Log in Request a demo

Weekly Security News Archive, 2023.

This page holds the weekly security news issues and newsletters that Brandefense published. It covers the 10 items from January 2023 to June 2023 (2023). Each entry keeps its original title, publish date and text, newest first. Earlier addresses of these entries now lead to the matching entry here. The overview page lists all periods.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview

All 10 Entries On This Page

June 2023

Security News Digest | Security Newsletter | June 16, 2023

Published:

We’ve gathered darkweb insights, cyber security news, vulnerabilities, and CVEs, ransomware for you. Enjoy!

A Short-Look at The Dark Web

Here are the insights & security news from the darkweb. Learn and protect yourself before threats reach you. If you want to get more insight, follow us on Twitter and Subscribe to our Ransomware Newsletter!

  • AnonymousSudan claims to have launched a DDoS attack affecting 15,000 Microsoft users in the U.S.  The outage lasted for 1.5 hours. They warn of more to come! More about AnonymousSudan is on this thread.
  • On the dark web, a threat actor offers a malicious method that takes advantage of a vulnerability in PostgreSQL. This could be a 0-day threat. Therefore, remain watchful and cautious of what you click on!

Important Security News

What happened in cyberspace in the last two weeks? Here is a quick shot of security news from the darkweb.

Microsoft Patch Tuesday: June 2023

Microsoft Patch Tuesday, the company’s monthly security update, has provided fixes for 70 vulnerabilities, 62 classified as important, six as critical, one as moderate, and one as low.

These fixes encompass various software, including Microsoft Office, Microsoft SharePoint, and Windows operating system components. Critical vulnerabilities addressed include CVE-2023-29357 in SharePoint Server 2019 and CVE-2023-29363, CVE-2023-32014, and CVE-2023-32015 in the Windows operating system’s implementation of Pragmatic General Multicast (PGM).

CVE-2023-29357: The Elevation of Privilege vulnerability in Microsoft SharePoint Server 2019 has a CVSSv3 severity score of 9.8 and is labeled critical. An unauthenticated, remote attacker can exploit this vulnerability by sending a spoofed JWT authentication token to the target server, thereby assuming the privileges of an authenticated user on that system.

CVE-2023—29363 / 32014 / 32015: These are Remote Code Execution (RCE) vulnerabilities in Windows Pragmatic General Multicast (PGM) that were assigned a critical severity rating of 9.8. An attacker who successfully exploits these vulnerabilities could execute arbitrary code on the target system with SYSTEM privileges.

Notably, the Elevation of Privilege (EoP) vulnerability CVE-2023-29357 in SharePoint Server 2019 is reported as having been used in a successful chained attack demonstration during the March Pwn2Own Vancouver contest. This vulnerability allows an unauthenticated, remote attacker to gain the privileges of an authenticated user by sending a spoofed JWT authentication token.

Microsoft recommends that users enable AMSI as mitigation, though the efficacy of this action remains untested.

Similarly, the Remote Code Execution (RCE) vulnerabilities in the Windows operating system’s PGM, CVE-2023-29363, CVE-2023-32014, and CVE-2023-32015, could allow an attacker to execute code remotely by sending a malicious file to a vulnerable system. These vulnerabilities are only exploitable on systems with message queueing services enabled.

Another set of vulnerabilities, CVE-2023-28310 and CVE-2023-32031, are RCEs in various Microsoft Exchange Server versions, allowing an authenticated attacker to execute arbitrary code or commands remotely. The affected versions are Microsoft Exchange Server 2016 Cumulative Update 23 and 2019 Cumulative Updates 12 and 13.

Another set of vulnerabilities, CVE-2023-28310 and CVE-2023-32031, are RCEs in various Microsoft Exchange Server versions, allowing an authenticated attacker to execute arbitrary code or commands remotely. The affected versions are Microsoft Exchange Server 2016 Cumulative Update 23 and 2019 Cumulative Updates 12 and 13.

Also, CVE-2023-29362 is an RCE vulnerability in the Remote Desktop Client component of Windows operating systems and the Remote Desktop Client for Windows Desktop applications, which can be exploited by a remote attacker with control over a Remote Desktop Server.

Microsoft urges all users to promptly apply the updates provided in the Patch Tuesday release to ensure their systems are protected against these vulnerabilities. As always, keeping software updated with the latest security patches is one of the best practices for maintaining a secure and resilient system.

Updates ASAP

In March 2023, Microsoft Patch Tuesday updates, Microsoft has released 2 zero-days. After that, BRANDEFENSE Analysts’ investigation, threat actors posted about CVE-2023-24880 on a dark web forum. In the forum post, threat actors said that not all Windows systems had been updated yet, so they could continue to share the PoC. [Read More]

Threat actors always wait for your mistakes. Do not forget your updates.

MOVEit Transfer Software Exploited Through Critical Zero Day Vulnerability 2023

Ipswitch, a subsidiary of Progress Software Corporation, has been hit by a major cybersecurity vulnerability exploited by unknown hackers to attack its MOVEit Transfer software. The software is a popular application for businesses and customers to transfer data securely. Identified as CVE-2023-34362 – a zero-day vulnerability – Progress Software Corporation has issued a critical security advisory warning its customers to take precautionary measures immediately.

The software developer advises all its customers to restrict access to external traffic to ports 80 and 443 on MOVEit Transfer servers until patches have been installed. While Progress notes that the recommendation is necessary, it also concedes that it will affect the operations of certain applications such as MOVEit Automation tasks, API functions, and the plugin functionality of the Outlook MOVEit Transfer.

Vulnerable to SQL injection that leads to remote code execution, cybersecurity company, Rapid7, has identified the zero-day flaw in the software. With approximately 2,500 exposed servers, primarily in the United States, Rapid7 notes a common feature of all exploited devices is the ‘human2.asp’ webshell, which can execute a series of commands if accessed with the correct password. Scarily, these commands enable the attacker to retrieve vast amounts of data from the server, such as lists of stored files, user details, and Azure Blob Storage account configurations.

Reportedly several admins have reported discovering multiple unexpected files post-breach. What is worrying is that the breach likely began over the long Memorial Day weekend in the United States when system monitoring is often at its minimum.

With a potential for data theft and exposure, cybersecurity experts are warning organizations to shut down their MOVEit Transfers until the issue is resolved and a comprehensive investigation for compromise has been conducted.

Charles Carmakal, CTO of Mandiant, strongly suggests that all organizations using MOVEit Transfer should acquire a forensic examination to ascertain whether their system was compromised and if data was stolen. Furthermore, Progress Software has confirmed that its cloud platform was impacted, potentially broadening the scope of victims. The company has released mitigation steps for on-premise and cloud-based systems, and experts recommend organizations follow them.

Microsoft has attributed the attacks exploiting the CVE-2023-34362 MOVEit Transfer 0-day vulnerability to Lace Tempest, known for ransomware operations and running the infamous Clop extortion site. The software giant has also published articles with IOCs, detections, and hunting guidance and will continue to monitor the situation with stakeholders.

Second MFT 0-Day in Six Months: Cl0p Ransomware Gangs Announced They Exploit Over 130 Organizations

The zero day vulnerability in the GoAnywhere file-sharing software is tracked with the code CVE-2023-0669 and was first discovered on February 3, 2023. On February 6, 2023, an exploit code was released for this vulnerability, and by February 10, 2023, Cl0p operators had announced that they had used the exploit to attack 130 organizations… [Read More]

“Triangulation Trojan” Launches Sophisticated Attack on Apple Devices

Security experts have uncovered an advanced, targeted cyberattack that leverages Apple’s mobile devices. The attack, named “Triangulation,” is aimed at planting covert spyware into the iPhones of employees of certain companies, including middle and top management personnel.

The cyberattack employs an invisible iMessage carrying a malicious attachment. Utilizing multiple vulnerabilities within the iOS operating system, the attachment is executed on the device, stealthily installing the spyware. This occurs without the need for user action. Once in place, the spyware discreetly relays sensitive data back to remote servers, including microphone recordings, instant messenger photos, geolocation, and other user activity data.

The proprietary nature of iOS makes the detection and removal of this spyware particularly challenging, requiring the use of external tools. A vital sign of the Triangulation presence is disabling iOS updates on the infected device. Additionally, a device backup should be made and checked using a unique utility for a more definitive infection confirmation. Kaspersky is also in the process of developing a free detection tool.

Unfortunately, due to the specific way the spyware blocks iOS updates, there is currently no effective method to remove the Triangulation without losing user data. The only recourse is to reset the infected iPhones to factory settings and install the latest version of the operating system and the entire user environment anew. This is crucial as the spyware can re-infect through vulnerabilities present in an outdated iOS version.

The attack’s sophisticated nature is such that it remained largely undetected until anomalies within the network originating from Apple devices were picked up by Kaspersky’s Unified Monitoring and Analysis Platform (KUMA), a native Security Information and Event Management (SIEM) solution. Subsequent investigations revealed that several dozen iPhones belonging to senior employees were infected with the spyware.

Kaspersky is still investigating this incident, with more information to be shared in a dedicated post on Securelist. They anticipate further details on the global proliferation of this spyware will emerge in the coming days. Despite being targeted in this attack, Kaspersky stresses they were not the primary objective and assures their business processes and user data remain unaffected.

C2 Domains For Triangulation Trojan Attack

The source is SecurceList.

addatamarket[.]net

backuprabbit[.]com

businessvideonews[.]com

cloudsponcer[.]com

datamarketplace[.]net

mobilegamerstats[.]com

snoweeanalytics[.]com

tagclick-cdn[.]com

topographyupdates[.]com

unlimitedteacup[.]com

virtuallaughing[.]com

web-trackers[.]com

growthtransport[.]com

anstv[.]net

ans7tv[.]net

Security News Headings

April 2023

Security News Digest | Security Newsletter | April 27, 2023

Published:

We’ve gathered dark web insights, cyber security news, vulnerabilities, and CVEs, ransomware for you. Enjoy!

Important Security News

What happened in cyberspace in the last two weeks? Here is a quick shot of security news from the world.

A New Trojan Pest Detected Targeting Android Users in Poland and Australia: Chameleon

A new banking trojan called Chameleon has been discovered by cybersecurity researchers, specifically targeting Android users in Poland and Australia. Besides a cryptocurrency exchange app, the trojan, active since January, mimics other popular apps, including an Australian government agency and a Polish bank.

The trojan is spread via compromised websites, Bitbucket hosting services, and Discord attachments. It has been observed that threat actors create the application icon by imitating the icons of ChatGPT, Chrome, and Bitcoin to distribute the malware.

In this way, malware does not arouse suspicion from users.

One of the notable features of Chameleon is its unique commands, which do not appear to be associated with any known Trojan families. This shows that the malware may be a new strain, and researchers believe it is still in its early stages of development and comes with limited capabilities.

Chameleon poses a significant threat to Android users with its usual banking trojan capabilities such as keylogging, SMS collection, launching overlay attacks and stealing cookies. In addition, the malware includes a lock catcher module that can detect if an Android device user is using a PIN, password or swipe. Chameleon can also disable Google Play Protect, making it harder for users to see and remove malware.

Although the current variant of Chameleon is not highly sophisticated, cybersecurity experts warn that it still abuses Accessibility Services.

This allows attackers to upgrade the malware further and cause more damage.

As a result, users are advised to be cautious when;

  • Links received via e-mails or text messages from unknown senders,
  • Always keep systems up to date, and
  • Take advantage of comprehensive security solutions.
Western Digital Suffers A Security Breach That Puts Its Internal Data In Danger

Western Digital, a famous Silicon Valley-based American computer drive manufacturer and data storage company, has been hit by a recent data breach, according to a report by TechCrunch.

The hackers claim to have stolen more than 10TB of sensitive data from the storage company, demanding more than $10 million in ransom. Still, Western Digital is refusing to cooperate with the hackers. Besides, the cybercriminals shared a sample of the stolen information with tech bloggers, who confirmed its authenticity.

Earlier this month, the company disclosed that an unauthorized third party had access to multiple systems used within the organization. The storage company did not provide further details about the attack’s size but continued coordinating with law enforcement and forensic cybersecurity experts.

The attack forced Western Digital’s cloud network out of action for nearly two weeks, and the company has only recently managed to get the consumer service My Cloud back online. The hackers claim to have customer information and sensitive company data, such as the cellphone numbers of the company’s top executives.

It remains unclear who is behind the attack. The hackers have not identified themselves, but they have warned that they will release the stolen data onto the hacking website Alphv if they do not receive the ransom from Western Digital.

The storage company has not confirmed whether the leaked information includes customers’ sensitive information, such as SSNs, DOBs, and banking information. Western Digital has also yet to ensure whether customer files were lost because of the security breach.

If the stolen data is released, it could harm the reputation of the publicly traded computer storage manufacturer. In this context, to avoid being the target of similar security breaches, it is recommended to consider some of the security measures given below.

  • The system, software, program and other inventories used in the institution/organization should be used in the current versions where the vulnerabilities are eliminated.
  • Institution/organization personnel should know about possible social engineering and phishing attacks.
  • Comprehensive security solutions should be deployed in the organization’s network, and traffic should be proactively monitored to detect potential cyber attack attempts.
  • Using the Brandefense Threat Intelligence platform, a DPRS solution, is recommended to detect cyber threats and attacks targeting the brand and take quick action.

A Short-Look at The Dark Web

Here are the insights & security news from the dark web. Learn and protect yourself before threats reach you. If you want to get more insight, follow us on Twitter and Subscribe to our Ransomware Newsletter!

🔥URGENT: an Indian insurance regulator hit by Lockbit ransomware! Sensitive data leaked 💼🆔 & ransom deadline: April 18⏳ Don’t become the next victim! Stay informed & protect yourself with our in-depth analysis of Lockbit’s: https://t.co/TQrq3B5dly #CyberSecurity💡 pic.twitter.com/LKfNHu60ld

— BRANDEFENSE | Digital Risk Protection Service (@Brandefense) April 13, 2023

  • Sophos EDR & Checkpoint Harmony EDR security software found for sale on the deep web! In nature, these products are used for malware detection. Threat actors may use them to test & evade the detection of their own malware.
  • The pro-Russian hacker group Noname057(16) has launched DDoS attacks on energy companies based in Germany and Sweden – RWE & Vatenfall – citing political conflict related to the Russia-Ukraine war.

Security News Headings

Security News Digest | Security Newsletter | April 14, 2023

Published:

We’ve gathered dark web insights, cyber security news, vulnerabilities, and CVEs, ransomware for you. Enjoy!

A Short-Look at The Dark Web

Here are the insights & security news from the dark web. Learn and protect yourself before threats reach you. If you want to get more insight, follow us on Twitter and Subscribe to our Ransomware Newsletter!

No need to cut credit cards; just monitor for suspicious activities! We recently discovered a threat actor claiming to have ~1M sensitive data records from a major US bank. Stay alert folks! And report any incidents to your bank! 🔐💳 #DataBreach #Financial #Cybersecurity pic.twitter.com/llb3bKnH1U

— BRANDEFENSE | Digital Risk Protection Service (@Brandefense) April 12, 2023

  • In a Russian dark web forum, threat actors are targeting a China-based EPC company which provides R&D, and engineering services. The hackers are demanding $10,000 for the RAT they used in the attack.
  • A new MacOS secure-Websocket HVNC malicious tool was discovered on the dark web, using port 443 for authentication, which is concerning, ’cause this port is typically open by default!

Important Security News

What happened in cyberspace in the last two weeks? Here is a quick shot of security news from the world.

Attacks Using Realtek and Cacti Vulnerabilities Increase

Security professionals must be aware of the recent surge in attacks targeting vulnerabilities in Cacti and Realtek devices on Windows and Linux servers. These vulnerabilities are being exploited by threat actors deploying ShellBot and Moobot botnet malware to gain control of vulnerable systems.

Moobot exploits an arbitrary command injection vulnerability in Realtek Jungle SDK (CVE-2022-46169) and a command injection vulnerability in Cacti (CVE-2021-35394). It communicates with a command and control (C2) server using heartbeat messages and scans for other known bots, killing their processes to launch distributed denial of service (DDoS) attacks.

On the other hand, ShellBot primarily targets the Cacti flaw to deploy new malware variants.

The second variant is particularly dangerous due to its extensive set of commands and multiple types of flooding attacks.

It’s worth noting that several other attackers have also leveraged these same vulnerabilities to deploy other botnet malware, such as Fodcha, Gafgyt, Mirai, Mozi, and RedGoBot.

While software updates have been released to address these vulnerabilities, many organizations still use vulnerable devices, exposing them to these attacks.

Therefore, security professionals should advise organizations to;

  • Update their Cacti and Realtek devices to the patched versions as soon as possible
  • Continue to monitor their systems for any signs of IoCs, and
  • Implement best practices for securing their networks, such as applying patches promptly, using strong passwords, and limiting access to sensitive data.
New Windows CLFS 0-Day Vulnerability Used in Ransomware Attacks

The critical Windows CLFS 0-day vulnerability that Microsoft addressed in the April 2023 security patches was found to be used in Ransomware attacks by threat actors.

The vulnerability, code CVE-2023-28252, affects the CLFS (Common Log File System) driver and allows local threat actors to elevate their privileges to SYSTEM privileges. The US CISA has identified findings regarding the use of the vulnerability in attacks where the distribution of Nokoyawa Ransomware software is provided.

All federal agencies are expected to fix the vulnerability upon detection by May 2, 2023. At the same time, Kaspersky Lab security researchers have identified evidence of active exploitation of the vulnerability in Nokoyawa attacks. Attacks using the vulnerability target small and medium-sized businesses in the Middle East, North America, and Asia regions.

In order to prevent active exploitation of the vulnerability, no detailed explanation will be made yet.

In this context, it is recommended to take the following precautions into consideration to avoid being the target of ransomware or other attack campaigns that can be carried out using the vulnerability.

  • Security updates that fix vulnerabilities should be applied to vulnerable systems immediately,
  • E-mails, attachments, and links from unknown parties should not be trusted, opened,
  • Comprehensive security solutions should be used,
  • Care should be taken against social engineering/phishing attacks that may be carried out during the distribution phase of the malware.
A New Stealer Targeting Cryptocurrency Users Through Phishing Sites Detected: “Creal”

The phishing site is impersonating a legitimate Cryptocurrency mining platform. When users click the “Download Kryptex” button to download the crypto money application to their computers, they are directed to the Dropbox page, where a ZIP file containing the Creal Stelar malware is hosted.

THE STEALER SOFTWARE IS CODED IN PYTHON, AND THE SOURCE CODE IS AVAILABLE IN A PUBLIC GITHUB REPOSITORY, ALLOWING OTHER THREAT ACTORS TO MODIFY THE CODE TO SUIT THEIR NEEDS. Therefore, it is a foreseeable scenario for various stealer malware to emerge from the source code of Creal Stealer and pose a significant threat to users. In addition, about 50 examples of the use of the malware in question have been observed in the wild. This shows that threat actors are actively using Open Source code.

Creal provides permanence by copying itself on the infected system. In the data collection process defines global variables by including keywords such as cookieWords, passwWords, CookieCount, P4sswCount, WalletsZip, GamingZip, and OtherZip.

The module that handles Stelar malware’s data collection targets Chromium-based browsers, chat and gaming apps, cold crypto wallets, and browser extensions.

The phishing site looks like the image below.

Security News Headings

March 2023

Security Newsletter | March 30, 2023

Published:

We’ve gathered dark web insights, cyber security news, vulnerabilities, and CVEs, ransomware for you. Enjoy!

A Short-Look to The Dark Web

Here are the insights from dark-web. Learn and protect yourself before threats reach you. If you want to reach more insight, follow us on Twitter and Subscribe to our Ransomware Newsletter!

  • Meow stealer (A NEW MALWARE), as we found out, only 4 out of 26 antivirus scanners can detect it. It steals sensitive data like browser info, crypto wallets, messaging apps, password managers, Discord tokens, and Windows product keys.
  • An alleged 7GB database leak exposes data of 50M Instagram users – emails, names, followers, following, bios, status, last update & locations.
  • Powerful macOS Stealer is now on the dark web. It can extract passwords and cookies from Chrome, Firefox, Brave, and Edge browsers. Also, it extracts the credit card details from the browsers we say above.
  • Brandefense Cyber Threat Intelligence (CTI) analysts uncovered a Russian underground forum post claiming to have breached a multinational energy company’s China database, with 7GB of sensitive data offered for $3000.

Security News of the Last Two Weeks

What happened in cyberspace in last two weeks? Here is a quick shot of security news from the world.

Adobe Acrobat Sign Abused in Redline Stealer Distribution Campaigns

Avast security researchers have observed that the Adobe Acrobat Sign software is being manipulated in Redline Stealer distribution campaigns by threat actors. It allows registered users to send document signing requests to anyone. This will create an email that will be sent to the targeted recipients containing a link to the document (PDF, Word document, HTML) that will be hosted on Adobe’s servers. The sender can also add text to the email, which is an important detail that can be easily exploited by cybercriminals.

Learn More

Microsoft Fixes Multiple Vulnerabilities in March 2023 Updates

Microsoft has released its March 2023 Patch Tuesday software updates, which include two zero-days. The first vulnerability is an information disclosure issue that can allow a remote attacker to send specially crafted email messages to a victim’s inbox. This will cause Windows Mail or Outlook to crash and restart, allowing the attacker to obtain the NTLMv2 hash of the victim’s account.

Learn More

Threat Actors Behind GoAnywhere Attacks Target Japan-based Hitachi Energy Firm

Hitachi Energy has confirmed a data breach as part of the GoAnywhere attacks. The Cl0p ransomware gang behind the attacks exploited a 0-day vulnerability in Fortra GoAnywhere MFT (Managed File Transfer) to gain access. Recently, it was discovered that a third-party software provider named FORTRA GoAnywhere MFT was vulnerable to a zero-day vulnerability and was being used in attacks by the Cl0p ransomware group targeting institutions/organizations in various countries.

Learn More

Apache Fineract Has Three Critical SQL Injection Vulnerabilities | CVE-2023-25196

Three critical vulnerabilities have been discovered in Apache Fineract, a platform designed to bring the world’s unbanked population into the modern financial ecosystem. These vulnerabilities, namely CVE-2023-25195, CVE-2023-25196, and CVE-2023-25197, could allow unauthorized users to access sensitive data or take control of the system.

Learn More

Hackers Are Targeting Organizations with FortiOS Vulnerability Exploitation

Hackers exploit a severe vulnerability, CVE-2022-41328, in FortiOS – an operating system widely used by governments and large organizations. This flaw enables them to execute arbitrary code and has already caused data loss and system corruption in targeted organizations.

Learn More

February 2023

Weekly Security News – Week 8

Published:

Welcome to our 8th Weekly Security News. We’ve gathered the most speculative cyber security news for you. Keep reading to learn details about this week’s security news and protect yourself proactively.

See you in next week’s News!

Fortinet Releases Critical Updates for FortiOS, FortiNAC and More

Fortinet has released security updates to address 40 security vulnerabilities affecting its FortiWeb, FortiOS, FortiNAC, and FortiProxy solutions. Two of the 40 vulnerabilities identified are considered critical, and 15 have a high level of importance.

Two of Fortinet’s Vulnerabilities are 9.8/10 Score

The critical vulnerabilities include CVE-2022-39952, a remote code execution (RCE) vulnerability in FortiNAC’s keyUpload script that could allow unauthorized code or commands to be executed by unauthenticated threat actors through specially crafted HTTP requests. The affected versions include;

  • FortiNAC 9.4.0,
  • FortiNAC 9.2.0 – 9.2.5,
  • FortiNAC 9.1.0 – 9.1.7,
  • FortiNAC 8.8 all versions,
  • FortiNAC 8.7 all versions,
  • FortiNAC 8.6 all versions,
  • FortiNAC 8.5 all versions, and
  • FortiNAC 8.3 all versions.

The second critical vulnerability, CVE-2021-42756, affects FortiWeb Proxy and is caused by a stack-based buffer overflow vulnerability. This vulnerability could allow an unauthenticated, remote threat actor to execute arbitrary code on vulnerable systems through specially crafted HTTP requests. The affected versions include;

  • FortiWeb 5. x all versions,
  • FortiWeb 6.0.7 and below,
  • FortiWeb 6.1.2 and below,
  • FortiWeb 6.2.6 and below,
  • FortiWeb 6.3.16 and below, and
  • all versions of FortiWeb 6.4.

Fortinet has also released security updates for other vulnerabilities affecting FortiADC, FortiExtender, FortiOS, FortiProxy, FortiSwitchManager, FortiWAN, FortiAnalyzer, FortiAuthenticator, FortiPortal, and FortiSandbox. Users are advised to apply the updates promptly to avoid potential attacks exploiting these vulnerabilities.

Critical Vulnerability Alert in ClamAV

A critical remote code execution vulnerability has been discovered in ClamAV, an open-source anti-virus software by Cisco. It is an open-source (GPLv2) virus protection solution designed for email scanning, especially in mail gateways.

The security vulnerability, identified as CVE-2023-20032, is due to a memory error resulting from the unchecked buffer size in the HFS+ file parser component. Threat actors can take advantage of this security vulnerability by sending an HFS+ partitioning file prepared by ClamAV for scanning to a vulnerable device. Successful exploitation of the vulnerability by threat actors can result in the execution of arbitrary code with the same privileges as the ClamAV scanning process or a denial of service (DoS) condition.

The Affected ClamAV Applications
  • Secure Endpoint (Advanced Malware Protection) for Windows, MacOS, and Linux devices
  • Secure Endpoint Private Cloud
  • Secure Web Appliance

It has been confirmed that the Secure Email Gateway and Secure Email and Web Manager products are not affected by the vulnerability.

In addition to the above vulnerability, a ClamAV information disclosure vulnerability affecting the DMG file parser, tracked by code CVE-2023-20052, has also been resolved with the release of versions 0.103.8, 0.105.2, and 1.0.1. In this context, it is recommended to apply the released updates promptly to avoid being targeted by attacks that can be carried out using the vulnerabilities.

Reddit Suffered a Security Breach Resulting in Unauthorized Access to Internal Systems

Reddit suffered a security breach resulting in unauthorized access to its internal systems, sensitive documents, and system source code by threat actors. The breach occurred through a phishing campaign targeting Reddit employees, where threat actors used a fake login page mimicking the company’s intranet site to obtain employee login credentials and two-factor authentication tokens.

Reddit released that user accounts and passwords are safe

Reddit confirmed the success of the phishing attack, stating that one employee’s login credentials were compromised, allowing threat actors to gain access to its internal systems, certain internal documents, source codes, internal dashboards, and other business systems. However, Reddit reassured users that their passwords and accounts were not compromised. The affected employee reported the incident, and the security team quickly responded by removing the attacker’s access and conducting an internal investigation.

Reddit recommended users enable two-factor authentication and regularly update their login credentials with strong password policies to avoid potential risks.

Weekly Security News – Week 6

Published:

Welcome to our 6th Weekly Security News. We’ve gathered the most speculative cyber security news for you. Keep reading to learn details about this week’s security news and protect yourself proactively.

See you next week!

Code Signing Certificates for GitHub Desktop and Atom Apps Suffered Unauthorized Access

On December 7, 2022, GitHub discovered that a series of repositories used in the planning and development of GitHub Desktop and Atom were accessed by unknown threat actors without authorization. After a comprehensive investigation, it was announced that the services were not at risk, and no unauthorized changes were made to these projects as a result of this unauthorized access.

As a result of the unauthorized access, a number of encrypted code signing certificates for GitHub Desktop and Atom applications were leaked. The certificates are password-protected, and no evidence of malicious use has been observed so far. However, if the password of the certificates is decrypted, the threat actor can act as if they have been officially created by GitHub by signing unofficial applications with these certificates.

They will cancel the open certificates used for GitHub Desktop and Atom

As a preventive measure, GitHub announced that they will cancel the open certificates used for GitHub Desktop and Atom applications. This cancellation of certificates will make some versions of GitHub Desktop for Mac and Atom invalid. However, this edit will not affect GitHub Desktop for Windows. The following versions of GitHub Desktop for Mac will be removed from use on February 2:

  • 1.2
  • 1.1
  • 1.0
  • 0.8
  • 0.7
  • 0.6
  • 0.5
  • 0.4
  • 0.3
  • 0.2

GitHub Atom will also stop serving the following versions on February 2:

  • 63.1
  • 63.0

It is recommended that users switch to previous versions of the applications that are not affected by the breach to continue using GitHub Desktop and Atom.

Adobe Acrobat Reader DC RCE Vulnerability: Exploit Code Released

A recently patched critical Remote Code Execution (RCE) vulnerability in the Adobe Acrobat Reader DC software has been identified with the publication of proof-of-concept (PoC) exploitation code.

The security vulnerability, coded as CVE-2023-21608, arises from a Use-After-Free error that could cause arbitrary code execution in a current user session. The threat actor could exploit this security vulnerability by convincing users to open a specially crafted document, allowing them to use the user’s privileges to execute arbitrary code on the system or cause the application to crash.

Adobe Released the Security Bulletin for Adobe Acrobat Reader

Adobe recently patched the vulnerability through a security bulletin, but shortly after the release of the update, Hacksysteam security research announced the publication of PoC code targeting the exploitation of CVE-2023-21608 vulnerability. To avoid being targeted by attacks that could be carried out using the vulnerability and exploitation code, it is recommended that users who are using vulnerable Adobe Acrobat Reader DC versions upgrade to the current version where the vulnerability has been fixed.

RCE Alert in IBM WebSphere Application Server

A critical security vulnerability has been identified in IBM WebSphere Application Server that can cause remote code execution by threat actors.

The security vulnerability (coded as CVE-2023-23477) is caused by an incorrect authentication that occurs during data processing. A remote threat actor can execute random code on the targeted system by sending specially prepared data to the server.

IBM released a security bulletin

This vulnerability affects versions of IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server 8.5. IBM has released updates to fix the vulnerability. To avoid being targeted in attacks that can be carried out using the vulnerability, it is recommended that users of the following versions of the IBM WebSphere Application Server apply the latest updates immediately:

For IBM WebSphere Application Server users who use versions between 9.0.0.0 and 9.0.5.7:

  • Apply Fix Pack 9.0.5.8 or a later version.

For IBM WebSphere Application Server users who use versions between 8.5.0.0 and 8.5.5.19:

  • Apply Fix Pack 8.5.5.20 or later versions.

Critical Vulnerability Alert in Atlassian Jira Service Management Server and Data Center

A critical security vulnerability has been detected in the Jira Service Management Server and Data Center solutions developed by Atlassian.

The vulnerability, coded as CVE-2023-22501, is caused by a faulty authentication control. The threat actor can exploit this vulnerability by using a specially prepared request to impersonate another user and gain access to a Jira Service Management session. The vulnerability affects the following versions:

  • 3.0
  • 3.1
  • 3.2
  • 4.0
  • 4.1
  • 5.0
Atlassian solved the vulnerability for Jira Service Management Server and Data Center

The vulnerability is resolved in versions 5.3.3, 5.4.2, 5.5.1, 5.6.0, and later. It is recommended that users of vulnerable versions upgrade promptly to a version that resolves the vulnerability.

Weekly Security News – Week 5

Published:

Welcome to our 5th Weekly Security News. We’ve gathered the most speculative cyber security news for you. To learn details about this week’s security news and protect yourself proactively, keep reading.

See you next week!

Multiple Vulnerabilities in ChromeOS

Multiple security vulnerabilities have been detected in ChromeOS that could allow remote attackers to execute code remotely and access sensitive information in affected installations.

The vulnerabilities include;

  • User-After-Free error affecting Google Chrome’s WebTransport component (CVE-2023-0471),
  • Use-After-Free error affecting Google Chrome’s WebRTC component (CVE-2023-0472),
  • Type Confusion errors affecting Google Chrome’s ServiceWorker API component (CVE-2023-0473), and
  • Use-After-Free error affecting Google Chrome’s GuestView component (CVE-2023-0474).

Google has released updated versions to address these vulnerabilities, and it is recommended to apply the updates promptly to avoid being targeted by potential attacks.

Critical RCE Alarm in VMware vRealize Log Insight

VMware has released updates for four security vulnerabilities that could have allowed remote code execution in the VMware vRealize Log Insight solution. vRealize Log Insight is a log management tool that helps to collect, view and analyze logs from monitoring or network solutions.

The critical vulnerabilities, identified as CVE-2022-31706 and CVE-2022-31704, are caused by directory traversal errors and improper access restrictions.

The company has released version 8.10.2 of VMware vRealize Log Insight, which addresses these vulnerabilities. There have been no findings of active exploitation of these vulnerabilities. It is recommended that these updates be applied as soon as possible to prevent potential attacks.

A Critical Vulnerability Affecting QNAP NAS Devices Has Been Detected

QNAP has released security updates that fix a critical security vulnerability affecting QNAP NAS devices.

The vulnerability, tracked as CVE-2022-27596, could allow a remote threat actor to take control of the system by injecting malicious code into affected QNAP NAS devices. Exploiting the vulnerability does not require user interaction or privileges. The vulnerability affects firmware versions QTS 5.0.1 and QuTS hero h5.0.1.

QNAP Released Security Updates

It has released security updates that fix the vulnerability. In order not to be the target of attacks that can be carried out using the vulnerability, it is recommended to immediately apply the published QTS or QuTS hero firmware updates.

Critical RCE Alert on Western Digital My Cloud OS

In Western Digital My Cloud OS 5 devices, a critical security vulnerability has been identified, which could allow attackers to remotely execute code through reverse shell methods.

The vulnerability is caused by a command that reads data from a privileged position without adequately cleaning it before creating a system command. The vulnerability affects several Western Digital solutions, including My Cloud PR2100, My Cloud PR4100, My Cloud EX4100, My Cloud EX2 Ultra, My Cloud Mirror G2, My Cloud DL2100, My Cloud DL4100, My Cloud EX2100, My Cloud, and WD Cloud.

Western Digital has released update

The company has released firmware version 5.26.119 to address the vulnerability, and it is recommended that users apply the update as soon as possible to avoid potential targeted attacks.

January 2023

Weekly Security News – Week 4

Published:

Welcome to our 4th Weekly Security News. We’ve gathered the most speculative cyber security news for you. To learn details about this week’s security news, and protect yourself proactively, keep reading.

See you next week!

Critical SQLi Alarm in CakePHP

A critical security vulnerability has been detected in the CakePHP Framework, which is designed to develop web applications using the PHP programming language.

The vulnerability, identified as CVE-2023-22727, allows remote attackers to perform SQL injection attacks on affected installations. The vulnerability is caused by insufficient cleaning of user-provided inputs.

The vulnerability has been fixed in versions 4.2.12, 4.3.11, and 4.4.10 of CakePHP, and users of vulnerable versions are advised to upgrade immediately. If upgrading is not possible, users can consider using the Pagination library of CakePHP to address the issue.

PayPal Data Breach That Puts More Than 34,000 User Accounts in Danger

A data breach at PayPal was recently discovered, potentially affecting millions of users. On 20 December 2022, PayPal confirmed that they had discovered a data breach affecting user accounts. The company stated that the incident occurred due to a large-scale credential stuffing attack. Credential stuffing is a type of cyber attack in which hackers use lists of stolen usernames and password combinations to gain unauthorized access to accounts on various websites.

The information that was potentially accessed includes customer names, email addresses, phone numbers, birthdates, social security numbers, and individual tax identification numbers. There is also a risk that threat actors may access users’ transaction histories, linked credit or debit card details, and PayPal billing data from their PayPal accounts.

PayPal has advised affected customers to change their passwords and monitor their account activity for any suspicious activity. The company has also stated that it will be providing free credit monitoring and identity protection services to impacted customers. If you believe your account may have been affected by the PayPal data breach, it’s essential to take immediate action to protect yourself. Here are some steps to take:

PayPal has assured customers that they are taking all necessary steps to prevent future incidents and protect customer information. In the meantime, it’s important to take the necessary precautions to protect yourself and your information.

More than 19,000 Cisco Router Solutions Detected to be Vulnerable to RCE Attacks

It has been detected that more than 19,000 Cisco VPN router devices are exposed to remote code execution (RCE) attacks due to the completion of their lifespan. These devices no longer receive security updates from Cisco, leaving them vulnerable to attacks.

On January 11, 2023, details about a critical security vulnerability affecting the Cisco Small Business router series were released. The vulnerability, identified by the code CVE-2023-20025, occurs due to insufficient authentication on the web-based management tool, allowing unauthorized threat actors to bypass authentication controls and gain administrative privileges to execute arbitrary commands on the vulnerable system.

The vulnerability affects four different Cisco Small Business router models: RV016, RV042, RV042G, and RV082. Cisco has stated in a released advisory that they will not be issuing software updates to address the vulnerability, as the affected models have reached the end of their lifespan, and no temporary solution to address the vulnerability has been found. Studies on the Censys scan engine have observed that approximately 20,000 devices are vulnerable to potential attacks using this vulnerability.

Cisco has published a list of devices that have the potential to be affected by the attacks. Cisco router users are advised to check if their devices are on the list of affected devices and upgrade to a newer, supported version as soon as possible. Additionally, users are recommended to implement network segmentation and utilize firewall solutions to help reduce potential attacks.

Critical RCE Alert in Apache Airflow MySQL Provider

A critical security vulnerability has been detected in the Apache Airflow MySQL Provider library that could allow threat actors to execute remote code in affected installations. Apache Airflow is an open-source workflow management platform used to programmatically write, schedule, and monitor workflows. The MySQL Provider is a library used to provide a MySQL connection.

The vulnerability, identified by the code CVE-2023-22884, is a command injection security vulnerability affecting versions of Apache Airflow prior to 2.5.1 and Apache Airflow MySQL Provider prior to 4.0.0. A remote threat actor can execute arbitrary commands on the target system by sending specially crafted data to the application.

It is recommended to upgrade to the current versions that fix the vulnerability as soon as possible to avoid being targeted by attacks that can be carried out using the vulnerability.

Weekly Security News – Week 2

Published:

Critical RCE Alarm in jsonwebtoken (JWT) Library

A critical vulnerability has been identified in the open source jsonwebtoken (JWT) library that could allow threat actors to execute code on the affected server remotely. JsonWebToken is an open-source JavaScript package that allows validation of JWTs used for authorization and authentication purposes. The package developed by Auth0 has more than 9 million weekly downloads and over 20,000 dependencies and plays a significant role in authentication/authorization functionality for many applications.

The vulnerability, tracked as CVE-2022-23529 (this CVE ID was later rejected), affects earlier versions of JsonWebToken 9.0.0. The vulnerability allows threat actors to bypass authentication mechanisms, execute code on the vulnerable system, gain access to sensitive information, and hijack or alter data.

In JsonWebToken version 9.0.0, the code snippet with the vulnerability has been removed, and the vulnerability has been fixed. It is recommended that users using the affected library versions immediately apply the update that fixes the vulnerability.

Maximum Severity Vulnerability on Synology VPN Plus Server

A critical security vulnerability has been identified in Synology VPN Plus servers, which were developed to transform Synology Router solutions into an advanced VPN (virtual private network) server, that could cause threat actors to execute code remotely in affected versions.

The security vulnerability tracked as CVE-2022-43931 is due to a boundary error in Remote Desktop Functionality and affects Synology VPN Plus Server versions before 1.4.3-0534 and 1.4.4-0635. The vulnerability could allow remote threat actors to execute code on the vulnerable system.

Synology Released Patch for Synology VPN Immediately

Synology fixed the vulnerability immediately after being discovered by Synology Incident Response Team (PSIRT). It had a maximum severity score of 10 out of 10.

To avoid being the target of attacks that can be carried out using vulnerabilities, it is recommended to upgrade to Synology VPN Plus Server 1.4.3-0534 or 1.4.4-0635 versions.

Critical 0-Day Alarm Affecting Windows ALPC

As part of the January 2023 updates, Microsoft has released updates that fix 98 security vulnerabilities, including a 0-day vulnerability, Windows ALPC.

The details of the detected 0-day security vulnerability are as follows;

  • The vulnerability tracked as CVE-2023-21674 is a critical Privilege Escalation vulnerability that affects Windows’s ALPC (Advanced Local Procedure Call)  component. The vulnerability due to the boundary fault could allow threat actors to execute code with SYSTEM privileges on the affected system. Advanced Local Procedure Call is a message-forwarding mechanism used in Windows systems.

It is known that threat actors actively exploit this vulnerability. Microsoft has released security updates that fix other vulnerabilities, including this one. In this context, it is recommended to immediately apply the published updates to vulnerable products and versions in order not to be the target of attacks that can be carried out using vulnerabilities.

Weekly Security News – Week 1

Published:

Critical Vulnerabilities on Lenovo ThinkPad X13s BIOS

Security vulnerabilities have been identified that affect the BIOS software of Lenovo ThinkPad X13s model devices and may cause threat actors to execute code remotely on the affected system and access sensitive data of the local user. (Reference Link)

The details of the identified vulnerabilities are as follows;

The vulnerabilities tracked as CVE-2022-40516, CVE-2022-40517, and CVE-2022-40520, are stack-based buffer overflow security vulnerabilities that could allow a local threat actor with elevated privileges to cause memory corruption in the Qualcomm BIOS.

The vulnerabilities, tracked as CVE-2022-40518 and CVE-2022-40519 in the Qualcomm BIOS, allow a local threat actor with elevated privileges to access memory contents.

The vulnerabilities tracked as CVE-2022-4432, CVE-2022-4433, CVE-2022-4434, and CVE-2022-4435, which are in the ThinkPad X13s BIOS, allow a local threat actor with elevated privileges to access memory contents.

These vulnerabilities affect versions before ThinkPad X13s BIOS 1.47. To avoid being the target of attacks that can be carried out using vulnerabilities, it is recommended to upgrade to current versions that fix the vulnerability.

Godfather Trojan Activity Targeting Financial Sector Detected

The Group-IB Threat Intelligence team detected that the Godfather Android banking trojan targeted more than 400 international financial companies between June 2021 and October 2022. Half of the targeted financial companies are banks, and the other half are cryptocurrency wallets and exchanges. The Godfather’s targets include 49 US-based companies, 31 Turkish-based companies, and 30 Spanish-based companies. Financial service providers in Canada, France, Germany, England, Italy, and Poland are among the hardest-hit companies.

The Godfather trojan was developed using the source code of another banking trojan called Anubis. However, The Godfather differs from Anubis with its updated functionality, such as updated command and control (C&C) communication, traffic encryption algorithm, a new module for managing virtual network computing (VNC) connections, and Google Authenticator OTPs. The Godfather is distributed through fake apps hosted on Google Play. Fake pages are placed on Godfather-infected devices. These fake web pages are opened when users click on fake notifications or open legitimate apps targeted by the Godfather. All data entered on these pages (usernames and passwords) is sent to command and control (C&C) servers.

Some activities that Godfather trojan software performs on infected systems;

  • Recording the device’s screen
  • Creating VNC connections
  • Capturing keystrokes (keylogging)
  • Leaking push notifications and SMS messages (to bypass 2FA)
  • Send SMS messages
  • Forward calls
  • Execute USSD requests
  • Start proxy servers
  • Enabling silent mode
  • Establishing WebSocket connections

A Godfather sample analyzed in September 2022 was observed to mimic Google Protect. When a user launches a malicious application, the application imitates the legitimate Google application, but the Godfather activities are running in the background. Once the malware is launched, it persists on the infected device, creates a pinned notification, and hides its icon from the list of installed apps. Considering these details, it is recommended to consider the following security recommendations to avoid being a victim of targeted attacks that the Godfather malware may carry out.

  • Emails, attachments, and links from unknown parties should not be respected.
  • Downloaded applications should be downloaded from legitimate application stores, and by checking the evaluations made,
  • Comprehensive security solutions should be used.

A Music Streaming Service’s User Data Detected Shared on Underground Forums

A music streaming service was exposed to a security breach in September 2019 that resulted in a user data vulnerability. The company stated that the breach was carried out by compromising the security of 3rd party partners and that users’ sensitive data, such as payment information or passwords, were not affected by the breach. However, during the intelligence studies, it was detected that threat actors in underground forums leaked the user data obtained in the September 2019 breach.

The leaked data includes various personal data of the service’s users, such as name, surname, gender, date of birth, e-mail address, location information, IP address, and username. Threat actors who shared the post stated that the breach occurred because a third party made a publicly accessible backup of the data.

Users of the service are advised to be aware of the leaked data, not to trust e-mails, attachments, and links from unknown parties, and to change the password information used on the platform by applying strong password policies. In addition, it is recommended that institutions/organizations and companies store and back up their data in a secure and inaccessible way, keep their systems up-to-date, and benefit from comprehensive security solutions in order not to be the target of data breaches.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview

Know What Is Exposed. Before Attackers Do.

Book a demo of the platform.

  • 4.7Gartner Peer Insights
  • 24hEarly warning time
  • 190+Countries covered

What you see in the demo

  1. Your exposureAssets and services seen from the outside, starting from your own domain.
  2. Threats aimed at youLeaked credentials, look-alike domains and brand abuse in one view.
  3. From alert to actionHow findings reach your team and what to do next.