Introduction
Malware, short for malicious software, is any software designed to harm or exploit computer systems. This can include viruses, worms, trojans, ransomware, and other types of malicious code. In recent years, there has been a significant increase in the number and sophistication of malware attacks. This has led to a growing concern about the security of computer systems and the need to protect against these threats.
Vulnerabilities, on the other hand, refer to weaknesses in software or systems that can be exploited by attackers. These can include defects in programming code, configuration errors, and other types of bugs. As with malware, there has been a significant increase in the number and sophistication of vulnerabilities found in software and systems in recent years. This has led to a growing concern about the security of computer systems and the need to address these vulnerabilities to protect against attacks.
It is becoming harder to secure our systems and protect our data. Advanced malware keeps increasing, and new critical security vulnerabilities are detected every second. Threat actors can exploit these detected vulnerabilities to obtain our sensitive data through advanced malware.
In our blog post, we described some of the vulnerabilities and malware we saw during 2022.
What is Vulnerability?
Vulnerability refers to a weakness or gap in a computer program or system that could be exploited by an attacker. These weaknesses have several causes, such as poor coding practices, lack of input validation, or failure to handle sensitive data properly. Once a vulnerability is discovered, an attacker can use it to gain unauthorized access to a system and steal or corrupt data. They can even launch a full-scale attack on the network.
Examples of common types of software vulnerabilities include:
- Buffer overflow: A buffer overflow occurs when a program tries to store more data in a buffer than it can hold. The data then overflows into adjacent memory locations. This can be used to execute arbitrary code.
- SQL injection: SQL injection occurs when an attacker inserts malicious SQL code into a query. This lets them gain access to sensitive data or run arbitrary commands on the database.
- Cross-site scripting (XSS): XSS occurs when an attacker injects malicious code into a web page that other users view. This lets them steal sensitive information or run arbitrary code in the user’s browser.
Software developers and system administrators should regularly check for and patch vulnerabilities in their systems. They should also have an incident response plan in case a vulnerability is exploited.
Vulnerability Trends
Security vulnerabilities detected in software and hardware are frequently used by threat actors to infect systems with malware, access sensitive information, and disrupt systems. Today, many institutions and organizations have a large number of unpatched vulnerabilities in their systems, providing threat actors with numerous attack paths. Every day, new security vulnerabilities are identified, and many of them can be exploited for years. In 2022, some of the security vulnerabilities that are frequently exploited by threat actors were as follows;
Log4Shell (CVE-2021-44228)
Log4Shell (CVE-2021-44228), identified in December 2021, is a critical vulnerability. It allows remote code execution on systems that use Apache Foundation’s Log4j. Log4j is an open-source Java library widely used in commercial and open-source software products and utilities.
Follina (CVE-2022-30190)
Follina (CVE-2022-30190), identified in June 2022, is a zero-day vulnerability that allows threat actors to execute code on targeted Windows systems through Microsoft Office documents.
Spring4Shell (CVE-2022-22965)
The Spring4Shell (CVE-2022-22965) vulnerability was identified in March 2022 in Spring, a popular Java-based web application framework. It is a remote code execution vulnerability. It results from the ability to pass user-controlled values to various properties of Spring’s ClassLoader. This vulnerability can be exploited by unauthenticated threat actors to inject a web shell and gain remote code execution.
Google Chrome Zero-Day (CVE-2022-0609)
The vulnerability in the Google Chrome web browser, tracked as CVE-2022-0609, was identified in February 2022. It allows threat actors to execute code on the user’s system by redirecting them to a malicious website. CISA lists it in its Known Exploited Vulnerabilities Catalog, with a date added of February 15, 2022.
Google Releases Updates to Actively Exploited 0-Day Security Vulnerability in Chrome
F5 BIG-IP (CVE-2022-1388)
The vulnerability, tracked as CVE-2022-1388, was detected in May 2022 on F5 BIG-IP network devices, which are used for load balancing and other purposes. It allows unauthenticated threat actors to execute commands on vulnerable devices by sending special requests.
Critical RCE Vulnerabilities Affecting F5 Products Detected
ProxyNotShell (CVE-2022-41082, CVE-2022-41040)
The vulnerabilities identified in September 2022 affect Microsoft Exchange Server 2013, 2016, and 2019 products. The critical vulnerability (SSRF), tracked as CVE-2022-41040, is caused by insufficient validation of user-supplied input in the Exchange OWA interface. It allows threat actors to direct the application to initiate requests to arbitrary systems via a specially crafted HTTP request. Another vulnerability, tracked as CVE-2022-41082, results from incorrect login validation in Exchange Server. It allows a remote user with access to PowerShell Remoting on Exchange systems to execute arbitrary code on the system. These vulnerabilities are known to be used in a chained manner by threat actors.
ZeroBot: New Botnet Malware Using IoT Security Vulnerabilities
Zimbra Collaboration Suite Bugs (CVE-2022-27925, CVE-2022-41352)
Security vulnerabilities were identified in Zimbra Collaboration Suite, a popular platform for email, calendaring, and other collaboration services. They allow threat actors to execute arbitrary commands on the server by sending a malicious request.
Atlassian Confluence RCE Flaw (CVE-2022-26134)
The vulnerability, identified in June 2022, is an unauthenticated OGNL injection remote code execution vulnerability affecting Confluence Server and Data Center versions later than 1.3.0. Threat actors can send a malicious HTTP GET request with an OGNL payload in the URI to exploit a vulnerable server. When this vulnerability is exploited, threat actors can execute remote commands with the privileges of the user running the Confluence application.
A later Confluence flaw, CVE-2023-22515 (broken access control), has its own page.
Zyxel RCE Vulnerability (CVE-2022-30525)
The vulnerability, identified in June 2022, affects Zyxel network devices. It allows unauthenticated threat actors to inject commands into the operating system through the administrative HTTP interface of firewalls. This allows them to modify specific files and execute operating system commands.
Proxyshell (CVE-2021-31207, CVE-2021-34473, CVE-2021-34523)
ProxyShell consists of three separate flaws in the Microsoft Exchange email server that allow for bypassing security features, achieving remote code execution, and escalating privileges. When these vulnerabilities are combined on vulnerable systems, ProxyShell allows an attacker to establish persistence and execute malicious PowerShell commands. A successful exploit allows threat actors to gain full control of vulnerable Microsoft Exchange email servers.
How Can Brandefense Help You Against Vulnerabilities?
Vulnerability intelligence gives information about known vulnerabilities targeting software and systems, including information about the risk level, affected products, and discussions on social media. Vulnerability patches or workarounds that are available can be found with official references. It is used to help organizations identify and prioritize destructive vulnerabilities in both internal and external systems to develop strategies for mitigating dangerous risks.
Brandefense is a proactive digital risk protection solution for organizations. Our AI-driven technology constantly scans the online world, including the dark, deep, and surface web. It discovers unknown events, automatically prioritizes risks, and delivers actionable intelligence you can use instantly to improve security. Our proactive approach enables you to identify and prioritize vulnerabilities in your systems and develop strategies for mitigating those risks.
What is Malware?
Malware, short for “malicious software,” is any software or program that is designed to harm or exploit computer systems and networks. It can come in many forms, including viruses, worms, trojan horses, ransomware, and spyware. Cybercriminals typically create and distribute these types of software to damage a computer’s files, steal personal information, or take control of a computer remotely.
Viruses are one of the most well-known forms of malware. They are designed to replicate and spread from one computer to another, often through email attachments or infected files shared on networks. Once a virus infects a computer, it can damage it by deleting files or corrupting data. It can also spread to other computers on the same network.
Trojan horses, often called simply Trojans, are malware that disguises itself as legitimate software. They can be distributed through email attachments, instant messaging, or downloaded from the internet. Once installed, they can give cybercriminals access to a user’s computer, allowing them to steal personal information, or even take control of the computer remotely.
Ransomware is a type of malware that encrypts a user’s files and demands payment to restore access. Once a computer is infected with ransomware, the user will not be able to access their files until a ransom is paid. This type of malware is particularly dangerous because it can cause irreparable damage to a user’s files. It can also spread quickly through networks.
The best way to protect against malware has three parts. Use anti-malware software. Keep software and operating systems up-to-date. Be cautious when opening email attachments or clicking on links from unknown sources.
Malware Trends
Malware is frequently used by threat actors to damage or exploit targeted computer systems, networks, or devices. Malware can be spread through various means, such as email attachments, infected websites, and online ads. It is known that threat actors are continuously developing more advanced versions of malware. In 2022, it was known that threat actors have utilized various advanced malware families for their purposes. Some of the malware families that were distributed to targeted systems in 2022 include;
European Focused Threat Actors – Ransomware Groups
Trickbot
First seen in 2016 as a banking Trojan, Trickbot operates as a malware-as-a-service (MaaS) platform with downloadable modules. It steals login credentials, spreads across the network using lateral movement exploits and disables Windows Defender. It has also been used alongside ransomware such as Ryuk.
Emotet
Emotet first appeared in 2014 as a banking Trojan. It later became a modular downloader that installs other malware, such as TrickBot and IcedID, on infected devices.
Initial Access Methods: How Malicious Actors Do Infiltrate Companies?
Qakbot
Qakbot (also known as Qbot) is a modular banking trojan that has been used mainly by financially motivated actors since at least 2007. Over time it grew from an information stealer into a way to deliver ransomware, such as ProLock, Egregor and Black Basta.
Agent Tesla
Observed since at least 2014, Agent Tesla is a .NET-based spyware trojan and remote access tool. It steals data through keylogging, credential harvesting and screenshot capture. It is delivered mainly through phishing emails with malicious attachments, including Microsoft Office documents that exploit known vulnerabilities.
APT Groups Actively Involved during the Russia-Ukraine Cyber War
RedLine Stealer
RedLine is an information stealer first identified in 2020 and sold as malware-as-a-service. Credentials stolen with it have been sold on the dark web to initial access brokers, who use or resell them for further intrusions.
Top 3 Stealer Malware Activity Research
Formbook
Formbook (now often called XLoader) has been in use since at least 2016 and is sold as malware-as-a-service. It steals data from web browsers, email clients and FTP applications.
Remcos
Remcos is a closed-source remote control and surveillance tool marketed by Breaking Security as legitimate software. Threat actors have widely used it in malicious campaigns as a remote access trojan (RAT). It offers keylogging, screen capture, webcam access and command execution. It is delivered through spear-phishing emails with malicious attachments, and it adds itself to the Windows registry Run key to persist on targeted systems.
New Phishing Campaign Detected That Deploying Remcos RAT
Dridex
Dridex is a prolific banking Trojan that first appeared in 2014. Its main goal is to steal sensitive information such as online banking credentials. It relies on users opening malicious attachments delivered through phishing emails.
What Should You Know About Ransomware
Conclusion and Mitigations
In the final months of 2021, a security vulnerability called Log4Shell was identified in Apache’s Log4J library, which tens of thousands of organizations use. Log4Shell is easily exploitable by threat actors. In the following year, many more critical vulnerabilities were identified. Threat actors frequently use these critical vulnerabilities to distribute various advanced malware to vulnerable systems and obtain sensitive data. As security solutions have evolved, threat actors have developed malware with advanced capabilities to gain access to targeted systems. To protect against security vulnerabilities and advanced malware, it is important to:
- Keep systems and applications up to date by scanning for security vulnerabilities.
- Do not access links in unsafe spam messages or unknown websites.
- Do not provide personal information to untrusted sources.
- Do not rely on e-mails, attachments, files, and links from suspicious or unknown parties.
- Never use USB sticks obtained from unknown sources.
- Use VPN services on public Wi-Fi networks.
- Sensitive data in the system should be backed up at regular intervals.
- Institutions and organizations should provide awareness training to their employees against cyber security threats.
- Up-to-date security solutions should be used in systems and e-mail mail servers.
References