Log in Request a demo

Weekly Security News Archive, 2023.

This page holds the weekly security news issues and newsletters that Brandefense published. It covers the 10 items from January 2023 to June 2023 (2023). Each entry keeps its first title, publish date and text, newest first. Earlier addresses of these entries now lead to the matching entry here. The overview page lists all periods.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview

All 10 Entries On This Page

June 2023

Security News Digest | Security Newsletter | June 16, 2023

Published:

We’ve gathered darkweb insights, cyber security news, vulnerabilities, and CVEs, ransomware for you. Enjoy!

A Short-Look at The Dark Web

Here are the insights & security news from the darkweb. Learn and protect yourself before threats reach you. If you want to get more insight, follow us on Twitter and Subscribe to our Ransomware Newsletter!

  • AnonymousSudan claims to have launched a DDoS attack hitting 15,000 Microsoft users in the U.S.  The outage lasted for 1.5 hours. They warn of more to come! More about AnonymousSudan is on this thread.
  • On the dark web, a threat actor offers a harmful method that takes advantage of a vulnerability in PostgreSQL. This could be a 0-day threat. So, remain watchful and cautious of what you click on!

Important Security News

What happened in cyberspace in the last two weeks? Here is a quick shot of security news from the darkweb.

Microsoft Patch Tuesday: June 2023

Microsoft Patch Tuesday, the company’s monthly security update, has provided fixes for 70 vulnerabilities. Of these, 62 are classified as important, six as critical, one as moderate, and one as low.

These fixes cover some software, including Microsoft Office, Microsoft SharePoint, and Windows operating system parts. Critical vulnerabilities addressed include CVE-2023-29357 in SharePoint Server 2019. They also include CVE-2023-29363, CVE-2023-32014, and CVE-2023-32015 in the Windows operating system’s rollout of Pragmatic General Multicast (PGM).

CVE-2023-29357: The Elevation of Privilege vulnerability in Microsoft SharePoint Server 2019 has a CVSSv3 severity score of 9.8 and is labeled critical. An unauthenticated, remote attacker can exploit this vulnerability by sending a spoofed JWT authentication token to the target server. This lets the attacker assume the privileges of an authenticated user on that system.

CVE-2023—29363 / 32014 / 32015: These are Remote Code Execution (RCE) vulnerabilities in Windows Pragmatic General Multicast (PGM). They were assigned a critical severity rating of 9.8. An attacker who exploits these vulnerabilities could run arbitrary code on the target system with SYSTEM privileges.

Notably, the Elevation of Privilege (EoP) vulnerability CVE-2023-29357 in SharePoint Server 2019 is reported as having been used in a successful chained attack demonstration during the March Pwn2Own Vancouver contest. This vulnerability allows an unauthenticated, remote attacker to gain the privileges of an authenticated user by sending a spoofed JWT authentication token.

Microsoft recommends that users enable AMSI as mitigation, though the efficacy of this action remains untested.

Similarly, the Remote Code Execution (RCE) vulnerabilities in the Windows operating system’s PGM, CVE-2023-29363, CVE-2023-32014, and CVE-2023-32015, could allow an attacker to run code remotely. The attacker sends a harmful file to a vulnerable system. These vulnerabilities are only exploitable on systems with message queueing services enabled.

Another set of vulnerabilities, CVE-2023-28310 and CVE-2023-32031, are RCEs in some Microsoft Exchange Server versions. This allows an authenticated attacker to run arbitrary code or commands remotely. The affected versions are Microsoft Exchange Server 2016 Cumulative Update 23 and 2019 Cumulative Updates 12 and 13.

Another set of vulnerabilities, CVE-2023-28310 and CVE-2023-32031, are RCEs in some Microsoft Exchange Server versions. This allows an authenticated attacker to run arbitrary code or commands remotely. The affected versions are Microsoft Exchange Server 2016 Cumulative Update 23 and 2019 Cumulative Updates 12 and 13.

Also, CVE-2023-29362 is an RCE vulnerability in the Remote Desktop Client part of Windows operating systems and the Remote Desktop Client for Windows Desktop apps. It can be exploited by a remote attacker with control over a Remote Desktop Server.

Microsoft urges all users to promptly apply the updates provided in the Patch Tuesday release. This ensures their systems are protected against these vulnerabilities. As always, keeping software updated with the latest security patches is one of the best practices for keeping a secure and resilient system.

Updates ASAP

In March 2023, Microsoft Patch Tuesday updates, Microsoft has released 2 zero-days. After that, BRANDEFENSE Analysts’ investigation, threat actors posted about CVE-2023-24880 on a dark web forum. In the forum post, threat actors said that not all Windows systems had been updated yet. So they could continue to share the PoC. [Read More].

Threat actors always wait for your mistakes. Do not forget your updates.

MOVEit Transfer Software Exploited Through Critical Zero Day Vulnerability 2023

Ipswitch, a subsidiary of Progress Software Corporation, has been hit by a major cybersecurity vulnerability. Unknown hackers exploited it to attack its MOVEit Transfer software. The software is a popular application for firms and customers to transfer data securely. Found as CVE-2023-34362 – a zero-day vulnerability – Progress Software Corporation has issued a critical security advisory. It warns its customers to take precautionary measures at once.

The software developer advises all its customers to restrict access to outside traffic to ports 80 and 443 on MOVEit Transfer servers until patches have been installed. Progress notes that the recommendation is needed. It also concedes that it will affect the operations of certain apps such as MOVEit Automation tasks, API functions. The plugin features of the Outlook MOVEit Transfer.

Vulnerable to SQL injection that leads to remote code execution, cybersecurity company, Rapid7, has found the zero-day flaw in the software. With about 2,500 exposed servers, mainly in the United States, Rapid7 notes a common feature of all exploited devices is the ‘human2.asp’ webshell. It can run a series of commands if accessed with the correct password.

Scarily, these commands enable the attacker to retrieve vast amounts of data from the server, such as lists of stored files, user details, and Azure Blob Storage account configurations.

Reportedly some admins have reported discovering many unexpected files post-breach. What is worrying is that the breach likely began over the long Memorial Day weekend in the United States. System monitoring is often at its minimum then.

With a potential for data theft and exposure, cybersecurity experts are warning firms to shut down their MOVEit Transfers. They should wait until the issue is resolved and a full investigation for compromise has been conducted.

Charles Carmakal, CTO of Mandiant, strongly suggests that all firms using MOVEit Transfer should acquire a forensic examination. It would ascertain whether their system was hacked and if data was stolen. Also, Progress Software has confirmed that its cloud platform was impacted, possibly broadening the scope of victims. The company has released mitigation steps for on-premise and cloud-based systems. Experts recommend firms follow them.

Microsoft has attributed the attacks abusing the CVE-2023-34362 MOVEit Transfer 0-day vulnerability to Lace Tempest. It is known for ransomware operations and running the infamous Clop extortion site. The software giant has also published articles with IOCs, detections, and hunting guidance. It will continue to monitor the situation with stakeholders.

Second MFT 0-Day in Six Months: Cl0p Ransomware Gangs Announced They Exploit Over 130 Organizations

The zero day vulnerability in the GoAnywhere file-sharing software is tracked with the code CVE-2023-0669. It was first discovered on February 3, 2023. On February 6, 2023, an exploit code was released for this vulnerability. By February 10, 2023, Cl0p operators had announced that they had used the exploit to attack 130 firms… [Read more about the GoAnywhere attack on Hitachi].

“Triangulation Trojan” Launches Sophisticated Attack on Apple Devices

Security experts have uncovered an advanced, targeted cyberattack that uses Apple’s mobile devices. The attack, named “Triangulation,” is aimed at planting covert spyware into the iPhones of staff of certain firms, including middle and top management staff.

The cyberattack employs an invisible iMessage carrying a harmful attachment. Using many vulnerabilities within the iOS operating system, the attachment is run on the device, stealthily installing the spyware. This occurs without the need for user action. Once in place, the spyware discreetly relays private data back to remote servers. This includes microphone recordings, instant messenger photos, geolocation, and other user activity data.

The proprietary nature of iOS makes the detection and removal of this spyware especially hard. It requires the use of outside tools. A vital sign of the Triangulation presence is disabling iOS updates on the infected device. Also, a device backup should be made and checked using a unique utility for a more definitive infection confirmation. Kaspersky is also in the process of developing a free detection tool.

Unfortunately, the spyware blocks iOS updates in a specific way. So there is currently no strong method to remove the Triangulation without losing user data. The only recourse is to reset the infected iPhones to factory settings. You must then install the latest version of the operating system and the entire user environment anew. This is crucial. The spyware can re-infect through vulnerabilities present in an outdated iOS version.

The attack’s advanced nature is such that it remained largely undetected until anomalies within the network originating from Apple devices were picked up by Kaspersky’s Unified Monitoring and Analysis Platform (KUMA). This is a native Security Information and Event Management (SIEM) solution. Subsequent investigations revealed that some dozen iPhones belonging to senior staff were infected with the spyware.

Kaspersky is still investigating this incident, with more data to be shared in a dedicated post on Securelist. They expect further details on the global spread of this spyware will emerge in the coming days. Despite being targeted in this attack, Kaspersky stresses they were not the main objective. It also assures that their business processes and user data remain unaffected.

C2 Domains For Triangulation Trojan Attack

The source is SecurceList.

addatamarket[.]net.

backuprabbit[.]com.

businessvideonews[.]com.

cloudsponcer[.]com.

datamarketplace[.]net.

mobilegamerstats[.]com.

snoweeanalytics[.]com.

tagclick-cdn[.]com.

topographyupdates[.]com.

unlimitedteacup[.]com.

virtuallaughing[.]com.

web-trackers[.]com.

growthtransport[.]com.

anstv[.]net.

ans7tv[.]net.

Security News Headings

April 2023

Security News Digest | Security Newsletter | April 27, 2023

Published:

We’ve gathered dark web insights, cyber security news, vulnerabilities, and CVEs, ransomware for you. Enjoy!

Important Security News

What happened in cyberspace in the last two weeks? Here is a quick shot of security news from the world.

A New Trojan Pest Detected Targeting Android Users in Poland and Australia: Chameleon

A new banking trojan called Chameleon has been discovered by cybersecurity experts. It specifically targets Android users in Poland and Australia. Besides a cryptocurrency exchange app, the trojan, active since January, mimics other popular apps. These include an Australian government agency and a Polish bank.

The trojan is spread via hacked websites, Bitbucket hosting services, and Discord attachments. It has been observed that threat actors create the application icon by imitating the icons of ChatGPT, Chrome, and Bitcoin. This is done to distribute the malware.

In this way, malware does not arouse suspicion from users.

One of the notable features of Chameleon is its unique commands. They do not appear to be linked to any known Trojan families. This shows that the malware may be a new strain. Experts believe it is still in its early stages of development and comes with limited features.

Chameleon poses a major threat to Android users with its usual banking trojan features such as keylogging, SMS collection, launching overlay attacks and stealing cookies. Also, the malware includes a lock catcher module. It can detect if an Android device user is using a PIN, password or swipe. Chameleon can also disable Google Play Protect, making it harder for users to see and remove malware.

Although the current variant of Chameleon is not highly advanced, cybersecurity experts warn that it still abuses Accessibility Services.

This allows attackers to upgrade the malware further and cause more damage.

As a result, users are advised to be cautious with the following.

  • Links received via e-mails or text messages from unknown senders.
  • Always keep systems up to date, and.
  • Take advantage of full security tools.
Western Digital Suffers A Security Breach That Puts Its Internal Data In Danger

Western Digital is a famous Silicon Valley-based American computer drive manufacturer and data storage company. It has been hit by a recent data breach, according to a report by TechCrunch.

The hackers claim to have stolen more than 10TB of private data from the storage company. They are demanding more than $10 million in ransom. Still, Western Digital is refusing to cooperate with the hackers. Besides, the cybercriminals shared a sample of the stolen data with tech bloggers. They confirmed its authenticity.

Earlier this month, the company disclosed that an unauthorized third party had access to many systems used within the firm. The storage company did not provide further details about the attack’s size. It continued coordinating with law enforcement and forensic cybersecurity experts.

The attack forced Western Digital’s cloud network out of action for nearly two weeks. The company has only recently managed to get the consumer service My Cloud back online. The hackers claim to have customer data and private company data, such as the cellphone numbers of the company’s top executives.

It remains unclear who is behind the attack. The hackers have not found themselves. But they have warned that they will release the stolen data onto the hacking website Alphv. This will happen if they do not receive the ransom from Western Digital.

The storage company has not confirmed whether the leaked data includes customers’ private data, such as SSNs, DOBs, and banking data. Western Digital has also yet to ensure whether customer files were lost because of the security breach.

If the stolen data is released, it could harm the reputation of the publicly traded computer storage manufacturer. To avoid being the target of similar security breaches, it is advised to consider some of the security measures given below.

  • The system, software, program and other inventories used in the institution/firm should be used in the current versions. In these versions the vulnerabilities are eliminated.
  • Institution/firm staff should know about possible social engineering and phishing attacks.
  • Full security tools should be deployed in the firm’s network. Traffic should be proactively monitored to detect possible cyber attack attempts.
  • Using the Brandefense Threat Intelligence platform, a DPRS solution, is advised. It helps detect cyber threats and attacks targeting the brand and take quick action.

A Short-Look at The Dark Web

Here are the insights & security news from the dark web. Learn and protect yourself before threats reach you. If you want to get more insight, follow us on Twitter and Subscribe to our Ransomware Newsletter!

🔥URGENT: an Indian insurance regulator hit by Lockbit ransomware! Sensitive data leaked 💼🆔 & ransom deadline: April 18⏳ Don’t become the next victim! Stay informed & protect yourself with our in-depth analysis of Lockbit’s: LockBit 3.0 technical analysis report #CyberSecurity💡 pic.twitter.com/LKfNHu60ld.

— BRANDEFENSE | Digital Risk Protection Service (@Brandefense) April 13, 2023

  • Sophos EDR & Checkpoint Harmony EDR security software found for sale on the deep web! In nature, these products are used for malware detection. Threat actors may use them to test & evade the detection of their own malware.
  • The pro-Russian hacker group Noname057(16) has launched DDoS attacks on energy firms based in Germany and Sweden – RWE &amp. Vatenfall – citing political conflict related to the Russia-Ukraine war.

Security News Headings

Security News Digest | Security Newsletter | April 14, 2023

Published:

We’ve gathered dark web insights, cyber security news, vulnerabilities, and CVEs, ransomware for you. Enjoy!

A Short-Look at The Dark Web

Here are the insights & security news from the dark web. Learn and protect yourself before threats reach you. If you want to get more insight, follow us on Twitter and Subscribe to our Ransomware Newsletter!

No need to cut credit cards; just monitor for suspicious actions! We recently discovered a threat actor claiming to have ~1M private data records from a major US bank. Stay alert folks! And report any incidents to your bank! 🔐💳 #DataBreach #Financial #Cybersecurity pic.twitter.com/llb3bKnH1U.

— BRANDEFENSE | Digital Risk Protection Service (@Brandefense) April 12, 2023

  • In a Russian dark web forum, threat actors are targeting a China-based EPC company which provides R&D, and engineering services. The hackers are demanding $10,000 for the RAT they used in the attack.
  • A new MacOS secure-Websocket HVNC harmful tool was discovered on the dark web, using port 443 for authentication, which is concerning, ’cause this port is often open by default!

Important Security News

What happened in cyberspace in the last two weeks? Here is a quick shot of security news from the world.

Attacks Using Realtek and Cacti Vulnerabilities Increase

Security experts must be aware of the recent surge in attacks targeting vulnerabilities in Cacti and Realtek devices on Windows and Linux servers. These vulnerabilities are being exploited by threat actors. They deploy ShellBot and Moobot botnet malware to gain control of vulnerable systems.

Moobot exploits an arbitrary command injection vulnerability in Realtek Jungle SDK (CVE-2022-46169) and a command injection vulnerability in Cacti (CVE-2021-35394). It communicates with a command and control (C2) server using heartbeat messages. It scans for other known bots, killing their processes to launch distributed denial of service (DDoS) attacks.

On the other hand, ShellBot mainly targets the Cacti flaw to deploy new malware variants.

The second variant is especially dangerous due to its extensive set of commands and many types of flooding attacks.

It’s worth noting that some other attackers have also used these same vulnerabilities to deploy other botnet malware, such as Fodcha, Gafgyt, Mirai, Mozi, and RedGoBot.

Software updates have been released to address these vulnerabilities. Still, many firms use vulnerable devices, exposing them to these attacks.

So, security experts should advise firms to do the following.

  • Update their Cacti and Realtek devices to the patched versions as soon as possible.
  • Continue to monitor their systems for any signs of IoCs, and.
  • Use best practices for securing their networks, such as applying patches promptly, using strong passwords, and limiting access to private data.
New Windows CLFS 0-Day Vulnerability Used in Ransomware Attacks

The critical Windows CLFS 0-day vulnerability was addressed by Microsoft in the April 2023 security patches. It was found to be used in Ransomware attacks by threat actors.

The vulnerability, code CVE-2023-28252, affects the CLFS (Common Log File System) driver. It allows local threat actors to elevate their privileges to SYSTEM privileges. The US CISA has found findings about the use of the vulnerability in attacks where the distribution of Nokoyawa Ransomware software is provided.

All federal agencies are expected to fix the vulnerability upon detection by May 2, 2023. At the same time, Kaspersky Lab security experts have found evidence of active exploitation of the vulnerability in Nokoyawa attacks. Attacks using the vulnerability target small and medium-sized firms in the Middle East, North America, and Asia regions.

To prevent active exploitation of the vulnerability, no detailed explanation will be made yet.

It is advised to take the following precautions into consideration. They help avoid being the target of ransomware or other attack campaigns that can be carried out using the vulnerability.

  • Security updates that fix vulnerabilities should be applied to vulnerable systems at once.
  • E-mails, attachments, and links from unknown parties should not be trusted, opened.
  • Full security tools should be used.
  • Care should be taken against social engineering/phishing attacks that may be carried out during the distribution phase of the malware.
A New Stealer Targeting Cryptocurrency Users Through Phishing Sites Detected: “Creal”

The phishing site is impersonating a real Cryptocurrency mining platform. Users click the “Download Kryptex” button to download the crypto money application to their computers. They are then directed to the Dropbox page. There a ZIP file containing the Creal Stelar malware is hosted.

THE STEALER SOFTWARE IS CODED IN PYTHON, AND THE SOURCE CODE IS AVAILABLE IN A PUBLIC GITHUB REPOSITORY, ALLOWING OTHER THREAT ACTORS TO MODIFY THE CODE TO SUIT THEIR NEEDS. So, it is a foreseeable scenario for some stealer malware to emerge from the source code of Creal Stealer. It would pose a major threat to users.

Also, about 50 examples of the use of the malware in question have been observed in the wild. This shows that threat actors are actively using Open Source code.

Creal provides permanence by copying itself on the infected system. In the data collection process defines global variables by including keywords such as cookieWords, passwWords, CookieCount, P4sswCount, WalletsZip, GamingZip, and OtherZip.

The module that handles Stelar malware’s data collection targets Chromium-based browsers, chat and gaming apps, cold crypto wallets, and browser extensions.

The phishing site looks like the image below.

Security News Headings

March 2023

Security Newsletter | March 30, 2023

Published:

We’ve gathered dark web insights, cyber security news, vulnerabilities, and CVEs, ransomware for you. Enjoy!

A Short-Look to The Dark Web

Here are the insights from dark-web. Learn and protect yourself before threats reach you. If you want to reach more insight, follow us on Twitter and Subscribe to our Ransomware Newsletter!

  • Meow stealer (A NEW MALWARE), as we found out, only 4 out of 26 antivirus scanners can detect it. It steals private data like browser info, crypto wallets, messaging apps, password managers, Discord tokens, and Windows product keys.
  • An alleged 7GB database leak exposes data of 50M Instagram users – emails, names, followers, following, bios, status, last update & locations.
  • Powerful macOS Stealer is now on the dark web. It can extract passwords and cookies from Chrome, Firefox, Brave, and Edge browsers. Also, it extracts the credit card details from the browsers we say above.
  • Brandefense Cyber Threat Intelligence (CTI) analysts uncovered a Russian underground forum post claiming to have breached a multinational energy company’s China database, with 7GB of private data offered for $3000.

Security News of the Last Two Weeks

What happened in cyberspace in last two weeks? Here is a quick shot of security news from the world.

Adobe Acrobat Sign Abused in Redline Stealer Distribution Campaigns

Avast security experts have observed that the Adobe Acrobat Sign software is being manipulated in Redline Stealer distribution campaigns by threat actors. It allows registered users to send document signing requests to anyone.

This will create an email that will be sent to the targeted recipients. It contains a link to the document (PDF, Word document, HTML) that will be hosted on Adobe’s servers. The sender can also add text to the email. This is an important detail that can be easily exploited by cybercriminals.

Adobe Acrobat Sign abused to spread RedLine Stealer: full story.

Microsoft Fixes Multiple Vulnerabilities in March 2023 Updates

Microsoft has released its March 2023 Patch Tuesday software updates, which include two zero-days. The first vulnerability is an information disclosure issue. It can allow a remote attacker to send crafted email messages to a victim’s inbox. This will cause Windows Mail or Outlook to crash and restart. This allows the attacker to get the NTLMv2 hash of the victim’s account.

Learn More.

Threat Actors Behind GoAnywhere Attacks Target Japan-based Hitachi Energy Firm

Hitachi Energy has confirmed a data breach as part of the GoAnywhere attacks. The Cl0p ransomware gang behind the attacks exploited a 0-day vulnerability in Fortra GoAnywhere MFT (Managed File Transfer) to gain access. Recently, it was discovered that a third-party software provider named FORTRA GoAnywhere MFT was vulnerable to a zero-day vulnerability. It was being used in attacks by the Cl0p ransomware group targeting institutions/firms in some countries.

GoAnywhere attack on Hitachi: full story.

Apache Fineract Has Three Critical SQL Injection Vulnerabilities | CVE-2023-25196

Three critical vulnerabilities have been discovered in Apache Fineract. It is a platform designed to bring the world’s unbanked population into the modern financial ecosystem. These vulnerabilities, namely CVE-2023-25195, CVE-2023-25196, and CVE-2023-25197, could allow unauthorized users to access private data or take control of the system.

Learn More.

Hackers Are Targeting Organizations with FortiOS Vulnerability Exploitation

Hackers exploit a severe vulnerability, CVE-2022-41328, in FortiOS – an operating system widely used by governments and large firms. This flaw enables them to run arbitrary code and has already caused data loss and system corruption in targeted firms.

Learn More.

February 2023

Weekly Security News – Week 8

Published:

Welcome to our 8th Weekly Security News. We’ve gathered the most speculative cyber security news for you. Keep reading to learn details about this week’s security news and protect yourself proactively.

See you in next week’s News!

Fortinet Releases Critical Updates for FortiOS, FortiNAC and More

Fortinet has released security updates to address 40 security vulnerabilities hitting its FortiWeb, FortiOS, FortiNAC, and FortiProxy tools. Two of the 40 vulnerabilities found are considered critical, and 15 have a high level of importance.

Two of Fortinet’s Vulnerabilities are 9.8/10 Score

The critical vulnerabilities include CVE-2022-39952, a remote code execution (RCE) vulnerability in FortiNAC’s keyUpload script that could allow unauthorized code or commands to be run by unauthenticated threat actors through crafted HTTP requests. The affected versions include the following.

  • FortiNAC 9.4.0.
  • FortiNAC 9.2.0 – 9.2.5.
  • FortiNAC 9.1.0 – 9.1.7.
  • FortiNAC 8.8 all versions.
  • FortiNAC 8.7 all versions.
  • FortiNAC 8.6 all versions.
  • FortiNAC 8.5 all versions, and.
  • FortiNAC 8.3 all versions.

The second critical vulnerability, CVE-2021-42756, affects FortiWeb Proxy and is caused by a stack-based buffer overflow vulnerability. This vulnerability could allow an unauthenticated, remote threat actor to run arbitrary code on vulnerable systems through crafted HTTP requests. The affected versions include the following.

  • FortiWeb 5. x all versions.
  • FortiWeb 6.0.7 and below.
  • FortiWeb 6.1.2 and below.
  • FortiWeb 6.2.6 and below.
  • FortiWeb 6.3.16 and below, and.
  • all versions of FortiWeb 6.4.

Fortinet has also released security updates for other vulnerabilities hitting FortiADC, FortiExtender, FortiOS, FortiProxy, FortiSwitchManager, FortiWAN, FortiAnalyzer, FortiAuthenticator, FortiPortal, and FortiSandbox. Users are advised to apply the updates promptly to avoid possible attacks abusing these vulnerabilities.

Critical Vulnerability Alert in ClamAV

A critical remote code execution vulnerability has been discovered in ClamAV, an open-source anti-virus software by Cisco. It is an open-source (GPLv2) virus protection solution designed for email scanning, especially in mail gateways.

The security vulnerability, found as CVE-2023-20032, is due to a memory error resulting from the unchecked buffer size in the HFS+ file parser part. Threat actors can take advantage of this security vulnerability by sending an HFS+ partitioning file prepared by ClamAV for scanning to a vulnerable device.

Successful exploitation of the vulnerability by threat actors can result in the execution of arbitrary code with the same privileges as the ClamAV scanning process or a denial of service (DoS) condition.

The Affected ClamAV Applications
  • Secure Endpoint (Advanced Malware Protection) for Windows, MacOS, and Linux devices.
  • Secure Endpoint Private Cloud.
  • Secure Web Appliance.

It has been confirmed that the Secure Email Gateway and Secure Email and Web Manager products are not affected by the vulnerability.

Besides the above vulnerability, a ClamAV information disclosure vulnerability hitting the DMG file parser, tracked by code CVE-2023-20052, has also been resolved with the release of versions 0.103.8, 0.105.2, and 1.0.1. It is advised to apply the released updates promptly to avoid being targeted by attacks that can be carried out using the vulnerabilities.

Reddit Suffered a Security Breach Resulting in Unauthorized Access to Internal Systems

Reddit suffered a security breach resulting in access without permission to its internal systems, private documents, and system source code by threat actors. The breach occurred through a phishing campaign targeting Reddit staff, where threat actors used a fake login page mimicking the company’s intranet site to get staff member login credentials and two-factor authentication tokens.

Reddit released that user accounts and passwords are safe

Reddit confirmed the success of the phishing attack, stating that one staff member’s login credentials were hacked. This allows threat actors to gain access to its internal systems, certain internal documents, source codes, internal dashboards, and other business systems. But Reddit reassured users that their passwords and accounts were not hacked. The affected staff member reported the incident.

The security team quickly responded by removing the attacker’s access and running an internal investigation.

Reddit advised users enable two-factor authentication and often update their login credentials with strong password policies to avoid possible risks.

Weekly Security News – Week 6

Published:

Welcome to our 6th Weekly Security News. We’ve gathered the most speculative cyber security news for you. Keep reading to learn details about this week’s security news and protect yourself proactively.

See you next week!

Code Signing Certificates for GitHub Desktop and Atom Apps Suffered Unauthorized Access

On December 7, 2022, GitHub discovered that a series of repositories used in the planning and development of GitHub Desktop and Atom were accessed by unknown threat actors without authorization. After a full investigation, it was announced that the services were not at risk, and no unauthorized changes were made to these projects as a result of this access without permission.

As a result of the access without permission, a number of encrypted code signing certificates for GitHub Desktop and Atom apps were leaked. The certificates are password-protected, and no evidence of harmful use has been observed so far. But if the password of the certificates is decrypted, the threat actor can act as if they have been officially created by GitHub by signing unofficial apps with these certificates.

They will cancel the open certificates used for GitHub Desktop and Atom

As a preventive measure, GitHub announced that they will cancel the open certificates used for GitHub Desktop and Atom apps. This cancellation of certificates will make some versions of GitHub Desktop for Mac and Atom invalid. But this edit will not affect GitHub Desktop for Windows. The following versions of GitHub Desktop for Mac will be removed from use on February 2:

  • 1.2.
  • 1.1.
  • 1.0.
  • 0.8.
  • 0.7.
  • 0.6.
  • 0.5.
  • 0.4.
  • 0.3.
  • 0.2.

GitHub Atom will also stop serving the following versions on February 2:

  • 63.1.
  • 63.0.

It is advised that users switch to previous versions of the apps that are not affected by the breach to continue using GitHub Desktop and Atom.

Adobe Acrobat Reader DC RCE Vulnerability: Exploit Code Released

A recently patched critical Remote Code Execution (RCE) vulnerability in the Adobe Acrobat Reader DC software has been found with the publication of proof-of-concept (PoC) exploitation code.

The security vulnerability, coded as CVE-2023-21608, arises from a Use-After-Free error that could cause arbitrary code execution in a current user session. The threat actor could exploit this security vulnerability by convincing users to open a crafted document. This allows them to use the user’s privileges to run arbitrary code on the system or cause the application to crash.

Adobe Released the Security Bulletin for Adobe Acrobat Reader

Adobe recently patched the vulnerability through a security bulletin. Shortly after the release of the update, Hacksysteam security research announced the publication of PoC code targeting the exploitation of CVE-2023-21608 vulnerability.

To avoid being targeted by attacks that could be carried out using the vulnerability and exploitation code, it is advised that users who are using vulnerable Adobe Acrobat Reader DC versions upgrade to the current version where the vulnerability has been fixed.

RCE Alert in IBM WebSphere Application Server

A critical security vulnerability has been found in IBM WebSphere Application Server that can cause remote code execution by threat actors.

The security vulnerability (coded as CVE-2023-23477) is caused by an incorrect authentication that occurs during data processing. A remote threat actor can run random code on the targeted system by sending specially prepared data to the server.

IBM released a security bulletin

This vulnerability affects versions of IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server 8.5. IBM has released updates to fix the vulnerability. To avoid being targeted in attacks that can be carried out using the vulnerability, it is advised that users of the following versions of the IBM WebSphere Application Server apply the latest updates at once:

For IBM WebSphere Application Server users who use versions between 9.0.0.0 and 9.0.5.7:

  • Apply Fix Pack 9.0.5.8 or a later version.

For IBM WebSphere Application Server users who use versions between 8.5.0.0 and 8.5.5.19:

  • Apply Fix Pack 8.5.5.20 or later versions.

Critical Vulnerability Alert in Atlassian Jira Service Management Server and Data Center

A critical security vulnerability has been detected in the Jira Service Management Server and Data Center tools built by Atlassian.

The vulnerability, coded as CVE-2023-22501, is caused by a faulty authentication control. The threat actor can exploit this vulnerability by using a specially prepared request to impersonate another user and gain access to a Jira Service Management session. The vulnerability affects the following versions:

  • 3.0.
  • 3.1.
  • 3.2.
  • 4.0.
  • 4.1.
  • 5.0.
Atlassian solved the vulnerability for Jira Service Management Server and Data Center

The vulnerability is resolved in versions 5.3.3, 5.4.2, 5.5.1, 5.6.0, and later. It is advised that users of vulnerable versions upgrade promptly to a version that resolves the vulnerability.

Weekly Security News – Week 5

Published:

Welcome to our 5th Weekly Security News. We’ve gathered the most speculative cyber security news for you. To learn details about this week’s security news and protect yourself proactively, keep reading.

See you next week!

Multiple Vulnerabilities in ChromeOS

Many security vulnerabilities have been detected in ChromeOS that could allow remote attackers to run code remotely and access private data in affected installations.

The vulnerabilities include the following.

  • User-After-Free error hitting Google Chrome’s WebTransport part (CVE-2023-0471).
  • Use-After-Free error hitting Google Chrome’s WebRTC part (CVE-2023-0472).
  • Type Confusion errors hitting Google Chrome’s ServiceWorker API part (CVE-2023-0473), and.
  • Use-After-Free error hitting Google Chrome’s GuestView part (CVE-2023-0474).

Google has released updated versions to address these vulnerabilities. It is advised to apply the updates promptly to avoid being targeted by possible attacks.

Critical RCE Alarm in VMware vRealize Log Insight

VMware has released updates for four security vulnerabilities that could have allowed remote code execution in the VMware vRealize Log Insight solution. vRealize Log Insight is a log management tool that helps to collect, view and study logs from monitoring or network tools.

The critical vulnerabilities, found as CVE-2022-31706 and CVE-2022-31704, are caused by directory traversal errors and improper access restrictions.

The company has released version 8.10.2 of VMware vRealize Log Insight, which addresses these vulnerabilities. There have been no findings of active exploitation of these vulnerabilities. It is advised that these updates be applied as soon as possible to prevent possible attacks.

A Critical Vulnerability Affecting QNAP NAS Devices Has Been Detected

QNAP has released security updates that fix a critical security vulnerability hitting QNAP NAS devices.

The vulnerability, tracked as CVE-2022-27596, could allow a remote threat actor to take control of the system by injecting harmful code into affected QNAP NAS devices. Exploiting the vulnerability does not require user interaction or privileges. The vulnerability affects firmware versions QTS 5.0.1 and QuTS hero h5.0.1.

QNAP Released Security Updates

It has released security updates that fix the vulnerability. To avoid attacks that can be carried out using the vulnerability, it is advised to at once apply the published QTS or QuTS hero firmware updates.

Critical RCE Alert on Western Digital My Cloud OS

In Western Digital My Cloud OS 5 devices, a critical security vulnerability has been found, which could allow attackers to remotely run code through reverse shell methods.

The vulnerability is caused by a command that reads data from a privileged position without adequately cleaning it before creating a system command. The vulnerability affects some Western Digital tools, including My Cloud PR2100, My Cloud PR4100, My Cloud EX4100, My Cloud EX2 Ultra, My Cloud Mirror G2, My Cloud DL2100, My Cloud DL4100, My Cloud EX2100, My Cloud, and WD Cloud.

Western Digital has released update

The company has released firmware version 5.26.119 to address the vulnerability. It is advised that users apply the update as soon as possible to avoid possible targeted attacks.

January 2023

Weekly Security News – Week 4

Published:

Welcome to our 4th Weekly Security News. We’ve gathered the most speculative cyber security news for you. To learn details about this week’s security news, and protect yourself proactively, keep reading.

See you next week!

Critical SQLi Alarm in CakePHP

A critical security vulnerability has been detected in the CakePHP Framework, which is designed to develop web apps using the PHP programming language.

The vulnerability, found as CVE-2023-22727, allows remote attackers to carry out SQL injection attacks on affected installations. The vulnerability is caused by insufficient cleaning of user-provided inputs.

The vulnerability has been fixed in versions 4.2.12, 4.3.11, and 4.4.10 of CakePHP. Users of vulnerable versions are advised to upgrade at once. If upgrading is not possible, users can consider using the Pagination library of CakePHP to address the issue.

PayPal Data Breach That Puts More Than 34,000 User Accounts in Danger

A data breach at PayPal was recently discovered, possibly hitting millions of users. On 20 December 2022, PayPal confirmed that they had discovered a data breach hitting user accounts. The company stated that the incident occurred due to a large-scale credential stuffing attack.

Credential stuffing is a type of cyber attack in which hackers use lists of stolen usernames and password combinations to gain access without permission to accounts on some websites.

The data that was possibly accessed includes customer names, email addresses, phone numbers, birthdates, social security numbers, and individual tax identification numbers. There is also a risk that threat actors may access users’ transaction histories, linked credit or debit card details, and PayPal billing data from their PayPal accounts.

PayPal has advised affected customers to change their passwords and monitor their account activity for any suspicious activity. The company has also stated that it will be giving free credit monitoring and identity protection services to impacted customers. If you believe your account may have been affected by the PayPal data breach, it’s key to take quick action to protect yourself. Here are some steps to take:

PayPal has assured customers that they are taking all needed steps to prevent future incidents and protect customer data. In the meantime, it’s important to take the needed precautions to protect yourself and your data.

More than 19,000 Cisco Router Solutions Detected to be Vulnerable to RCE Attacks

It has been detected that more than 19,000 Cisco VPN router devices are exposed to remote code execution (RCE) attacks due to the completion of their lifespan. These devices no longer receive security updates from Cisco, leaving them vulnerable to attacks.

On January 11, 2023, details about a critical security vulnerability hitting the Cisco Small Business router series were released. The vulnerability, found by the code CVE-2023-20025, occurs due to insufficient authentication on the web-based management tool. This allows unauthorized threat actors to bypass authentication controls and gain administrative privileges to run arbitrary commands on the vulnerable system.

The vulnerability affects four different Cisco Small Business router models: RV016, RV042, RV042G, and RV082. Cisco has stated in a released advisory that they will not be issuing software updates to address the vulnerability, as the affected models have reached the end of their lifespan, and no temporary solution to address the vulnerability has been found.

Studies on the Censys scan engine have observed that about 20,000 devices are vulnerable to possible attacks using this vulnerability.

Cisco has published a list of devices that have the potential to be affected by the attacks. Cisco router users are advised to check if their devices are on the list of affected devices and upgrade to a newer, supported version as soon as possible. Also, users are advised to set up network segmentation and use firewall tools to help reduce possible attacks.

Critical RCE Alert in Apache Airflow MySQL Provider

A critical security vulnerability has been detected in the Apache Airflow MySQL Provider library that could allow threat actors to run remote code in affected installations. Apache Airflow is an open-source workflow management platform used to programmatically write, schedule, and monitor workflows. The MySQL Provider is a library used to provide a MySQL connection.

The vulnerability, found by the code CVE-2023-22884, is a command injection security vulnerability hitting versions of Apache Airflow prior to 2.5.1 and Apache Airflow MySQL Provider prior to 4.0.0. A remote threat actor can run arbitrary commands on the target system by sending crafted data to the application.

It is advised to upgrade to the current versions that fix the vulnerability as soon as possible to avoid being targeted by attacks that can be carried out using the vulnerability.

Weekly Security News – Week 2

Published:

Critical RCE Alarm in jsonwebtoken (JWT) Library

A critical vulnerability has been found in the open source jsonwebtoken (JWT) library that could allow threat actors to run code on the affected server remotely. JsonWebToken is an open-source JavaScript package that allows validation of JWTs used for authorization and authentication uses. The package built by Auth0 has more than 9 million weekly downloads and over 20,000 dependencies and plays a major role in authentication/authorization features for many apps.

The vulnerability, tracked as CVE-2022-23529 (this CVE ID was later rejected), affects earlier versions of JsonWebToken 9.0.0. The vulnerability allows threat actors to bypass authentication methods, run code on the vulnerable system, gain access to private data, and hijack or alter data.

In JsonWebToken version 9.0.0, the code snippet with the vulnerability has been removed, and the vulnerability has been fixed. It is advised that users using the affected library versions at once apply the update that fixes the vulnerability.

Maximum Severity Vulnerability on Synology VPN Plus Server

A critical security vulnerability has been found in Synology VPN Plus servers, which were built to transform Synology Router tools into an advanced VPN (virtual private network) server, that could cause threat actors to run code remotely in affected versions.

The security vulnerability tracked as CVE-2022-43931 is due to a boundary error in Remote Desktop Features and affects Synology VPN Plus Server versions before 1.4.3-0534 and 1.4.4-0635. The vulnerability could allow remote threat actors to run code on the vulnerable system.

Synology Released Patch for Synology VPN Immediately

Synology fixed the vulnerability right away after being discovered by Synology Incident Response Team (PSIRT). It had a maximum severity score of 10 out of 10.

To avoid being the target of attacks that can be carried out using vulnerabilities, it is advised to upgrade to Synology VPN Plus Server 1.4.3-0534 or 1.4.4-0635 versions.

Critical 0-Day Alarm Affecting Windows ALPC

As part of the January 2023 updates, Microsoft has released updates that fix 98 security vulnerabilities, including a 0-day vulnerability, Windows ALPC.

The details of the detected 0-day security vulnerability are as follows.

  • The vulnerability tracked as CVE-2023-21674 is a critical Privilege Escalation vulnerability that affects Windows’s ALPC (Advanced Local Procedure Call)  part. The vulnerability due to the boundary fault could allow threat actors to run code with SYSTEM privileges on the affected system. Advanced Local Procedure Call is a message-forwarding method used in Windows systems.

It is known that threat actors actively exploit this vulnerability. Microsoft has released security updates that fix other vulnerabilities, including this one. It is advised to at once apply the published updates to vulnerable products and versions in order not to be the target of attacks that can be carried out using vulnerabilities.

Weekly Security News – Week 1

Published:

Critical Vulnerabilities on Lenovo ThinkPad X13s BIOS

Security vulnerabilities have been found that affect the BIOS software of Lenovo ThinkPad X13s model devices and may cause threat actors to run code remotely on the affected system and access private data of the local user. (Reference Link).

The details of the found vulnerabilities are as follows.

The vulnerabilities tracked as CVE-2022-40516, CVE-2022-40517, and CVE-2022-40520, are stack-based buffer overflow security vulnerabilities that could allow a local threat actor with elevated privileges to cause memory corruption in the Qualcomm BIOS.

The vulnerabilities, tracked as CVE-2022-40518 and CVE-2022-40519 in the Qualcomm BIOS, allow a local threat actor with elevated privileges to access memory contents.

The vulnerabilities tracked as CVE-2022-4432, CVE-2022-4433, CVE-2022-4434, and CVE-2022-4435, which are in the ThinkPad X13s BIOS, allow a local threat actor with elevated privileges to access memory contents.

These vulnerabilities affect versions before ThinkPad X13s BIOS 1.47. To avoid being the target of attacks that can be carried out using vulnerabilities, it is advised to upgrade to current versions that fix the vulnerability.

Godfather Trojan Activity Targeting Financial Sector Detected

The Group-IB Threat Intelligence team detected that the Godfather Android banking trojan targeted more than 400 international financial firms between June 2021 and October 2022. Half of the targeted financial firms are banks, and the other half are cryptocurrency wallets and exchanges. The Godfather’s targets include 49 US-based firms, 31 Turkish-based firms, and 30 Spanish-based firms.

Financial service providers in Canada, France, Germany, England, Italy, and Poland are among the hardest-hit firms.

The Godfather trojan was built using the source code of another banking trojan called Anubis. But The Godfather differs from Anubis with its updated features, such as updated command and control (C&C) contact, traffic encryption algorithm, a new module for managing virtual network computing (VNC) connections, and Google Authenticator OTPs.

The Godfather is spread through fake apps hosted on Google Play. Fake pages are placed on Godfather-infected devices. These fake web pages are opened when users click on fake notifications or open real apps targeted by the Godfather. All data entered on these pages (usernames and passwords) is sent to command and control (C&C) servers.

Godfather trojan software can do the following on an infected system.

  • Recording the device’s screen.
  • Creating VNC connections.
  • Capturing keystrokes (keylogging).
  • Leaking push notifications and SMS messages (to bypass 2FA).
  • Send SMS messages.
  • Forward calls.
  • Execute USSD requests.
  • Start proxy servers.
  • Enabling silent mode.
  • Establishing WebSocket connections.

A Godfather sample analyzed in September 2022 was observed to mimic Google Protect. When a user launches a harmful application, the application imitates the real Google application. But the Godfather actions are running in the background.

Once the malware is launched, it persists on the infected device, creates a pinned notification, and hides its icon from the list of installed apps. Considering these details, it is advised to consider the following security recommendations to avoid being a victim of targeted attacks that the Godfather malware may carry out.

  • Emails, attachments, and links from unknown parties should not be respected.
  • Downloaded apps should be downloaded from real application stores, and by checking the evaluations made.
  • Full security tools should be used.

A Music Streaming Service’s User Data Detected Shared on Underground Forums

A music streaming service was exposed to a security breach in September 2019 that resulted in a user data vulnerability. The company stated that the breach was carried out by compromising the security of 3rd party partners and that users’ private data, such as payment data or passwords, were not affected by the breach.

But during the intelligence studies, it was detected that threat actors in underground forums leaked the user data gained in the September 2019 breach.

The leaked data includes some personal data of the service’s users, such as name, surname, gender, date of birth, e-mail address, location data, IP address, and username. Threat actors who shared the post stated that the breach occurred because a third party made a publicly accessible backup of the data.

Users of the service are advised to be aware of the leaked data, not to trust e-mails, attachments, and links from unknown parties, and to change the password data used on the platform by applying strong password policies.

Also, it is advised that institutions/firms and firms store and back up their data in a secure and inaccessible way, keep their systems up-to-date, and benefit from full security tools in order not to be the target of data breaches.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview

Know What Is Exposed. Before Attackers Do.

Book a demo of the platform.

  • 4.7Gartner Peer Insights
  • 24hEarly warning time
  • 190+Countries covered

What you see in the demo

  1. Your exposureAssets and services seen from the outside, starting from your own domain.
  2. Threats aimed at youLeaked credentials, look-alike domains and brand abuse in one view.
  3. From alert to actionHow findings reach your team and what to do next.