BRANDEFENSE BRANDEFENSE
  • Home
  • Product
    How it works?
    Platform Overview
    Cyber Intelligence
    Brand & Reputation Protection
    Exposure Management
    Solutions
    Threat Intelligence Service
    Brand Protection
    Vulnerability Management
    Attack Surface Management
    Fraud Protection
    VIP Security
    Vulnerability Intelligence
    By Use Case
    Preventing Data Leakage
    Phishing Monitoring
    Account Takeover Detection
    Stolen Credit Cards
    Dark Web Monitoring
    Remediation and Takedown
    brandefense background
    Eliminate risks
    Explore the Brandefense
  • Blog
  • Resources
    Security News
    Threat Intelligence Researches
    Digital Risk Protection – FAQ
    We in the Press
  • Partners
    Channel Partners
    Deal Registration
  • Company
    About Us
    Career
    Privacy Policy
    Terms of Use
    Contact Us
Free Trial

BRANDEFENSE

  • Home
  • Product
    How it works?
    Platform Overview
    Cyber Intelligence
    Brand & Reputation Protection
    Exposure Management
    Solutions
    Threat Intelligence Service
    Brand Protection
    Vulnerability Management
    Attack Surface Management
    Fraud Protection
    VIP Security
    Vulnerability Intelligence
    By Use Case
    Preventing Data Leakage
    Phishing Monitoring
    Account Takeover Detection
    Stolen Credit Cards
    Dark Web Monitoring
    Remediation and Takedown
    brandefense background
    Eliminate risks
    Explore the Brandefense
  • Blog
  • Resources
    Security News
    Threat Intelligence Researches
    Digital Risk Protection – FAQ
    We in the Press
  • Partners
    Channel Partners
    Deal Registration
  • Company
    About Us
    Career
    Privacy Policy
    Terms of Use
    Contact Us
Security News – Week 11

Security News – Week 11

BRANDEFENSE
Weekly Newsletter
16/03/2022

Last updated on August 9th, 2022 at 09:27 pm

two critical vulnerabilities detected in veeam data back-up solution

Table of Contents

  • Two Critical Vulnerabilities Detected in Veeam Data Back-up Solution
  • Multiple Vulnerabilities Detected in Popular Package Managers
  • MuddyWater Threat Actors Target Turkey and Arabian Peninsula With A New Malware Campaign
  • New Android Malware Detected to Hijack Google Authenticator MFA Tokens: “Escobar”

Two Critical Vulnerabilities Detected in Veeam Data Back-up Solution

Veeam Software has released updates to two critical security vulnerabilities affecting Backup & Replication, a backup solution for virtual environments.

Unauthenticated threat actors can exploit two security vulnerabilities tracked with codes CVE-2022-26500 and CVE-2022-26501 to remote code execution. The vulnerabilities exist in the Veeam Distribution service running on TCP port 9380 by default, allowing unauthenticated users to access internal Veeam API functions. Threat actors who exploit vulnerabilities to execute code on the target system can send inputs to the Veeam API to load and run malicious code.

Critical vulnerabilities affect Veeam Backup & Replication versions 9.5, 10, and 11. Unfortunately, Veeam Software has only released updates that fix the vulnerability for versions 10 and 11. For this reason, it is recommended that users using version 9.5 upgrade to a supported version.

multiple vulnerabilities detected in popular package managers

Multiple Vulnerabilities Detected in Popular Package Managers

Security vulnerabilities have been detected in popular package managers, allowing threat actors to execute arbitrary code on the target system and access sensitive data. Package managers are tools that enable easy installation, updating, and configuration of third-party dependencies required by applications.

The detected security vulnerabilities are in the following package managers;
• Composer
• Bundler
• Bower
• Poetry
• Yarn
• pnpm
• Pip
• Pipenv

The vulnerability found in Composer and tracked with code CVE-2021-41116 is a Command Injection vulnerability that could allow remote threat actors to execute arbitrary commands on the target system. Argument Injection and Untrusted Search Path security vulnerabilities found in Bundler, Poetry, Yarn, Pip, and Pipenv can allow threat actors to execute arbitrary code on the target system via malware-laden Git or Gemfiles files.

The package managers fixed the vulnerabilities that were foreseen to be used in supply chain attacks shortly after the announcement. However, the Untrusted Search Path vulnerability affecting three package managers, Composer, Pip, and Pipenv, is still not fixed. In this context, it is recommended that users using vulnerable package manager versions immediately upgrade to the published updates in order not to be the target of attacks that can be carried out using vulnerabilities.

muddywater threat actors target turkey and arabian peninsula with a new malware campaign

MuddyWater Threat Actors Target Turkey and Arabian Peninsula With A New Malware Campaign

Iranian state-backed MuddyWater threat actors have been associated with a new offensive campaign targeting Turkey and the Arabian Peninsula to plant remote access trojans (RATs) on compromised systems.

The chain of attacks begins with sending phishing e-mails containing malicious attachments to the recipients to distribute the SloughRAT (Canopy) trojan, which is responsible for executing commands received from command and control servers (C&C). The malicious document sent by the phishing e-mail contains a malicious macro that drops two WSF (Windows Script File) files on the target system. One of these scripts is used to execute the next phase and is placed in the current user’s Startup folder by a VBA macro to ensure persistence between reboots. The second script contains the “SloughRAT” malware, which will be used to execute arbitrary commands on the target system. This RAT consists of hidden Visual Basic and JavaScript code. After a series of malicious activities are carried out through malware, the data and results captured are transferred to C&C servers.

It has been determined that the campaign is a continuation of the November 2021 MuddyWater campaign, which targets Turkish private and government institutions with PowerShell-based backdoors for information gathering and espionage activities. To not be the target of this and similar malware campaigns, it is important to ignore e-mail attachments and links from unknown people, not to download files or programs from unknown sources, and conduct attack surface analyses at regular intervals. Also, It is recommended to raise awareness of institution/organization personnel against possible phishing / social engineering attacks and block detected IoC findings related to the campaign from security devices in use.

new android malware detected to hijack google authenticator mfa tokens: “escobar”

New Android Malware Detected to Hijack Google Authenticator MFA Tokens: “Escobar”

Security researchers have detected that the Aberebot Android banking trojan has been redistributed under the name ‘Escobar’ with new features added, including the hijacking of Google Authenticator multi-factor authentication (MFA) codes. Furthermore, it has been observed that the features added to the Aberebot malware developed to take control of infected Android devices via VNC, record audio, take pictures, and capture identity information, are also found in the newly detected Escobar variant. The ultimate goal of this malware is to gather the information that would allow threat actors to hijack targets’ bank accounts and perform unauthorized transactions.

Escobar malware is distributed to target systems as a fake McAfee Anti-Virus application. The malicious application downloaded to the user device requests 25 different permissions, which is 15 abused. It has been observed that if users approve the requested permissions, the malware gains access to the user’s contact directory, SMS, call logs, and sensitive data such as device location. In addition, the malware comes with the features of deleting files, sending SMS, making calls, and controlling the device camera via commands received from the C&C server, the ability to record calls and voice.

Threats targeting the banking sector are increasing and developing day by day. It is observed that Escobar and similar software are often distributed through unofficial sources such as forums. For this reason, it is recommended that Android users download their applications from official and reliable sources, pay attention to the permissions requested by applications and enable multi-factor authentication (MFA) features not to be exposed to similar malware campaigns. In addition, it is recommended to use reliable Anti-Virus / Anti-Malware solutions and prevent IoC findings related to the malware in question from the security solutions in use.

Bower Bundler Composer CVE-2022-26500 CVE-2022-26501 cyber attack news cyber security news cybersecurity news news hackers Pip Pipenv pnpm Poetry security news Yarn
Share on Facebook Share on Twitter
Search
Categories
APT GroupsBlogDark WebDRPSFraudRansomwareSector AnalysisSecurity NewsVIP SecurityWe in the PressWeekly Newsletter
Recent Posts
  • Perspective of the Month | APT Groups
    Perspective of the Month | APT Groups
  • BellaCiao: The New Malware From Iran’s Charming Kitten
    BellaCiao: The New Malware From Iran’s Charming Kitten
  • Security News Digest | Security Newsletter | April 27, 2023
    Security News Digest | Security Newsletter | April 27, 2023
  • Cyber Security Trends in 2023: What You Need to Know
    Cyber Security Trends in 2023: What You Need to Know
2023 Ransomware Trends Report
Let’s Dive in Ransomware Attack Trends
Report

Let’s Dive in Ransomware Attack Trends

Download Report
Follow us!

Continue Reading

Previous post

Two Critical Vulnerabilities Detected in Veeam Data Back-up Solution

critical vulnerabilities detected in veeam
multiple vulnerabilities detected in popular package managers
Next post

A New Linux Backdoor Detected to Deployed with Log4Shell Vulnerabilities

particle element
We know what hackers know about you
Our cyber threat intelligence and security research team is ready to help you.
Request a demo
Free Trial
Contact
Login

Follow us on

brandefense logo brandefense

Brandefense is solving SOC’s complex challenges. We are here to help Brandefense customers to protect their brands and reputations against cyber threats.

United States:

300 Delaware Ave. Ste 210 #328 Wilmington, DE 19801 / USA

Turkey:

Üniversiteler Mahallesi, 1605.Cadde, Kapı No:3/1, No: 204, 06800 Çankaya/Ankara 06800

© 2022 Brandefense. All rights reserved.

Solutions
Threat IntelligenceBrand ProtectionVulnerability ManagementFraud ProtectionVIP SecurityAttack Surface ManagementVulnerability Intelligence
Use Case
Data LeakagePhishing MonitoringAccount Takeover DetectionStolen Credit CardsDark Web MonitoringRemediation / Takedown
Partners
Channel PartnersDeal Registration
Company
AboutCareerPrivacy PolicyTerms Of UseContact
Manage Cookie Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Manage options Manage services Manage vendors Read more about these purposes
View preferences
{title} {title} {title}
Close
Search

Hit enter to search or ESC to close