Security News – Week 11

Two Critical Vulnerabilities Detected in Veeam Data Back-up Solution

Veeam Software has released updates to two critical security vulnerabilities affecting Backup & Replication, a backup solution for virtual environments.

Unauthenticated threat actors can exploit two security vulnerabilities tracked with codes CVE-2022-26500 and CVE-2022-26501 to remote code execution. The vulnerabilities exist in the Veeam Distribution service running on TCP port 9380 by default, allowing unauthenticated users to access internal Veeam API functions. Threat actors who exploit vulnerabilities to execute code on the target system can send inputs to the Veeam API to load and run malicious code.

Critical vulnerabilities affect Veeam Backup & Replication versions 9.5, 10, and 11. Unfortunately, Veeam Software has only released updates that fix the vulnerability for versions 10 and 11. For this reason, it is recommended that users using version 9.5 upgrade to a supported version.

Multiple Vulnerabilities Detected in Popular Package Managers

Security vulnerabilities have been detected in popular package managers, allowing threat actors to execute arbitrary code on the target system and access sensitive data. Package managers are tools that enable easy installation, updating, and configuration of third-party dependencies required by applications.

The detected security vulnerabilities are in the following package managers;
• Composer
• Bundler
• Bower
• Poetry
• Yarn
• pnpm
• Pip
• Pipenv

The vulnerability found in Composer and tracked with code CVE-2021-41116 is a Command Injection vulnerability that could allow remote threat actors to execute arbitrary commands on the target system. Argument Injection and Untrusted Search Path security vulnerabilities found in Bundler, Poetry, Yarn, Pip, and Pipenv can allow threat actors to execute arbitrary code on the target system via malware-laden Git or Gemfiles files.

The package managers fixed the vulnerabilities that were foreseen to be used in supply chain attacks shortly after the announcement. However, the Untrusted Search Path vulnerability affecting three package managers, Composer, Pip, and Pipenv, is still not fixed. In this context, it is recommended that users using vulnerable package manager versions immediately upgrade to the published updates in order not to be the target of attacks that can be carried out using vulnerabilities.

MuddyWater Threat Actors Target Turkey and Arabian Peninsula With A New Malware Campaign

Iranian state-backed MuddyWater threat actors have been associated with a new offensive campaign targeting Turkey and the Arabian Peninsula to plant remote access trojans (RATs) on compromised systems.

The chain of attacks begins with sending phishing e-mails containing malicious attachments to the recipients to distribute the SloughRAT (Canopy) trojan, which is responsible for executing commands received from command and control servers (C&C). The malicious document sent by the phishing e-mail contains a malicious macro that drops two WSF (Windows Script File) files on the target system. One of these scripts is used to execute the next phase and is placed in the current user’s Startup folder by a VBA macro to ensure persistence between reboots. The second script contains the “SloughRAT” malware, which will be used to execute arbitrary commands on the target system. This RAT consists of hidden Visual Basic and JavaScript code. After a series of malicious activities are carried out through malware, the data and results captured are transferred to C&C servers.

It has been determined that the campaign is a continuation of the November 2021 MuddyWater campaign, which targets Turkish private and government institutions with PowerShell-based backdoors for information gathering and espionage activities. To not be the target of this and similar malware campaigns, it is important to ignore e-mail attachments and links from unknown people, not to download files or programs from unknown sources, and conduct attack surface analyses at regular intervals. Also, It is recommended to raise awareness of institution/organization personnel against possible phishing / social engineering attacks and block detected IoC findings related to the campaign from security devices in use.

New Android Malware Detected to Hijack Google Authenticator MFA Tokens: “Escobar”

Security researchers have detected that the Aberebot Android banking trojan has been redistributed under the name ‘Escobar’ with new features added, including the hijacking of Google Authenticator multi-factor authentication (MFA) codes. Furthermore, it has been observed that the features added to the Aberebot malware developed to take control of infected Android devices via VNC, record audio, take pictures, and capture identity information, are also found in the newly detected Escobar variant. The ultimate goal of this malware is to gather the information that would allow threat actors to hijack targets’ bank accounts and perform unauthorized transactions.

Escobar malware is distributed to target systems as a fake McAfee Anti-Virus application. The malicious application downloaded to the user device requests 25 different permissions, which is 15 abused. It has been observed that if users approve the requested permissions, the malware gains access to the user’s contact directory, SMS, call logs, and sensitive data such as device location. In addition, the malware comes with the features of deleting files, sending SMS, making calls, and controlling the device camera via commands received from the C&C server, the ability to record calls and voice.

Threats targeting the banking sector are increasing and developing day by day. It is observed that Escobar and similar software are often distributed through unofficial sources such as forums. For this reason, it is recommended that Android users download their applications from official and reliable sources, pay attention to the permissions requested by applications and enable multi-factor authentication (MFA) features not to be exposed to similar malware campaigns. In addition, it is recommended to use reliable Anti-Virus / Anti-Malware solutions and prevent IoC findings related to the malware in question from the security solutions in use.