{"id":7277,"date":"2022-07-13T08:53:20","date_gmt":"2022-07-13T15:53:20","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7277"},"modified":"2023-04-05T12:30:22","modified_gmt":"2023-04-05T19:30:22","slug":"securins-weekly-threat-intelligence-july-11-2022-july-15-2022","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/securins-weekly-threat-intelligence-july-11-2022-july-15-2022\/","title":{"rendered":"Securin&#8217;s Weekly Threat Intelligence &#8211; Jul 11, 2022 &#8211; Jul 15, 2022"},"content":{"rendered":"<p dir=\"ltr\">CSW\u2019s weekly threat intelligence edition brings to you early warnings about critical vulnerabilities that are already weaponized or could potentially be weaponized and prove dangerous to your organization and its assets.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Why play catch-up when you can proactively patch these vulnerabilities now?<\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Check out our Threat Intelligence Podcast featuring Top Three Threats of the Week!<\/strong><\/p>\n<div style=\"padding: 56.25% 0 0 0; position: relative;\"><iframe style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%;\" title=\"Ep: 03 Top three cyber threats of the week\" src=\"https:\/\/player.vimeo.com\/video\/730281131?h=da9e851f70&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/div>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">Microsoft fixes the actively exploited Windows CSRSS Elevation of Privilege zero-day vulnerability and 83 other CVEs<\/h2>\n<p dir=\"ltr\">On Patch Tuesday, Microsoft <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/\">released patches to fix 84 vulnerabilities<\/a>, one of which is an actively exploited zero-day vulnerability (CVE-2022-22047). This CVE, caused by improper privilege management in the Windows Client Server Runtime Subsystem (CSRSS), can be used to execute code remotely. With this, attackers can disable local services such as Endpoint Detection and Security tools and deploy tools to recover admin and domain level accounts. CISA has added this CVE to the list of <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-22047\">Known Exploited Vulnerabilities<\/a> on 12-07-2022.\u00a0 Apart from this, four other critical RCE vulnerabilities (CVE-2022-30220, CVE-2022-22026, CVE-2022-22029, and CVE-2022-22039) also have available patches.<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrjgHubVGCPPmlBy?backgroundColor=yellow&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">VMware patches critical CVE (CVE-2021-22048)<\/h2>\n<p>VMware has <a href=\"https:\/\/www.vmware.com\/security\/advisories\/VMSA-2021-0025.html#:~:text=2022%2D07%2D12%20VMSA%2D2021%2D0025.2\">released a patch<\/a> for a high-severity privilege escalation vulnerability, CVE-2021-22048, 8 months after it was discovered. This vulnerability is found in vCenter Server&#8217;s Integrated Windows Authentication and can only be exploited from the same physical or logical network on which the targeted server is located. The attackers can gain access using low privileges and no user interaction, making it highly dangerous. VMware has categorized this CVE to be in the Important Severity range, meaning that an exploit would result in the complete compromise of the confidentiality and the integrity of user data and processing resources.<\/p>\n<p dir=\"ltr\">Our Predictive VI Reconnaissance had picked out traces of discussion around the CVE on the Deep &amp; Dark Web and prioritized it as a highly exploitable vulnerability long ago.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2021-22048<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 8.8<\/p>\n<p dir=\"ltr\"><strong>Patch Link<\/strong>: <a href=\"https:\/\/www.vmware.com\/security\/advisories\/VMSA-2021-0025.html\">Download<\/a><\/p>\n<h2 dir=\"ltr\">Amazon fixes bugs in AWS Kubernetes service<\/h2>\n<p dir=\"ltr\">In the AWS Kubernetes service, three authentication bugs\u2014causing the vulnerability CVE-2022-2385\u2014have been fixed in the latest version of AWS IAM Authenticator for Kubernetes. This vulnerability could be used to exploit the username through the AccessKeyID in AWS IAM Authenticator. However, no significant exploits have been detected or reported. All users of the AWS Kubernetes service who host and manage their own Kubernetes clusters have been asked to update their AWS IAM Authenticator for Kubernetes to version 0.5.9.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2022-30190<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 7.8<\/p>\n<p dir=\"ltr\"><strong>CWE ID<\/strong>: CWE-20<\/p>\n<p dir=\"ltr\"><strong>Patch Link<\/strong>: <a href=\"https:\/\/github.com\/kubernetes-sigs\/aws-iam-authenticator\/issues\/472\">Download<\/a><\/p>\n<h2 dir=\"ltr\">The Rozena backdoor is the latest malware used to exploit the Follina bug<\/h2>\n<p dir=\"ltr\">Microsoft\u2019s Follina bug is trending and has been <a href=\"https:\/\/symantec-enterprise-blogs.security.com\/blogs\/threat-intelligence\/follina-msdt-exploit-malware\">actively exploited<\/a> by several APT and ransomware groups, especially from Russia and China. In the Follina bug exploit, social engineering tools and phishing campaigns have been deployed to bait victims. To date, the groups have used various malware\u2014such as Qbot and AsyncRAT\u2014to exploit the bug.<\/p>\n<p dir=\"ltr\">Most recently, hackers have started using the Rozena backdoor to inject a remote shell connection back to the attacker, allowing the attacker to take control of the system to access information while maintaining a backdoor to the compromised system. The vulnerability associated with this is CVE-2022-30190, and a patch has been released. If your organization relies heavily on Microsoft Word and Excel, you may want to patch this vulnerability immediately.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2022-30190<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 7.8<\/p>\n<p dir=\"ltr\"><strong>Exploit Type<\/strong>: [&#8216;RCE&#8217;, &#8216;WebApp&#8217;]<\/p>\n<p dir=\"ltr\"><strong>Affected Products<\/strong>: 18<\/p>\n<p dir=\"ltr\"><strong>Patch Link<\/strong>: <a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2022-30190\">Download<\/a><\/p>\n<p dir=\"ltr\"><strong>APT Associations<\/strong>: TA413<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">For more information on Follina, check out <a href=\"https:\/\/cybersecurityworks.com\/blog\/vulnerabilities\/follina-the-no-patch-microsoft-office-0-day-bug-cve-2022-30190-springs-in-wild.html\">our blog<\/a>.<\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">North Korean threat actor targets CVE-2022-26352 with H0lyGh0st ransomware<\/h2>\n<p dir=\"ltr\">CVE-2022-26352, a DotCMS remote code execution vulnerability is now actively being exploited by a North Korean threat actor dubbed as DEV-0530. They have been developing and deploying ransomware in small and medium businesses across multiple countries since June 2021. They gain initial access to target networks by exploiting vulnerabilities in public-facing web applications and content management systems. The vulnerability allows directory crawl attack while downloading files using which the attacker can take control of the system. The patch is available in the latest dotCMS versions 22.03, 5.3.8.10_lts and\/or 21.06.7_lts.<\/p>\n<p dir=\"ltr\">CSW&#8217;s predictive VI analysis tool picked up this CVE in May and warned that it was an extremely\u00a0 exploitable vulnerability. True to this, the CVE is trending as an active exploit now.<\/p>\n<p dir=\"ltr\">Interestingly, this CVE is yet to be added in the NVD or CISA KEV list.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>:\u00a0 CVE-2022-26352<\/p>\n<p dir=\"ltr\"><strong>Exploit Type<\/strong>: RCE<\/p>\n<p dir=\"ltr\"><strong>APT Associations<\/strong>: DEV-0530<\/p>\n<p dir=\"ltr\"><strong>Ransomware Association<\/strong>: H0lyGh0st<\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">New vulnerabilities discovered in the IBM MQ Operator and queue managers<\/h2>\n<p dir=\"ltr\">On July 8, IBM released a security bulletin stating the IBM MQ Operator catalog container images are vulnerable to an issue in the Golang Go packages. There were three CVEs named for this issue: CVE-2020-15257, CVE-2021-21334, and CVE-2021-41771. The first two allow remote code execution, while the last can be used in a DDoS attack. These vulnerabilities have a CVSS base score of 7.5 and higher and are found in the 1.8.2 version of the IBM MQ Operator CD release. IBM has released fixes in the latest version of the IBM MQ Operator (2.0.0 LTS).<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2020-15257<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 5.2<\/p>\n<p dir=\"ltr\"><strong>Affected Products:<\/strong> 4<\/p>\n<p dir=\"ltr\"><strong>Patch Link<\/strong>: <a href=\"https:\/\/www.ibm.com\/support\/pages\/node\/6602259\">Download<\/a><\/p>\n<h2 dir=\"ltr\">New sandbox vulnerability discovered in macOS<\/h2>\n<p dir=\"ltr\">In October 2021, an AppleApp Sandbox vulnerability was discovered and reported to Apple. The vulnerability is now named CVE-2022-26706 and Apple released a patch for it, this week. The vulnerability allows attackers to escape the App Sandbox and run unrestricted on the system using specially crafted codes.<\/p>\n<p dir=\"ltr\">Apple has recommended that all users install these security updates as soon as possible.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2022-26706<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 5.5<\/p>\n<p dir=\"ltr\"><strong>Affected Products<\/strong>: 6<\/p>\n<p dir=\"ltr\"><strong>Patch Link<\/strong>: <a href=\"https:\/\/support.apple.com\/en-us\/HT213253\">Download<\/a><\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">We use our Threat Intelligence Platform driven by Artificial Intelligence (AI) and Machine Learning (ML) models to analyze the vulnerabilities that could potentially be exploited by hackers. We warn our customers continuously about their exposures and prioritize their vulnerabilities to facilitate rapid remediation.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">Follow our weekly blog and podcast to get proactive alerts on trending threats. Reach out to us if you need help in managing your vulnerabilities and exposures from attackers.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">Leverage our expertise and manage your threats on a continuous basis to stay safe from attackers.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><a href=\"https:\/\/cybersecurityworks.com\/contact-us.php\">Talk to Us<\/a><\/p>\n<p style=\"text-align: center;\">\n","protected":false},"excerpt":{"rendered":"<p>CSW\u2019s weekly threat intelligence edition brings to you early warnings about critical vulnerabilities that are already weaponized or could potentially be weaponized and prove dangerous to your organization and its assets.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[80,146],"tags":[229,172,107,228,89,230,232,233,150,231,218,103,108],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7277"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/comments?post=7277"}],"version-history":[{"count":6,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7277\/revisions"}],"predecessor-version":[{"id":14318,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7277\/revisions\/14318"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=7277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/categories?post=7277"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/tags?post=7277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}