Weekly Security News Archive, Q2 2022.

This page holds the weekly security news issues and newsletters that Brandefense published. It covers the 10 items from April 2022 to June 2022 (2022 Q2). Each entry keeps its original title, publish date and text, newest first. Earlier addresses of these entries now lead to the matching entry here. The overview page lists all periods.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview

All 10 Entries On This Page

• Security News – Week 26 (29 Jun 2022)
• Security News – Week 25 (22 Jun 2022)
• Security News – Week 24 (15 Jun 2022)
• Security News – Week 22 (1 Jun 2022)
• Security News – Week 21 (26 May 2022)
• Security News – Week 20 (18 May 2022)
• Security News – Week 19 (11 May 2022)
• Security News – Week 17 (27 Apr 2022)
• Security News – Week 16 (20 Apr 2022)
• Security News – Week 14 (7 Apr 2022)

June 2022

Security News – Week 26

Published: 29 June 2022

LockBit Threat Actors Release LockBit 3.0 with New “Bug Bounty” Program

LockBit Ransomware threat actors announced the release of version 3.0 of LockBit Ransomware. With the new version, the LockBit Bug Bounty program, a first for the Dark Web, has been launched. In addition, a statute containing the rules for potential affiliates participating in the affiliate program in the new version of LockBit, which is based on the RaaS (Ransomware as a Service) model, has been published.

With the launching Bug Bounty program, LockBit invites security researchers and hackers to join the program, noting that it will offer rewards for threat actors, high-profile targets, security vulnerabilities, and more (PII). Although it is claimed that high amounts of rewards will be given to the participants in the program in question, it should be noted that LockBit is a Ransomware threat group.

In order not to be the target of attacks that can be carried out using the new LockBit 3.0 version released in this context;

• Using the system/programs used in the most up-to-date versions,
• Disregarding e-mails, attachments, and links from unknown parties,
• Raising awareness of institution/organization personnel against potential phishing/social engineering attacks,
• It is recommended to use comprehensive security solutions (Anti-Virus/Anti-Malware).

Critical RCE Vulnerability Found in Mitel MiVoice VoIP Devices Actively Exploited

A 0-day vulnerability detected in Linux-based Mitel MiVoice VOIP devices was found to be used by threat actors to execute code on vulnerable systems. Critical organizations in various industries rely on Mitel VOIP devices for their telephony needs.

The 0-day RCE vulnerability, tracked as CVE-2022-29499, is used by threat actors to gain access to the network. And successful first accesses are observed as the beginning of larger ransomware attacks.

The vulnerability affecting the Service Appliance component in Mitel MiVoice Connect exists due to incorrect data validation. MiVoice Connect devices using the Service Appliance component and affected by the vulnerability are as follows;

• SA 100
• SA 400
• Virtual SA

There is no official update yet that fixes the vulnerability. However, on April 19, 2022, Mitel released a hotfix script for the following affected versions;

• MiVoice Connect versions 19.2 SP3 and earlier.
• R14.x versions

The vulnerability has been exploited in at least one ransomware campaign. In this context, it is recommended to regularly monitor the updates that correct the vulnerability and implement the mitigation measures immediately. Also, it is important to take advantage of comprehensive security solutions for potential ransomware attacks.

Multiple PyPI Packages Detected Aiming to Hijack AWS Credentials and Metadata

Sonatype security researchers have detected multiple Python packages (PyPI) containing malicious code developed to hijack and publicly leak AWS (Amazon Web Services) credentials and environment variables.

Python is a programming language built on packages and modules, so it creates the basis for possible security breaches.

PyPI packages found to contain malicious code developed to hijack AWS are as follows;

• Loglib-Modules
• Pyg-Modules
• Pygrata
• Pygrata-Utils
• Hkg-Sol-Utils

While loglib-modules’ and ‘pygrata-utils’ packages contain malicious code developed to capture sensitive data from the system, packages such as ‘pygrata’ use one of these packages as a dependency. The packages ‘loglib-modules’ and ‘pygrata-utils’ contain malicious code, some of which are shown below.

When the image is examined, it is seen that the malicious code scans the AWS credentials, network interface information, and environment variables on the system and sends the collected sensitive data and metadata to one or more endpoints hosted on the PyGrata domain. (hxxp://graph.pygrata[.]com:8000/upload)

After the data collected from the system is uploaded to the PyGrata server, it is shared on the internet in hundreds of .txt formats that everyone can access.

There are no details yet as to who the threat actors behind the manipulation of these packages are and their ultimate goals. However, detected malicious python packages have been deprecated after reporting them to the PyPI security team.

In this context, it is recommended to check the PyPI dependencies of the packages used and to use comprehensive Anti-Malware solutions in order not to be the target of similar attacks. In addition, it is important to follow the IOC findings related to the campaign and prevent it from the security solutions used if found.

Security News – Week 25

Published: 22 June 2022

OneDrive and SharePoint Cloud Solutions Vulnerable to Ransomware Attacks

A dangerous Office 365 functionality has been identified by Proofpoint security researchers that allow ransomware to encrypt files stored on SharePoint and OneDrive in a way that makes them unrecoverable without a decryption key. Cloud systems are considered to be more resilient to potential ransomware attacks due to flexible data recovery and backup options. However, research shows that organizations and cloud infrastructures using cloud solutions will be targeted by ransomware attacks in the future.

Chain of Attack

The chain of attacks begins when threat actors gain access to their SharePoint Online or OneDrive accounts by seizing the identities of Microsoft users. Threat actors can follow multiple methods to access users’ SharePoint or OneDrive accounts. These methods are:

• Bypassing Account Security: It is possible to access the identity information of users’ cloud accounts through phishing, Brute Force attacks, and other methods of obtaining identity information.
• Third-Party OAuth Applications: Threat actors can make users trust third-party OAuth applications for their targeted SharePoint or OneDrive access.
• Hijacked Session Tokens: Hijacking a user’s web session or obtaining an active API token for SharePoint Online/OneDrive allows threat actors to access their targeted accounts.

Threat actors that gain access to OneDrive or SharePoint user privileges and data in the cloud identify and discover accessible data in Office 365 environments in the next step. This attack differs from traditional ransomware activities because the encryption phase requires that every file in SharePoint Online or OneDrive is encrypted beyond the allowed versioning limit. With this method, all original versions of files stored in cloud solutions are lost, and only encrypted versions of each file remain in the cloud account. At this point, threat actors can demand ransom from the targeted institution/organization.

In this context, in order not to be the target of similar attacks;

• Creating account login credentials by applying strong password policies,
• Enabling multi-factor authentication (MFA) on all possible platforms,
• Detecting and correcting account violations and abuse of third-party applications regarding cloud solutions in use,
• Preventing large-scale or critical data downloads to unmanaged/unprotected devices,
• It is recommended to take multiple backups of data from different sources in order to avoid data loss in case of a possible ransomware attack.

Vulnerable QNAP NAS Devices Are Targeted in eCh0raix Ransomware Campaigns

Campaigns that distribute eCh0raix ransomware have been found to target QNAP NAS devices using weak passwords or outdated QTS firmware.

It is known that eCh0raix ransomware, which targeted QNAP NAS devices in the last attacks, was used in attacks targeting Synology NAS devices in 2021. QNAP officials have not yet made a detailed statement regarding the ech0raix campaigns. However, it is predicted that the number of users affected by the campaigns will be higher than the announced number.

Mitigations

It is recommended to prevent potential eCh0raix ransomware infection;

• Using passwords created by applying strong policies in administrator accounts,
• Enabling IP Access Protection to protect accounts from Brute-Force attacks,
• Avoiding the use of default ports 443 and 8080,
• Using the QTS firmware in the most up-to-date versions with vulnerabilities,
• Updating all installed applications to the latest versions,
• Using comprehensive security solutions,
• Preventing the detected IoC findings related to the malware in question from the security solutions in use.

A Critical Code Execution Vulnerability (RCE) Detected in Splunk Enterprise

Splunk has released security updates that address multiple vulnerabilities in Splunk Enterprise, including a critical vulnerability that could lead to arbitrary code execution. Splunk is a SIEM (Security Information and Event Management) solution that collects logs from various sources, stores (indexes) the collected logs, and provides search, research, analysis, and correlation on the stored logs.

The security vulnerability tracked as CVE-2022-32158 occurs because the Splunk Enterprise deployment servers prior to version 9.0 allow clients to manipulate the server to distribute the message packets to other clients. A threat actor who compromises a Universal Forwarder endpoint could exploit this vulnerability to execute arbitrary code on all other Universal Forwarder endpoints that subscribe to the distribution server. x is used to collect data from endpoint systems. When the data we want to collect is not directly available on the server where Splunk is installed, the Splunk Universal Forwarder (UF) can be installed on your remote endpoint servers and used to forward the data back to Splunk for indexing.

In addition to the vulnerability, Splunk also announced that it fixed several critical vulnerabilities in Splunk Enterprise, including a bug where distribution servers in versions prior to 9.0 allowed forwarder packets to be downloaded without authentication (CVE-2022-32157). Splunk has resolved the issue by releasing Enterprise distribution server version 9.0. Splunk users are advised to upgrade vulnerable installations to the newly released version immediately.

Security News – Week 24

Published: 15 June 2022

A Critical Security Vulnerability Detected in Apple M1 Processor: “PACMAN”

A new security vulnerability targeting Apple’s popular M1 processor has been identified by researchers at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL). Called PACMAN, the attack is intended to circumvent the Pointer Authentication (PAC) mechanism in M1 and other ARM-based processors. PAC is a security feature that helps protect against threat actors that have gained memory access to the CPU. Pointers store memory addresses, and the PAC checks for unexpected pointer changes caused by an attack.

PACMAN vulnerability is in a hardware mechanism, so it is estimated that it cannot be remedied with a software update. What makes PACMAN vulnerability dangerous is that it directly affects the core. The core is the most privileged part of the operating system. Endangering the core means a threat actor can do everything the user can in a vulnerable system.

PACMAN can be triggered if there is any software vulnerability in the system, but there is no risk of endangering systems on their own. For example, memory corruption is one of the vulnerabilities that can cause PACMAN to be triggered. In this context, Apple users must keep their operating systems and software up-to-date.

BlackCat Ransomware Is Targeted Vulnerable Microsoft Exchange Servers

Cyber threat actors have been found to launch attack campaigns by exploiting vulnerable Microsoft Exchange servers to spread BlackCat ransomware. After gaining access to vulnerable Microsoft Exchange servers, BlackCat ransomware was found to be distributed to target systems with the PsExec tool. In this way, threat actors infiltrate target systems, obtain critical identity data of users and carry out “double extortion” activities. Double Extortion is the name given to cases where threat actors threaten to leak data or publish some of it on the Internet, even if the ransom is paid in ransomware-infected organizations.

BlackCat ransomware was first observed in 2021 and developed with the Rust programming language. RaaS (Ransomware-as-a-Service) operators aim to ensure persistence by gaining unauthorized access to multiple systems on the target network before ransomware activities. How BlackCat ransomware infects victims differ according to the techniques and tactics of RaaS operators. For example, It is known that the FIN12 threat group, which organizes ransomware campaigns such as Ryuk, Hive, and Conti, has been one of the BlackCat operators since March 2022.

BlackCat ransomware is also distributed by the DEV-0504 threat group, which uses the Stealbit malware of the LockBit threat group. The DEV-0504 threat group is known to use BlackMatter, Conti, LockBit 2.0, Revil, and Ryuk ransomware.

The Microsoft Exchange Server vulnerabilities used in the said attack campaign are as follows;

• CVE-2021-26855
• CVE-2021-26858
• CVE-2021-26857
• CVE-2021-27065

Using ransomware with different versions in attack campaigns significantly increases the risk of institutions and organizations encountering BlackCat-like malware. In this context, in order not to be the target of similar ransomware attacks;

• Beware of untrusted e-mail content,
• Not opening additional files/links of suspicious sender mail addresses,
• Using reliable Anti-Malware solutions
• Using licensed and current technologies,
• It is recommended to block shared IoC findings related to the malware campaign by security solutions.

Misconfigured Elasticsearch Servers Targeted by Threat Actors

Secureworks security researchers have identified a new attack campaign targeting misconfigured Elasticsearch databases. Threat actors demand ransom payments from targets by altering the database content on vulnerable Elasticsearh servers with their ransom notes.

The threat actors conduct the campaign by deleting the vulnerable database contents and adding ransom notes via an automated script. If the targets do not pay the ransom demanded by the threat actors within seven days, the ransom fee is doubled, and access to the content is lost without return. Upon the execution of the requested ransom payment by the targets, the threat actors download a link to the database session of the targets. It is claimed that the link in question will enable the restoration of all compromised directories.

However, at this stage, promises made by threat actors should not be respected because it is impractical for threat actors to store large amounts of content. Most likely, the contents of the hacked databases are deleted, but ransom notes are left promising to restore the contents to the system. Therefore, database administrators need to take regular backups.

These and similar security breaches can lead to loss of reputation, data leakage, and possible service interruptions that may cost much more than the ransom amount of the affected institutions/organizations and organizations. In this context, it is recommended to use the current versions of the systems and programs, take regular backups of critical systems/files, perform attack surface analysis tests at regular intervals, and use comprehensive security solutions.

Security News – Week 22

Published: 1 June 2022

Follina: The Critical 0-Day Vulnerability Affects Windows Systems

A 0-day vulnerability has been identified that allows threat actors to perform code execution activities on targeted Windows systems through Microsoft Office documents. It has been observed that threat actors exploiting the vulnerability called Follina obtain an HTML document from the command and control (C&C) server with the “remote template” feature of the malicious Microsoft Word document and use the ‘ms-msdt’ MSProtocol URI scheme to execute the malicious code on the target system.

MSDT is a tool that collects errors that Windows users receive on the system for analysis. Threat actors can execute malicious code on the system with the MSDT tool, even if the targets do not enable macros of Microsoft Word documents. Also, converting the document to RTF format runs the code in the browser without the need to open the document.

The malicious Microsoft Word document, which cannot be detected in the Microsoft Defender Anti-Malware solution, affects Office 2016 and 2021 applications. In this context, it is recommended not to open Office documents obtained from unknown parties via e-mail attachments and other vectors, benefit from comprehensive Anti-Malware solutions, and use Office applications in the most up-to-date versions.

GoodWill: A New Ransomware Group Raising Attention to Social Responsibility

CloudSEK security researchers have identified a ransomware group that solicits donations from targets to individuals and patients who need help in exchange for a decryption tool. Ransomware called GoodWill was detected in March 2022. As the threat group’s name suggests, operators are allegedly more interested in promoting targets for social justice than traditional financial motivations. Some of the features identified by GoodWill in the analyzes are as follows;

• GoodWill ransomware was developed with .NET and packaged with UPX wrappers.
• It can stay in sleep mode for 722.45 seconds to avoid being detected during dynamic analysis.
• It uses the AES_Encrypt function to encrypt the captured files with the AES algorithm.
• It has a function called “GetCurrentCityAsync” that tries to detect the geolocation of the infected system.

When GoodWill infects systems, it encrypts documents, photos, videos, databases, and other important files with the “.gdwill” extension, making all these elements inaccessible without the decryption key. In the ransom note that the group left on the systems, it is stated that the targets must perform some social activities to obtain the decryption key.

In the detailed analysis of GoodWill carried out by CloudSEK threat intelligence researchers, it has been observed that the ransomware in question has approximately 1246 threads, and 91 of them overlap with the open-source HiddenTear ransomware software developed by an operator of Turkish origin. In addition, the use of Hindi scripts by threat actors in the existing lines leads to the opinion that the group is based in India.

Although the threat actors behind the GoodWill ransomware software claim to operate under the name of social responsibility campaigns, they violate the intellectual property and privacy concepts of institutions/organizations. At the same time, these activities cause the targeted organizations to be unable to provide services, damage their reputation, material, and moral losses, and violate the security of personal information.

To not be the target of similar attacks in this context, it is recommended that email, attachments, and links from unknown parties are not respected, and input information used in accounts is created using unique and powerful policies. Also, it is important to use comprehensive security solutions and enable 2FA/MFA features on all possible platforms.

Misconfigured Elasticsearch Servers Targeted by Threat Actors

Secureworks security researchers have identified a new attack campaign targeting misconfigured Elasticsearch databases. Threat actors demand ransom payments from targets by altering the database content on vulnerable Elasticsearh servers with their ransom notes.

The threat actors conduct the campaign by deleting the vulnerable database contents and adding ransom notes via an automated script. If the targets do not pay the ransom demanded by the threat actors within seven days, the ransom fee is doubled, and access to the content is lost without return. Upon the execution of the requested ransom payment by the targets, the threat actors download a link to the database session of the targets. It is claimed that the link in question will enable the restoration of all compromised directories.

However, at this stage, promises made by threat actors should not be respected because it is impractical for threat actors to store large amounts of content. Most likely, the contents of the hacked databases are deleted, but ransom notes are left promising to restore the contents to the system. Therefore, database administrators need to take regular backups.

These and similar security breaches can lead to loss of reputation, data leakage, and possible service interruptions that may cost much more than the ransom amount of the affected institutions/organizations and organizations. In this context, it is recommended to use the current versions of the systems and programs, take regular backups of critical systems/files, perform attack surface analysis tests at regular intervals, and use comprehensive security solutions.

May 2022

Security News – Week 21

Published: 26 May 2022

Cryptocurrency Scammers Targeted Elon Musk with Deepfake Technology

Cryptocurrency scammers have been found to use the Deepfake video content of Elon Musk and other leading cryptocurrency advocates to promote a fake BitVex trading platform. The fake BitVex platform, allegedly owned by Elon Musk by threat actors, is known to hijack the currency deposited by visitors.

The scam campaign started when threat actors created fake YouTube accounts to host Deepfake-generated videos of Elon Musk, Cathie Wood, Brad Garlinghouse, Michael Saylor, and Charles Hoskinson in early May 2022. Deepfake is a technology in which a person in an existing image or video can be replaced with another person’s image using artificial neural networks.

In these videos, it is stated that Elon Musk introduced the fake BitVex platform created by fraudulent activities and invested $ 50 million in the platform. When the interviews conducted in the videos are examined, it is understood that Elon Musk’s voice was changed by simulating to promote the BitVex trading platform, but many different findings reveal that this is a fraudulent activity.

The fake BitVex platform allegedly contains and references endorsements by Elon Musk and Cathie Wood, CEO of investment firm Ark Invest, and Changpeng Zhao, CEO of Binance. Users who want to use the BitVex platform must open an account at bitvex[.]org or bitvex[.]net to access the investment platform. After logging into the platforms, a relatively legitimate-looking dashboard is displayed where users can deposit various cryptocurrencies, choose an investment plan or withdraw their earnings.

The perpetuation of such fraudulent activities by threat actors has become quite common and profitable. The FTC (Federal Trade Commission) has issued a warning that since October 2020, $80 Million worth of financial losses has been incurred due to cryptocurrency investment scams.

In this context, to not be the target of similar campaigns, crypto money users need to verify the validity of the crypto wallet application to be used before investment transactions. The simplest method for the verification process is to perform transactions with only a small amount in practice. Crypto scammers often use social media to promote their fraudulent schemes, as in the case under consideration. For this reason, it is recommended not to be trusted when faced with crypto opportunities promoted on social media.

New Goal of Fraud and Phishing Activities: LinkedIn Users

During the intelligence studies, it was determined that LinkedIn, a business network and social sharing platform, is frequently used by threat actors in phishing activities carried out through various methods.

Linkedln, which provides reliability for users due to being a professional platform, creates a suitable ground for fraudulent activities carried out by threat actors. Some examples of campaigns where the LinkedIn platform has been manipulated using phishing or social engineering activities are detailed below;

Fake Notifications

By taking advantage of the notifications that LinkedIn users frequently encounter, threat actors can send phishing e-mails designed to infect users’ systems with malware or capture login credentials. These e-mails attract users’ attention by containing phrases such as “1 person viewed your profile”, “You’ve been viewed in 3 searches this week,” or “Congratulations on your connection’s new position,” which LinkedIn users are pretty familiar with.

When users click on the link in the e-mail, they are directed to a LinkedIn login page that requests login credentials. At the last stage, all other services where users logging in with LinkedIn username and password information use the same authentication are compromised by threat actors.

Fake Job Offers

To obtain LinkedIn users’ login and personal information, threat actors can communicate via direct message with the promise of high-paying job offers, causing users to open a malicious link if caught off guard. Scenarios are also observed in which threat actors, motivated to obtain more information about users, charge a certain fee to fill in personal information via Google Forms and obtain users’ bank information.

Fake Financial Advisory Offers

It is a frequently observed situation that LinkedIn users are also targeted in Forex and cryptocurrency fraud activities carried out by threat actors. A well-trained and legal financial advisor reaches out to users with a “great investment” offer and convinces users to make the requested investment through a series of social engineering methods. In this process, professionally created web pages and content are used to ensure reliability. At the last stage, the convinced users are provided to transfer money or crypto money for the promised investment, and their bank/wallet and personal information are captured.

In order not to be the target of phishing/social engineering activities that can be carried out using the aforementioned methods, it is recommended to disregard suspicious-looking e-mails, attachments, and links that appear to come from LinkedIn, instead checking LinkedIn notifications directly. In addition, it is important to be careful about connection and message requests from unknown people, to control the privacy settings in case the personal information used on LinkedIn is public, and to create the login information used in the accounts using strong policies.

The New Phishing Attack Using Multiple Malware Types

A phishing campaign targeting Microsoft Windows users used three different types of malware designed to snatch sensitive information from targets.

The chain of attacks begins with sending spear-phishing emails containing a malicious Excel document to the targets, which appears to be a payment report notification from a trusted source. Emails try to persuade recipients to open the attached Excel document for report detail. When the Excel file called “Remittance-Details-951244.xlam” is opened, and the macro is activated, a VBA (Visual Basic Application) script called “Auto_Open()” is executed, which is responsible for downloading the malware to be used in the campaign.

As a result of a series of steps performed through Powershell and the stated VBA scripts, malicious software called AveMariaRAT, BitRAT, and PandoraHVNC, which is responsible for capturing users’ sensitive information, including passwords and bank information, is downloaded to the target system. BitRAT can take full control of infected Windows systems, monitor webcam activity, listen to audio over the microphone, allow threat actors to perform undetected transactions on compromised cryptocurrency wallets, and download additional malicious files, which is why it was considered particularly dangerous.

There are no details yet as to why the campaign involved three malware. Still, the three different types of malware distributed are known to increase the chances of threat actors accessing sensitive information they want to capture. In this context, to not be the target of similar attacks, it is recommended not to rely on emails, attachments, and links from unknown parties and to prefer comprehensive security solutions.

Security News – Week 20

Published: 18 May 2022

Welcome to our Weekly Security News. This is Week 20’s Newsletter. We’ve gathered the most speculative cyber security news for you. To learn details about this week’s security news, and protect yourself proactively, keep reading.

See you next week!

The New Phishing Attack Using Multiple Malware Types

A phishing campaign targeting Microsoft Windows users used three different types of malware designed to snatch sensitive information from targets.

The chain of attacks begins with sending spear-phishing emails containing a malicious Excel document to the targets, which appears to be a payment report notification from a trusted source. Emails try to persuade recipients to open the attached Excel document for report detail. When the Excel file called “Remittance-Details-951244.xlam” is opened, and the macro is activated, a VBA (Visual Basic Application) script called “Auto_Open()” is executed, which is responsible for downloading the malware to be used in the campaign.

As a result of a series of steps performed through Powershell and the stated VBA scripts, malicious software called AveMariaRAT, BitRAT, and PandoraHVNC, which is responsible for capturing users’ sensitive information, including passwords and bank information, is downloaded to the target system. BitRAT can take full control of infected Windows systems, monitor webcam activity, listen to audio over the microphone, allow threat actors to perform undetected transactions on compromised cryptocurrency wallets, and download additional malicious files, which is why it was considered particularly dangerous.

There are no details yet as to why the campaign involved three malware. Still, the three different types of malware distributed are known to increase the chances of threat actors accessing sensitive information they want to capture. In this context, to not be the target of similar attacks, it is recommended not to rely on emails, attachments, and links from unknown parties and to prefer comprehensive security solutions.

Bitter APT Targets Bangladesh’s Key Institutions Through Phishing Emails

It has been detected that the threat actors known for their espionage campaigns targeting China, Pakistan, and Saudi Arabia have targeted Bangladesh institutions and organizations as part of a campaign going on since August 2021. Cisco Talos security researchers attributed the campaign to threat actors called Bitter APT based on similarities in the command and control (C2) infrastructure of other campaigns analyzed. The group, also known as T-APT-17, uses harmful software such as BitterRAT, ArtraDownloader, and AndroRAT, to target the energy sector and government institutions in South Asia.

Threat actors submitted documents allegedly related to operational tasks to senior officers of the Bangladesh Police Rapid Action Battalion Unit (RAB) through phishing emails, which appear to be originated from Pakistan. The sender requests that the destinations review or validate a malicious document, a call data log (CDR), a list of phone numbers, or a list of registered cases, but emails contain a malicious RTF document or an Excel table to use to exploit known security vulnerabilities. With the view of the content of the documents, malicious software ZxxZ, which appears to be a Windows Security update service, is installed and run on the intended system. ZxxZ allows remote code execution attacks on the target system by exploiting vulnerabilities tracked as CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.

Such campaigns allow threat actors to access the organization’s confidential information. In this context, to not be the target of similar attacks, it is recommended not to rely on e-mails, attachments, and links from unknown parties and to prefer comprehensive security solutions.

Frappo: A New “Phishing-as-a-Service” On The Dark Web

A new underground service called “Frappo” has been detected on the dark web by security researchers at Resecurity Hunter. Frappo provides threat actors with the ability to host and create high-quality phishing pages that imitate online banking, e-commerce, popular retailers, and online services to capture customer data.

Frappo is a service that serves as a Phishing (PaaS) provider as a Service. The service, first known to emerge on the dark web around 22 March 2021, has been significantly improved, providing phishing pages for more than 20 financial institutions, online retailers, and popular services such as Netflix and Uber. In terms of appearance, Frappo is designed as a service that gives the impression of an anonymous crypto wallet. The original project with a similar name is currently available on GitHub, allowing developers to integrate payment methods that support Ethereum and Bitcoin.

It was observed that Frappo, technically a browser extension, was added to Chrome’s online store by threat actors. Enabling the extension requires installing the browser plug-in on Firefox or Google Chrome and making payments.

Frappo developers offer a variety of payment plans for threat actors based on the subscription period they choose. When Frappo is activated, the threat actors are provided with a navigation menu to create a new phishing page (phishlet). An interactive wizard is then provided that allows threat actors to configure settings, define server credentials, and select the brand to imitate.

Phishing pages categorized by brand and profiles are of high quality and contain interactive scenarios that fool targets into entering critical credentials. Threat actors successfully use PaaS platforms such as Frappo for malicious activities such as Account Import (ATO), Commercial Email reconciliation (BEC), Payment, and Identity Theft.

Threat actors use advanced tools and tactics to target global consumers, so protecting digital identity becomes one of the most critical priorities for online security. In this context, it is recommended that;

• users and organizers who are members of e-commerce platforms ensure the reliability of the platforms where they use critical account information,
• do not rely on email, attachments, and links from unknown parties,
• not keep the input information available in the account in the browser memory,
• enable the 2FA/MFA features on any platform available, and
• use comprehensive security solutions.

Security News – Week 19

Published: 11 May 2022

Multiple Privilege Escalation Vulnerabilities Detected in Linux Operating System

Microsoft security researchers have detected two critical vulnerabilities that could allow threat actors to carry out a series of malicious activities with root privileges on Linux systems. The vulnerabilities collectively called “Nimbuspwn” can be used to gain root privileges on Linux systems and allow threat actors to deploy various malicious software, such as backdoors and ransomware, to the vulnerable system.

Nimbuspwn security vulnerabilities, tracked as CVE-2022-29799 and CVE-2022-29800, exist in networkd-dispatcher, a component that sends link state changes on Linux machines. The vulnerability tracked as code CVE-2022-29799 exists due to a Directory Traversal error in the _run_hooks_for_state function in the source code of networkd-dispatcher. Another security vulnerability with code CVE-2022-29800 is related to a time-of-check to time-of-use (TOCTOU) error in the _run_hooks_for_state function.

To not be the target of malware campaigns that can be carried out using these security vulnerabilities, users of networkd-dispatcher are advised to immediately update the vulnerable versions to the latest version that fixes the vulnerabilities.

Frappo: A New “Phishing-as-a-Service” On The Dark Web

A new underground service called “Frappo” has been detected on the dark web by security researchers at Resecurity Hunter. Frappo provides threat actors with the ability to host and create high-quality phishing pages that imitate online banking, e-commerce, popular retailers, and online services to capture customer data.

Frappo is a service that serves as a Phishing (PaaS) provider as a Service. The service, first known to emerge on the dark web around 22 March 2021, has been significantly improved, providing phishing pages for more than 20 financial institutions, online retailers, and popular services such as Netflix and Uber. In terms of appearance, Frappo is designed as a service that gives the impression of an anonymous crypto wallet. The original project with a similar name is currently available on GitHub, allowing developers to integrate payment methods that support Ethereum and Bitcoin.

It was observed that Frappo, technically a browser extension, was added to Chrome’s online store by threat actors. Enabling the extension requires installing the browser plug-in on Firefox or Google Chrome and making payments.

Frappo developers offer a variety of payment plans for threat actors based on the subscription period they choose. When Frappo is activated, the threat actors are provided with a navigation menu to create a new phishing page (phishlet). An interactive wizard is then provided that allows threat actors to configure settings, define server credentials, and select the brand to imitate.

Phishing pages categorized by brand and profiles are of high quality and contain interactive scenarios that fool targets into entering critical credentials. Threat actors successfully use PaaS platforms such as Frappo for malicious activities such as Account Import (ATO), Commercial Email reconciliation (BEC), Payment, and Identity Theft.

Threat actors use advanced tools and tactics to target global consumers, so protecting digital identity becomes one of the most critical priorities for online security. In this context, it is recommended that;

• users and organizers who are members of e-commerce platforms ensure the reliability of the platforms where they use critical account information,
• do not rely on email, attachments, and links from unknown parties,
• not keep the input information available in the account in the browser memory,
• enable the 2FA/MFA features on any platform available, and
• use comprehensive security solutions.

April 2022

Security News – Week 17

Published: 27 April 2022

Welcome to our 17th Weekly Security News. We’ve gathered the most speculative cyber security news for you. Keep reading to learn details about this week’s security news and protect yourself proactively.

See you in next week’s News!

Critical Authentication Bypass Security Vulnerability Detected in Atlassian Jira

Jira and Jira Service Management products developed by Atlassian have been identified to be affected by an authentication bypass vulnerability that exists in Jira Seraph, the web application security framework. In Seraph, Jira, and Confluence, it is a security and authentication framework used to process all login and logout requests.

The vulnerability, tracked with code CVE-2022-0540, allows a remote threat actor to bypass authentication by sending a specially crafted HTTP request to vulnerable endpoints.

The vulnerability, rated as critical, affects Jira Core Server, Software Data Center, Software Server, Service Management Server, and Management Data Center solutions. The versions of the affected solutions are as follows:

• Jira Core Server, Software Server, and Software Data Center before 8.13.18, 8.14.x, 8.15.x, 8.16.x, 8.17.x, 8.18.x, 8.19.x, 8.20.x before 8.20.6 and 8.21.x versions are affected.
• Jira Service Management Server versions earlier than 4.13.18 and Management Data Center, 4.14.x, 4.15.x, 4.16.x, 4.17.x, 4.18.x, 4.19.x, 4.20.x and earlier than 4.20.6 Versions 4.21.x are affected.

It is known that security vulnerability does not affect versions of Jira and Jira Service Management Cloud. Atlassian releases security updates for affected versions. Users who use vulnerable versions are advised to immediately upgrade to the current releases to not be the target of attacks that can be carried out using this vulnerability.

Rocket Kitten APT Exploit VMware RCE Vulnerabilities in Backdoor Distribution Campaigns

It has been detected that the Iranian-connected Rocket Kitten threat actors have recently distributed “Core Impact” malware through an updated VMware RCE security vulnerability.

The vulnerability monitored by code CVE-2022-22954 and affecting VMware Workspace ONE Access and Identity Manager solutions cause RCE attacks that allow the threat actor to access with high privileges. Threat actors who use this vulnerability to access the target system then deploy the Core Impact Backdoor to memory using the PowerShell script called PowerTrash.

The widespread use of VMware Identity Manager solutions and unlimited remote access to threat actors from this attack can lead to destructive breaches among industries.

In this context, it is recommended that users using vulnerable VMware products immediately apply the published updates to protect against attacks that can be carried out using the said vulnerability. In addition, it is important to prevent the IoC findings related to the campaign in question from the security solutions used.

A Cryptographic Security Vulnerability Detected in Java: “Psychic Signatures”

A cryptographic security vulnerability has been detected by security researchers in Java that allows threat actors to potentially capture communications and messages that should be encrypted, such as SSL communications and authentication processes (JWT).

The security vulnerability, called “Psychic Signatures,” monitored as CVE-2022-21449, is due to the incorrect application of the signature verification algorithm (ECDSA). Effective use of vulnerability results in the void of the integrity of content guaranteed by signatures.

The vulnerability affects Java 15, 16, 17, and 18 versions. In this context, it is recommended to immediately upgrade the vulnerable Java versions to the latest version (17.03 or 18.0.1) not to be the target of attacks that can be carried out using the vulnerability.

Three Critical Vulnerabilities Detected Affecting Cisco Products

Network solutions provider Cisco has released updates to address high-severity security vulnerabilities that could allow threat actors to take control of affected systems and carry out denial-of-service attacks (DoS).

The details of these security vulnerabilities are as follows:

• The vulnerability, tracked by code CVE-2022-20783 and due to lack of authentication, affects Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software.
• The vulnerability tracked by code CVE-2022-20773 and found in Cisco Umbrella Virtual Appliance (VA) relates to a static SSH host switch that allows threat actors to perform potential Man-In-The-Middle (MitM) attacks.
• The vulnerability, tracked by code CVE-2022-20732, could allow threat actors to view and modify database content to elevate their privileges on the affected device.

Cisco has also fixed many medium-severity vulnerabilities affecting other products in its product line, including Webex Meeting, Unified Communications Products, Umbrella Secure Web Gateway, and IOS XR Software. In this context, it is recommended to immediately upgrade the vulnerable versions to the published updates in order not to be the target of attacks that can be carried out using vulnerabilities.

Enterprises GitHub Repos Are Targeted through Captured Auth0 Access Tokens

A cloud-based storage service, GitHub, has announced that threat actors manipulate 0Auth user access tokens to commit data breaches from enterprise GitHub repos. With the detection of transactions by threat actors on April 12, 2022, it has been observed that the data of many organizations, including NPM, were seized using 0Auth access tokens belonging to Heroku and Travis-CI applications.

OAuth access tokens are often used by different services and applications to authorize access to designated parts of user data and communicate with each other without sharing credentials. This is based on the SSO (Single Sign-on) architecture, allowing single login to authorize other applications.

Github authorities have issued a statement stating that 0Auth access tokens will not be obtained by a data breach on GitHub and that these tokens are not stored directly in a usable format. Also has been detected by GitHub security researchers that unauthorized access to the NPM’s development environment has been made through a compromised AWS API key. It is estimated that the threat actors obtained the API key using the 0Auth access tokens captured. Github took action following an increase in activities using 0Auth access tokens, preventing the use of such tokens.

According to Github’s statement, some Github repositories have been compromised, but no changes have been made to the packages, and no user data or credentials have been accessed. Github has launched a detailed investigation to identify all users and organizations affected by the breach. It is recommended that GitHub users who have the potential to be affected by this breach regularly review OAuth applications that they are authorized or have access to their organization and periodically follow the security logs of the relevant organization to identify potential anomaly activities.

New Zero Click Vulnerability Detected Affecting iOS Operating System

Citizen Lab digital security researchers have detected a new zero-click iMessage vulnerability, which is used to install Pegasus spyware on the iPhone devices of Catalan politicians, journalists, and activists. Pegasus is developed by the Israeli firm NSO and marketed to governments as licensed software for investigating terrorist activities. With Pegasus spyware, attacks were carried out on high-level authorities of many states such as the United Kingdom and Finland.

Between 2017 and 2020, it was observed that Pegasus targeted at least 65 people by exploiting the Kismet iMessage vulnerability and a vulnerability in Whatsapp. Many people are among the recently observed campaign targets, such as Catalan members of the European Parliament, heads of state, judges, lawyers, and journalists.

The zero-click vulnerability, called HOMAGE, affected some versions before iOS 13.2 and was fixed in iOS 13.2. In the statement made by Apple officials, it was stated that users using the current version of iOS are not affected by the HOMAGE exploit. Spyware installed on target systems without any user interaction (zero-click) comes with many features such as reading messages on devices, listening to calls, capturing user passwords, location tracking, and accessing the device’s microphone and camera.

The campaign in question has not yet been attributed to any state or threat actor, but the findings indicate that the campaign was carried out by threat actors affiliated with the Spanish government.

In this context, in order not to be the target of attacks that can be carried out using the said vulnerability and malicious software, it is recommended to keep the device/system or programs used in the latest version, download applications from official sources, and use a comprehensive anti-malware solution.

Security News – Week 16

Published: 20 April 2022

A New Android Banking Trojan Distributed via Google Play Store: “OCTO”

A new malware campaign has been detected deploying the banking trojan “OCTO”, which aims to hijack users’ banking information through multiple Android apps with more than 50,000 downloads on the Google Play Store. OCTO Trojan malware is a new variant of Exobot malware that targets financial institutions in various countries such as Turkey, France, Germany, Australia, Thailand, and Japan.

OCTO malware has many functions, such as recording keystrokes (keylogging), hijacking credentials, bypassing security solutions, and ensuring persistence on the target system. Also, Octo Malware gains remote access capability through the update to ExobotCompact, allowing threat actors to perform on-device fraud (ODF) activities.

ODF is a very dangerous, risky, and unsuspecting type of fraud transaction are started from the device the targets are using and can be used in other applications available in the system. However, performing such fraudulent activities on the target system requires users to enable Accessibility Services.

Applications used for the distribution of malware are as follows:

• Pocket Screencaster (Com.Moh.Screen)
• Fast Cleaner 2021 (Vizeeva.Fast.Cleaner)
• Play Store (Com.Restthe71)
• Postbank Security (Com.Carbuildz)
• Pocket Screencaster (Com.Cutthousandjs)
• BAWAG PSK Security (Com.Frontwonder2)
• Play Store App Install (Com.Theseeye5)

OCTO trojan distributed through the above applications can also be distributed via fake Google Chrome or Play Store updates. OCTO’s capabilities to capture screen contents in real-time and record keystrokes allow threat actors to capture entered credentials, a lock pattern or PIN code used to unlock the device, and user data stored in browsers.

Based on the different communication techniques established by OCTO with command and control (C&C) servers, multiple different threat actors are thought to be behind the attacks. It has been foreseen that attacks using malicious software with financial motivation such as OCTO, Cerberus, and Medusa will continue to increase.

To not be the target of similar campaigns, it is recommended to download applications/programs from reliable official sources, check the permissions requested by the applications, keep the applications downloaded to the devices to a minimum, and use Anti-Virus/Anti-Malware solutions.

Fake Web Apps Steal Android Users’ Banking Information

It has been detected that threat actors manipulate various Android applications and carry out campaigns targeting the banking information of Malaysian Android users.

The campaign begins with the web apps of cleaning services Grabmaid, Maria’s Cleaning, Maid4u, YourMaid, Maideasy, MaidACall, and a pet store PetsMore imitated by threat actors and delivered to their targets via Facebook ads. However, these fake web apps do not offer targets the option to make direct online purchases. Instead, targets are requested to download the relevant apps from the Google Play app store. However, the “Download” buttons provided for users to download the application via Google Play do not direct users to Google Play but to servers under the control of threat actors.

Successful execution of the campaign requires Android users to enable the “Install Unknown Apps” option on their devices. Additionally, it has been observed that some of the fake web applications in question do not have an Android application on Google Play, contrary to what is claimed.

Applications require users to login to appear legitimate after they are downloaded and launched; however, there is no account verification mechanism on the server-side. Apps with the appearance of a real e-store imitate the interface of the original stores, offering the option to order and pay for the goods and services purchased. The targets can pay by credit card or by transferring the required amount from their bank accounts at the next stage. Users who choose the direct transfer option are presented with a fake FPX checkout page and are asked to select their bank from among the eight Malaysian banks provided and then enter their credentials.

It has been observed that the targeted banks are eight banks operating in Malaysia. At the last stage, an error message is sent to the end-users that provide their banking information as input, stating that the username and password are invalid. As a result, the bank information entered by the user is captured by threat actors.

In order not to be the target of similar campaigns, should not respect advertisements observed on social media platforms, application downloads should be made through reliable application stores, the reliability of platforms where critical information is requested should be checked, 2FA / MFA features should be enabled on every possible platform.

The Critical Vulnerability in Elementor WordPress Plugin Affects Thousands of Websites

A critical remote code execution vulnerability has been detected in Elementor, the leading website building platform for WordPress, that could affect nearly 500,000 websites.

The exploitation of the vulnerability requires authentication, but it is a serious threat that anyone entering the vulnerable website, including regular subscribers, can take advantage of the vulnerability. A threat actor that creates a regular user account on an affected website can change the name and theme of the affected site to make it look completely different.

It is foreseen that an unauthenticated user too may exploit the critical vulnerability in the Elementor plugin in the continuing process. This RCE vulnerability has been fixed in the published version of 3.6.3. To avoid being affected by attacks that can be carried out using this vulnerability, website administrators are advised to apply the latest update available for the WordPress plugin or remove the plugin entirely from the website.

Security News – Week 14

Published: 7 April 2022

New Phishing Campaign Detected That Deploying Remcos RAT

Morphisec Labs researchers have been detected that new phishing campaign that deploys Remcos RAT. The chain of attacks begins when threat actors send targets phishing e-mails that appear to be from a financial institution and contain a malicious attachment related to payment methods (Money Transfer/EFT).

In the e-mail content, the threat actors request the targets to open the Excel file containing recommendations on payment methods. The Excel file is password-protected to avoid detection, and the password is included in the text of the e-mail sent to the destinations.

The Excel file contains Visual Basic code that runs when a user opens the file and enables macros. The Visual Basic code in question executes a PowerShell command that downloads another .vbs file from a remote server. Then the newly downloaded and executed .vbs file connects back to the C2 server and fetches a hardcoded PowerShell code. This PowerShell code is responsible for downloading and decoding the next phase. In the final stage, Remcos RAT is injected into the target system.

Remcos is a commercial remote access trojan developed by BreakingSecurity. The Remcos trojan allows threat actors to quickly and easily control an infected computer, hijack personal information and monitor the target’s activity. This type of malware uses advanced defense techniques to evade detection.

These techniques include disabling and removing security solutions, hiding or encrypting data and scripts. In this context, in order not to be the target of similar malware campaigns, it is recommended to disregard e-mail attachments and links from unknown parties, download files/programs from reliable sources, raise awareness of institution/organization personnel about possible social engineering/phishing attacks, and use reliable security solutions. In addition, it is recommended that the IoC findings related to the campaign be blocked from the security solutions in use.

Zyxel Released Updates to Fixing a Critical Vulnerability

Zyxel has released security updates for a critical security vulnerability affecting business firewall and VPN solutions.

The security vulnerability tracked by code CVE-2022-0342 is an authentication bypass vulnerability caused by the lack of a proper access control mechanism in the web interface of some firewall versions. A threat actor that successfully exploits the vulnerability can bypass authentication and gain access to administrative privileges on the vulnerable system. The vulnerability affects the versions listed below.

Zyxel stated that no evidence of active exploitation of the said vulnerability has been detected yet and has released updates that fix the vulnerability. In this context, it is recommended that updates that fix the vulnerability be applied immediately to avoid the attacks that can be carried out using the vulnerability.

Beastmode Botnet Targets Security Vulnerabilities in Totolink Routers

Beastmode Botnet, a variant of Mirai Botnet, has been detected to exploit security vulnerabilities in Totolink routers to expand access to vulnerable systems and perform denial-of-service attacks.

The security vulnerabilities in Totolink routers, tracked by codes CVE-2022-26210, CVE-2022-26186, CVE-2022-25075, CVE-2022-25084, relate to a command injection vulnerability that could allow arbitrary code execution.

Snippets containing the execution of the Beastmode Botnet with different filenames and parameters;

It is observed that Beastmode also exploits vulnerabilities found in TP-Link Tapo C200 IP cameras, Huawei HG532 routers, NUUO, and Netgear’s video surveillance solutions, and discontinued D-Link products.

In this context, to not be the targets of attacks by the botnet may carry out, it is recommended to immediately upgrade the vulnerable versions to the current versions that fix the vulnerabilities. In addition, it is important to block the IoC findings related to the Beastmode Botnet from the security solutions in use.

The Threat Actor Breached MailChimp Customer Accounts

E-mail marketing company MailChimp has been exposed to a data breach by the threat actor. It has been detected that the threat actor, who have infiltrated the company’s systems and captured more than 100 user information, use this data in phishing activities targeting the popular hardware crypto wallet maker.

In the MailChimp breach, an unknown threat actor hijacked internal tools used by the company’s customer support staff for account management. This social engineering attack that targets MailChimp’s employees resulted in the hijacking of employee credentials.

After the MailChimp attack, users of the crypto wallet that hardware that allows users to store their cryptocurrencies offline reported receiving suspicious e-mails about a security incident related to the company. These e-mails received by users are part of a carried out phishing attack through captured data in the MailChimp attack.

In that phishing campaign, e-mails were sent to buyers informing them that the wallet maker had suffered a security breach and that they needed to download the latest version of the wallet application and set up a new PIN for the wallets to protect their assets. If users download the fake application and enter their password information, crypto money wallets are seized by the threat actor.

In this context, it is recommended to disregard e-mails and links that seem to come from the wallet maker, change the information used in MailChimp accounts using strong policies, be aware of leaked data, and enable 2FA/MFA features on used platforms. In addition important to raise awareness of institution/organization personnel against possible phishing or social engineering attacks.

Cicada APT Group Targets Government Institutions

It has been detected that the Chinese-supported APT group Cicada has carried out espionage campaigns targeting government agencies and non-governmental organizations in many countries, including the USA, Canada, Hong Kong, Turkey, Israel, India, Montenegro, and Italy.

It is observed that threat actors take advantage of security vulnerabilities in vulnerable Microsoft Exchange servers to gain initial access to the target network in these attacks.

The following tools have been observed to be used in this attack campaign:

• Mimikatz Loader: Used to download Mimikatz malware responsible for hijacking user credentials from compromised systems.
• WinVNC: Allows remote control of vulnerable systems by threat actors.
• RAR Archiving Tool: It is used to compress, encrypt or archive the files used to gain access to the target network.
• System/Network Discovery Tool: This tool allows threat actors to detect which systems or services are connected to an infected machine.
• WMIExec: WMIExec is a Microsoft command-line tool used to execute commands used by threat actors.
• NBTScan: Used by APT groups for discovery within a compromised network.

After successfully accessing the targeted system, Sodamaster Backdoor, which is used in other Cicada campaigns, is deployed to the system. Sodamaster backdoor can check registry keys or delay the execution to avoid detection, hijack data of targeted systems such as username, hostname, and operating system information, download and execute additional payloads, and mask traffic to a command and control (C&C) server.

It is predicted that threat actors targeting important sectors such as education, health, and justice will continue their attacks in many countries. In this context, in order not to be the target of similar types of attacks, it is recommended to keep the systems and programs used up-to-date, to use reliable Anti-Virus/Anti-Malware solutions, and to block the IoC findings related to the campaign from using security solutions.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview