storing the RSA key in memory on a hardware platform that performs hardware-based encryption. A remote threat actor can exploit the vulnerability to execute a Lenstra Side-Channel attack and gain access to the RSA key. A compromised RSA Private Key can be used to impersonate a device running Cisco ASA Software or Cisco FTD Software or to decrypt device traffic.

Cisco stated that the vulnerability only affects Cisco ASA Software 9.16.1 and later versions, Cisco FTD Software 7.0.0 and later versions, and has released security updates that fix the vulnerability. In this context, it is recommended that users using vulnerable Cisco ASA and FTD software versions immediately apply the published updates so that they are not the target of attacks that can be carried out using the vulnerability.

A new attack campaign targeting defense industry organizations and public institutions in various countries have been detected by Kaspersky ICS CERT researchers. Due to the overlap of techniques, tactics, and procedures (TTPs) used, the attack attributed to the TA428 APT group targets industrial facilities, design bureaus, research institutes, government agencies, and ministries in various Eastern European countries (Belarus, Russia, and Ukraine) as well as Afghanistan.

The attack starts with the distribution of phishing emails created by threat actors using internal data of the targeted organization to the targets. Microsoft Word documents attached to phishing emails contain malicious code that exploits the CVE-2017-11882 vulnerability.

The vulnerability allows threat actors to execute arbitrary code on the vulnerable system through the PortDoor Backdoor malware without user interaction. A new variant of PortDoor Backdoor was detected in this campaign. The latest version PortDoor collects data from the infected system and sends it to command and control (CnC) servers controlled by threat actors. In addition, it was observed that backdoor malware such as nccTrojan, Logtu, Cotx, and DNSep was also used in the attack.

Threat actors, who first gain access to the targeted system, try to distribute malware to other computers in the corporate network in later stages. For this purpose, Ladon malware, which Chinese-origin threat actors frequently use, helps TA428 threat actors to carry out Lateral Movement activities in the target network. The final stage of the attack includes capturing the target organization’s domain controller by threat actors and acquiring critical documents and files from all workstations and servers of the organization.