Weekly Security News Archive, Q1 2022.

This page holds the weekly security news issues and newsletters that Brandefense published. It covers the 5 items from February 2022 to March 2022 (2022 Q1). Each entry keeps its original title, publish date and text, newest first. Earlier addresses of these entries now lead to the matching entry here. The overview page lists all periods.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview

All 5 Entries On This Page

• Security News – Week 13 (31 Mar 2022)
• Security News – Week 12 (23 Mar 2022)
• Security News – Week 11 (16 Mar 2022)
• Security News – Week 10 (9 Mar 2022)
• Security News – Week 7 (19 Feb 2022)

March 2022

Security News – Week 13

Published: 31 March 2022

Malicious Applications Distributed on Google Play Detected to Target Facebook Accounts

It has been determined that Facestealer malware targeting Android users is distributed on Google Play and third-party application stores under the name Craftsart Cartoon Photo Tools.

The Craftsart Cartoon Photo Tools application allows users to upload an image and convert it into a cartoon image. It has been determined that the malware distributed within the application is FaceStealer malware, also called Android/Trojan.Spy.Facestealer.

When users open an application like Craftsart Cartoon Photo Tools, they are greeted with a verification screen that directs them to Facebook. At this point, an injected malicious Javascript code sends the login credentials to a C&C server. Then, on an infected Android device with malware, It captures the user’s Facebook data, such as e-mail address, IP address, credit card information, chat archive and other connected session information.

The malicious piece of code that sends data to the C2 server:

The mobile app imitates the behavior of popular photo editing apps to reach a large audience and ensure confidentiality. In this way, the security measures of the application markets are bypassed. In this context, it is recommended to use MDM software and Anti-Malware solutions, which are corporate mobile device management applications. In addition, it is important to prevent the IoC findings of the pest from the security solutions in use.

Storm Cloud APT Group Targets macOS Systems

Volexity security researchers have detected unauthorized access to a MacBook Pro device running macOS 11.6 via the GIMMICK malware associated with the Storm Cloud APT group. It has been observed that Windows systems were targeted in past attacks using GIMMICK malware.

GIMMICK is used in attacks by Storm Cloud threat actors of Chinese origin known to target organizations in Asia. GIMMICK is a multi-platform malware family with advanced features that uses cloud hosting services such as Google Drive to communicate with command and control (C2) servers. The newly detected macOS variant is written in Objective C, but other variants which target Windows systems are known to be developed with .NET and Delphi. Despite fundamental differences in the programming languages used and targeted operating systems, variants are followed under the same name due to shared C2 architecture, file paths, and behavior patterns.

GIMMICK can be launched as a daemon or directly by the user on macOS systems. In a scenario where GIMMICK is run by a user, the malware first leaves the PLIST file it contains in the /Users/<username>/Library/LaunchAgents directory, so it installs itself as a “Launch Agent” created for a specific logged-in user. Consequently, when that user logs on to the vulnerable system every time, GIMMICK malware is executed. In addition, the technical analysis revealed that customized the malware to imitate an application commonly launched by the targeted user.

It has been observed that the malware samples examined regarding the GIMMICK malware family have a highly developed and complex structure, and it is expected different operating systems will also be targeted through this malware. To not be the target of similar attacks that may be carried out, it is especially recommended that MacOS users regularly check persistence locations such as LaunchAgents and LaunchDaemons or benefit from security solutions developed for this purpose, monitor network traffic and Proxy activity. In addition, it is important to enable Apple XProtect, MRT services, and prevent the detected IoC findings related to malware from the security solutions used.

Critical Vulnerability Affected SonicWall Firewall Solutions

SonicWall has released security updates that address a critical vulnerability that affects Firewall solutions. An unauthenticated, remote threat actor could exploit this vulnerability to execute arbitrary code and trigger a denial of service (DoS) condition on the vulnerable system.

The vulnerability tracked code CVE-2022-22274 exists due to a stack-based buffer overflow error in SonicOS’s web management interface that could cause remote code execution or a denial of service via a specially crafted HTTP request.

The critical vulnerability affects 31 different SonicWall Firewall solutions running the versions listed in the table below.

SonicWall stated that no evidence has yet been found for active exploitation of the vulnerability. To not be the target of attacks that can be carried out using the vulnerability, it is recommended that users who use vulnerable versions immediately apply updates that fix the vulnerability. Additionally, until updates are implemented, SonicWall advises customers to limit SonicOS management access to trusted source IP addresses.

A New Linux Backdoor Detected to Deployed with Log4Shell Vulnerabilities

A new Linux backdoor that is deployed through Log4Shell security vulnerabilities and communicates with command and control servers (C&C) using the DNS tunnelling method has been detected by Netlab 360 security researchers.

In the researchers’ analyses, it has been observed that the backdoor called “B1txor20” targets systems with Linux ARM X64 CPU architecture, spreads through Apache Log4Shell vulnerabilities detected towards the end of 2021, and uses DNS tunnel technology to create a C&C communication channel. In addition to traditional backdoor functions, B1txor20 also enables Socket5 proxy, downloading Rootkit payloads from a remote server and performing data theft. Another critical factor detected related to malware is not using many advanced features. This shows that the developers of B1txor20 have developed and customized different functions according to different scenarios. The malware, which infects vulnerable systems, sends the captured sensitive information, command execution results, and other information that needs to be delivered to C&C servers as a DNS request after hiding it using specific coding techniques.

Since their disclosure, Apache Log4Shell vulnerabilities have been actively used by various threat actors such as many state-sponsored cyber threat groups and Ransomware gangs. So, a significant increase is observed in the number of malicious software that takes advantage of these vulnerabilities. In this context, it is recommended to immediately apply updates that fix vulnerabilities to systems vulnerable to Log4Shell vulnerabilities and ensure that the system/programs used are up-to-date. In addition essential to use reliable Anti-Virus/Anti-Malware solutions and block IoC findings related to malware from security solutions in use.

Security News – Week 12

Published: 23 March 2022

A New Backdoor in Microsoft: Serpent

A new backdoor has been identified, used by threat actors in attacks targeting French construction, real estate, and government organizations, and distributed through popular Windows package managers.

The chain of attacks begins with distributing macro-containing Microsoft Word documents that appear to be related to the European Union General Data Protection Regulation (GDPR) to targets via targeted phishing e-mails. When targets activate the macros, a seemingly harmless image file hosted on a remote server is downloaded. However, the image file in question contains a Base64 encoded PowerShell script hidden using steganography. This PowerShell script is responsible for installing Chocolatey, the Python package manager Pip, and the PySocks proxy library on the Windows machine. The same PowerShell script is downloading another image file from the same remote server containing the Serpent backdoor, which comes with the capabilities to execute commands transmitted from the C2 server.

In addition to steganography methods, the distribution of widely used original package managers has also been observed to be an attempt to avoid detection. The campaign has not yet been associated with a known threat actor but is believed to have been carried out by a sophisticated cyber threat group. In this context, it is recommended not to respect spam e-mail attachments and links from unknown sides, raise awareness of institution/organization personnel against possible advanced phishing attacks, and use reliable anti-virus / anti-malware solutions. In addition, it is recommended to prevent the IoC findings related to the campaign from the security solutions used.

Cyclops Blink Botnet Targets ASUS Routers and WatchGuard Devices

Cyclops Blink Botnet, which is associated with Russian state-backed Sandworm APT, has been found to target Asus Routers and WatchGuard Firebox devices with a new attack campaign. A statement on the Cyclops Botnet has recently been published in a joint effort by the UK National Cyber Security Center (NCSC), CISA, NSA, and FBI.

First spotted in 2019, the Cyclops Blink Botnet is written in C and uses the TCP protocol to communicate with the command and control (C2) server. The malware uses OpenSSL functions to encrypt the intercepted data and uses Brute Force techniques to access the targeted systems. In addition, Cyclops Blink includes modules responsible for ensuring persistence on the target system, downloading additional payloads, and transferring data to C&C servers. These modules are as follows;

Asus (0x38): This module enables devices to read/write from flash memory. Flash memory is used by devices to store the operating system, configuration, and all files in the file system. And since the flash memory content is persistent, this module is used to ensure persistence on the target system and disable the factory reset feature.

System Reconnaissance (0x08): This module is responsible for sending information from infected devices to the C&C server. Some information from an infected device is as follows; 

• Current Linux version, 
• Memory consumption information belongs to the device 
• The content of the following files; 
  • /etc/passwd, 
  • /etc/group, 
  • /proc/mounts, 
  • /proc/partitions 
• The information about the network interfaces. 

File Download (0x0f): This module is responsible for downloading additional files and payloads from the internet.

It is known that Cyclops Blink is targeting other security solution providers besides Asus and WatchGuard. Still, the relevant companies are not yet informed as sufficient malware samples have not been obtained yet. Regarding this issue, Asus made a statement stating that they were aware of the attacks in question and that investigations into the campaign were continuing. It is recommended to reset the devices used to factory default settings, apply the latest updates immediately, and change the default administrator credentials using powerful policies not to be the target of attacks that can be carried out using the malware. In addition, Asus recommends keeping the Remote Management function disabled, which is disabled by default.

New 0-Day in Dompdf PDF Converter Library

A 0-day vulnerability has been identified in dompdf, a PHP-based HTML to PDF conversion library, that could lead to remote code execution in specific configurations.

Threat actors who want to execute code on the target system by exploiting the vulnerability first upload the malicious font files (CSS) with the .php extension to the webserver. Then threat actors access the said font files from the vulnerable website via XSS vulnerability and trigger a remote code execution vulnerability. The vulnerability can cause severe consequences for websites that require server-side creation of PDFs such as ticket purchase and payslips, especially when the entries are not sanitized enough to mitigate XSS flaws dompdf library is installed in a publicly accessible directory.

According to statistics published by Github, dompdf is known to have 59,250 installations. Dompdf 1.2.0 and earlier versions which are “$isRemoteEnabled” configuration, enabled and located in a directory accessible over the Internet, are vulnerable. However, versions 0.8.5 and earlier of the library are affected by the vulnerability even if this option is configured as “false.” In this context, it is recommended that users who are using vulnerable dompdf versions move the Dompdf outside of the web directory, configure the “$isRemoteEnabled” option as “false,” and apply hardening where user input is sanitized against possible XSS attacks until updates that fix the vulnerability are released.

A New Linux Backdoor Detected to Deployed with Log4Shell Vulnerabilities

A new Linux backdoor that is deployed through Log4Shell security vulnerabilities and communicates with command and control servers (C&C) using the DNS tunnelling method has been detected by Netlab 360 security researchers.

In the researchers’ analyses, it has been observed that the backdoor called “B1txor20” targets systems with Linux ARM X64 CPU architecture, spreads through Apache Log4Shell vulnerabilities detected towards the end of 2021, and uses DNS tunnel technology to create a C&C communication channel. In addition to traditional backdoor functions, B1txor20 also enables Socket5 proxy, downloading Rootkit payloads from a remote server and performing data theft. Another critical factor detected related to malware is not using many advanced features. This shows that the developers of B1txor20 have developed and customized different functions according to different scenarios. The malware, which infects vulnerable systems, sends the captured sensitive information, command execution results, and other information that needs to be delivered to C&C servers as a DNS request after hiding it using specific coding techniques.

Since their disclosure, Apache Log4Shell vulnerabilities have been actively used by various threat actors such as many state-sponsored cyber threat groups and Ransomware gangs. So, a significant increase is observed in the number of malicious software that takes advantage of these vulnerabilities. In this context, it is recommended to immediately apply updates that fix vulnerabilities to systems vulnerable to Log4Shell vulnerabilities and ensure that the system/programs used are up-to-date. In addition essential to use reliable Anti-Virus/Anti-Malware solutions and block IoC findings related to malware from security solutions in use.

Security News – Week 11

Published: 16 March 2022

Two Critical Vulnerabilities Detected in Veeam Data Back-up Solution

Veeam Software has released updates to two critical security vulnerabilities affecting Backup & Replication, a backup solution for virtual environments.

Unauthenticated threat actors can exploit two security vulnerabilities tracked with codes CVE-2022-26500 and CVE-2022-26501 to remote code execution. The vulnerabilities exist in the Veeam Distribution service running on TCP port 9380 by default, allowing unauthenticated users to access internal Veeam API functions. Threat actors who exploit vulnerabilities to execute code on the target system can send inputs to the Veeam API to load and run malicious code.

Critical vulnerabilities affect Veeam Backup & Replication versions 9.5, 10, and 11. Unfortunately, Veeam Software has only released updates that fix the vulnerability for versions 10 and 11. For this reason, it is recommended that users using version 9.5 upgrade to a supported version.

Multiple Vulnerabilities Detected in Popular Package Managers

Security vulnerabilities have been detected in popular package managers, allowing threat actors to execute arbitrary code on the target system and access sensitive data. Package managers are tools that enable easy installation, updating, and configuration of third-party dependencies required by applications.

The detected security vulnerabilities are in the following package managers;
• Composer
• Bundler
• Bower
• Poetry
• Yarn
• pnpm
• Pip
• Pipenv

The vulnerability found in Composer and tracked with code CVE-2021-41116 is a Command Injection vulnerability that could allow remote threat actors to execute arbitrary commands on the target system. Argument Injection and Untrusted Search Path security vulnerabilities found in Bundler, Poetry, Yarn, Pip, and Pipenv can allow threat actors to execute arbitrary code on the target system via malware-laden Git or Gemfiles files.

The package managers fixed the vulnerabilities that were foreseen to be used in supply chain attacks shortly after the announcement. However, the Untrusted Search Path vulnerability affecting three package managers, Composer, Pip, and Pipenv, is still not fixed. In this context, it is recommended that users using vulnerable package manager versions immediately upgrade to the published updates in order not to be the target of attacks that can be carried out using vulnerabilities.

MuddyWater Threat Actors Target Turkey and Arabian Peninsula With A New Malware Campaign

Iranian state-backed MuddyWater threat actors have been associated with a new offensive campaign targeting Turkey and the Arabian Peninsula to plant remote access trojans (RATs) on compromised systems.

The chain of attacks begins with sending phishing e-mails containing malicious attachments to the recipients to distribute the SloughRAT (Canopy) trojan, which is responsible for executing commands received from command and control servers (C&C). The malicious document sent by the phishing e-mail contains a malicious macro that drops two WSF (Windows Script File) files on the target system. One of these scripts is used to execute the next phase and is placed in the current user’s Startup folder by a VBA macro to ensure persistence between reboots. The second script contains the “SloughRAT” malware, which will be used to execute arbitrary commands on the target system. This RAT consists of hidden Visual Basic and JavaScript code. After a series of malicious activities are carried out through malware, the data and results captured are transferred to C&C servers.

It has been determined that the campaign is a continuation of the November 2021 MuddyWater campaign, which targets Turkish private and government institutions with PowerShell-based backdoors for information gathering and espionage activities. To not be the target of this and similar malware campaigns, it is important to ignore e-mail attachments and links from unknown people, not to download files or programs from unknown sources, and conduct attack surface analyses at regular intervals. Also, It is recommended to raise awareness of institution/organization personnel against possible phishing / social engineering attacks and block detected IoC findings related to the campaign from security devices in use.

New Android Malware Detected to Hijack Google Authenticator MFA Tokens: “Escobar”

Security researchers have detected that the Aberebot Android banking trojan has been redistributed under the name ‘Escobar’ with new features added, including the hijacking of Google Authenticator multi-factor authentication (MFA) codes. Furthermore, it has been observed that the features added to the Aberebot malware developed to take control of infected Android devices via VNC, record audio, take pictures, and capture identity information, are also found in the newly detected Escobar variant. The ultimate goal of this malware is to gather the information that would allow threat actors to hijack targets’ bank accounts and perform unauthorized transactions.

Escobar malware is distributed to target systems as a fake McAfee Anti-Virus application. The malicious application downloaded to the user device requests 25 different permissions, which is 15 abused. It has been observed that if users approve the requested permissions, the malware gains access to the user’s contact directory, SMS, call logs, and sensitive data such as device location. In addition, the malware comes with the features of deleting files, sending SMS, making calls, and controlling the device camera via commands received from the C&C server, the ability to record calls and voice.

Threats targeting the banking sector are increasing and developing day by day. It is observed that Escobar and similar software are often distributed through unofficial sources such as forums. For this reason, it is recommended that Android users download their applications from official and reliable sources, pay attention to the permissions requested by applications and enable multi-factor authentication (MFA) features not to be exposed to similar malware campaigns. In addition, it is recommended to use reliable Anti-Virus / Anti-Malware solutions and prevent IoC findings related to the malware in question from the security solutions in use.

Security News – Week 10

Published: 9 March 2022

A New Malware Has Been Detected, Distributed via Fake Antivirus Applications: “SharkBot.”

A new Android Banking Trojan has been detected distributed via a fake Anti-Virus application on the Google Play Store. The malware, called SharkBot, was developed to perform money transfers from infected systems by bypassing multi-factor authentication mechanisms (MFA) such as TeaBot, Flubot, and Oscorp malware.

In the analyses carried out by security researchers, it has been observed that SharkBot uses ATS (Automation Transfer Switches) features to perform money transfers from compromised systems. ATS features are used to manipulate the targeted bank’s fraud detection systems by simulating a user’s sequence of actions, such as keystrokes and clicks, for threat actors to perform illegal money transfers. Distribution of malware is done by manipulating Android’s “Direct Reply” feature. If users consent to Accessibility permissions, SharkBot performs malicious activities such as exploiting Phishing attacks to obtain credentials, recording keystrokes, and redirecting the obtained user data to C&C servers. The applications available in the Google Play Store that are responsible for the distribution of the said malware are as follows;

• Antivirus, Super Cleaner
• Atom Clean-Booster, Antivirus
• Alpha Antivirus, Cleaner
• Powerful Cleaner, Antivirus

Finally, to minimize the possibility of infecting user devices with similar malicious software, it is recommended to keep the number of applications installed on the devices to a minimum and pay attention to the permissions requested by the downloaded applications. In addition, it is crucial to prevent IoC findings related to malware from security solutions in use.

A Security Vulnerability Has Been Detected in GitLab That Could Lead to User Data Disclosure

It has detected a security vulnerability in GitLab, an open-source software development platform, that allows a remote threat actor to obtain sensitive information about users such as first name, last name, email, and password. Data breaches using this vulnerability enable threat actors to create a new username list (Combolist) based on GitLab installations and perform Brute Force attacks through this list.

The vulnerability tracked by code CVE-2021-4191 exists due to insufficient authentication checking when processing specific GitLab GraphQL API queries. As a result, a remote threat actor can exploit the vulnerability to gain unauthorized access to sensitive information in the system.

The vulnerability affects all GitLab Community Edition and Enterprise Editions 13.0.0 – 14.8.1 but was fixed in the last released version. In addition, another critical vulnerability tracked as CVE-2022-0735 is fixed with the released updates. Users using vulnerable GitLab versions are advised to apply the released updates immediately.

Avast Releases A Free Decryption Tool For HermeticRansom Ransomware Targeting Ukraine

Avast has released a decryption tool for HermeticRansom Ransomware used in attacks against Ukraine. Security firms aim to help victims who have been targeted by the malware in question recover their files for free.

HermeticRansom is one of three components included in the devastating attacks detailed by security researchers. These components are:

• HermeticWiper: Destroys System Data, Making the System Inoperable.
• HermeticWizard: Allows HermeticWiper Malware to Spread on a Local Network Via WMI and SMB.
• HermeticRansom: A Ransomware Software Written With Go.

Security researchers have discovered a vulnerability in HermoticRansom’s encryption algorithms that could later allow the password to be solved. It is estimated that malware developers have made limited efforts to test Ransomware. This is because the ultimate goal of threat actors is not limited to just performing encryption activities. In this context, HermoticRansom victims can recover their encrypted data with the decryption tool released by Avast. In addition, Avast has published a guide with operating instructions for the published tool.

Path Traversal Security Vulnerability Detected in SolarWinds Serv-U FTP Server

A security vulnerability has been detected in the Serv-U FTP Server file sharing solution developed by SolarWinds, allowing remote threat actors to perform Path Traversal attacks on the vulnerable system.

The vulnerability, tracked as CVE-2021-35250, exists due to a validation error when processing migration sequences. Successfully exploiting a vulnerability could allow access to files on the system.

The high severity vulnerability only affects Serv-U FTP Server version 15.3. SolarWinds has released updates that fix the vulnerability and other issues. Users using the vulnerable version are advised to immediately apply the updates that fix the vulnerability.

February 2022

Security News – Week 7

Published: 19 February 2022

Welcome to our 8th Weekly Security News. We’ve gathered the most speculative cyber security news for you. Keep reading to learn details about this week’s security news and protect yourself proactively.

See you in next week’s News!

Swissport Aviation Services Company Targeted by Blackcat Ransomware

Swissport, which operates in the aviation industry, has been exposed to a Ransomware attack that caused flight delays and service interruptions. The BlackCat Ransomware Group -also known as ALPHV- accepted responsibility for the cyberattack and posted a series of allegedly seized samples of files belonging to Swissport on the leak site.

It is claimed that the data allegedly captured threat actors include sensitive information such as name, surname, e-mail, phone number, internal notes, and passport information of company personnel. The company stated that the attack caused minor delays between 3 and 20 minutes on 22 flights.

Confirming their affiliation with the BlackMatter/DarkSide operation, Blackcat threat actors have been carrying out attacks targeting multiple countries since November 2021, including the USA, Australia, and India. To be able to avoid possible Ransomware attacks, it is recommended not to interact with e-mails and links from unknown parties, use reliable security solutions, and download files or applications over known/trusted connections and sources.

Google Releases Updates to Actively Exploited 0-Day Security Vulnerability in Chrome

Google has released updates that address 11 vulnerabilities in the Chrome web browser, including a critical 0-day vulnerability actively exploited in attacks.

The vulnerability tracked as CVE-2022-0609 is due to a Use-After-Free error in the Animation component in Google Chrome. As a result, a remote threat actor can create a specially crafted web page and redirect users to this web page. Then it can execute arbitrary code on the target system by triggering the vulnerability.

It is recommended that Google Chrome users update to version 98.0.4758.102 released for Windows, Mac, and Linux to prevent attacks using these security vulnerabilities.

A Critical RCE Vulnerability Has Been Detected in Apache Cassandra

A security vulnerability has been detected in Apache Cassandra -an open-source NoSQL database management system- leading to remote code execution on affected systems. However, security researchers state that the vulnerability only occurs in non-default configurations of Cassandra.

The vulnerability, tracked as CVE-2021-44521, allows arbitrary code execution on the vulnerable system if the following settings are applied in the “cassandra.yaml” configuration file;

• Enable_user_defined_functions: True
• Enable_scripted_user_defined_functions: True
• Enable_user_defined_functions_threads: False

The vulnerability -rated as critical- affects Apache Cassandra versions 3.0.0 to 4.0.1 (Included). Therefore, it is recommended that Cassandra users upgrade their systems to versions 3.0.26, 3.11.12, and 4.0.2 by adding a new “allow_extra_insecure_udfs” flag not to be affected by the vulnerability.

DoS Security Vulnerability Detected in Cisco Email Security Appliance DNS Verification Component

A security vulnerability has been detected in the DNS Verification component of the AsyncOS Software for Cisco Email Security Appliance that could cause an affected device to denial of service (DoS).

The vulnerability, tracked as CVE-2022-20653, is caused by improper management of internal resources in the DNS-based Authentication of Named Entities (DANE) e-mail authentication component when performing DNS name resolution. As a result, a remote threat actor can perform a Denial of Service (DoS) attack by sending a specially crafted e-mail message to the system.

The vulnerability -which is considered critical- affects Cisco AsyncOS for Cisco Email Security Appliance 14.0, 13.5, 13.0, 12.5, and earlier versions. Cisco has released workarounds and updates that fix the vulnerability. It is recommended that users using vulnerable versions immediately upgrade to updated versions where the vulnerability has been fixed.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview