{"id":7269,"date":"2022-08-01T08:45:06","date_gmt":"2022-08-01T15:45:06","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7269"},"modified":"2023-04-05T12:30:08","modified_gmt":"2023-04-05T19:30:08","slug":"securins-threat-intelligence-august-02-2022-august-05-2022","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/securins-threat-intelligence-august-02-2022-august-05-2022\/","title":{"rendered":"Securin&#8217;s Threat Intelligence Aug 2, 2022 &#8211; Aug 5, 2022"},"content":{"rendered":"<p dir=\"ltr\">In this edition, we bring you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Watch David Rushton talk about the Top Three Threats of the Week in his Threat Intelligence Podcast!<\/strong><\/p>\n<div style=\"padding: 56.25% 0 0 0; position: relative;\"><iframe style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%;\" title=\"Cyber Threat Intelligence Ep: 06\" src=\"https:\/\/player.vimeo.com\/video\/736831049?h=513a4bec99&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/div>\n<p><strong>Here are the top threats of this week:<\/strong><\/p>\n<p dir=\"ltr\"><a href=\"#BlackCat attacks Enveco pipelines in Europe\">BlackCat attacks Enveco pipelines in Europe<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#Critical Authentication Bypass Vulnerabilities in VMware\">Critical Authentication Bypass Vulnerabilities in VMware<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#RCE vulnerability affecting multiple DrayTek routers\">RCE vulnerability affecting multiple DrayTek routers<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#CISCO fixes critical security vulnerabilities in VPN routers\">CISCO fixes critical security vulnerabilities in VPN routers<\/a><\/p>\n<p dir=\"ltr\"><a href=\"#Threats to watch out for\">Threats to watch out for<\/a><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\"><a id=\"BlackCat attacks Enveco pipelines in Europe\" name=\"BlackCat attacks Enveco pipelines in Europe\"><\/a>BlackCat attacks Enveco pipelines in Europe<\/h2>\n<p dir=\"ltr\">The notorious ransomware group, BlackCat attacked Creos, the energy supplier in Luxembourg. Creos is a subsidiary of Enveco. During the attack none of the services were interrupted, but the customer portals were down for a while. It is estimated that sizable data of 150 GB containing contracts, agreements, passports, bills, and emails was stolen. BlackCat (ALPHV) has threatened to leak this data if their ransom demands are not met. BlackCat is believed to be a rebrand of DarkSide, known for its attack on the Colonial Pipeline.<\/p>\n<p dir=\"ltr\">The following CVEs are associated with BlackCat ransomware\u2019s attacks: CVE-2016-0099,CVE-2019-7481,CVE-2021-31207,CVE-2021-34473,CVE-2021-34523.<br \/>\nBlackCat has carried out attacks against\u00a0public and private organizations without distinction.\u00a0Check out our comprehensive <a href=\"https:\/\/cybersecurityworks.com\/blog\/ransomware\/all-about-blackcat-alphav.html\" target=\"_blank\" rel=\"noopener\">blog on BlackCat&#8217;s activities<\/a>.<\/p>\n<h2 dir=\"ltr\"><a id=\"Critical Authentication Bypass Vulnerabilities in VMware\" name=\"Critical Authentication Bypass Vulnerabilities in VMware\"><\/a>Critical Authentication Bypass Vulnerabilities in VMware<\/h2>\n<p>Two vulnerabilities,<strong> CVE-2022-31656<\/strong>,<strong>CVE-2022-31659<\/strong> were discovered in VMware Workspace ONE Access, Identity Manager, and vRealize Automation products. If exploited, these vulnerabilities could affect local domain users and enable unauthenticated attackers to gain admin privileges.<\/p>\n<p dir=\"ltr\">VMware has\u00a0<a href=\"https:\/\/www.vmware.com\/security\/advisories\/VMSA-2022-0021.html\" target=\"_blank\" rel=\"noopener\">released patches for these vulnerabilities<\/a> as soon as news of their discovery was publicized.<\/p>\n<p dir=\"ltr\">Since this affects the on-premises devices, VMware has insisted that any organization using ITIL methodologies for change management should consider fixing this as an emergency and apply the patches.<\/p>\n<p dir=\"ltr\">There are no known exploits in the wild for these vulnerabilities.<\/p>\n<h2 dir=\"ltr\"><a id=\"RCE vulnerability affecting multiple DrayTek routers\" name=\"RCE vulnerability affecting multiple DrayTek routers\"><\/a>RCE vulnerability affecting multiple DrayTek routers<\/h2>\n<p dir=\"ltr\">DrayTek is a Taiwanese company manufacturing Small and Home Office routers. They are widely adopted in the UK, Taiwan, Vietnam, etc. Recently, a remote code execution vulnerability, CVE-2022-32548 was discovered in these devices. Over 200k devices have the vulnerable service exposed on the internet and can be exploited without user interaction when configured to be internet facing. A one-click attack can also be performed from within the LAN in the default device configuration. If exploited, it can lead to a full compromise of the device and may lead to a network breach and unauthorized access to internal resources.<\/p>\n<p dir=\"ltr\">CVE-2022-32548 has a CVSS score of 10.0, classifying it as extremely critical.<\/p>\n<p dir=\"ltr\">DrayTek has immediately <a href=\"https:\/\/www.draytek.com\/support\/latest-firmwares\/\">released patches<\/a> for this vulnerability and is urging its customers to apply them.<\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\"><a id=\"CISCO fixes critical security vulnerabilities in VPN routers\" name=\"CISCO fixes critical security vulnerabilities in VPN routers\"><\/a>CISCO fixes critical security vulnerabilities in VPN routers<\/h2>\n<p dir=\"ltr\">Unauthenticated, remote attackers can exploit two security flaws identified as CVE-2022-20842 and CVE-2022-20827 to execute arbitrary code or commands, resulting in denial of service (DoS) conditions on vulnerable devices. These vulnerabilities are caused by insufficient input validation in Cisco&#8217;s web-based management interfaces and web filter database update feature. In attacks with no user interaction, these vulnerabilities allow the attacker to take over without authentication..<\/p>\n<p dir=\"ltr\">There is no evidence of exploit in the wild.<\/p>\n<p dir=\"ltr\">CISCO has <a href=\"https:\/\/tools.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-sb-mult-vuln-CbVp4SUR\" target=\"_blank\" rel=\"noopener\">released patches<\/a> for both the CVEs. Organizations using CISCO\u2019s Small Business VPN routers are required to apply these patches with utmost urgency.<\/p>\n<p dir=\"ltr\">This week we&#8217;ve added a new section to track evolving threats.<\/p>\n<h2 dir=\"ltr\"><a id=\"Threats to watch out for\" name=\"Threats to watch out for\"><\/a>Threats to watch out for<\/h2>\n<h3 dir=\"ltr\">Moodle\u2019s Vulnerability<\/h3>\n<p dir=\"ltr\">CVE-2022-35650, identified in Moodle can lead to arbitrary file read due to insufficient path checks. A <a href=\"http:\/\/git.moodle.org\/gw?p=moodle.git&amp;a=search&amp;h=HEAD&amp;st=commit&amp;s=MDL-72029\" target=\"_blank\" rel=\"noopener\">vendor advisory<\/a> has been released for this CVE.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2022-35650<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 7.5<\/p>\n<p dir=\"ltr\"><strong>CWE<\/strong>: CWE-20, CWE-22<\/p>\n<p dir=\"ltr\"><strong>Affected Product Coun<\/strong>t: 5<\/p>\n<p>&nbsp;<\/p>\n<h3 dir=\"ltr\">Vulnerability in ZIMRA<\/h3>\n<p dir=\"ltr\">A vulnerability in Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. The vulnerability is assigned the CVE:\u00a0 CVE-2022-27924<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2022-27924<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 7.5<\/p>\n<p dir=\"ltr\"><strong>CWE<\/strong>: CWE-74<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count<\/strong>: 2<\/p>\n<p dir=\"ltr\"><em><strong>This vulnerability was added to the CISA KEV list on 4th of Aug, 2 days after we called it out in this blog.<\/strong><\/em><\/p>\n<h3 dir=\"ltr\">LINUX Vulnerability<\/h3>\n<p dir=\"ltr\">CVE-2022-34918, a vulnerability in the Linux kernel through 5.18.9 could be used by an attacker to escalate privileges.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2022-34918<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 7.8<\/p>\n<p dir=\"ltr\"><strong>CWE<\/strong>: CWE-843, CWE-1025<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count<\/strong>: 1<\/p>\n<p>&nbsp;<\/p>\n<h3 dir=\"ltr\">Raspberry Robin worm<\/h3>\n<p dir=\"ltr\">Russian hacking group Evil Corp has been using Raspberry Robin, a USB-based worm in their recent attacks.\u00a0In July 2022, it was used extensively in attacks on <a href=\"https:\/\/cybersecurityworks.com\/blog\/ransomware\/how-safe-are-storage-devices-from-a-ransomware-attack.html\" target=\"_blank\" rel=\"noopener\">QNAP storage devices<\/a>.<\/p>\n<h3 dir=\"ltr\">Woody RAT malware<\/h3>\n<p dir=\"ltr\">Russian organizations, including a government-controlled defense corporation were recently attacked by unknown actors using the Woody RAT malware. The CVE associated with this malware is CVE-2022-30190, the Follina bug.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2022-30190<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 7.8<\/p>\n<p dir=\"ltr\"><strong>Exploit Type<\/strong>: [&#8216;RCE&#8217;, &#8216;WebApp&#8217;]<\/p>\n<p dir=\"ltr\"><strong>APT Group Association<\/strong>: TA413, APT29, Sandworm Team<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count<\/strong>: 18<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">Watch out for this section to track how these threats evolve.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">We use our Threat Intelligence Platform driven by Artificial Intelligence (AI) and Machine Learning (ML) models to analyze the vulnerabilities that hackers could potentially exploit. We warn our customers continuously about exposures and prioritize vulnerabilities to facilitate rapid remediation.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">Follow our weekly blog and podcast to get proactive alerts on trending threats. Reach out to us if you need help managing your vulnerabilities and exposures.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">Leverage our expertise and manage your threats continuously to stay safe from attackers.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><a href=\"https:\/\/cybersecurityworks.com\/contact-us.php\">Talk to Us<\/a><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this edition, we bring you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[80,146],"tags":[107,147,89,220,124,219,116,91,115,218,106,103],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7269"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/comments?post=7269"}],"version-history":[{"count":9,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7269\/revisions"}],"predecessor-version":[{"id":14131,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7269\/revisions\/14131"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=7269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/categories?post=7269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/tags?post=7269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}