{"id":7350,"date":"2022-07-08T07:17:33","date_gmt":"2022-07-08T14:17:33","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7350"},"modified":"2023-04-05T12:32:21","modified_gmt":"2023-04-05T19:32:21","slug":"securins-friday-threat-intelligence","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/securins-friday-threat-intelligence\/","title":{"rendered":"Securin\u2019s Friday Threat Intelligence"},"content":{"rendered":"<p dir=\"ltr\">CSW\u2019s weekly threat intelligence edition brings to you early warnings about critical vulnerabilities that are already weaponized or could potentially be weaponized and prove dangerous to your organization and its assets. This week, we bring to you eight threats that are currently trending as well as new vulnerabilities that hackers are exploiting.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Why play catch-up when you can proactively patch these vulnerabilities now?<\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Check out our new Threat Intelligence Podcast featuring Top Three Threats of the Week hosted by <a href=\"mailto:david.rushton@cybersecurityworks.com\">David Rushton<\/a> from the CSW Research Team.<\/strong><\/p>\n<div style=\"padding: 56.25% 0 0 0; position: relative;\"><iframe style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%;\" title=\"Ep: 02 Top three cyber threats of the week\" src=\"https:\/\/player.vimeo.com\/video\/728015977?h=4587aaa4ea&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/div>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\">Top Critical Cyber Threats of the Week<\/h2>\n<ol>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"#Black Basta\">Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit<\/a><\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"#Shadow Pad\">ShadowPad Targets Industrial Control Systems<\/a><\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"#CVE-2022-28219\">CVE-2022-2819:\u00a0Unauthenticated XXE to RCE and Domain Compromise in ManageEngine ADAudit Plus<\/a><\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"#Linux servers\">Microsoft Warns of Cryptomining Malware Campaign Targeting Linux Servers<\/a><\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"#Oracle\">The Miracle Exploit affects Oracle Fusion Middleware and Oracle Online Systems<\/a><\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"#ZuoRat\">ZuoRAT Hijacks SOHO Routers to Silently Stalk Networks<\/a><\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"#FabricSpace\">FabricScape: Escaping Service Fabric, Privilege Escalation<\/a><\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\"><a href=\"#UnRaR\">UnRAR Vulnerability Could Let Attackers Hack Zimbra Webmail Servers<\/a><\/p>\n<\/li>\n<\/ol>\n<h2 dir=\"ltr\"><a id=\"Black Basta\" name=\"Black Basta\"><\/a>Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit<\/h2>\n<p dir=\"ltr\">Black Basta is a highly notorious ransomware group that has extorted from over 50 organizations in recent times. This week, the group was caught deploying a banking trojan named QakBot as a means of entry and movement to exploit the PrintNightmare vulnerability (CVE-2021-34527). This vulnerability is caused by improper privilege management and can be used to remotely execute code. Black Basta abused the Windows Print Spooler Service or spoolsv.exe to drop its payload, spider.dll, and perform privileged file operations. It also exploited the vulnerability to execute another file in the affected system, but samples of this file were no longer available in the system. Additionally, researchers found that the ransomware actors used the Coroxy backdoor in conjunction with the abuse of the computer networking utility tool Netcat to move laterally across the network. Once the attackers gained a wide foothold in the network, they executed the Black Basta ransomware.<\/p>\n<p dir=\"ltr\"><a href=\"https:\/\/cybersecurityworks.com\/blog\/vulnerabilities\/how-to-detect-cve-2021-34527.html\">Check out our Detailed Blog on Printnightmare and Get the Script to Detect the Vulnerability.<\/a><\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrFLGAJvsC31vLcC?backgroundColor=gray&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<h2 dir=\"ltr\"><a id=\"Shadow Pad\" name=\"Shadow Pad\"><\/a>ShadowPad Targets Industrial Control Systems<\/h2>\n<p dir=\"ltr\">Recently, a ShadowPad malware attack campaign was launched targeting unpatched Microsoft Exchange servers across Asia. According to an advisory, once the attacker gains initial access via the Proxylogon vulnerabilities, the threat actors deploy the ShadowPad malware on the industrial control systems (ICS) of telecommunications companies in <a href=\"https:\/\/ics-cert.kaspersky.com\/publications\/reports\/2022\/06\/27\/attacks-on-industrial-control-systems-using-shadowpad\/\">Pakistan and Afghanistan<\/a> and a logistics and a transport organization in Malaysia. Although the true motive behind this campaign is not clear, the attackers seem to be interested in the operations of the IC systems and may be gathering information on the larger infrastructure of various countries.<\/p>\n<p dir=\"ltr\">The adversary began launching intrusions around March 2021, when the ProxyLogon vulnerabilities in Exchange Servers were made public. It is also reported that some of the targets were breached by exploiting CVE-2021-26855, a server-side request forgery (SSRF) vulnerability.<\/p>\n<p dir=\"ltr\"><strong>Threat Associated CVEs: <\/strong>CVE-2021-26855<\/p>\n<p dir=\"ltr\"><strong>CVSS Score:<\/strong> 9.8<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count: <\/strong>24<\/p>\n<p dir=\"ltr\"><strong>Exploit Type: <\/strong>[&#8216;RCE&#8217;, &#8216;PE&#8217;, &#8216;WebApp&#8217;]<\/p>\n<p dir=\"ltr\"><strong>CWE: <\/strong>NA<\/p>\n<p dir=\"ltr\"><strong>Ransomware Associations:<\/strong> AvosLocker, Conti, Black Kingdom, Cuba, Epsilon Red, DearCry<\/p>\n<p dir=\"ltr\"><strong>APT Groups:<\/strong> HAFNIUM, Tonto Team, BRONZE BUTLER, Mustang Panda, Threat Group-3390, Calypso, Winnti Group, Websiic, Mikroceen, FamousSparrow, APT29, TR<\/p>\n<p dir=\"ltr\"><strong>Malware: <\/strong>ShadowPad<\/p>\n<p dir=\"ltr\"><strong>CISA KEV: <\/strong>Yes<\/p>\n<p dir=\"ltr\"><strong>CISA Patch Deadline: <\/strong>April 16, 2021<\/p>\n<p dir=\"ltr\"><strong>Patch:<\/strong> <a href=\"http:\/\/support.microsoft.com\/kb\/5000871\">Download<\/a><\/p>\n<h2 dir=\"ltr\"><a id=\"CVE-2022-28219\" name=\"CVE-2022-28219\"><\/a>CVE-2022-28219: Unauthenticated XXE to RCE and Domain Compromise in ManageEngine ADAudit Plus<\/h2>\n<p dir=\"ltr\">CVE-2022-28219 is an unauthenticated remote code execution vulnerability affecting Zoho ManageEngine ADAudit Plus, a compliance tool used by enterprises to monitor changes to Active Directory. The vulnerability consists of several issues, including untrusted Java deserialization, path traversal, and blind injection of XML External Entities (XXE). It can be exploited to steal encrypted login credentials of customers\u2019 domains. It can also be used to distribute malware on all machines on the network.<\/p>\n<p>Our predictive VI had assessed the vulnerability at risk of weaponization way back in April 2022, based on deep &amp; dark web reconnaissance.<\/p>\n<p dir=\"ltr\"><strong>Threat Associated CVEs: <\/strong>CVE-2022-28219<\/p>\n<p dir=\"ltr\"><strong>CVSS Score:<\/strong> 9.8<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count: <\/strong>14<\/p>\n<p dir=\"ltr\"><strong>CWE:<\/strong> CWE-611<\/p>\n<p dir=\"ltr\"><strong>Exploit Type:\u00a0<\/strong> NA<\/p>\n<p dir=\"ltr\"><strong>Ransomware Associations:<\/strong> NA<\/p>\n<p dir=\"ltr\"><strong>APT Groups: <\/strong>NA<\/p>\n<p dir=\"ltr\"><strong>Malware:<\/strong> NA<\/p>\n<p dir=\"ltr\"><strong>CISA KEV: <\/strong>NA<\/p>\n<p dir=\"ltr\"><strong>CISA Patch Deadline:<\/strong> NA<\/p>\n<p dir=\"ltr\"><strong>Patch:<\/strong> <a href=\"https:\/\/www.manageengine.com\/products\/active-directory-audit\/cve-2022-28219.html\">Download<\/a><\/p>\n<h2 dir=\"ltr\"><a id=\"Linux servers\" name=\"Linux servers\"><\/a>Microsoft Warns of Cryptomining Malware Campaign Targeting Linux Servers<\/h2>\n<p dir=\"ltr\">8220 Gang Attack Again! The most recent attack of the &#8216;8220&#8217; malware gang was to compromise Linux systems and install crypto-mining malware. This gang has recently been spotted exploiting the critical bug affecting Atlassian Confluence Server and Data Center, tracked as CVE-2022-26134. The group has actively updated its techniques and payloads over the last year. On June 30, 2022, researchers observed campaigns targeting i686 and x86_64 Linux systems and uses RCE exploits for CVE-2022-26134 (Confluence) and CVE-2019-2725 (WebLogic) for initial access. The updates include the deployment of new versions of a crypto miner and an Internet Relay Chat (IRC) bot.<\/p>\n<p dir=\"ltr\">Know more about the threat that targets Confluence Vulnerability (CVE-2022-26134) here.<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrQXWYnhnB2UcZoJ?backgroundColor=gray&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<h2 dir=\"ltr\"><a id=\"Oracle\" name=\"Oracle\"><\/a>The Miracle Exploit Affects Oracle Fusion Middleware and Oracle Online Systems<\/h2>\n<p dir=\"ltr\">Four CVEs are a part of the \u2018Miracle Exploit\u2019 which affects Oracle Fusion Middleware due to a deserialization bug in the ADF Faces component of the software. Oracle has released a patch to fix these bugs six months after the bug was discovered. These bugs can be exploited through remotely executed code.<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrHwRqeGPgymAiU6?backgroundColor=gray&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\"><a id=\"ZuoRat\" name=\"ZuoRat\"><\/a>ZuoRAT Hijacks SOHO Routers to Silently Stalk Networks<\/h2>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">Since 2020, a multistage remote access trojan (RAT) known as ZuoRAT has been targeting remote workers via small office\/home office (SOHO) routers across North America and Europe undetected. These highly targeted campaigns and their attackers&#8217; tactics, techniques, and procedures (TTPs) are hallmarks of a state-sponsored threat actor, according to security researchers. In addition to passive network sniffing capabilities, the multi-stage ZuoRAT malware provided in-depth network reconnaissance capabilities once it was deployed on an unpatched router (unpatched against known security flaws).<\/p>\n<p>&nbsp;<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrjfLyGtcddJHiiI?backgroundColor=gray&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<h2 dir=\"ltr\"><a id=\"FabricSpace\" name=\"FabricSpace\"><\/a>CVE-2022-30137: Microsoft Azure FabricScape Bug let Hackers Hijack Linux Clusters<\/h2>\n<p dir=\"ltr\">A new security flaw affecting Microsoft&#8217;s Service Fabric has been discovered by Palo Alto Networks Unit 42, which could be exploited by malicious actors to gain elevated permissions and control of the cluster. It can only be weaponized on containers that have runtime access, which has been named FabricScape (CVE-2022-30137). The issue has been resolved in Service Fabric 9.0 Cumulative Update 1.0 as of June 14, 2022.<\/p>\n<p dir=\"ltr\"><strong>Threat Associated CVEs: <\/strong>CVE-2022-30137<\/p>\n<p dir=\"ltr\"><strong>CVSS Score: <\/strong>6.7<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count: <\/strong>1<\/p>\n<p dir=\"ltr\"><strong>Exploit Type: <\/strong>N\/A<\/p>\n<p dir=\"ltr\"><strong>CWE:<\/strong> N\/A<\/p>\n<p dir=\"ltr\"><strong>Ransomware Associations: <\/strong>NA<\/p>\n<p dir=\"ltr\"><strong>APT Groups:<\/strong> N\/A<\/p>\n<p dir=\"ltr\"><strong>Malware:<\/strong> NA<\/p>\n<p dir=\"ltr\"><strong>CISA KEV: <\/strong>No<\/p>\n<p dir=\"ltr\"><strong>CISA Patch Deadline: <\/strong>NA<\/p>\n<p dir=\"ltr\"><strong>Patch:<\/strong> <a href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2022-30137\">Download<\/a><\/p>\n<h2 dir=\"ltr\"><a id=\"UnRaR\" name=\"UnRaR\"><\/a>UnRAR Vulnerability Could Let Attackers Hack Zimbra Webmail Servers<\/h2>\n<p dir=\"ltr\">An exploitable path traversal vulnerability in RarLab&#8217;s UnRAR binary can potentially lead to remote code execution (RCE) on Zimbra and other applications. Assigned the identifier as CVE-2022-30333 which affects the Unix versions of UnRAR, where maliciously crafted RAR archives can trigger a path traversal vulnerability. Successful exploitation of this high severity issue on Zimbra, the open-source platform used by more than <a href=\"https:\/\/www.zimbra.com\/\">200,000 businesses<\/a>, allows attackers to access every email sent or received on compromised servers.<\/p>\n<p dir=\"ltr\"><strong>Threat Associated CVEs: <\/strong>CVE-2022-30333<\/p>\n<p dir=\"ltr\"><strong>CVSS Score:<\/strong> 7.5<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count: <\/strong>1<\/p>\n<p dir=\"ltr\"><strong>CWE:<\/strong> CWE-22<\/p>\n<p dir=\"ltr\"><strong>Exploit Type:<\/strong> NA<\/p>\n<p dir=\"ltr\"><strong>Ransomware Associations: <\/strong>NA<\/p>\n<p dir=\"ltr\"><strong>APT Groups:<\/strong> N\/A<\/p>\n<p dir=\"ltr\"><strong>Malware:<\/strong> NA<\/p>\n<p dir=\"ltr\"><strong>CISA KEV: <\/strong>No<\/p>\n<p dir=\"ltr\"><strong>CISA Patch Deadline:<\/strong> NA<\/p>\n<p dir=\"ltr\"><strong>Patch: <\/strong><a href=\"https:\/\/www.rarlab.com\/rar\/rarlinux-x32-612.tar.gz\">Download<\/a><\/p>\n<p dir=\"ltr\">We use our Threat Intelligence Platform driven by Artificial Intelligence (AI) and Machine Learning (ML) models to analyze the vulnerabilities that could potentially be exploited by hackers. We warn our customers continuously about their exposures and prioritize their vulnerabilities to facilitate rapid remediation.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Follow our weekly blog and podcast to get proactive alerts on trending threats. Reach out to us if you need help in managing your vulnerabilities and exposures from attackers.<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Leverage our expertise and manage your threats on a continuous basis to stay safe from attackers.<\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong><a href=\"https:\/\/cybersecurityworks.com\/contact-us.php\">Talk to Us<\/a>\u00a0<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This week, we bring to you eight threats that are currently trending as well as new vulnerabilities that hackers are exploiting.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[80,146],"tags":[242,107,243,234,89,247,167,116,239,244,246,236,174,235,91,248,238,103,237,108,216,241,240,245],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7350"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/comments?post=7350"}],"version-history":[{"count":4,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7350\/revisions"}],"predecessor-version":[{"id":14319,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7350\/revisions\/14319"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=7350"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/categories?post=7350"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/tags?post=7350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}