{"id":7237,"date":"2022-09-02T07:39:29","date_gmt":"2022-09-02T14:39:29","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7237"},"modified":"2023-04-05T12:27:12","modified_gmt":"2023-04-05T19:27:12","slug":"securins-threat-intelligence-august-29-2022-september-2-2022","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/securins-threat-intelligence-august-29-2022-september-2-2022\/","title":{"rendered":"Securin&#8217;s Threat Intelligence  Aug 29, 2022 &#8211; Sep 2, 2022"},"content":{"rendered":"<p dir=\"ltr\">This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><span style=\"font-size: 18px;\"><span style=\"color: #000080;\"><strong>Why play catch up when you can fix this now?<\/strong><\/span><\/span><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><span style=\"font-size: 18px;\"><span style=\"color: #000080;\"><strong>Check out our podcast on the top critical threats of this week, hosted by David Rushton!<\/strong><\/span><\/span><\/p>\n<div style=\"padding: 56.25% 0 0 0; position: relative;\"><iframe style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%;\" title=\"LockBit | TA428 | Top Cyber Threats of the Week | Podcast\" src=\"https:\/\/player.vimeo.com\/video\/745768156?h=d98d784d18&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/div>\n<p dir=\"ltr\"><a href=\"#Trending Critical Threats\">Trending Critical Threats<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#LockBit Explores Triple-Extortion Tactic\">LockBit Explores Triple-Extortion Tactic<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#ScanBox Malware Targets Australian Government Agencies\">ScanBox Malware Targets Australian Government Agencies<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#BianLian Ransomware Adopts GoLang for Malware Technology\">BianLian Ransomware Adopts GoLang for Malware Technology<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#Unnamed Threat Actors Target Korean Companies\">Unnamed Threat Actors Target Korean Companies<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#Threats to Watch Out For\">Threats to Watch Out For<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#CVE-2022-21849 - Microsoft Windows IKE Extension RCE Vulnerability\">CVE-2022-21849 &#8211; Microsoft Windows IKE Extension RCE Vulnerability<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#Exploits in WatchGuard Firewalls\">Exploits in WatchGuard Firewalls<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#Ragnar Locker Ransomware\">Ragnar Locker Ransomware<\/a><\/p>\n<h2 dir=\"ltr\" style=\"text-align: center;\"><a id=\"Trending Critical Threats\" name=\"Trending Critical Threats\"><\/a>Trending Critical Threats<\/h2>\n<h3 dir=\"ltr\"><a id=\"LockBit Explores Triple-Extortion Tactic\" name=\"LockBit Explores Triple-Extortion Tactic\"><\/a>LockBit Explores Triple-Extortion Tactic<\/h3>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">LockBit ransomware employs encryption and data leaks to extort from victims.<\/p>\n<p dir=\"ltr\">Their recent attack on security giant Entrust resulted in an alleged DDoS counter-attack by Entrust preventing them from leaking the stolen data. Now, the ransomware family has announced that they will use Denial of Service attacks in addition to leaking data and encryption to extort from its victims.<\/p>\n<p dir=\"ltr\">LockBit has sophisticated attack techniques and uses double-encryption on target victims.<\/p>\n<p dir=\"ltr\"><em><strong><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-13379\">CVE-2018-13379<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-22986\">CVE-2021-22986<\/a> are the two CVEs targeted by the ransomware family.<\/strong><\/em><\/p>\n<h3 dir=\"ltr\"><a id=\"ScanBox Malware Targets Australian Government Agencies\" name=\"ScanBox Malware Targets Australian Government Agencies\"><\/a>ScanBox Malware Targets Australian Government Agencies<\/h3>\n<p>The Chinese APT group TA423 (Red Ladon) has been targeting Australian Government agencies and other entities operating in the South China sea. The attacks began in April 2022 and lasted till June 2022. TA423 has been using carefully-worded phishing emails to direct the victims to a fake news-channel website which deploys malware known as ScanBox. This malware is able to retrieve and execute a number of plugins allowing it to log keystrokes, fingerprint the browser, gather a list of browser add-ons installed, and communicate with the infected machines.<\/p>\n<p>ScanBox has also been used by other Chinese threat actors\u2014HUI Loader, PlugX, and ShadowPad\u2014and is believed to be shared among them internally.<\/p>\n<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2012-0158\">CVE-2012-0158<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-0199\">CVE-2017-0199<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detailCVE-2017-0199\">CVE-2017-11882<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2017-8759\">CVE-2017-8759<\/a>, and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-30190\">CVE-2022-30190<\/a> are some of the vulnerabilities used for targeting victims.<\/p>\n<p>&nbsp;<\/p>\n<h3 dir=\"ltr\"><a id=\"BianLian Ransomware Adopts GoLang for Malware Technology\" name=\"BianLian Ransomware Adopts GoLang for Malware Technology\"><\/a>BianLian Ransomware Adopts GoLang for Malware Technology<\/h3>\n<p dir=\"ltr\">Recently, ransomware actors are increasingly adopting Go language to script malware samples used in cross-platform attacks. The latest ransomware family to use GoLang is BianLian. Go language has the following advantages over other programming languages which make it very popular among threat actors:<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Makes reverse-engineering difficult<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Cross-platform functionalities<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Open-source<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Allows an exponential increase in the attack surface<\/p>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">In BianLian ransomware\u2019s attack methodology, after initial access to victim networks, a web-shell or an ngrok payload is dropped for further exploitation. BianLian is behind popular cyber attacks on several industry sectors such as Manufacturing, Education, Healthcare, etc. Its capabilities are said to be similar to that of Agenda ransomware.<\/p>\n<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-34473\">CVE-2021-34473<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-34473\">CVE-2021-34473<\/a>, and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-31207\">CVE-2021-31207<\/a> are the vulnerabilities most targeted by BianLian.<\/p>\n<h3 dir=\"ltr\"><a id=\"Unnamed Threat Actors Target Korean Companies\" name=\"Unnamed Threat Actors Target Korean Companies\"><\/a>Unnamed Threat Actors Target Korean Companies<\/h3>\n<p dir=\"ltr\">Multiple attack campaigns on Korean companies with exposed servers are underway by an unknown threat actor group. The attacks are carried out using FRP (Fast Reverse Proxy) tools which are used to gain initial access to a server accessible from outside. Once it is successful, the attackers go on to escalate privileges using JuicyPotato and SweetPotato malware. The attackers have targeted companies in multiple sectors with no bias except an exposed server. There is no data as to how much information has been stolen from these companies.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">Here are the CVEs were exploited in these attacks:<\/p>\n<p>&nbsp;<\/p>\n<table border=\"2\" cellspacing=\"2\" cellpadding=\"2\" align=\"center\">\n<colgroup>\n<col width=\"207\" \/>\n<col width=\"100\" \/> <\/colgroup>\n<thead>\n<tr>\n<th scope=\"col\">\n<p dir=\"ltr\">CVE<\/p>\n<\/th>\n<th scope=\"col\">\n<p dir=\"ltr\">CVSS Score<\/p>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2018-8440<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.8<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2019-1405<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.8<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2021-1675<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">8.8<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2021-1732<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.8<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2021-36934<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.8<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2021-40449<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.8<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-21882<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.8<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2022-21999<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.8<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<p dir=\"ltr\">CVE-2019-1322<\/p>\n<\/td>\n<td>\n<p dir=\"ltr\">7.8<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\" style=\"text-align: center;\"><a id=\"Threats to Watch Out For\" name=\"Threats to Watch Out For\"><\/a>Threats to Watch Out For<\/h2>\n<h3 dir=\"ltr\"><a id=\"CVE-2022-21849 - Microsoft Windows IKE Extension RCE Vulnerability\" name=\"CVE-2022-21849 - Microsoft Windows IKE Extension RCE Vulnerability\"><\/a>CVE-2022-21849 &#8211; Microsoft Windows IKE Extension RCE Vulnerability<\/h3>\n<p>A critical vulnerability is found in Windows OS which could potentially allow remote code execution. There are no known exploits for this CVE and Microsoft has released a <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2022-21849\">patch <\/a>available for it.<\/p>\n<p>&nbsp;<\/p>\n<h3 dir=\"ltr\"><a id=\"Exploits in WatchGuard Firewalls\" name=\"Exploits in WatchGuard Firewalls\"><\/a>Exploits in WatchGuard Firewalls<\/h3>\n<p dir=\"ltr\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-31788\">CVE-2022-3178<\/a> and CVE-2022-31790 are two pre-authentication remote root 0-days on every WatchGuard Firebox\/XTM appliance. Threat actors have been exploiting similar vulnerabilities this year and WatchGuard customers need to be on the lookout for such vulnerabilities.<\/p>\n<h3 dir=\"ltr\"><a id=\"Ragnar Locker Ransomware\" name=\"Ragnar Locker Ransomware\"><\/a>Ragnar Locker Ransomware<\/h3>\n<p dir=\"ltr\">Ragnar Locker ransomware is making news with multiple targets this year. It has been attacking the energy sector, the prime example being, the recent attack on natural gas transmission operator DESFA. In this attack, some of the IT systems were encrypted, disrupting operations. The supply services however, were not affected. Apart from this, Ragnar Locker attacked Air Portugal and allegedly stole customer information.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><em>Check out this section to track how these threats evolve!<\/em><\/p>\n<p dir=\"ltr\">We use our Threat Intelligence Platform driven by Artificial Intelligence (AI) and Machine Learning (ML) models to analyze the vulnerabilities that hackers could potentially exploit. We warn our customers continuously about exposures and prioritize vulnerabilities to facilitate rapid remediation.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">Follow our weekly blog and podcast to get proactive alerts on trending threats. Reach out to us if you need help managing your vulnerabilities and exposures.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">Leverage our expertise and manage your threats continuously to stay safe from attackers.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><a href=\"https:\/\/cybersecurityworks.com\/contact-us.php\">Talk to Us<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[80,146],"tags":[107,119,91,106,103,108],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7237"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/comments?post=7237"}],"version-history":[{"count":8,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7237\/revisions"}],"predecessor-version":[{"id":14312,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7237\/revisions\/14312"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=7237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/categories?post=7237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/tags?post=7237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}