{"id":12111,"date":"2023-01-09T04:19:37","date_gmt":"2023-01-09T11:19:37","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=12111"},"modified":"2023-04-27T09:17:19","modified_gmt":"2023-04-27T16:17:19","slug":"securins-threat-intelligence-january-9-2023-january-13-2023","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/securins-threat-intelligence-january-9-2023-january-13-2023\/","title":{"rendered":"Securin&#8217;s Threat Intelligence &#8211; Jan 9, 2023 &#8211; Jan 13, 2023"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"12111\" class=\"elementor elementor-12111\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-348037e1 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"348037e1\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-23a08e0b\" data-id=\"23a08e0b\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-5a1236c elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5a1236c\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-inner-column elementor-element elementor-element-fc1482f\" data-id=\"fc1482f\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-269ab05 elementor-widget elementor-widget-text-editor\" data-id=\"269ab05\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-94cbe84 elementor-widget elementor-widget-spacer\" data-id=\"94cbe84\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d034520 elementor-widget elementor-widget-heading\" data-id=\"d034520\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Why play catch up when you can fix this now?<br>Check out our Threat Intelligence Podcast hosted by David Rushton!<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2df0a87 elementor-widget elementor-widget-text-editor\" data-id=\"2df0a87\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div style=\"padding: 56.25% 0 0 0; position: relative;\"><iframe style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%;\" title=\"UNC961 | Spyware | 3CX Application | Securin Threat Intelligence\" src=\"https:\/\/player.vimeo.com\/video\/790695212?h=38cd4f2b15\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/div>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b57622e elementor-widget elementor-widget-spacer\" data-id=\"b57622e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f7804cb elementor-widget elementor-widget-heading\" data-id=\"f7804cb\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dd6443f elementor-widget elementor-widget-text-editor\" data-id=\"dd6443f\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#scattered-spider-exploits-windows-security-deficiencies-in-latest-campaign\" target=\"_blank\" rel=\"noopener\">Scattered Spider Exploits Windows Security Deficiencies in Latest Campaign<\/a><\/li><li><a href=\"#lorenz-ransomware-gang-installs-backdoors\" target=\"_blank\" rel=\"noopener\">Lorenz Ransomware Gang Installs Backdoors<\/a><\/li><li><a href=\"#new-apt-group-dark-pink\" target=\"_blank\" rel=\"noopener\">New APT Group: Dark Pink<\/a><\/li><li><a href=\"#kinsing-malware-employs-initial-access-techniques-in-kubernetes-environments\">Kinsing Malware Employs Initial Access Techniques in Kubernetes Environments<\/a><\/li><li><a href=\"#cisa-adds-2-new-cves-to-the-kev-catalog\">CISA Adds 2 New CVEs to the KEV Catalog<\/a><\/li><li><a href=\"#microsoft-fixes-93-vulnerabilities-in-patch-tuesday\">Microsoft Fixes 93 Vulnerabilities in Patch Tuesday<\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7c7c83d elementor-widget elementor-widget-heading\" data-id=\"7c7c83d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-77e69ad elementor-widget elementor-widget-text-editor\" data-id=\"77e69ad\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#cve-2022-44877-centos-web-panel-vulnerability\">CVE-2022-44877: Centos Web Panel Vulnerability<\/a><\/li><li><a href=\"#cve-2022-46169-cacti-command-injection-vulnerability\">CVE-2022-46169: Cacti Command Injection Vulnerability<\/a><\/li><li><a href=\"#cve-2022-23529-jsonwebtoken-vulnerability\">CVE-2022-23529: JsonWebToken Vulnerability<\/a><\/li><li><a href=\"#cve-2022-43473-manageengine-xxe-injection-flaw\">CVE-2022-43473: ManageEngine XXE Injection Flaw<\/a><\/li><li>CVE-2023-20025: Auth Bypass Bug in CISCO<\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-10154da elementor-widget elementor-widget-spacer\" data-id=\"10154da\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ba7001a elementor-widget elementor-widget-heading\" data-id=\"ba7001a\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-17f7486 elementor-widget elementor-widget-spacer\" data-id=\"17f7486\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-abd356c elementor-widget elementor-widget-menu-anchor\" data-id=\"abd356c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"scattered-spider-exploits-windows-security-deficiencies-in-latest-campaign\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9996c4d elementor-widget elementor-widget-heading\" data-id=\"9996c4d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Scattered Spider Exploits Windows Security Deficiencies in Latest Campaign<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a01e82e elementor-widget elementor-widget-text-editor\" data-id=\"a01e82e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\">Scattered Spider has been targeting theBPO and telecom industry since June 2022. In December 2022, they began a new campaign exploiting Windows Security Deficiencies with a Bring-Your-Own-Vulnerable-Driver (BYOVD) tactic in an attempt to bypass endpoint security. The group deploys a malicious kernel driver through a vulnerability (<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2015-2291\" target=\"_blank\" rel=\"noopener\">CVE-2015-2291<\/a>) in the Intel Ethernet diagnostics driver. The driver used by Scattered Spider is a small 64-bit kernel driver with 35 functions, signed by different certificates stolen from signing authorities like NVIDIA and Global Software LLC, so Windows doesn&#8217;t block it. The BYOVD technique allows publicly available tools, such as KDMapper, to map non-signed drivers into memory.<\/p><p dir=\"ltr\">CVE-2015-2291 was fixed in 2015. However, by planting an older, still vulnerable version on the breached devices, the threat actors can leverage the flaw no matter what updates the victim has applied to the system.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-73d2fac elementor-widget elementor-widget-menu-anchor\" data-id=\"73d2fac\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"lorenz-ransomware-gang-installs-backdoors\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-71d7686 elementor-widget elementor-widget-heading\" data-id=\"71d7686\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Lorenz Ransomware Gang Installs Backdoors<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6f56dfe elementor-widget elementor-widget-text-editor\" data-id=\"6f56dfe\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The Lorenz ransomware gang is employing a new technique in their attacks. They are exploiting Mitel VoIP zero-days to install malicious webshells. These webshells contain backdoors and remain in the victims\u2019 system for a long while and the gang returns after several months to launch the ransomware attack. <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-29499\" target=\"_blank\" rel=\"noopener\">CVE-2022-29499<\/a> is the latest of vulnerabilities to be exploited. It could lead to remote code execution (RCE) when exploited. Most of the backdoors deployed using the zero-days can be exploited even after the vulnerabilities are patched. In a recent attack, the gang deployed backdoors five months prior to the ransomware attack.\u00a0<\/p><p dir=\"ltr\">This teaches the importance of\u00a0<a href=\"\/attack-surface-management\/\" target=\"_blank\" rel=\"noopener\">attack surface management<\/a>\u00a0which can help identify malicious files in the network and eliminate them.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6eab6a2 elementor-widget elementor-widget-menu-anchor\" data-id=\"6eab6a2\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"new-apt-group-dark-pink\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6ef0c01 elementor-widget elementor-widget-heading\" data-id=\"6ef0c01\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">New APT Group: Dark Pink<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0f0fa59 elementor-widget elementor-widget-text-editor\" data-id=\"0f0fa59\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\">This APT group has been active since mid-2021 in the APAC region and occasionally in Europe. They employ spear phishing techniques to initially compromise a victim\u2019s network. It seems that the group is also using a new set of tactics, techniques, and procedures rarely utilized by previously known APT groups. These include a custom toolkit featuring TelePowerBot, KamiKakaBot and Cucky and Ctealer information stealers. Further, Dark Pink can also infect USB devices attached to compromised computers. They execute malicious files using\u00a0 a file type association and DLL Side-Loading. Dark Pink\u2019s intent behind the attacks is cyber-espionage as they have attacked governmental and military entities.<\/p><p dir=\"ltr\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2017-0199\" target=\"_blank\" rel=\"noopener\">CVE-2017-0199<\/a> is a CVE that Dark Pink has exploited in their attacks.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-95149b7 elementor-widget elementor-widget-menu-anchor\" data-id=\"95149b7\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"kinsing-malware-employs-initial-access-techniques-in-kubernetes-environments\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-63c70e5 elementor-widget elementor-widget-heading\" data-id=\"63c70e5\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Kinsing Malware Employs Initial Access Techniques in Kubernetes Environments<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dda3889 elementor-widget elementor-widget-text-editor\" data-id=\"dda3889\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\">Kinsing malware is using new methods to target Kubernetes clusters: exploitation of weakly configured PostgreSQL containers and exploiting vulnerable images. In the first method, a misconfigured and exposed PostgreSQL server is used to run a malicious payload. The \u2018trust authentication\u2019 setting, when improperly configured, can open attackers to several options such as brute force on the Postgresql accounts, attacking the container availability with DoS and DDoS attacks, and trying to exploit the container and the DB itself.<\/p><p dir=\"ltr\">Kinsing malware also uses images vulnerable to remote code execution in the container to run their malicious payload. Some of the popular applications that are exploited are PHP Unit, Liferay, WebLogic, and WordPress. <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-14882\" target=\"_blank\" rel=\"noopener\">CVE-2020-14882<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-14750\" target=\"_blank\" rel=\"noopener\">CVE-2020-14750,<\/a> <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-14883\" target=\"_blank\" rel=\"noopener\">CVE-2020-14883<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-44228\" target=\"_blank\" rel=\"noopener\">CVE-2021-44228<\/a>, and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2022-26134\" target=\"_blank\" rel=\"noopener\">CVE-2022-26134<\/a> are some of the CVEs that Kinsing exploits.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8bb8b76 elementor-widget elementor-widget-menu-anchor\" data-id=\"8bb8b76\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"cisa-adds-2-new-cves-to-the-kev-catalog\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d4c134b elementor-widget elementor-widget-heading\" data-id=\"d4c134b\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CISA Adds 2 New CVEs to the KEV Catalog<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e7f1187 elementor-widget elementor-widget-text-editor\" data-id=\"e7f1187\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\">On January 10, 2023, CISA included <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-41080\" target=\"_blank\" rel=\"noopener\">CVE-2022-41080<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-21674\" target=\"_blank\" rel=\"noopener\">CVE-2023-21674<\/a> in the Known Exploited Vulnerabilities (KEV) catalog.\u00a0<\/p><p dir=\"ltr\">CVE-2022-41080 is a Microsoft Exchange elevation of privileges bug that can be chained with the <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2022-41082\" target=\"_blank\" rel=\"noopener\">CVE-2022-41082<\/a> ProxyNotShell bug to gain remote code execution. The Play ransomware group exploited it as a zero-day to bypass Microsoft&#8217;s ProxyNotShell URL rewrite mitigations and escalate permissions on compromised Exchange servers.<\/p><p dir=\"ltr\">CVE-2023-21674 is another zero-day in Microsoft\u2019s\u00a0 Windows Advanced Local Procedure Call (ALPC). It is a privilege escalation flaw and is actively exploited in attacks. It was patched in January\u2019s Patch Tuesday.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4d1c954 elementor-widget elementor-widget-menu-anchor\" data-id=\"4d1c954\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"microsoft-fixes-93-vulnerabilities-in-patch-tuesday\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dbf50f2 elementor-widget elementor-widget-heading\" data-id=\"dbf50f2\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Microsoft Fixes 93 Vulnerabilities in Patch Tuesday<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5b83092 elementor-widget elementor-widget-text-editor\" data-id=\"5b83092\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\">Among the vulnerabilities that Microsoft\u00a0<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/releaseNote\/2023-Jan\" target=\"_blank\" rel=\"noopener\">patched<\/a>\u00a0on Jan 10, 2023, is an actively exploited zero-day <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-21674\" target=\"_blank\" rel=\"noopener\">CVE-2023-21674<\/a>. In summary, Microsoft fixed:<\/p><ul dir=\"ltr\"><li>39 Elevation of Privilege Vulnerabilities<\/li><li>4 Security Feature Bypass Vulnerabilities<\/li><li>33 Remote Code Execution Vulnerabilities<\/li><li>10 Information Disclosure Vulnerabilities<\/li><li>10 Denial of Service Vulnerabilities<\/li><li>2 Spoofing Vulnerabilities<\/li><\/ul><p dir=\"ltr\"><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2023-21674\" target=\"_blank\" rel=\"noopener\">CVE-2023-21674<\/a>\u00a0is a sandbox escape vulnerability that can lead to the elevation of privileges to the system.\u00a0<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2023-21549\" target=\"_blank\" rel=\"noopener\">CVE-2023-21549<\/a>\u00a0is a Windows SMB Witness Service Elevation of Privilege Vulnerability that was publicly disclosed.<\/p><p dir=\"ltr\"><em><strong>Microsoft users are recommended to apply these patches at the earliest.<\/strong><\/em><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2606336 elementor-widget elementor-widget-spacer\" data-id=\"2606336\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fcc29e3 elementor-widget elementor-widget-heading\" data-id=\"fcc29e3\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4fe6a10 elementor-widget elementor-widget-spacer\" data-id=\"4fe6a10\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9550bb1 elementor-widget elementor-widget-menu-anchor\" data-id=\"9550bb1\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"cve-2022-44877-centos-web-panel-vulnerability\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-309781e elementor-widget elementor-widget-heading\" data-id=\"309781e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2022-44877: Centos Web Panel Vulnerability<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e97e991 elementor-widget elementor-widget-text-editor\" data-id=\"e97e991\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\">A new vulnerability tracked as <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-44877\" target=\"_blank\" rel=\"noopener\">CVE-2022-44877<\/a> has been identified in Centos Web Panel 7. The vulnerability could be exploited to gain remote code execution capabilities. It is yet to be assigned a CVSS score. You can find the proof of concept for it <a href=\"https:\/\/github.com\/numanturle\/CVE-2022-44877\" target=\"_blank\" rel=\"noopener\">here<\/a>.<\/p><p dir=\"ltr\"><strong><span style=\"color: #000000;\">Update:<\/span><\/strong> Hackers have been actively exploiting this vulnerability and deploying webshells for more than 2 weeks now. They have used this vulnerability to deploy webshells with malicious payloads in CWP servers. More than 400,000 CWP instances are accessible over the internet. The encoded payloads convert to Python commands that call the attacker\u2019s machine and spawn a terminal on the vulnerable host using the Python pty Module.<\/p><p><strong><em>Web Panel users are recommended to update to the\u00a0<a href=\"https:\/\/control-webpanel.com\/changelog\" target=\"_blank\" rel=\"noopener\">latest version<\/a>\u00a0immediately.<\/em><\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-28ec0b4 elementor-widget elementor-widget-menu-anchor\" data-id=\"28ec0b4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"cve-2022-46169-cacti-command-injection-vulnerability\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4a9faf1 elementor-widget elementor-widget-heading\" data-id=\"4a9faf1\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2022-46169: Cacti Command Injection Vulnerability<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-949873d elementor-widget elementor-widget-text-editor\" data-id=\"949873d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-46169\" target=\"_blank\" rel=\"noopener\">CVE-2022-46169<\/a> is a command injection vulnerability that allows an unauthenticated user to execute arbitrary code on a server running Cacti. That is, if a specific data source was selected for any monitored device. The\u00a0<a href=\"https:\/\/github.com\/Cacti\/cacti\/security\/advisories\/GHSA-6p93-p743-35gf\" target=\"_blank\" rel=\"noopener\">security advisory<\/a>\u00a0offers remediation steps to avoid falling victim to exploitation.<\/p><p><strong><span style=\"color: #000000;\">Update:<\/span> <\/strong>Hackers are actively exploiting this vulnerability and there are more than 1600 instances of the Cacti device exposed to the internet. Mirai botnets are installed using this vulnerability along with the IRC botnet (PERL-based) that opens a reverse shell on the host and instructs it to run port scans.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9ae9603 elementor-widget elementor-widget-menu-anchor\" data-id=\"9ae9603\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"cve-2022-23529-jsonwebtoken-vulnerability\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-73356bd elementor-widget elementor-widget-heading\" data-id=\"73356bd\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2022-23529: JsonWebToken Vulnerability<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b944477 elementor-widget elementor-widget-text-editor\" data-id=\"b944477\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-23529\" target=\"_blank\" rel=\"noopener\">CVE-2022-23529<\/a> vulnerability is found in the JsonWebToken open source project. It is used for authentication and authorization in many applications. An attacker exploiting this vulnerability can arbitrarily execute code in a server by verifying a maliciously crafted JSON web token (JWT) request. To <a href=\"https:\/\/github.com\/advisories\/GHSA-27h2-hvpr-p74q\" target=\"_blank\" rel=\"noopener\">patch<\/a>\u00a0this vulnerability, a user needs to update to\u00a0 the JsonWebToken package version 9.0.0.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1b309d6 elementor-widget elementor-widget-menu-anchor\" data-id=\"1b309d6\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"cve-2022-43473-manageengine-xxe-injection-flaw\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-792f385 elementor-widget elementor-widget-heading\" data-id=\"792f385\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CVE-2022-43473: ManageEngine XXE Injection Flaw<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ae1d99d elementor-widget elementor-widget-text-editor\" data-id=\"ae1d99d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\">This XML External Entity (XXE) vulnerability exists in the UCS module in OpManager. Exploiting XMLs with vulnerable XML entities can lead to the access of restricted resources. ManageEngine released the <a href=\"https:\/\/www.manageengine.com\/itom\/advisory\/cve-2022-43473.html\" target=\"_blank\" rel=\"noopener\">patch<\/a> for <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-43473\" target=\"_blank\" rel=\"noopener\">CVE-2022-43473<\/a> wherein you disable XML entities when parsing XML responses, so XML entities are not invoked.\u00a0<\/p><p dir=\"ltr\"><em><strong>OpManager users are required to apply this patch immediately.<\/strong><\/em><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<div class=\"elementor-element elementor-element-99f16e1 elementor-widget elementor-widget-spacer\" data-id=\"99f16e1\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-66ada11c elementor-widget elementor-widget-text-editor\" data-id=\"66ada11c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\">Follow our weekly Threat Intelligence Series and podcast for proactive alerts on trending threats.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e2115d8 elementor-cta--skin-classic elementor-animated-content elementor-bg-transform elementor-bg-transform-zoom-in elementor-widget elementor-widget-call-to-action\" data-id=\"e2115d8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"call-to-action.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-cta\">\n\t\t\t\t\t\t\t<div class=\"elementor-cta__content\">\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<h2 class=\"elementor-cta__title elementor-cta__content-item elementor-content-item\">\n\t\t\t\t\t\tLeverage our expertise to continuously manage your threats & exposures.\t\t\t\t\t<\/h2>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-cta__button-wrapper elementor-cta__content-item elementor-content-item \">\n\t\t\t\t\t<a class=\"elementor-cta__button elementor-button elementor-size-lg\" href=\"\/vulnerability-intelligence\/\" target=\"_blank\">\n\t\t\t\t\t\tLEARN HOW\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>We bring you threats that are currently trending as well as new vulnerabilities that hackers are exploiting.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[80,146],"tags":[107,89,660,661,170,116,93,659],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/12111"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/comments?post=12111"}],"version-history":[{"count":51,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/12111\/revisions"}],"predecessor-version":[{"id":17360,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/12111\/revisions\/17360"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=12111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/categories?post=12111"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/tags?post=12111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}