{"id":16403,"date":"2023-03-16T08:39:49","date_gmt":"2023-03-16T15:39:49","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=16403"},"modified":"2023-04-06T15:14:08","modified_gmt":"2023-04-06T22:14:08","slug":"securins-threat-intelligence-mar-13-2023-mar-17-2023","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/securins-threat-intelligence-mar-13-2023-mar-17-2023\/","title":{"rendered":"Securin\u2019s Threat Intelligence: Mar 13, 2023 \u2013 Mar 17, 2023"},"content":{"rendered":"\t\t
This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/span><\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t IceFire ransomware, previously focused on Windows exploits, has released a malware that infects Linux devices. The ransomware gang has already deployed these malware samples in a number of organizations worldwide. The new ransomware encrypts files on the Linux system but not all of them. Specific paths remain unencrypted allowing critical system parts to remain operational. <\/span>CVE-2022-47986<\/span><\/a>, the IBM Aspera vulnerability is targeted by IceFire to gain initial access. There are more than 150 Aspera servers exposed online. Aspera users must fix this Vulnerabilities to avoid falling victim to IceFire ransomware.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t CVE-2021-39144<\/a> is a critical VMware XStream flaw that can allow attackers to execute code remotely. It has a 9.8 score on the CVSS scale. This bug can be exploited in low-complexity attacks without user interaction necessary to execute arbitrary code with root privileges.\u00a0<\/span><\/p> A proof of concept is already available publicly and there is evidence that this vulnerability is exploited in the wild.<\/span><\/p> CVE-2020-5741<\/a> is the Plex bug that was exploited in the LastPass breach. It allows attackers with admin privileges to execute arbitrary code remotely in low-complexity attacks. The attackers do not need user interaction for exploitation. LastPass was hacked in 2022 using this vulnerability and installing a keylogger.<\/span><\/p> CISA added both these vulnerabilities to the Known Exploitable Vulnerabilities list on Mar 10, 2023 and requires the federal organizations to patch them by March 31, 2023.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t One of the US federal branches was recently breached by unknown threat actors who exploited the deserialization vulnerability (CVE-2019-18935<\/a>) in Progress Telerik user interface (UI) for ASP.NET AJAX. The vulnerability can allow attackers to remotely execute code in the compromised servers. The attack occurred sometime between November 2022 and early January 2023. Malicious payloads were deployed once the threat actors gained initial access, which was then used to steal data from the device, and evade detection. Microsoft fixed this vulnerability in November 2021 but since the federal agency did not patch it, it was the victim of this attack.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t A chain of vulnerabilities in Jenkins Server and Update Center was recently discovered. An attacker can execute arbitrary code in a compromised server by exploiting these vulnerabilities.<\/span><\/p> Tracked as CVE-2023-27898<\/a> and CVE-2023-27905<\/a>, they are called CorePlague and can also allow attackers to impact self-hosted Jenkins servers.<\/span><\/p> Jenkins <\/span>patched<\/span><\/a> these vulnerabilities on Feb 15, 2023 and recommends users to apply it to mitigate risks.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t CVE-2022-41328<\/a> is a high-severity vulnerability in FortiOS that is actively exploited by threat actors.\u00a0 An authenticated attacker can exploit it to read and write arbitrary files by sending crafted CLI commands. Forti has <\/span>patched<\/span><\/a> this vulnerability in FortiOS version 6.4.12 and above.<\/span><\/p> \u00a0Threat actors are targeting Government networks which use unpatched versions of FortiOS.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\tWhy play catch up when you can fix this now?<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
Trending Threats<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
Vulnerabilities to Watch Out For<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
Trending Threats<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
IceFire Ransomware Targets Linux Devices<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
CISA Adds More CVEs to the KEV List<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
Telerik Vulnerability Under Active Exploitation<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
Vulnerabilities to Watch Out For<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
Several Vulnerabilities in Jenkins Server<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
FortiOS Zero-Day Vulnerability<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t