1
The War Room
1 readers
1 users here now
Community for various OSINT news and subject matter for open discussion or dissemination elsewhere
founded 1 year ago
MODERATORS
2
1
Akira ransomware gang spotted targeting Cisco VPN products to hack organizations
(securityaffairs.com)
3
4
5
6
New HiatusRAT malware attacks target US Defense Department
In a new HiatusRAT malware campaign, threat actors have targeted a server belonging to the U.S. Department of Defense in what researchers described as a reconnaissance attack.
This is a significant shift in tactics, seeing that the attacks previously focused on organizations from Latin America and Europe, being deployed to compromise business-class DrayTek Vigor VPN routers used by medium-sized businesses for remotely connecting to corporate networks.
However, as Lumen's Black Lotus Labs observed, the campaign's reconnaissance efforts took an unexpected turn between mid-June through August. A U.S. military procurement system was also targeted, with Taiwan-based organizations also singled out.
HiatusRAT samples were recompiled to cater to various architectures ranging from Arm, Intel 80386, and x86-64 to MIPS, MIPS64, and i386) and hosted on newly acquired virtual private servers (VPSs).
One of these VPS nodes was used in a data transfer operation with a U.S. military server designated for contract proposals and submissions.
The website's affiliation with contract proposals suggests that the attackers might be seeking publicly accessible information about military requisites or trying to find information on Defense Industrial Base (DIB)-affiliated organizations.
"We suspect this actor was searching for publicly available resources related to current and future military contracts," Lumen's Black Lotus Labs said.
"Given that this website was associated with contract proposals, we suspect the objective was to obtain publicly available information about military requirements and searching for organizations involved in the Defense Industrial Base (DIB), potentially for subsequent targeting."
New HiatusRAT campaign (Lumen Black Lotus Labs)
This campaign follows an earlier series of attacks where over a hundred businesses, mainly from Europe, North America, and South America, were infected with HiatusRAT to create a covert proxy network.
The malware is primarily used to install additional payloads on infected devices and convert the compromised systems into SOCKS5 proxies for command and control server communication.
"Despite prior disclosures of tools and capabilities, the threat actor took the most minor of steps to swap out existing payload servers and carried on with their operations, without even attempting to re-configure their C2 infrastructure," Lumen said.
As Lumen highlights, this shift in information collection and targeting preferences aligns with Chinese strategic interests, a connection emphasized by the 2023 ODNI annual threat assessment.
U.S. organizations have also been recently targeted in attacks linked to other Chinese-backed threat groups, including Volt Typhoon and Storm-0558.
"We suspect the HiatusRAT cluster serves as another example of tradecraft that could be applied against the U.S. Defense Industrial Base with a sense of impunity. We recommend defense contractors exercise caution and monitor their networking devices for the presence of HiatusRAT," Lumen concluded.
7
Windows 11 KB5029351 preview update released with Search fixes
Microsoft has released the optional August 2023 cumulative update for Windows 11, version 22H2, with fixes for several issues affecting the Search app.
KB5029351 is a monthly non-security preview update that enables Windows admins and users to test fixes and improvements scheduled for release with the forthcoming September 2023 Patch Tuesday rollout.
The update tackles an issue encountered after waking the system from sleep mode, where the Search app fails to launch when clicking the search icon.
Furthermore, it enhances the Search app's reliability while addressing an issue affecting the search box dimensions on Microsoft Surface Pro and Surface Book devices in tablet mode.
Notably, monthly "C" updates are optional; unlike Patch Tuesday releases, they do not come with security-related fixes.
To install the KB5029351 update, click the 'Download and install' button in Settings > Windows Update to check for new updates.
Alternatively, you can download it from the Microsoft Update Catalog and install it manually.
Other highlights in Windows 11 KB5029351
Today's optional update comes with additional fixes and improvements, with some of the most important ones listed below:
- This update adds new functionality that affects app defaults.
- This update addresses an issue that affects print jobs that are sent to a virtual print queue. They fail without an error.
- This update addresses an issue that causes high CPU use. This occurs when you enable the "fBlockNonDomain" policy.
- This update addresses an issue that affects disk partitions. The system might stop working. This occurs after you delete a disk partition and add the space from the deleted partition to an existing BitLocker partition.
The complete list of fixes and improvements can be found in the KB5029351 support bulletin.
With this update, Microsoft also introduced a new policy named "Enable optional updates," which gives admins better control of how monthly optional updates are installed on enterprise devices.
The same policy can be used to control the deployment of controlled feature rollouts (CFR) across endpoints.
A temporary fix is available for this issue, with Windows admins being advised to provision end-user devices before the Windows 11 22H2 upgrade to get around the provisioning issues.
8
9
Microsoft Excel to let you run Python scripts as formulas
Microsoft is adding the Python programming language to Microsoft Excel, allowing users to create powerful functions for analyzing and manipulating data.
The public preview of the feature is now available to Microsoft 365 Insiders in the Beta channel, with the goal to ultimately roll out the feature to Excel for Windows in 16.0.16818.2000.
However, even if you join the Microsoft 365 Insiders Beta channel to test the new feature, there is no guarantee that Python in Excel will be available, as Microsoft is rolling it out slowly to test the feature.
Python in Excel
The new Python in Excel feature brings a new 'PY' function that allows users to embed Python code directly in a cell to be executed like any macro or regular Excel function.
However, instead of running the Python scripts locally, Excel will execute the code in the cloud using a hypervisor-isolated container on Azure Container Instances. Microsoft says this container environment will include Python and a curated set of Anaconda libraries to prevent security issues.
These libraries include the data visualization and analysis tool 'pandas' and the visualization tool 'Matplotlib.'
As the Python scripts will run in an isolated container, they will not have access to any local resources, including the local network, computer, files, and a Microsoft 365 authentication token.
To embed a Python script in Excel, users will use the =PY() function to open a text area where they can enter the Python code they wish to execute.
The code is then executed in the cloud container, and the results are sent back and displayed in the worksheet. Microsoft says this is all done anonymously so that your Python code is not linked back to a particular user.
"Python in Excel makes it possible to natively combine Python and Excel analytics within the same workbook - with no setup required," Microsoft explains in an announcement.
"With Python in Excel, you can type Python directly into a cell, the Python calculations run in the Microsoft Cloud, and your results are returned to the worksheet, including plots and visualizations."
Using the Python Panda library in Excel
Source: Microsoft
Microsoft treats Python in Excel like other embedded scripting languages, automatically blocking them if a document contains a Mark of The Web (MoTW).
Windows automatically adds MoTW flags to all documents and executables downloaded from untrusted sources, such as the internet, using a special 'Zone. Id' alternate data stream.
These MotW labels tell Windows, Microsoft Office, web browsers, and other apps that the file should be treated with suspicion and will cause the document to be opened in Protected View, preventing the execution of macros and embedded Python scripts.
"If you open a workbook that contains Python code from the internet, Excel Protected View won't run Python formulas in the workbook. If a workbook is opened with Microsoft Defender Application Guard, Python formulas don't run by default," explains Microsoft.
To test Python in Excel, join the Microsoft 365 Insider Program and enroll in the Beta channel. However, as previously said, this feature may take some time to roll out to everyone
10
Akira ransomware targets Cisco VPNs to breach organizations
There's mounting evidence that Akira ransomware targets Cisco VPN (virtual private network) products as an attack vector to breach corporate networks, steal, and eventually encrypt data.
Akira ransomware is a relatively new ransomware operation launched in March 2023, with the group later adding a Linux encryptor to target VMware ESXi virtual machines.
Cisco VPN solutions are widely adopted across many industries to provide secure, encrypted data transmission between users and corporate networks, typically used by remotely working employees.
Reportedly, Akira has been using compromised Cisco VPN accounts to breach corporate networks without needing to drop additional backdoors or set up persistence mechanisms that could give them away.
Akira targets Cisco VPNs
Sophos first noted Akira's abuse of VPN accounts in May, when researchers stated that the ransomware gang breached a network using "VPN access using Single Factor authentication."
However, an incident responder, known as 'Aura,' shared further information on Twitter on how they responded to multiple Akira incidents that were conducted using Cisco VPN accounts that weren't protected by multi-factor authentication.
In a conversation with BleepingComputer, Aura stated that due to the lack of logging in Cisco ASA, it remained unclear if Akira brute-forced the VPN account credentials or if they bought them on dark web markets.
A SentinelOne report shared privately with BleepingComputer and focusing on the same attack method presents the possibility of Akira exploiting an unknown vulnerability in Cisco VPN software that might be able to bypass authentication in the absence of MFA.
SentinelOne found evidence of Akira using Cisco VPN gateways in leaked data posted on the group's extortion page and observed Cisco VPN-related traits in at least eight cases, indicating this is part of an ongoing attack strategy by the ransomware gang.
Cisco VPN trait seen in eight Akira attacks
Source: SentinelOne
Remote RustDesk access
Additionally, SentinelOne's analysts observed Akira using the RustDesk open-source remote access tool to navigate compromised networks, making them the first ransomware group known to abuse the software.
Because RustDesk is a legitimate tool, its presence is unlikely to raise any alarms, so it can offer stealthy remote access to breached computers.
Other benefits that arise from using RustDesk include:
- Cross-platform operation on Windows, macOS, and Linux, covering Akira's full targeting range.
- P2P connections are encrypted and hence less likely to be flagged by network traffic monitoring tools.
- Supports file transfer which can facilitate data exfiltration, streamlining Akira's toolkit.
Other TTPs observed by SentinelOne in Akira's latest attacks include SQL database access and manipulation, disabling firewalls and enabling RDP, disabling LSA Protection, and disabling Windows Defender.
These not-so-subtle changes are performed after the attackers establish their presence in the environment and are ready to proceed to the final phases of their attack.
In late June 2023, Avast released a free decryptor for Akira ransomware. However, the threat actors have patched their encryptors since then, and Avast's tool will only help victims of older versions.
11
Carderbee hacking group hits Hong Kong orgs in supply chain attack
Image: Midjourney
A previously unidentified APT hacking group named 'Carderbee' was observed attacking organizations in Hong Kong and other regions in Asia, using legitimate software to infect targets' computers with the PlugX malware.
Symantec reports that the legitimate software used in the supply chain attack is Cobra DocGuard, created by Chinese developer' EsafeNet,' and used in security applications for data encryption/decryption.
The fact that Carderbee uses PlugX, a malware family widely shared among Chinese state-backed threat groups, indicates that this novel group is likely linked to the Chinese threat ecosystem.
A supply chain attack
Symantec's researchers spotted the first signs of Carderbee activity in April 2023. However, an ESET report from September 2022 highlights a malicious update in Cobra DocGuard being used as the initial compromise point, so the threat actor's activity might date back to September 2021.
Symantec said they saw the Cobra DocGuard software installed on 2,000 computers but only observed malicious activity in 100, indicating that the threat actors only further compromised high-value targets.
For those targeted devices, Carderbee used the DocGuard software updater to deploy a range of malware strains, including PlugX. However, it remains unclear how the threat actors were able to conduct the supply chain attack using the legitimate updater.
The updates arrive in the form of a ZIP file fetched from "cdn.streamamazon[.]com/update.zip," which is decompressed to execute "content.dll," which acts as a malware downloader.
Interestingly, the downloader for PlugX malware is digitally signed using a certificate from Microsoft, specifically Microsoft Windows Hardware Compatibility Publisher, making detecting the malware more challenging.
Microsoft disclosed in December 2022 that hackers abused Microsoft hardware developer accounts to sign malicious Windows drivers and post-compromise rootkits.
The malicious DLL pushed by Carderbee also contains x64 and x86 drivers, used to create the Windows services and registry entries required for persistence.
Eventually, PlugX is injected into the legitimate 'svchost.exe' (Service Host) Windows system process to evade AV detection.
The PlugX sample seen by Symantec in these attacks features the following capabilities:
- Command execution via CMD
- File enumeration
- Checking running processes
- File downloading
- Firewall ports opening
- Keylogging
Symantec says Carderbee's exact targeting scope remains murky. While links to the 'Budworm' group are likely based on the collected evidence, the extent of their relationship remains unclear.
The use of a supply chain attack and signed malware makes this new threat very stealthy, and the selective deployment of malware indicates high-level preparation and reconnaissance.
12
13
14
15
16
17
1
Hacker Conversations: Cris Thomas (AKA Space Rogue) From Lopht Heavy Industries
(www.securityweek.com)
18
19
20
21
22
23
24
25
view more: next ›