{"id":7275,"date":"2022-07-18T08:52:03","date_gmt":"2022-07-18T15:52:03","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7275"},"modified":"2023-04-05T12:30:15","modified_gmt":"2023-04-05T19:30:15","slug":"securins-threat-intelligence-july-18-2022-july-22-2022","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/securins-threat-intelligence-july-18-2022-july-22-2022\/","title":{"rendered":"Securin&#8217;s Threat Intelligence Jul 18, 2022 &#8211; Jul 22, 2022"},"content":{"rendered":"<p dir=\"ltr\">In this edition, we bring you early warnings and trending news about cyber threats along with accurate threat context. Check out which threat group is on the rampage and what vulnerability they could weaponize soon and more\u2026.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Why play catch up when you can fix this now!<\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Check out our Threat Intelligence Podcast featuring Top Three Threats of the Week!<\/strong><\/p>\n<p><iframe title=\"vimeo-player\" src=\"https:\/\/player.vimeo.com\/video\/733112153?h=3ee9947244\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<h2 dir=\"ltr\">Transparent Tribe launches cyber attacks in the Indian sub-continent<\/h2>\n<p dir=\"ltr\">Transparent Tribe, an\u00a0 APT group, has been targeting educational institutions in India by deploying CrimsonRAT and ObliqueRAT malware. To deploy this, they have used various campaigns including email phishing, setting up fake domains, weaponized documents, etc. The group is suspected to have originated in Pakistan and the latest infection campaign is hosted on a Pakistani web-hosting service ZainHosting. Two RCE CVEs are associated with this attack: <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2017-0199\">CVE-2017-0199<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2012-0158\">CVE-2012-0158<\/a>. The group may have motives of stealing research information from these educational institutions by exploiting student\/staff data stolen during these attacks.<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrBtZNCod3eqN8E0?backgroundColor=green&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<h2 dir=\"ltr\">CloudMensis spyware targets macOS cloud users<\/h2>\n<p dir=\"ltr\">A new spyware exploits the Apple cloud to exfiltrate documents, screenshots, email attachments, and other sensitive data. Dubbed CloudMensis, this spyware was discovered in April 2022, although it has been around for quite some years.\u00a0 The method used to compromise the device still remains unknown but the malware uses a cloud storage provider and an access token to gain access and exfiltrate files. CloudMensis supports three different providers: pCloud, Yandex Disk, and Dropbox. The target victims and the mode of injection of the CloudMensis malware is yet to be discovered, but it is considered a very powerful tool of exploitation.<\/p>\n<p dir=\"ltr\">The CVE associated with this malware is CVE-2020\u20139934.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2020\u20139934<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count<\/strong>: 3<\/p>\n<p dir=\"ltr\"><strong>Exploit Type<\/strong>: Other<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 5.5<\/p>\n<h2 dir=\"ltr\">Elastix VoIP servers under massive attack<\/h2>\n<h2 dir=\"ltr\"><\/h2>\n<p dir=\"ltr\">Two attack groups have targeted Elastix VoIP servers with more than 500,000 malware samples since December 2021. These attacks use the remote code execution vulnerability CVE-2021-45461 to plant a PHP web shell that could run arbitrary commands on the compromised communications servers. This CVE has been exploited since December 2021 and has received a critical rating of 9.8 in NVD.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2021-45461<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 9.8<\/p>\n<p dir=\"ltr\"><strong>Exploit Type<\/strong>: RCE<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count<\/strong>: 4<\/p>\n<p dir=\"ltr\"><strong>Patch Link<\/strong>: <a href=\"https:\/\/community.freepbx.org\/t\/0-day-freepbx-exploit\/80092\">Download<\/a><\/p>\n<h2 dir=\"ltr\">Potential RCE exploit in Juniper\u2019s nginx component<\/h2>\n<p dir=\"ltr\">During an external security scan, it was discovered that an off-by-one error in Juniper\u2019s nginx resolver, could be used to create a worker process crash or arbitrary code execution by forging UDP packets from the DNS server to cause a 1-byte memory overwrite. The CVE associated with this is\u00a0 CVE-2021-23017 and Juniper has <a href=\"https:\/\/supportportal.juniper.net\/s\/article\/2022-07-Security-Bulletin-Northstar-Controller-nginx-component-allows-remote-attacker-to-cause-worker-process-crash-or-potentially-arbitrary-code-execution-CVE-2021-23017-2?language=en_US\">released patches<\/a> for this issue. Thus far, there have been no attacks reported based on this vulnerability.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2021-23017<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 9.4<\/p>\n<p dir=\"ltr\"><strong>Exploit Type<\/strong>: DoS<\/p>\n<p dir=\"ltr\"><strong>CWE ID<\/strong>: CWE-193<\/p>\n<p dir=\"ltr\"><strong>Affected Products<\/strong>: 25<\/p>\n<p dir=\"ltr\"><strong>Patch Link<\/strong>: <a href=\"https:\/\/supportportal.juniper.net\/s\/article\/2022-07-Security-Bulletin-Northstar-Controller-nginx-component-allows-remote-attacker-to-cause-worker-process-crash-or-potentially-arbitrary-code-execution-CVE-2021-23017-2?language=en_US\">Download<\/a><\/p>\n<h2 dir=\"ltr\">Candiru exploits Chrome zero-day vulnerability CVE-2022-2294<\/h2>\n<p dir=\"ltr\">The Candiru spyware was making rounds in July 2021 has made a comeback after disappearing for a while. It is now exploiting a zero-day Chrome vulnerability, CVE-2022-2294, and targeting Lebanese journalists, in particular.<\/p>\n<p dir=\"ltr\">The vulnerability is caused by a heap buffer overflow in WebRTC. This can be exploited to achieve shellcode execution inside a renderer process.<\/p>\n<p dir=\"ltr\">Chrome has released a patch to fix this vulnerability.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2022-2294<\/p>\n<p dir=\"ltr\"><strong>Patch<\/strong>: <a href=\"https:\/\/chromereleases.googleblog.com\/2022\/07\/stable-channel-update-for-desktop.html\">Download<\/a><\/p>\n<p dir=\"ltr\">We use our Threat Intelligence Platform driven by Artificial Intelligence (AI) and Machine Learning (ML) models to analyze the vulnerabilities that could potentially be exploited by hackers. We warn our customers continuously about their exposures and prioritize their vulnerabilities to facilitate rapid remediation.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Follow our weekly blog and podcast to get proactive alerts on trending threats. Reach out to us if you need help in managing your vulnerabilities and exposures from attackers.<\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Leverage our expertise and manage your threats on a continuous basis to stay safe from attackers.<\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong><a href=\"https:\/\/cybersecurityworks.com\/contact-us.php\">Talk to Us<\/a><\/strong><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this edition, we bring you early warnings and trending news about cyber threats along with accurate threat context. Check out which threat group is on the rampage and what vulnerability they could weaponize soon and more\u2026.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[80,146],"tags":[107,227,224,222,225,226,223,221,103,149],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7275"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/comments?post=7275"}],"version-history":[{"count":5,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7275\/revisions"}],"predecessor-version":[{"id":14317,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7275\/revisions\/14317"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=7275"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/categories?post=7275"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/tags?post=7275"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}