{"id":7273,"date":"2022-07-25T08:49:36","date_gmt":"2022-07-25T15:49:36","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7273"},"modified":"2023-04-05T12:30:12","modified_gmt":"2023-04-05T19:30:12","slug":"securins-threat-intelligence-july-25-2022-july-29-2022","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/securins-threat-intelligence-july-25-2022-july-29-2022\/","title":{"rendered":"Securin&#8217;s Threat Intelligence Jul 25, 2022 &#8211; Jul 29, 2022"},"content":{"rendered":"<p dir=\"ltr\">In this edition, we bring you early warnings and trending news about cyber threats along with accurate threat context. Check out which threat group is on the rampage and what vulnerability they could weaponize soon and more\u2026.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Why play catch up when you can fix this now!<\/strong><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><strong>Check out our Threat Intelligence Podcast featuring Top Three Threats of the Week!<\/strong><\/p>\n<div style=\"padding: 56.25% 0 0 0; position: relative;\"><iframe style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%;\" title=\"Cyber Threat Intelligence Ep: 05\" src=\"https:\/\/player.vimeo.com\/video\/734680187?h=8069299a92&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/div>\n<p><a href=\"#KnotWeed attacks European and Central American targets using zero-day exploits\">1.\u00a0KnotWeed attacks European and Central American targets using zero-day exploits<\/a><br \/>\n<a href=\"#Atlassian vulnerabilities under active attacks\">2. Atlassian vulnerabilities under active attacks<\/a><br \/>\n<a href=\"#GoMet backdoor used to attack Ukrainian organizations\">3. GoMet backdoor used to attack Ukrainian organizations<\/a><br \/>\n<a href=\"#LockBit Ransomware got an upgrade!\">4. LockBit ransomware has an upgrade!<\/a><br \/>\n<a href=\"#SonicWall releases patch for critical SQL injection bug\">5. SonicWall releases a patch for a critical SQL injection bug<\/a><br \/>\n<a href=\"#Potential RCE vulnerabilities discovered in Grails\">6. Potential RCE vulnerabilities discovered in Grails<\/a><br \/>\n<a href=\"#Microsoft releases patches for more critical vulnerabilities\">7.\u00a0Microsoft releases patches for more critical vulnerabilities<\/a><\/p>\n<h2 dir=\"ltr\"><a id=\"KnotWeed attacks European and Central American targets using zero-day exploits\" name=\"KnotWeed attacks European and Central American targets using zero-day exploits\"><\/a>KnotWeed attacks European and Central American targets using zero-day exploits<\/h2>\n<p dir=\"ltr\">A private-sector offensive actor (PSOA) called KnotWeed has developed a malware known as SubZero which uses zero-day exploits in Windows and Adobe Reader to attack corporations in Europe and Central America. Knotweed has offered their hacking services and malware toolset, SubZero to multinational corporations claiming that they could help enhance their security using its services. One prominent exploit CVE is CVE-2022-22047, a zero-day CSRSS exploit, for which a patch was released on July\u2019s Patch Tuesday. Microsoft has since urged its clients to patch this CVE immediately to avoid grave attacks. Knotweed has also targeted the following CVEs in 2021: CVE-2021-31199 ,and CVE-2021-31201, CVE-2021-28550, CVE-2021-36948. All of these have patches.<\/p>\n<p dir=\"ltr\">KnotWeed is the upcoming PSOA to watch out for as they have been conducting unauthorized attacks.<\/p>\n<p dir=\"ltr\">In our previous <a href=\"https:\/\/cybersecurityworks.com\/blog\/cyber-risk\/csws-threat-intelligence-july-11-2022-july-15-2022.html\">Cyber Threat Intelligence blog<\/a>, we had called out\u00a0 CVE-2022-22047 as a critical vulnerability and we again urge you to patch this without delay.<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrLCGxYx14O58KaJ?backgroundColor=green&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<h2 dir=\"ltr\"><a name=\"Atlassian vulnerabilities under active attacks\"><\/a>Atlassian vulnerabilities under active attacks<\/h2>\n<p dir=\"ltr\">Following the attack on Atlassian Confluence Servers (2022-26134), three more vulnerabilities &#8211; CVE-2022-26138, CVE-2022-26136 &amp; CVE-2022-26137 in Atlassian products are under active exploitation.<\/p>\n<p dir=\"ltr\">CVE-2022-26138 is found in the Questions for Confluence app. It has a hardcoded password using which it was exploited in the wild. An attacker can browse an organization\u2019s Confluence Cloud instance using this exploit and even execute ransomware attacks. This is the most critical of the three vulnerabilities. Atlassian\u2019s advisory has steps to mitigate this vulnerability and also includes information on how to look for evidence of exploitation.<\/p>\n<p dir=\"ltr\">CVE-2022-26136 &amp; CVE-2022-26137 are found in multiple Atlassian Cloud products. These vulnerabilities are due to issues in Servlet Filters in Java. If exploited, it can grant remote access code execution privilege to attackers.<\/p>\n<p>Atlassian has released <a href=\"https:\/\/confluence.atlassian.com\/security\/july-2022-atlassian-security-advisories-overview-1142446703.html\">security advisories<\/a> for all three vulnerabilities and recommends they be patched urgently.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2022-26138<\/p>\n<p dir=\"ltr\"><strong>CWE<\/strong>: CWE-798<\/p>\n<p dir=\"ltr\"><strong>Patch Link<\/strong>: <a href=\"https:\/\/confluence.atlassian.com\/doc\/confluence-security-advisory-2022-07-20-1142446709.html\">Download<\/a><\/p>\n<h2 dir=\"ltr\"><a id=\"GoMet backdoor used to attack Ukrainian organizations\" name=\"GoMet backdoor used to attack Ukrainian organizations\"><\/a>GoMet backdoor used to attack Ukrainian organizations<\/h2>\n<p dir=\"ltr\">The Ukraine government agencies and many private Ukrainian organizations have been constantly targeted by Russian APT groups since before the Russia-Ukraine war began. In the latest rounds of attacks, hackers are using the GoMet backdoor to gain access to networks in the Ukraine state agencies. This malware was first used in 2020 and exploited the\u00a0 CVE-2020-5902 vulnerability. In the next attack in 2022,\u00a0 CVE-2022-1040 was exploited in a Ukrainian software development organization. To break into a network, the hackers use a public vulnerability on appliances and then deploy the GoMet backdoor to further exploit it. This vulnerability (CVE-2022-1040) is expected to be exploited more in the upcoming days.<\/p>\n<p dir=\"ltr\">Patches are available for both these vulnerabilities.<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrkusVUTrniHBF2d?backgroundColor=green&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<h2 dir=\"ltr\"><a id=\"LockBit Ransomware got an upgrade!\" name=\"LockBit Ransomware got an upgrade!\"><\/a>LockBit Ransomware got an upgrade!<\/h2>\n<p dir=\"ltr\">The LockBit ransomware gang released LockBit 3.0 in June with various upgrades such as a bug bounty program, Zcash payment, and new extortion tactics. They\u2019re offering handsome payments for bounty hunters who can find flaws in their malware. Malicious actors can also purchase stolen data from them using cryptocurrency, Zcash, etc. The gang which has been active since 2019 has made at least two headlines this week &#8211; attacking the Italian Revenue Agency and a county in Ontario, St.Mary with its new LockBit 3.0. The attack on the Italian Revenue Agency is considered to be the biggest attack in the agency\u2019s history and could potentially have grave repercussions. The town in Ontario has been locked out of their systems disrupting day-to-day operations. It is not known if both the victims have been contacted for ransom.<\/p>\n<p dir=\"ltr\">The two CVEs most recently associated with the LockBit ransomware is: CVE-2018-13379 (WebApp exploit affecting Fortinet) and CVE-2021-22986 (RCE\/PE exploit affecting F5).<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrJ6xefcIGHC2nex?backgroundColor=green&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p>&nbsp;<\/p>\n<h2 dir=\"ltr\"><a id=\"SonicWall releases patch for critical SQL injection bug\" name=\"SonicWall releases patch for critical SQL injection bug\"><\/a>SonicWall releases patch for critical SQL injection bug<\/h2>\n<p>A critical SQL injection vulnerability was discovered in its Global Management System (GMS) software. There are no known instances of exploits as of yet, but this vulnerability could allow a hacker to gain complete access to the system including read, write, and modify data in it. The vulnerability, tracked as CVE-2022-22280, arises due to insufficient sanitization of user-supplied data. Sonicwall has released a patch for this vulnerability and is urging all its global enterprise customers to apply it immediately.<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2022-22280<\/p>\n<p dir=\"ltr\"><strong>Patch<\/strong>: <a href=\"https:\/\/psirt.global.sonicwall.com\/vuln-detail\/SNWLID-2022-0007\">Download<\/a><\/p>\n<h2 dir=\"ltr\"><a id=\"Potential RCE vulnerabilities discovered in Grails\" name=\"Potential RCE vulnerabilities discovered in Grails\"><\/a>Potential RCE vulnerabilities discovered in Grails<\/h2>\n<p dir=\"ltr\">A critical vulnerability which could potentially allow remote code execution was recently discovered in Grails, an open source web application framework based on the Apache Groovy programming language.A hacker can remotely execute code within a Grails application runtime by issuing a specially crafted web request that grants the attacker access to the class loader. The vulnerability, tracked as \u00a0 CVE-2022-35912, is found on Grails framework versions 3.3.10 and higher that are running on Java 8. Grails has immediately released a patch for this vulnerability.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\"><strong>CVE<\/strong>: CVE-2022-35912<\/p>\n<p dir=\"ltr\"><strong>CVSS Score<\/strong>: 9.8<\/p>\n<p dir=\"ltr\"><strong>Affected Product Count<\/strong>: 4<\/p>\n<p dir=\"ltr\"><strong>Patch Link<\/strong>: <a href=\"https:\/\/docs.grails.org\/latest\/guide\/gettingStarted.html#downloadingAndInstalling\">Download\u00a0<\/a><\/p>\n<h2 dir=\"ltr\"><a id=\"Microsoft releases patches for more critical vulnerabilities\" name=\"Microsoft releases patches for more critical vulnerabilities\"><\/a>Microsoft releases patches for more critical vulnerabilities<\/h2>\n<p dir=\"ltr\">Three critical vulnerabilities now have patches from Microsoft. The vulnerabilities are <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-26925\">CVE-2022-26925<\/a>, <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-26923\">CVE-2022-26923<\/a>, <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-26809\">CVE-2022-26809<\/a>. These vulnerabilities are added to the threat watchlist as CVE-2022-26925 has been actively exploited by the attacker, and the other two CVEs (CVE-2022-26923, CVE-2022-26809) have publicly available exploits.<br \/>\n<a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-26809\">CVE-2022-26809<\/a> can allow arbitrary code by\u00a0 sending a specially crafted Remote Procedure Call (RPC). <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-26923\">CVE-2022-26923<\/a> can escalate privilege to a domain administrator in a default Active Directory environment with the \u201cActive Directory Certificate Services\u201d server role installed. <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-26925\">CVE-2022-26925<\/a> could potentially allow remote exploits and force domain controllers to authenticate them via the Windows NT LAN Manager (NTLM) security protocol.<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrmc0Lawo2rXYy0N?backgroundColor=green&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">We use our Threat Intelligence Platform driven by Artificial Intelligence (AI) and Machine Learning (ML) models to analyze the vulnerabilities that could potentially be exploited by hackers. We warn our customers continuously about their exposures and prioritize their vulnerabilities to facilitate rapid remediation.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">Follow our weekly blog and podcast to get proactive alerts on trending threats. Reach out to us if you need help in managing your vulnerabilities and exposures from attackers.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\">Leverage our expertise and manage your threats on a continuous basis to stay safe from attackers.<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><a href=\"https:\/\/cybersecurityworks.com\/contact-us.php\">Talk to Us<\/a><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this edition, we bring you early warnings and trending news about cyber threats along with accurate threat context. Check out which threat group is on the rampage and what vulnerability they could weaponize soon and more\u2026.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[80,146],"tags":[89,124,116,91,103],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7273"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/comments?post=7273"}],"version-history":[{"count":6,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7273\/revisions"}],"predecessor-version":[{"id":14316,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7273\/revisions\/14316"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=7273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/categories?post=7273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/tags?post=7273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}