1010.TEAM 🇺🇦

CYBERSECURITY / DEFENSE / INTELLIGENCE

  • Analyze Malicious Powershell Scripts by Running Malware in ANY.RUN Sandbox

    ·

    Hackers exploit PowerShell, a built-in scripting tool on Windows (and sometimes Linux), to launch various attacks. PowerShell scripts can download malware, bypass antivirus, steal data, and grant remote access.  

    The scripts are attractive to attackers because they are easy to write, difficult to detect due to obfuscation techniques (like partial name matching), and leverage legitimate system resources for malicious actions (“living off the land”) but some tools can analyze these PowerShell scripts for safe detonation and step-by-step tracing. 

    PowerShell scripts are a type of automation tool used on Windows systems that can be used for legitimate purposes like configuration management or for malicious purposes like installing malware.  

    Easily see detailed function input and output in PowerShell Tracer

    The new PowerShell Script Tracer helps analysts understand what a PowerShell script does by providing a detailed breakdown of the script’s functions and how they connect to each other, which can help analysts identify malicious behaviour in the script more easily. 

    Hackers often use it to perform a variety of malicious actions, such as: 

    • Download and execute malicious binaries from a separate source. 
    • Bypass antivirus software by executing the script in memory. 
    • Execute malicious scripts. 
    • Collect and exfiltrate system data. 
    • Remotely control the infected system. 
    Document

    Integrate ANY.RUN in Your Company for Effective Malware Analysis

    Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

    • Real-time Detection
    • Interactive Malware Analysis
    • Easy to Learn by New Security Team members
    • Get detailed reports with maximum data
    • Set Up Virtual Machine in Linux & all Windows OS Versions
    • Interact with Malware Safely

    If you want to test all these features now with completely free access to the sandbox:

    ANY.RUN’s Script Tracer helps analyze PowerShell scripts used in malware and to access it, locate the process tree on the right side of the interface, which shows processes launched, including PowerShell commands. 

    PowerShell command launched

    For further investigation where you can see how this tracer works, click on the specific PowerShell process in the tree, which will display a process details tab at the bottom and within this tab, click “More Info” to access the Script Tracer and gain detailed insights into the deobfuscated script’s activities.  

    The Advanced Details window replaces the general process information with a detailed view of what it is doing.

    The Script Tracer tab focuses on PowerShell executions and shows the functions called by the process in order, from top to bottom.

    This allows you to determine how the process is acting by examining the function calls and how they are executed.

    Advanced details of a process window

    A malicious program downloads data from a URL using the System.Net.WebClient class. The downloaded data are binary and encoded in Base64.

    The program then decodes the data using the FromBase64String method and converts it to a Unicode string using System. Text.UnicodeEncoding.GetString. 

    The MZ signature in the trace indicates that the string is the actual PowerShell command that the program wants to execute, which is most likely an encoded executable file. 

    Static Discovering

    The provided PowerShell code exhibits several indicators of malicious intent and executes hidden, bypassing security measures (-windowstyle hidden, -executionpolicy bypass) by downloading data from image URLs ($links) and extracting a Base64-encoded command hidden within the downloaded content ($imageText.Substring). 

    This retrieved command is then loaded directly into memory as a.NET assembly for execution ([System.Reflection.Assembly]::Load), bypassing traditional file-based detection methods suggesting the code aims to download and execute a hidden malicious payload (hidden) within an image. 

    Analysis revealed the script’s malicious nature, where extracted URLs, https://uploaddeimagens[.]com.br/images/004/766/978/full/new_image_vbs.jpg?1712588469 and https://uploaddeimagens[.]com.br/images/004/766/979/original/new_image_vbs.jpg?1712588500, can be used as Indicators of Compromise (IOCs) for further investigation.

    Analyze PowerShell Scripts in Malware in ANY.RUN - Register for Free

    What is ANY RUN?

    ANY.RUN is a renowned ally for over 400,000 cybersecurity experts globally. This interactive sandbox platform streamlines the malware analysis process for threats aimed at both Windows and Linux systems, equipping analysts with a sophisticated tool for their investigative work.

    Additionally, ANY.RUN’s threat intelligence offerings, namely Lookup and Feeds, deliver precise indicators of compromise and contextual insights that enable users to detect threats and manage incident responses swiftly.

    ANY.RUN enhances the speed and accuracy of threat analysis. The platform is adept at identifying common malware families using YARA and Suricata rules and can pinpoint malware behaviors through signatures when specific family detection is unfeasible.

    Key Features of ANY.RUN:

    • Rapid Malware Detection: ANY.RUN can detect malware in approximately 40 seconds following a file upload. It utilizes YARA and Suricata rules to recognize well-known malware families and employs behavioral signatures to identify malicious activities in new threats.
    • Real-Time Interaction with Samples: Powered by VNC, ANY.RUN’s interactive cloud sandbox allows users to perform real-system activities such as browsing web pages, navigating through installers, and accessing password-protected archives.
    • Cost-Effective and Maintenance-Free: As a cloud-based solution, ANY.RUN eliminates the need for initial setup or ongoing maintenance, saving time and resources for businesses.
    • Comprehensive Malware Behavior Analysis: ANY.RUN offers an in-depth examination of malware behavior, tracking network traffic, system calls, and file system modifications.
    • Enhanced Team Collaboration: The platform facilitates easy sharing of analysis results among team members. Senior analysts can also review the work of junior colleagues by accessing recordings of their analysis sessions.
    • Scalability: ANY.RUN’s cloud service model allows for easy scaling of security operations by simply adding more licenses.

    For a closer look at how ANY.RUN can benefit your security team, contact ANY.RUN for a personalized guided tour of the platform.

     

    The post Analyze Malicious Powershell Scripts by Running Malware in ANY.RUN Sandbox appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Aid heads to Ukraine; Army’s 100K goal; Niger pullout talks; Pentagon test recuses himself; And a bit more.

    ·

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Beware! Zero-click RCE Exploit for iMessage Circulating on Hacker Forums

    ·

    A new cybersecurity threat has emerged as a zero-click remote code execution (RCE) exploit targeting Apple’s iMessage service is reportedly being circulated on various hacker forums.

    This exploit, which allows hackers to take control of an iPhone without any interaction from the user, poses a significant risk to millions of iMessage users worldwide.

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    A zero-click exploit is a cybersecurity threat that does not require the victim to click on a link, download a file, or take any action to trigger the exploit.

    This makes zero-click exploits particularly dangerous and effective, as they can compromise devices silently without the user’s knowledge.

    A recent tweet by Dark Web Informer brought to our attention an article discussing the circulation of a Zero-click Remote Code Execution (RCE) exploit for iMessage on hacker forums.

    The iMessage Vulnerability

    The exploit takes advantage of a vulnerability in iMessage, which is integrated deeply into the iOS system used by iPhones and iPads.

    Document

    Integrate ANY.RUN in Your Company for Effective Malware Analysis

    Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

    • Real-time Detection
    • Interactive Malware Analysis
    • Easy to Learn by New Security Team members
    • Get detailed reports with maximum data
    • Set Up Virtual Machine in Linux & all Windows OS Versions
    • Interact with Malware Safely

    If you want to test all these features now with completely free access to the sandbox:

    Details about the specific nature of the vulnerability have not been disclosed publicly, but it is known that the exploit can allow unauthorized access to the device’s data and functionalities.

    The exploit reportedly uses sophisticated techniques to bypass Apple’s security measures.

    Once it is executed, the attacker can remotely control the device, access sensitive information, and potentially deploy further malware.

    Response from Apple

    Apple has not yet released an official statement regarding this specific exploit.

    However, the company is known for its swift response to security threats and is likely working on a patch to fix the vulnerability.

    Users are advised to keep their devices updated to the latest version of iOS to protect against such exploits.

    The circulation of this exploit on hacker forums increases the risk of it being used by malicious actors.

    Users are advised to be extra cautious and avoid opening or interacting with suspicious messages.

    Tips for Protection:

    • Update Regularly: Ensure your device’s operating system is up-to-date with the latest security patches.
    • Be Cautious: Be wary of your device’s unusual messages or behavior.
    • Use Security Software: Consider using security software designed for mobile devices.

    The discovery of the zero-click RCE exploit for iMessage is a reminder of the constant vigilance required in the digital age.

    Users and corporations must stay informed about potential threats and proactively protect their digital environments.

    Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo 

    The post Beware! Zero-click RCE Exploit for iMessage Circulating on Hacker Forums appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New DragonForce Ransomware Emerged From The Leaked LOCKBIT Builder

    ·

    Hackers exploit LOCKBIT Builder due to its versatility in creating customized ransomware payloads which enable them to tailor attacks to specific targets and evade detection by security measures.

    DragonForce Ransomware emerged in November 2023, employing double extortion tactics – data theft followed by encryption, with victims’ data leaked if the ransom is unpaid. 

    Though sharing the name with a Malaysian hacktivist group, the origins of the DragonForce Ransomware are unclear. 

    Cyble’s cybersecurity researchers’ analysis recently revealed that the DragonForce’s binary is based on the leaked LOCKBIT Black builder, allowing customization like encryption modes, filename obfuscation, process impersonation, file & folder exclusions, and ransom note templating.

    DragonForce Leak Site (Source – Cyble)

    DragonForce LOCKBIT Builder

    Over 25 global victims have been disclosed so far, and the group leverages the leaked LOCKBIT infrastructure for operational efficiency while maintaining anonymity through the rebranded “DragonForce” identity.

    After analyzing the code, it was found that DragonForce ransomware uses the leaked LOCKBIT builder, which shares many characteristics in terms of design and functionalities.

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    Upon execution, this virus stops many processes and services such as Oracle, Microsoft Office apps, antivirus software, and even backup solutions to speed up encryption. 

    The encrypted files are given a random name followed by the ‘.AoVOpni2N’ extension. 

    Encrypted Files (Source – Cyble)

    The criminals also put a ransom note called ‘AoVOpni2N.README.txt’ into each encrypted folder. It contains instructions on how to pay for decryption.

    Ransom Note (Source – Cyble)

    What DragonForce does is take advantage of their knowledge about Lockbit, which they got from another leak, to make their attacks fast, but it is not easy to attribute them back through rebranding themselves.

    The DragonForce ransomware shows how dangerous the situation becomes with leaked malware builders such as LOCKBIT Black. 

    These types of programs allow threat actors to create personalized ransomware quickly and without much effort, making it harder for international companies to protect themselves against them. 

    This data-stealing and encrypting method demonstrates that cyber attackers continuously evolve their strategies to impose maximum monetary harm through ransomware attacks, such as those performed by groups such as DragonForce, which utilizes the “double extortion” method, reads Cyble report.

    This particular case serves as another reminder of why strong safeguards should always exist against the ever-changing threats posed by ransomware groups that take advantage when developers leak their tools into the public domain.

    Recommendations

    Here below we have mentioned all the recommendations:-

    • Verify links and email attachments before opening.
    • Regularly backup data and store it offline.
    • Enable automatic software updates on all devices.
    • Utilize reputable antivirus and security software.
    • Disconnect infected devices from the network.
    • Disconnect external storage devices if connected.
    • Monitor system logs for suspicious activity.

    Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo 

    The post New DragonForce Ransomware Emerged From The Leaked LOCKBIT Builder appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • JudgeO Online Code Editor Flaw Let Attackers Execute Code as Root User

    ·

    A critical flaw has been identified in the popular online code editor, JudgeO.

    If exploited, this vulnerability could allow attackers to execute arbitrary code with root-level privileges, posing a significant threat to systems and data integrity.

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    The vulnerability, tracked under the identifier, was discovered in the JudgeO online code editor, as reported by GitHub.

    This tool, widely used by developers and educational institutions for coding and testing purposes, has been found to contain a severe security flaw that malicious actors could exploit.

    This release fixes the following security vulnerabilities:

    • CVE-2024-28185
    • CVE-2024-28189
    • CVE-2024-29021

    The issue’s core lies in the application’s handling of symbolic links (symlinks) within the sandbox directory.

    Attackers can exploit this oversight by creating symlinks that point to critical system files.

    Details:

    When JudgeO writes a run_script to the sandbox directory, it inadvertently writes to these linked system files instead due to the symlink.

    unless submission.is_project

      # gsub is mandatory!

      command_line_arguments = submission.command_line_arguments.to_s.strip.encode("UTF-8", invalid: :replace).gsub(/[$&;<>|`]/, "")

      File.open(run_script, "w") { |f| f.write("#{submission.language.run_cmd} #{command_line_arguments}")}

    end

    The vulnerability manifests when executing a submission. JudgeO’s process involves writing a run_script to the sandbox directory.

    However, if an attacker has already placed a symlink at the run_script path, the f.write operation in the code will write to an arbitrary file on the system that is not sandboxed.

    Document

    Integrate ANY.RUN in Your Company for Effective Malware Analysis

    Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

    • Real-time Detection
    • Interactive Malware Analysis
    • Easy to Learn by New Security Team members
    • Get detailed reports with maximum data
    • Set Up Virtual Machine in Linux & all Windows OS Versions
    • Interact with Malware Safely

    If you want to test all these features now with completely free access to the sandbox:

    This security gap allows an attacker to overwrite system scripts and achieve code execution outside the confines of the sandbox environment.

    The vulnerability stems from the application’s  chown command on files within the sandbox that users can manipulate.

    Attackers can exploit this by creating a symbolic link (symlink) from within the sandbox to a file outside.

    This allows the chown command, intended only for internal sandbox operations, to be executed on any file on the system.       

    Details:

    The specific issue arises in the context where the application attempts to change the ownership of a file name run_script, which is crucial for the execution of user-submitted code.

    The relevant code snippet is as follows:

    `sudo chown $(whoami): #{run_script} && rm #{run_script}` unless submission.is_project

    This command is executed unless the submission is marked as a project.

    By strategically creating a symlink named run_script that points to a critical system file, an attacker can force the application to change the ownership of an external file, effectively gaining control over it.

    CVE-2024-29021: SSRF into Sandbox Escape through Unsafe Default Configuration

    The vulnerability is rooted in Judge0’s default configuration, particularly its handling of network requests within the sandboxed environment.

    This configuration flaw can be exploited via SSRF, an attack where an attacker induces the server-side application to make requests to an unintended location.

    Details:

    Judge0 includes a configuration option labeled enable_network, which, when enabled, allows the sandboxed application to perform network requests.

    This includes communication with internal services such as Judge0’s PostgreSQL database, accessible within the internal Docker network.

    The exploit targets the following critical lines of code:

    command = "isolate #{cgroups} \

        -s \

        -b #{box_id} \

        -M #{metadata_file} \

        #{submission.redirect_stderr_to_stdout ? "--stderr-to-stdout" : ""} \

        #{submission.enable_network ? "--share-net" : ""} \

        -t #{submission.cpu_time_limit} \

        -x #{submission.cpu_extra_time} \

        -w #{submission.wall_time_limit} \

        -k #{submission.stack_limit} \

        -p#{submission.max_processes_and_or_threads} \

        #{submission.enable_per_process_and_thread_time_limit ? (cgroups.present? ? "--no-cg-timing" : "") : "--cg-timing"} \

        #{submission.enable_per_process_and_thread_memory_limit ? "-m " : "--cg-mem="}#{submission.memory_limit} \

        -f #{submission.max_file_size} \

        -E HOME=/tmp \

        -E PATH=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\" \

        -E LANG -E LANGUAGE -E LC_ALL -E JUDGE0_HOMEPAGE -E JUDGE0_SOURCE_CODE -E JUDGE0_MAINTAINER -E JUDGE0_VERSION \

        -d /etc:noexec \

        --run \

        -- /bin/bash run \

        < #{stdin_file} > #{stdout_file} 2> #{stderr_file} \

        "
        puts "[#{DateTime.now}] Running submission #{submission.token} (#{submission.id}):"
        puts command.gsub(/\s+/, " ")
        puts
        `#{command}`

    This command setup is generally secure against command injection vulnerabilities, as all variables injected into the shell command are controlled (either string literals or numerical values).

    However, the SSRF vulnerability allows an attacker to manipulate these settings by interacting with the database to change the data types of relevant columns, potentially leading to command injection.

    This incident serves as a stark reminder of the importance of cybersecurity vigilance.

    As the developers of JudgeO have demonstrated, prompt action and transparency in addressing security issues are critical.

    Users, for their part, must remain proactive in updating their software and staying informed about potential vulnerabilities.

    Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo 

    The post JudgeO Online Code Editor Flaw Let Attackers Execute Code as Root User appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Network Threats: A Step-by-Step Attack Demonstration

    ·

    Follow this real-life network attack simulation, covering 6 steps from Initial Access to Data Exfiltration. See how attackers remain undetected with the simplest tools and why you need multiple choke points in your defense strategy. Surprisingly, most network attacks are not exceptionally sophisticated, technologically advanced, or reliant on zero-day tools that exploit

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • DOJ Arrests Founders of Crypto Mixer Samourai for $2 Billion in Illegal Transactions

    ·

    The U.S. Department of Justice (DoJ) on Wednesday announced the arrest of two co-founders of a cryptocurrency mixer called Samourai and seized the service for allegedly facilitating over $2 billion in illegal transactions and for laundering more than $100 million in criminal proceeds. To that end, Keonne Rodriguez, 35, and William Lonergan Hill, 65, have been charged

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cyber Attack Defenders Up For Battle: Huge Uptick In Timely Attack Detections

    ·

    Attackers are employing evasion techniques to bypass detection and extend dwell time on compromised systems. This is achieved by targeting unmonitored devices, leveraging legitimate tools, and exploiting zero-day vulnerabilities. 

    While defenders are improving detection speed (dwell time decreased from 16 to 10 days), this is partly due to faster ransomware identification and adversary-in-the-middle and social engineering tactics to bypass multi-factor authentication. 

    Cloud infrastructure is under attack, with attackers even leveraging cloud resources. Both red and purple teams are exploring AI for better security outcomes as they analyze these trends and offer mitigation strategies to the security community.

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    In 2023, more than half of compromised organizations learned of the incident from an external source, most commonly through a ransom demand from the attacker (70% for ransomware-related intrusions). 

    Ransomware External Notification Source, 2023

    It suggests improved internal detection capabilities, as the percentage of externally notified intrusions decreased compared to 2022 (54% vs. 63%).

    Ransomware events are most often discovered externally (70%), with attacker ransom notes being the dominant notification method (75% of externally discovered ransomware intrusions). 

    Investigations into ransomware attacks are on the rise again, reaching 23% of all investigations in 2023, surpassing the 2022 numbers and matching the 2021 levels.

    Organizations are also becoming faster at detecting ransomware than other intrusions, with a median detection time of just 5 days in 2023. 

    Global Median Dwell Time by Detection Source

    The improvement is seen across the board, with internal detection dropping to 6 days and external notification leading to a 5-day detection window.

    Overall, dwell time (time attackers remain undetected) continues to decrease, highlighting the urgency of rapid response to security incidents. 

    Mandiant’s 2023 incident response investigations showed financial, business, and professional services, high tech, retail and hospitality, and healthcare as the most targeted industries. 

    Global Industries Targeted, 2023

    These sectors hold sensitive data like PII, PHI, and financial information, and the most typical initial infection vector was an exploit (38%), followed by phishing (17%) and prior compromises (15%). This suggests that attackers are increasingly using exploits and leveraging existing network breaches to gain access.

    There was a rise in financially motivated cyberattacks in 2023, with ransomware being the most common culprit. Data theft also remained prevalent, though slightly less frequent than in 2022. 

    In some cases, stolen data was directly sold for extortion, while other attackers used a combination of data theft, ransomware deployment, and extortion threats.

    Data breaches involving intellectual property and targeted theft by espionage groups were also identified. 

    Observed Threat Groups by Goal, 2023

    They tracked a vast number of threat actors, encountering over 300 unique groups during incident response in 2023. A significant portion (719) were newly identified, with over half exhibiting financial motivations. 

    It aligns with the rise in ransomware observed in 2023, as espionage and other objectives saw a modest decline, while a substantial number (36%) remains challenging to categorize definitively due to limited evidence. 

    In 2023, a consistent distribution of malware categories was observed, with backdoors (33%), downloaders (16%), droppers (15%), credential stealers (7%), and ransomware (5%) being the top five. 

    Credential stealers re-entered the top five in 2023, while ransomware families decreased from 7% in 2022 to 5% in 2023. This suggests a rise in preexisting ransomware strains like LOCKBIT, ALPHV, BASTA, and ROYALLOCKER.

    Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo 

    The post Cyber Attack Defenders Up For Battle: Huge Uptick In Timely Attack Detections appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / / / / / / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Alert! Cisco Releases Critical Security Updates to Fix 2 ASA Firewall 0-Days

    ·

    Cisco has released critical security updates to address multiple vulnerabilities in its Adaptive Security Appliance (ASA) devices and Firepower Threat Defense (FTD) software, collectively known as the “ArcaneDoor” vulnerabilities.

    If exploited, these vulnerabilities could allow a cyber threat actor to take control of an affected system.

    The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild.

    Recently, GBHackers on Security reported that a sophisticated cyber espionage campaign dubbed “ArcaneDoor” conducted by a state-sponsored threat actor tracked as UAT4356 to exploit these 2 zero-day vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in Cisco’s Adaptive Security Appliance (ASA) firewalls.

    Combat Email Threats with Free Phishing Simulations: Email Security Awareness Training ->Try Free Demo 

    CVE-2024-20353 and CVE-2024-20359: Persistent Remote Code Execution Vulnerabilities

    These two vulnerabilities tracked as CVE-2024-20353 and CVE-2024-20359, are persistent remote code execution vulnerabilities in Cisco ASA and FTD software.

    They allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system with root-level privileges.

    The vulnerabilities exist due to improper handling of certain HTTP requests and improper sanitization of user-supplied data.

    An attacker could exploit these vulnerabilities by sending crafted HTTP requests to a targeted device, potentially leading to complete system compromise.

    “To determine whether a device that is running Cisco ASA Software or FTD Software is affected, use the show asp table socket | include SSL command and look for an SSL listen socket on any TCP port.”

    If a socket is present in the output, the device should be considered vulnerable. The following example shows the output for a Cisco ASA device with two SSL listen sockets on TCP port 443 and TCP port 8443:

    ciscoasa#  show asp table socket | include SSL
    SSL       00185038  LISTEN     172.16.0.250:443    0.0.0.0:*
    SSL       00188638  LISTEN      10.0.0.250:8443    0.0.0.0:*

    Cisco has confirmed active exploitation of these vulnerabilities and has released software updates to address them. No workarounds are available, and users are strongly encouraged to apply the necessary updates immediately.

    CVE-2024-20358: Web Services Denial of Service Vulnerability

    CVE-2024-20358 is a denial of service (DoS) vulnerability in the management and VPN web servers of Cisco ASA and FTD software.

    An unauthenticated, remote attacker could cause the affected device to reload unexpectedly, resulting in a DoS condition.

    The vulnerability is due to incomplete error checking when parsing an HTTP header.

    An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on the device, causing it to reload and become unavailable.

    This vulnerability affects the Cisco ASA restore CLI command that is described in the Software and Configurations chapter of the Cisco ASA Series General Operations CLI Configuration Guide.

    This vulnerability does not affect the backup restore functionalities documented in the System Management chapter of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager and the Backup and Restore chapter of the Firepower Management Center Configuration Guide.

    Cisco has released software updates to address this vulnerability, and there are no workarounds available.

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    The post Alert! Cisco Releases Critical Security Updates to Fix 2 ASA Firewall 0-Days appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / / / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Pakistani APT Hackers Attacking Indian Govt Entities With Weaponized Shortcut Files

    ·

    Cybersecurity experts at Seqrite Labs have reported a surge in cyberattacks against Indian government entities.

    These attacks have been attributed to Pakistani Advanced Persistent Threat (APT) groups, which have been intensifying their malicious activities.

    Attack Methods

    The recent campaigns uncovered by Seqrite Labs’ APT team reveal a sophisticated level of cyber warfare.

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    The Pakistani-linked APT group SideCopy has been particularly active, deploying its commonly used AllaKore Remote Access Trojan (RAT) in three separate campaigns.

    Attack Chain of SideCopy
    Attack Chain of SideCopy

    In each of these campaigns, two instances of the RAT were used simultaneously, showcasing the group’s aggressive tactics.

    Simultaneously, Transparent Tribe (APT36), the parent group of SideCopy, has been consistently utilizing the Crimson RAT.

    However, they have modified their approach by encoding or packing the RAT differently to evade detection.

    Targets

    The primary targets of these cyberattacks are Indian defense and government entities.

    SideCopy and APT36 have been persistent in their efforts to infiltrate these sectors since at least 2019.

    The decoy files used in previous campaigns in February-March 2023 have been observed. 

    “Grant_of_Risk_and_HardShip_Allowances_Mar_24.pdf.” As the name suggests, it is an advisory from 2022 on allowance grants to Army officers under India’s Ministry of Defence.

    Decoy Files
    Decoy Files

    Their arsenal is not limited to AllaKore and Crimson RATs but includes other malicious tools such as Ares RAT, Action RAT, Reverse RAT, and Margulas RAT.

    The impact of these cyberattacks is significant, as they compromise the security and integrity of critical government systems.

    The persistent targeting of these entities threatens national security and puts sensitive data at risk of being exploited.

    Countermeasures

    In response to these escalating threats, Indian cybersecurity forces are urged to strengthen their defenses and remain vigilant.

    This includes updating security protocols, conducting regular system checks, and training personnel to effectively recognize and respond to cyber threats.

    As geopolitical tensions continue influencing the cyber threat landscape, India remains a prime target for APT groups.

    Seqrite Labs’ recent findings underscore the need for robust cybersecurity measures to protect against these sophisticated and persistent threats.

    Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo 

    The post Pakistani APT Hackers Attacking Indian Govt Entities With Weaponized Shortcut Files appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶