HexaLocker V2: Skuld Stealer Paving the Way prior to Encryption

/in

HexaLocker, Ransomware, Skuld Stealer

Key Takeaways

  • HexaLocker was first discovered in mid-2024, with version 2 introducing significant updates and enhanced functionalities.

  • HexaLocker V2 includes a persistence mechanism that modifies registry keys to ensure continued execution after the affected system reboots.

  • The updated version downloads Skuld Stealer, which extracts sensitive information from the victim’s system before encryption.

  • Unlike its predecessor, HexaLocker V2 exfiltrates victim files before encrypting them, following the double extortion method of data theft and file encryption.

  • HexaLocker V2 utilizes a combination of advanced encryption algorithms, including AES-GCM for string encryption, Argon2 for key derivation, and ChaCha20 for file encryption.

  • HexaLocker V2 replaces the TOXID communication method with a unique hash, enabling victims to communicate with the Threat Actors’ (TA’s) site. 

Executive Summary

On August 9th, the HexaLocker ransomware group announced a new Windows-based ransomware on their Telegram channel. The post highlighted that the ransomware was developed in the Go programming language and claimed that their team included members from notable groups like LAPSUS$ and others. Following this announcement, researchers from Synacktiv analyzed this ransomware variant and published their findings shortly after.

On October 21st, cybersecurity researcher PJ04857920 shared a post on X, revealing that the admin behind HexaLocker had decided to shut down the operation and put the ransomware’s source code and web panel up for sale based on information from the HexaLocker group’s Telegram channel.

Later, on December 12th, they provided another update on X, stating that the HexaLocker ransomware had been revived, with signs of ongoing development and activity. The Telegram post also mentioned that the upgraded version of HexaLocker would feature enhanced encryption algorithms, stronger encryption passwords, and new persistence mechanisms.

Cyble Research and Intelligence Labs (CRIL) came across a new version of the HexaLocker ransomware. Upon execution, it copies itself to the %appdata% directory, creates a run entry for persistence, encrypts files, and appends the “HexaLockerv2” extension to them.

Prior to encryption, the ransomware also steals the victim’s files and exfiltrates them to a remote server. Notably, in this new version, the ransomware downloads an open-source stealer named Skuld to collect sensitive information from the victim’s machine before encryption. The figure below shows the Hexalocker Ransomware Site used for Victim’s communication.

Ransomware. Hexalocker
Figure 1 – Ransomware login page

Technical Details

Persistence

Upon execution, the HexaLocker ransomware creates a self-copy named “myapp.exe” in the “%appdata%MyApp” directory and establishes persistence by adding an AutoRun entry at “HKCUSoftwareMicrosoftWindowsCurrentVersionRun” with the value “MyAppAutostart” ensuring the ransomware binary executes upon system reboot.

Task Manager, AutoRun
Figure 2  – AutoRun entry

Obfuscation

All string references, including the Stealer URL, file paths, folder names, environment variable names, WMIC commands, and ransom notes, are generated during runtime through multiple layers of AES-GCM decryption. This approach effectively obfuscates the strings, making them harder to detect by security solutions. In contrast, all strings in the previous version were statically visible.

String decryption
Figure 3 – String Decryption

Stealer

Prior to initiating the encryption process, the ransomware downloads a stealer binary, a Go-compiled program, from the URL hxxps[:]//hexalocker.xyz/SGDYSRE67T43TVD6E5RD[.]exe and executes it from the current directory. This stealer functionality was absent in the previous version of HexaLocker.

The downloaded stealer, identified as Skuld, is an open-source tool designed to target Windows systems and steal user data from various applications such as Discord, browsers, crypto wallets, and more.

Skuld Stealer
Figure 4 – Skuld Stealer’s features

In this case, the TA has utilized only the browser module from the many available in the open-source Skuld Stealer. The image below shows function names corresponding only to the browser module from the Skuld project.

Github, Browser
Figure 5 – Browser modules

The stealer collects various sensitive data stored by Chromium and Gecko-based browsers, such as cookies, saved credit card information, downloads, browsing history, and login credentials. Skuld Stealer targets the following web browsers in this campaign.

Gecko-based browsers

Firefox SeaMonkey
Waterfox K-Meleon
Thunderbird IceDragon
Cyberfox BlackHaw
Pale Moon mercury

Chromium browsers

Chrome SxS ChromePlus 7Star
Chrome Chedot Vivaldi
Kometa Elements Browser Epic Privacy Browser
Uran Fenrir Inc Citrio
Coowon liebao QIP Surf
Orbitum Dragon 360Browser
Maxthon3 K-Melon CocCoc
BraveSoftware Amigo Torch
Sputnik Edge DCBrowser
YandexBrowser UR Browser Slimjet
Opera    

The stolen data is compressed into a ZIP archive named ‘BrowsersData-*.zip’ and stored in the AppDataLocalTemp directory before being exfiltrated to the remote server “hxxps://hexalocker[.]xyz/upload.php”. The image below shows the console output of the stealer upon completing each stage.

Infostealer, Malware
Figure 6 – Stealer Console Output

Exfiltration

Upon executing the stealer payload, the ransomware exfiltrates the victims’ files by scanning all folders starting from “C:” to find files with extensions matching those listed in the table below. The identified files are compiled into a single ZIP archive named “data_*.zip”, stored in the “%localappdata%DataHexaLocker” directory, and subsequently transmitted to the attacker’s remote server via “hxxps[:]//hexalocker.xyz/receive.php”.

Category File Types
Documents .pdf, .doc, .docx, .rtf, .txt, .wps, .xls, .xlsx, .csv, .ppt, .pot, .xps, .xsd, .xml
Images .jpg, .jpeg, .png, .bmp, .gif, .tif, .tiff, .ico, .jpe, .dib, .raw, .psd, .exr, .bay
Audio .mp3, .wav, .wma, .m4a, .m4p, .flac, .aac, .amr, .ogg, .adp
Video .mp4, .mkv, .avi, .mov, .wmv, .flv, .3gp, .m4v, .amv, .swf
Compressed Files .zip, .rar, .7z, .tar, .gz, .bz2, .cab, .iso, .lzh, .ace, .arj
Code & Scripts .php, .asp, .htm, .html, .js, .jsp, .css, .py, .java, .c, .cpp, .asm, .vbs, .cmd, .bat
Executable Files .exe, .msi, .dll, .apk, .lnk
Database Files .db, .dbf, .mdb, .sql, .odc, .odm, .pst, .mdf, .myi, .tab
3D/Design Files .3ds, .dae, .stl, .max, .dwg, .dxf, .obj, .r3d, .kmz, .opt
Web/Markup Files .html, .htm, .xml, .xsl, .rss, .cfm, .xsf
System/Backup Files .bak, .cer, .crt, .pfx, .p12, .p7b, .log, .cfg, .ini, .lnk
Others .sum, .sln, .dif, .dmg, .p7c, .opt, .sie, .key, .vob

Encryption

The ransomware generates a key and the salt needed for encryption and sends them to a remote server at “hxxps[:]//hexalocker.xyz/index[.]php,” along with host-specific details such as the IP address, computer name, and ID. This information is used to identify the victims and facilitate the recovery of the encrypted files.

PII, Exfiltration
Figure 7 – Victim’s Details

Once the gathered information is transmitted to the attacker, HexaLocker proceeds to scan the “C:Users<username>” directory on the victim’s machine. It searches for files that match a specific set of extensions, as listed in the table below.

Category Extensions
Text Documents .txt, .doc, .odt, .rtf, .wps, .dot
Databases .sql, .mdb, .dbf, .pdb, .mdf, .mdw, .myi
Spreadsheets .xls, .ods, .csv, .xla, .xlw, .xlm, .xlt, .slk
Presentations .ppt, .odp, .pps, .pot
Programming Files .cpp, .css, .php, .asp, .ini, .inc, .obj, .bat, .cmd, .vbs, .jsp, .asm, .cfm
Archives .zip, .rar, .tar, .iso, .bz2, .cab, .lzh, .ace, .arj
Images .jpg, .png, .bmp, .gif, .tif, .ico, .psd, .raw, .svg, .jpe, .dib, .iff, .dcm, .bay, .dcr, .nef, .orf, .r3d
Audio .mp3, .mka, .m4a, .wav, .wma, .flv, .pls, .adp
Video .mp4, .mkv, .avi, .mov, .wmv, .3gp, .m4v, .amv, .m4p, .vob, .mpv, .3g2, .f4v, .m1v
Web Files .htm, .html, .xml, .css, .js, .jsp, .rss
Executables .exe, .jar, .msi, .dll
Scripts .php, .asp, .vbs, .cmd, .bat
Backup/Logs .bak, .log
3D/CAD .3ds, .dae, .dwg, .max, .geo
Compressed .zip, .rar, .tar, .bz2, .gz
Configuration .ini, .cfg, .xml
Emails .msg, .oft, .pst, .dbx
Fonts .ttf, .otf, .woff
Certificates .crt, .cer, .pfx, .p12, .p7b, .p7c
Others .lnk, .dat, .sum, .opt, .dic, .tbi, .xps, .key, .tab, .stm, .ai3, .ai4, .ai5, .ai6, .ai7, .ai8, .opt

The ransomware reads the content of the original file and uses the ChaCha20 algorithm to encrypt the data. Once the encryption is complete, it creates a new file with the “.HexaLockerV2” extension and writes the encrypted content to this newly created file. The ransomware then proceeds to delete the original file using the os.Remove function, leaving only the encrypted file behind. The figure below shows the chacha20 encryption algorithm used by the ransomware binary.

Chacha20
Figure 8 – Chacha20 Algorithm

The figure below illustrates the files encrypted by the HexaLocker Ransomware, which have the “.HexaLockerV2” extension.

Figure 9 – User files after encryption

Finally, the ransomware displays a ransom note to the victim, instructing them to contact the TA through their communication channels, such as Signal, Telegram, and Web Chat, as shown below.

Ransom Note
Figure 10 – Ransom note

The ransom note contains a unique personal hash, which the victim uses to communicate with the TA through a chat window provided by the attacker, as shown below.

Hexalocker, Chat
Figure 11 – Web Chat Window

Conclusion

The new version of HexaLocker ransomware represents a significant upgrade, incorporating enhanced encryption logic and a customized stealer component. Developed in Go, this ransomware benefits from Go’s efficiency, making it more challenging to detect by endpoints.

Before initiating the encryption process, the ransomware employs the Skuld stealer to collect sensitive information from the victim’s machine. This strategic combination of the Skuld stealer and the ransomware highlights the continuous evolution and sophistication of the HexaLocker group, posing an ongoing threat to targeted systems.

The Yara rule to detect HexaLocker Version 2 is available for download from the linked Github repository.    

Our Recommendations

We have listed some essential cybersecurity best practices that create the first line of control against attackers. We recommend that our readers follow the best practices given below: 

Safety Measures to Prevent Ransomware Attacks 

  • Regularly back up important files to offline or cloud storage, ensuring they are stored securely and not connected to the main network.

  • Enable automatic updates for your operating system, applications, and security software to ensure you receive the latest patches and security fixes.

  • Implement endpoint protection with reputable anti-virus and anti-malware software to detect and block potential ransomware threats.

  • Educate employees or users about phishing attacks and suspicious email links, which are common ransomware delivery methods.

  • Restrict user privileges and avoid running unnecessary services to minimize the attack surface, ensuring users only have access to the resources they need.

MITRE ATT&CK® Techniques

Tactic Technique ID Procedure
Execution (TA0002)
User Execution (T1204.002)  		 User executes the ransomware file.
Persistence (TA0003)   Registry Run Keys / Startup Folder (T1547.001) Adds a Run key entry for execution on reboot.
Defense Evasion (TA0005) Deobfuscate/Decode Files or Information (T1140)  Ransomware Decrypts strings using the AES algorithm
Discovery (TA0007) File and Directory Discovery (T1083) Ransomware enumerates folders for file encryption and file deletion. 
Impact (TA0040) T1486 (Data Encrypted for Impact)  Ransomware encrypts files for extortion. 
Credential Access (TA0006)  Credentials from Password Stores: Credentials from Web Browsers (T1555.003)  Retrieves passwords from Login Data
Credential Access (TA0006)  Steal Web Session Cookie (T1539)  Steals browser cookies 
Collection (TA0009)  Archive via Utility (T1560.001)  Zip utility is used to compress the data before exfiltration 
Exfiltration (TA0010)  Exfiltration Over C2 Channel (T1041)  Exfiltration Over C2 Channel

Indicators of Compromise (IOCs)

Indicators Indicator Type Description
8b347bb90c9135c185040ef5fdb87eb5cca821060f716755471a637c350988d8 SHA-256 Stealer
0347aa0b42253ed46fdb4b95e7ffafa40ba5e249dfb5c8c09119f327a1b4795a SHA-256 HexaLockerV2
28c1ec286b178fe06448b25790ae4a0f60ea1647a4bb53fb2ee7de506333b960 SHA-256 HexaLockerV2
d0d8df16331b16f9437c0b488d5a89a4c2f09a84dec4da4bc13eab15aded2e05 SHA-256 HexaLockerV2
hxxps[:]//hexalocker.xyz/SGDYSRE67T43TVD6E5RD[.]exe URL Stealer download url
hxxps[:]//hexalocker[.]xyz/upload[.]php URL NA
hxxps[:]//hexalocker[.]xyz/receive[.]php URL NA

References

https://www.trellix.com/en-in/blogs/research/skuld-the-infostealer-that-speaks-golang

https://www.synacktiv.com/publications/lapsus-is-dead-long-live-hexalocker.html

The post HexaLocker V2: Skuld Stealer Paving the Way prior to Encryption appeared first on Cyble.

Blog – Cyble – ​Read More

How vulnerable Ecovacs robot vacuums are being hacked | Kaspersky official blog

/in

Imagine: you get up in the night for a glass of water, walk across the unlit landing, when out of the darkness a voice starts yelling at you. Not nice, you’d surely agree. But that’s the new reality for owners of vulnerable robot vacuums, which can be commanded by hackers to turn from domestic servants into foul-mouthed louts. And that’s not all: hackers can also control the robot remotely and access its live camera feed.

The danger is clear and present: recently, cases of cyberhooligans hijacking vulnerable robot vacuums to prank people (and worse) have been seen in the wild. Read on for the details…

How a robot vacuum works

Let’s start with the fact that a modern robot vacuum is a full-fledged computer on wheels, usually running on Linux. It comes with a powerful multi-core ARM processor, a solid chunk of RAM, a capacious flash drive, Wi-Fi, and Bluetooth.

Schematic of a typical robot vacuum

Today’s robot vacuum is a full-fledged computer on wheels Source

And of course, the modern robot vacuum has sensors everywhere: infrared, lidar, motion, camera (often several of each), and some models also have microphones for voice control.

Camera and microphones in the Ecovacs DEEBOT X1

The Ecovacs DEEBOT X1 has not only a camera, but an array of microphones Source

And naturally, all modern robot vacuums are permanently online and hooked up to the vendor’s cloud infrastructure. In most cases, they communicate aplenty with this cloud — uploading piles upon piles of data collected during operation.

Vulnerabilities in Ecovacs robot vacuums and lawn mowers

The first report of vulnerabilities in Ecovacs robot vacuums and lawnmowers surfaced in August 2024, when security researchers Dennis Giese (known for hacking a Xiaomi robot vacuum) and Braelynn Luedtke gave a talk at DEF CON 32 on reverse engineering and hacking Ecovacs robots.

Ecovacs GOAT G1 robot lawnmower

The Ecovacs GOAT G1 can also be equipped with GPS, LTE and a long-range Bluetooth module Source

In their talk, Giese and Luedtke described several methods for hacking Ecovacs robot vacuums and the mobile app that owners use to control them. In particular, they found that a potential hacker could access the feed from the robot’s built-in camera and microphone.

This is possible for two reasons. First, if the app is used on an insecure network, attackers can intercept the authentication token and communicate with the robot. Second, although in theory the PIN code set by the device owner secures the video feed, in practice it gets verified on the app side — so it can be bypassed.

Attackers accessing the video feed from an Ecovacs robot vacuum

The PIN code for securing the video feed from an Ecovacs robot vacuum is verified on the app side, which makes the mechanism extremely vulnerable Source

The researchers also managed to gain root access to the robot’s operating system. They found it was possible to send a malicious payload to the robot via Bluetooth, which in some Ecovacs models gets turned on after a scheduled reboot, while in others it’s on all the time. In theory, encryption should protect against this, but Ecovacs uses a static key that’s the same for all devices.

Armed with this knowledge, an intruder can get root privileges in the operating system of any vulnerable Ecovacs robot and hack it at a distance of up to 50 meters (~165 feet) — which is precisely what the researchers did. As for robot lawnmowers, these models are hackable at more than 100 meters (~330 feet) away, since they’ve got more powerful Bluetooth capabilities.

Add to that that, as mentioned already, today’s robot vacuums are full-fledged Linux-based computers, and you can see how attackers can use one infected robot as a means to hack others nearby. In theory, hackers can even create a network-worm to automatically infect robots anywhere in the world.

Bluetooth vulnerability could potentially be used to create a worm

Bluetooth vulnerability in Ecovacs robots could lead to a chain of infection Source

Giese and Luedtke informed Ecovacs about the vulnerabilities they found, but received no response. The company did try to close some of the holes, say the researchers, but with little success and ignoring the most serious vulnerabilities.

How the Ecovacs robot vacuums were hacked for real

It appears that the DEF CON talk generated great interest in the hacker community — so much so that someone seems to have taken the attack a step further and deployed it on Ecovacs robot vacuums out in the real world. According to recent reports, owners in several U.S. cities had been hit by hackers and made to suffer abuse from their robot servants.

In one incident in Minnesota, an Ecovacs DEEBOT X2 started moving by itself and making strange noises. Alarmed, its owner went into the Ecovacs app and saw that someone was accessing the video feed and remote-control feature. Writing it off as a software glitch, he changed the password, rebooted the robot and sat down on the couch to watch TV with his wife and son.

But the robot kicked back into life almost straight away — this time emitting a continuous stream of racial slurs from its speakers. Not knowing what to do, the owner turned off the robot, took it into the garage and left it there. Despite this ordeal, he is grateful that the hackers made their presence so obvious. Far worse, he says, would have been if they’d simply secretly monitored his family through the robot without revealing themselves.

Video feed from an Ecovacs robot vacuum

Hijacking a live video feed of an Ecovacs robot vacuum Source

In a similar case, this time in California, another Ecovacs DEEBOT X2 chased a dog around the house, again shouting obscenities. And a third case was reported from Texas, where, you guessed it, an Ecovacs robot vacuum went walkabout and hurled abuse at its owners.

The exact number of hacks of Ecovacs robot vacuums is unknown. One reason for this, alluded to above, is that the owners may not be aware of it: the hackers may be quietly observing their daily lives through the built-in camera.

How to guard against robot vacuum hacking?

The short answer is: you can’t. Unfortunately, there’s no universal method of protecting against robot vacuum hacking that covers all bases. For some models, in theory, there’s the option of hacking it yourself, getting root access, and unlinking the machine from the vendor’s cloud. But this is a complex and time-consuming procedure that the average owner won’t consider attempting.

A serious problem with IoT devices is that many vendors, sadly, still pay insufficient attention to security. And they often prefer to bury their heads in the sand — even declining to respond to researchers who helpfully report such issues.

To reduce the risks, try do your own research on the security practices of the vendor in question before purchasing. Some actually do a pretty good job of keeping their products safe. And, of course, always install firmware updates: new versions usually remove at least some of the vulnerabilities that hackers can exploit to gain control over your robot.

And remember that a robot connected to home Wi-Fi, if hacked, can become a launchpad for an attack on other devices connected to the same network — smartphones, computers, smart TVs, and so on. So it’s always a good idea to move IoT devices (in particular, robot vacuums) to a guest network, and install reliable protection on all devices where possible.

Kaspersky official blog – ​Read More

Lithuania’s New Cyber Command is a Strategic Step Towards National and NATO Cybersecurity Resilience

/in

Lithuanian Cyber Command

Overview 

On January 1, Lithuania marked a pivotal moment in its national defense strategy with the official launch of the Lithuanian Cyber Command (LTCYBERCOM). Spearheaded by the Ministry of National Defence, this new military unit aims to enhance the country’s cybersecurity posture while strengthening its collaboration with NATO and other international partners. 

A New Era in Cyber Defense with Lithuanian Cyber Command 

LTCYBERCOM is tasked with conducting cyberspace operations and managing strategic communications and information systems (CIS). Its creation reflects Lithuania’s recognition of the growing importance of cyberspace in modern warfare and national security. By consolidating cyber defense resources under one command, LTCYBERCOM ensures a unified and efficient approach to countering digital threats. 

The command structure includes: 

  • Command Headquarters: Responsible for planning and executing cyber operations. 

  • Lithuanian Great Hetman Kristupas Radvila Perkūnas CIS Battalion: Focused on delivering robust communication and information services. 

  • IT Service of the Cyber Defence Command: A revamped entity from the Ministry of National Defence’s former IT service. 

This restructuring consolidates Lithuania’s cyber capabilities, aligning them under the Cyber Command’s mandate. Some functions, however, remain with the National Cyber Security Centre and the Core Centre of State Telecommunications, ensuring seamless coordination across all levels of cyber defense. 

Strengthening National and Allied Defense 

Vice Minister of National Defence Tomas Godliauskas called out the importance of LTCYBERCOM in modern defense strategies. “The Lithuanian Cyber Command is critical as an enabler of military planning and action coordination in cyberspace. Strengthening cyber defense and effective cyber incident management are cornerstone steps in protecting against emerging threats and safeguarding national security,” he said. 

The command also ensures interoperability with NATO’s cyber defense framework. As a NATO member since 2004, Lithuania has actively contributed to collective defense efforts. LTCYBERCOM will enhance Lithuania’s ability to respond to cyber threats while aligning its strategies with NATO’s broader objectives. 

Responding to Growing Cyber Threats 

Lithuania’s investment in cyber defense comes amid a surge in digital threats driven by geopolitical tensions. Cyberattacks, particularly from neighboring Russia, have targeted NATO allies, including Lithuania, with the goal of disrupting critical infrastructure and sowing division. 

A 2024 report from Google highlighted an uptick in Russian cyber operations against NATO nations, coinciding with Russia’s ongoing invasion of Ukraine. These attacks showcase the need for robust cyber defenses to protect not just national interests but also the stability of the NATO alliance. 

By establishing LTCYBERCOM, Lithuania is taking a proactive stance against these challenges. The new command will focus on preventing and mitigating cyber incidents, securing critical infrastructure, and ensuring rapid responses to digital threats. 

Complementary Roles of National Agencies 

While the Lithuanian Cyber Command assumes responsibility for military cyber operations, the National Cyber Security Centre under the Ministry of Defence continues to play a vital role in civilian cybersecurity. This year, the NCSC invited more than 500 organizations providing critical services to participate in the annual cybersecurity exercise “Cyber ​​Shield”. In addition, all residents had the opportunity to deepen their knowledge in various cybersecurity training programs. 

The center also provides incident response services, enhances resilience across government agencies, and supports critical sectors. Together, these entities form a comprehensive defense framework that addresses both military and civilian cybersecurity needs. 

Conclusion 

The legal foundation for LTCYBERCOM was laid in July 2024 when Lithuania’s Seimas approved amendments to the structure of the Armed Forces. This legislative milestone paved the way for the January inauguration, signaling Lithuania’s commitment to adapting its defense strategies for the digital age. 

Looking ahead, LTCYBERCOM is poised to become a cornerstone of Lithuania’s national defense strategy. With cyberattacks becoming an integral part of modern conflict, LTCYBERCOM equips Lithuania with the tools and strategies needed to safeguard its sovereignty and support its allies. By focusing on cyber capabilities, the country ensures its readiness to counter emerging threats while contributing to NATO’s collective security framework. 

References: 

The post Lithuania’s New Cyber Command is a Strategic Step Towards National and NATO Cybersecurity Resilience appeared first on Cyble.

Blog – Cyble – ​Read More

CISA Releases Two New Industrial Control Systems Advisories for 2025

/in

Cyble | Industrial Control Systems

Overview 

The Cybersecurity and Infrastructure Security Agency (CISA) released two critical Industrial Control Systems (ICS) advisories. These advisories, ICSA-25-007-01 and ICSA-25-007-02, aim to inform users and administrators about vulnerabilities in key ICS products. The goal is to mitigate potential risks to vital infrastructure sectors by highlighting existing security weaknesses that could be exploited by cyber attackers. 

ICSA-25-007-01: ABB ASPECT-Enterprise, NEXUS, and MATRIX Series Products 

The first advisory, ICSA-25-007-01, addresses multiple vulnerabilities within ABB’s ASPECT-Enterprise, NEXUS, and MATRIX series products. ABB, a leading provider of industrial automation and control systems, has reported numerous security flaws that could severely impact system integrity. These vulnerabilities range from weak passwords to critical code injection weaknesses, and they pose a significant risk to critical manufacturing sectors. 

Key Vulnerabilities 

Several vulnerabilities have been identified within ABB’s products, which include: 

  • Files or Directories Accessible to External Parties (CVE-2024-6209) 

  • Improper Validation of Specified Type of Input (CVE-2024-6298) 

  • Cleartext Transmission of Sensitive Information (CVE-2024-6515) 

  • Cross-site Scripting (XSS) (CVE-2024-6516) 

  • Server-Side Request Forgery (SSRF) (CVE-2024-6784) 

  • Code Injection (CVE-2024-48839) 

  • Weak Password Requirements (CVE-2024-48845) 

  • Unrestricted Upload of Dangerous Files (CVE-2024-51548) 

The most severe vulnerabilities carry a CVSS v3 score of 10.0, indicating they are highly exploitable and could lead to remote code execution, unauthorized access, or denial of service (DoS). These vulnerabilities were present across multiple versions of ABB products, including ASPECT-Enterprise (ASP-ENT-x), NEXUS Series (NEX-2x), and MATRIX Series (MAT-x), with affected versions prior to 3.08.02. 

Affected Products 

The following products are affected by these vulnerabilities: 

  • ABB ASPECT-Enterprise (ASP-ENT-x <= 3.08.02) 

  • ABB NEXUS Series (NEX-2x, NEXUS-3-x) 

  • ABB MATRIX Series (MAT-x) 

These products are deployed worldwide and are critical to operations in sectors like critical manufacturing. The vulnerabilities affect systems in both industrial and commercial environments, making them high-priority targets for cybersecurity professionals. 

Mitigations 

ABB has recommended users upgrade their systems to version 3.08.02 or later, which resolves many of these issues. Additionally, users are urged to apply security patches and adopt stronger password policies to mitigate the risk of unauthorized access. 

CISA’s advisory highlights that these vulnerabilities could be exploited remotely, with low complexity and without requiring direct access to the devices. Exploits could allow attackers to execute arbitrary code, gain unauthorized access to sensitive data, or disrupt operations. Thus, the ICSA-25-007-01 advisory serves as a critical call to action for administrators to update their systems and implement security best practices immediately. 

ICSA-25-007-02: Nedap Librix Ecoreader 

The second advisory, ICSA-25-007-02, addresses vulnerabilities in the Nedap Librix Ecoreader. Nedap is a well-known provider of RFID solutions, and the Ecoreader is used in access control and inventory management. The advisory highlights several flaws in the system that could expose sensitive data and allow attackers to manipulate access controls. 

While the ICSA-25-007-02 advisory lacks the extensive list of vulnerabilities that appear in the ABB advisory, it still outlines critical risks, particularly in environments where physical security and data integrity are paramount. 

Conclusion  

The release of CISA’s ICS advisories, ICSA-25-007-01 and ICSA-25-007-02, highlights the critical need for prompt action to secure industrial control systems against emerging cyber threats. These advisories identify vulnerabilities in ABB’s and Nedap’s products that could compromise ICS integrity, leading to operational disruptions and data breaches.  

With cyberattacks on infrastructure becoming more sophisticated, organizations must prioritize security updates and proactive measures. Cybersecurity experts like Cyble can help organizations better defend against cyber threats, ensuring the protection of critical infrastructure and operations. 

References:

The post CISA Releases Two New Industrial Control Systems Advisories for 2025 appeared first on Cyble.

Blog – Cyble – ​Read More

The Commonwealth Cyber Security Posture 2024: A Deep Dive into Australia’s Cyber Defense Measures

/in

Commonwealth Cyber Security Posture

Overview 

The Australian Government has shared its latest report for commonwealth cyber security. The Commonwealth Cyber Security Posture in 2024 report provides an essential update on the measures and progress related to cyber security across Australian Government entities. Tabled before the Australian Parliament, the report is a key tool for understanding the implementation and effectiveness of cyber security protocols for the 2023–24 financial year. As part of the government’s ongoing efforts to protect national security, public trust, and the economy, the Commonwealth Cyber Security Posture in 2024 highlights areas of improvement, challenges, and recommendations for enhancing Australia’s cyber defenses.

According to the report, the Australian Government consists of 1002 non-corporate Commonwealth entities (NCEs), 74 corporate Commonwealth entities (CCEs), and 16 Commonwealth companies (CCs), summing up to 190 government entities as of June 30, 2024. The report draws from the Australian Signals Directorate’s (ASD) Cyber Security Survey for Commonwealth Entities, which revealed an impressive 94% participation rate in 2024—the highest to date. This marks an important step towards understanding and mitigating cyber security risks across Australian Government entities. 

Cyber security is assessed in the report using three primary criteria: 

  1. Cyber Security Hardening: The implementation of technical mitigations to reduce the likelihood of system compromises. 

  1. Incident Preparedness and Response: The readiness and actions of entities when a cyber incident occurs. 

  1. Leadership and Planning: The involvement of leadership in fostering a strong cyber security culture and ensuring the overall security of systems. 

Key Findings of the Commonwealth Cyber Security Posture in 2024 

The report illustrates that while substantial progress has been made, there are areas in need of improvement. One notable concern is the declining number of entities meeting Maturity Level 2 across the Essential Eight mitigation strategies. In 2024, only 15% of entities reached Maturity Level 2—a decrease from 25% in 2023.  

The Essential Eight strategies, a set of cyber security practices developed by ASD, aim to reduce vulnerabilities and enhance cyber resilience across government systems. These strategies form the backbone of the Commonwealth Cyber Security Posture in 2024, and their implementation is a crucial factor in assessing the security posture of government agencies. 

Despite this decline, there are encouraging signs of progress in certain areas. In 2024, 75% of entities had a cyber security strategy in place, an increase from 73% in 2023. Moreover, 86% of entities had incorporated cyber security disruptions into their business continuity and disaster recovery plans, a notable improvement from 83% in the previous year. These strategies are crucial for maintaining continuity of government services, ensuring that cyber threats do not derail essential functions. 

Another positive development is that 88% of entities had a planned body of work to improve their cyber security, with 82% of these plans being funded. This reflects a proactive stance toward addressing vulnerabilities and strengthening security defenses. Furthermore, 86% of entities now have an incident response plan in place, an increase from 82% in 2023, signaling better preparedness to handle cyber threats when they arise. 

Training and Workforce Development 

The role of training and awareness in strengthening the Commonwealth Cyber Security Posture is also highlighted in the report. In 2024, 78% of government entities provided annual cyber security training to their workforce, maintaining the same percentage as in 2023. More encouragingly, the provision of privileged user training increased with 51% of entities offering this specialized training, up from 39% in 2023. This reflects the growing recognition of the critical need to educate personnel about advanced threats, such as phishing and unauthorized access attempts, which remain prevalent across government networks. 

The presence of legacy IT systems remains a persistent challenge for the Commonwealth Cyber Security Posture. These outdated systems pose cyber security risks due to their vulnerability to modern cyberattacks. In April 2024, ASD published guidance on managing the risks of legacy IT, offering low-cost mitigations to help entities manage these risks alongside their current cyber security strategies. 

Cyber security Incident Reporting and Supply Chain Risk 

Despite the improvements in cyber security governance, there are still gaps in incident reporting. Only 32% of entities reported at least half of the cyber security incidents observed on their networks to ASD. This highlights a critical area for further improvement, as comprehensive incident reporting is important for identifying online threats and improving national cyber security resilience. 

Supply chain risks also remain an important concern. In 2024, 74% of entities conducted supply chain risk assessments for applications, ICT equipment, and services, underscoring the importance of evaluating the security of third-party services and software that could pose risks to government systems. 

Addressing the Commonwealth Cyber Security Posture Going Forward 

To enhance Australia’s cyber security defenses, the report recommends that entities: 

  1. Continue to implement the Essential Eight strategies across their networks to reach at least Maturity Level 2. 

  1. Increase cyber security incident reporting and share cyber threat information with ASD to improve overall situational awareness. 

  1. Implement strategies for managing legacy IT, ensuring that both old and new systems are protected against cyber threats.  

  1. Maintain incident response plans and conduct exercises at least every two years to ensure readiness. 

These recommendations are vital for building a more resilient Commonwealth Cyber Security Posture, ensuring that Australian Government entities are well-prepared to respond to the online threats.  

Conclusion  

The Commonwealth Cyber Security Posture in 2024 highlights both the progress and challenges in strengthening Australia’s cyber security defenses. The Essential Eight mitigation strategies continue to play an important role in reducing vulnerabilities and enhancing the resilience of government ICT systems. With updates to these strategies addressing cyber threats, the Australian Signals Directorate (ASD) remains at the forefront of protecting against increasingly sophisticated cyber adversaries.  

While strides have been made, ongoing vigilance, collaboration, and the continuous refinement of cybers ecurity practices are crucial for protecting Australia’s critical infrastructure. Moving forward, the nation’s commitment to improving incident response, workforce training, and adopting best practices will be vital in overcoming the growing complexities of cyber threats, ensuring a secure and resilient digital future. 

References:

The post The Commonwealth Cyber Security Posture 2024: A Deep Dive into Australia’s Cyber Defense Measures appeared first on Cyble.

Blog – Cyble – ​Read More

MyCERT Advisory Recommends Cybersecurity Practices for Water Systems

/in

Cyble | MyCERT advisory

Overview 

The water sector is experiencing a rise in cyber threats, with critical infrastructure, including both IT and operational technology (OT) systems, becoming primary targets for malicious actors. These attacks, which exploit vulnerabilities in internet-facing OT systems and industrial control systems (ICS), pose cybersecurity risks to public health, business continuity, and national security.  

MyCERT, the Malaysian Computer Emergency Response Team, has issued MA-1228.012025, an advisory aimed at raising awareness of cybersecurity risks in the water sector and providing recommendations to mitigation stratergies. While there have been no cyber incidents reported in Malaysia’s water systems, the MyCERT advisory stresses the importance of vigilance and proactive defense strategies. 

MyCERT Advisory Highlights the Growing Cybersecurity Threat to Water Systems 

Water systems control essential services such as pumping stations, chlorination processes, and valves, all of which are critical to public health and safety. However, older systems with outdated software and weak security measures are increasingly susceptible to cyber-attacks. Many of these attacks exploit simple security weaknesses, such as default passwords and unprotected access points, enabling attackers to gain unauthorized access to sensitive systems. 

Cyberattacks targeting water systems can take many forms, from ransomware attacks demanding payment to prevent data exposure, to more insidious breaches targeting programmable logic controllers (PLCs) and other ICS devices. While large utilities have strengthened their defenses, smaller systems remain especially vulnerable. 

The recent cyber incident in October 2024, involving American Water in New Jersey, is one of such examples of these attacks. Although the attack did not result in operational disruptions at American Water’s facilities, it stresses the importance of cybersecurity vulnerabilities in the sector. The attack primarily affected computer networks and administrative systems, underlining the necessity for water utilities worldwide, including those in Malaysia, to enhance their security measures. 

Potential Impacts of Cyberattacks on Water Systems 

Cybersecurity incidents in the water sector can have a wide range of destructive consequences, both direct and indirect. Among the most concerning impacts are: 

  • Cyberattacks can interfere with the normal functioning of water systems, leading to delays in water treatment, pumping, and distribution processes. 

  • If attackers gain control of critical water system functions, they could contaminate drinking water or improperly manage chemicals, posing serious risks to public health. 

  • Industries relying on water, such as agriculture and manufacturing, could face operational shutdowns, leading to economic losses. 

  • Attackers who gain access to sensitive water system data could compromise confidential information, resulting in reputational damage and erosion of public trust. 

  • These attacks exploit vulnerabilities in water systems to hold sensitive data hostage. If ransoms are not paid, attackers may leak confidential data, including trade secrets and personal information, leading to further harm. 

  • Recovering from a cyberattack often involves substantial costs, including expenses for system restoration, legal fees, and potential fines for data breaches. 

MyCERT Advisory for Securing Water Systems 

To mitigate the cybersecurity risks facing water systems, MyCERT has outlined a series of best practices aimed at improving resilience and reducing the likelihood of successful attacks. Water system administrators are encouraged to follow these guidelines to protect critical assets: 

  1. Immediately replace default passwords with strong, unique passwords. This is one of the most basic yet effective steps to secure systems. 

  2. Minimize the number of critical systems exposed to the public internet, thereby reducing the attack surface for potential threats. 

  3. Ensure that user accounts have access only to the data and systems necessary for their role. This can limit the damage caused by compromised accounts. 

  4. MFA provides an added layer of security by requiring additional verification steps before granting access to critical systems. 

  5. Apply network segmentation in water treatment facilities to isolate key systems from non-essential systems, preventing widespread damage in the event of an attack. 

  6. Ensure that all systems, both OT and IT, are updated with the latest security patches and antivirus definitions. This is crucial to defending against known vulnerabilities. 

  7. Perform daily backups of both OT and IT systems and store backup copies in remote locations. Regularly test backup processes to ensure they function correctly during a disaster recovery scenario. 

  8. Provide annual cybersecurity training for all staff members, ensuring they understand the latest threats and how to avoid common pitfalls like phishing or clicking on malicious links. 

  9. Regularly update disaster recovery and business continuity plans to account for emerging threats and vulnerabilities. Ensure these plans are well-practiced in the event of an actual breach. 

Conclusion  

The MyCERT advisory emphasizes the need to strengthen cybersecurity in Malaysia’s water systems, which are crucial for public health and the economy. As these systems become more digital and interconnected with sectors like agriculture and manufacturing, their exposure to cyber risks grows. 

By adopting best practices like updating passwords, using multi-factor authentication, and applying security patches, water utilities can improve defenses against cyber threats. MyCERT encourages staying updated on cybersecurity developments and conducting regular assessments. While Malaysia has not faced major cyber incidents in water systems, the rising threats require vigilance. Platforms like Cyble, with AI-driven threat intelligence, help protect these vital infrastructures. 

References 

The post MyCERT Advisory Recommends Cybersecurity Practices for Water Systems appeared first on Cyble.

Blog – Cyble – ​Read More

Tenable Nessus Bug and LDAP RCE: What You Need to Know

/in

Cyble | JoCERT

Overview 

JoCERT has alerted the global cybersecurity community about two critical issues requiring urgent attention from IT professionals and system administrators. The first involves Tenable Nessus Agents, a widely-used vulnerability scanning tool, while the second concerns a critical vulnerability in Windows Lightweight Directory Access Protocol (LDAP), potentially leading to remote code execution (RCE). Both incidents emphasize the need for prompt action and a proactive approach to cybersecurity. 

This blog will provide a detailed overview of the incidents, their impacts, and recommended resolution steps to help organizations mitigate potential risks. 

Incident 1: Tenable Nessus Agent Outage 

Incident Overview 

On December 31, 2024, Tenable Nessus Agent versions 10.8.0 and 10.8.1 encountered a critical issue due to a faulty differential plugin update. This bug disrupted systems across multiple regions, including the Americas, Europe, and Asia, leaving Nessus agents offline and unable to perform their core function—vulnerability scanning. The root cause was a rare race condition triggered during plugin updates, which led to the simultaneous compilation of interdependent libraries. 

Impact 

  • Nessus agents running versions 10.8.0 and 10.8.1 stopped functioning, rendering them incapable of conducting vulnerability scans. 

  • Tenable temporarily disabled plugin feed updates for these versions to prevent further issues. 

  • Organizations relying on these agents for vulnerability management faced significant disruptions. 

Resolution Steps 

To address the issue, Tenable provided the following guidance: 

  1. Upgrade or Downgrade Agents 

  • Upgrade to Nessus Agent version 10.8.2. 

  • Downgrade to version 10.7.3 if upgrading is not feasible. 

  1. Plugin Reset 

  • If using agent profiles for updates, a plugin reset is necessary to recover offline agents. This can be achieved using the following methods: 

  • Use a script provided in the Tenable release notes. 

  • Execute the nessuscli reset command. 

  1. Manual Upgrade Process 

  • Download the Tenable Nessus Agent 10.8.2 or 10.7.3 installation package. 

  • Manually upgrade or downgrade agents using the install package. 

  1. Recommendations for Long-Term Management 

  • Maintain vigorous change management processes to minimize risks associated with tool updates. 

  • Consider retaining older, stable software versions for quick rollback scenarios. 

Key Fixes in Nessus Agent Version 10.8.2 

  • Resolved issues causing agents to crash under specific error conditions. 

  • Addressed the race condition that caused agents to go offline following a plugin update. 

Additional Notes 

Organizations should review their network configurations to ensure uninterrupted communication between Nessus agents and Tenable’s infrastructure. For instance, domain allow lists must include *.cloud.tenable.com to ensure compatibility with Tenable’s new domains, reducing operational overhead. 

Incident 2: Windows LDAP Remote Code Execution Vulnerability (CVE-2024-49113) 

Incident Overview 

Microsoft disclosed a critical vulnerability, CVE-2024-49113, impacting the Lightweight Directory Access Protocol (LDAP). LDAP is integral to Microsoft’s Active Directory, facilitating the access and maintenance of directory services. The vulnerability could potentially allow Remote Code Execution (RCE), enabling attackers to exploit directory services and compromise sensitive systems. 

Impact 

An attacker could exploit the vulnerability to: 

  • Execute arbitrary code on the targeted system. 

  • Disrupt directory services, leading to a Denial of Service (DoS). 

  • Compromise sensitive organizational data stored in Active Directory. 

Mitigation Steps 

Microsoft has provided mitigations to reduce the risk associated with this vulnerability. Organizations are advised to: 

  1. Apply Patches Immediately 

  • Ensure the latest security patches are applied to all systems using LDAP services. 

  1. Enhance Security Configurations 

  • Limit access to LDAP servers to trusted entities. 

  • Implement mutual authentication to verify both the server and client identities. 

  1. Monitor for Malicious Activity 

  • Regularly audit LDAP logs for suspicious activity. 

  • Deploy intrusion detection/prevention systems (IDS/IPS) to monitor LDAP traffic. 

  1. Train Employees 

  • Educate users on identifying and avoiding phishing attempts that could lead to LDAP exploitation. 

Key Recommendations 

Applying these mitigations will reduce the likelihood of attackers successfully convincing victims to connect to malicious servers. Organizations should regularly review and update their security protocols to address evolving threats. 

Technical Analysis and Key Learnings 

Tenable Nessus Incident 

The Tenable Nessus outage point out the importance of thorough testing before deploying updates to critical systems. The race condition caused by simultaneous compilation of interdependent libraries could have been identified with more comprehensive testing under varied conditions. This incident highlights the need for: 

  • Strong QA Processes: Test updates across different environments before release. 

  • Fail-Safe Mechanisms: Implement automatic rollbacks or sandboxing for plugin updates to prevent widespread outages. 

Windows LDAP Vulnerability 

The Windows LDAP vulnerability illustrates the critical need for: 

  • Proactive Patch Management: Timely patching is essential to mitigate known vulnerabilities. 

  • Layered Defense Strategies: Relying solely on patching is insufficient. Organizations must adopt a multi-layered approach that includes firewalls, access controls, and continuous monitoring. 

Conclusion 

The Tenable Nessus Agent outage and the Windows LDAP vulnerability (CVE-2024-49113) emphasize the critical importance of proactive vulnerability management and swift response strategies. These incidents highlight the need for vigorous patch management, effective change controls, and the ability to quickly roll back in times of disruption. 

Staying ahead in today’s cybersecurity landscape requires vigilance, routine updates, and strategic planning to mitigate evolving threats. By learning from these events and prioritizing system resilience, organizations can strengthen their defenses and minimize risks. 

References:

The post Tenable Nessus Bug and LDAP RCE: What You Need to Know appeared first on Cyble.

Blog – Cyble – ​Read More

Weekly Vulnerability Insights Report: Critical Vulnerabilities Highlighted from December 25-31, 2024

/in

Cyble Weekly Vulnerability Insights Report: Critical Vulnerabilities Highlighted from December 25-31, 2024

Overview

This week’s vulnerability report sheds light on a broad range of critical vulnerabilities identified from December 25 to December 31, 2024. The report emphasizes several high-severity flaws that pose online threats to cybersecurity, including new additions to the CISA’s Known Exploited Vulnerability (KEV) catalog.

Among the most pressing vulnerabilities, one concerning Palo Alto Networks’ PAN-OS stands out. This vulnerability has been actively exploited by cybercriminals to compromise firewalls, forcing them to reboot and disrupting network security. The Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to their KEV catalog, signifying its exploitation in the wild.

Beyond this, CRIL also analyzed multiple high-profile vulnerabilities impacting D-Link products and Four-Faith routers, both of which are integral to various Internet of Things (IoT) applications.

CISA’s KEV Catalog Adds New Vulnerability

This week, CISA’s KEV catalog was updated to include a critical vulnerability in PAN-OS by Palo Alto Networks (CVE-2024-3393). The flaw lies in the handling of malformed DNS packets, which can be leveraged to exploit the firewall systems, ultimately causing service disruptions by forcing them to reboot. Given its active exploitation, CISA has strongly urged organizations using Palo Alto Networks firewalls to apply the necessary patches to safeguard their networks from potential breaches.

In addition, Four-Faith routers (CVE-2024-12856) have also been found vulnerable to OS command injection. These routers are extensively used in IoT environments, where remote attackers can exploit default credentials and send specially crafted HTTP requests. Once successful, attackers can remotely execute arbitrary OS commands, significantly compromising the integrity of the affected systems.

D-Link Vulnerabilities Pose Major Threats

D-Link, a global leader in networking hardware, continues to be the focus of vulnerability research. CRIL identified multiple flaws affecting various D-Link routers, including the DIR-806 (CVE-2019-10891), DIR-645 (CVE-2015-2051), and DIR-845L (CVE-2024-33112), among others. These command injection vulnerabilities allow attackers to execute arbitrary commands on vulnerable devices remotely, facilitating initial access for malware campaigns.

Furthermore, vulnerabilities in D-Link’s GO-RT-AC750 (CVE-2022-37056) and DIR-845L (CVE-2024-33112) routers were found to be exploited by the Ficora and Capsaicin botnets, targeting outdated routers or devices that are no longer supported. These findings emphasize the importance of updating D-Link devices and ensuring that default credentials are changed to prevent attackers from easily gaining access.

New Exploits in Apache Software and Google Products

The Apache Software Foundation has also become a focal point in the latest vulnerability findings. Two critical vulnerabilities were identified in Apache Traffic Control (CVE-2024-45387) and Apache HugeGraph-Server (CVE-2024-43441). The former, an SQL injection vulnerability, allows privileged users to execute arbitrary SQL queries against a backend database. The latter vulnerability, an authentication bypass flaw, affects Apache HugeGraph, an open-source graph database, and could be exploited by attackers to bypass authentication mechanisms.

In the realm of web security, Google Chrome (CVE-2024-9122) and the AngularJS web framework (CVE-2024-54152) also saw severe vulnerabilities this week. The Chrome vulnerability centers around a Type Confusion flaw in the V8 JavaScript engine, enabling attackers to access out-of-bounds memory locations through malicious HTML pages. Meanwhile, AngularJS users are at risk of a code injection flaw in earlier versions of Angular Expressions, which could allow arbitrary code execution on affected systems.

Vulnerability Exploits in Underground Forums

CRIL researchers also monitored underground forums and Telegram channels, where they observed multiple instances of Proof-of-Concept (PoC) exploits being shared. Among the vulnerabilities discussed were CVE-2023-21554, which affected Microsoft MSMQ, and CVE-2024-54152, which affected AngularJS. Threat actors in these forums discussed the active exploitation of these vulnerabilities and shared tools and methods for attacking vulnerable systems.

The Microsoft Message Queuing (MSMQ) service vulnerability (CVE-2023-21554), also known as QueueJumper, is particularly concerning. This remote code execution (RCE) vulnerability can allow attackers to execute arbitrary code on vulnerable servers. A notable trend in underground forums was the high demand for exploits targeting MSMQ servers, with actors willing to purchase exploits for up to USD 1,000.

Similarly, the CVE-2024-9122 vulnerability in Google Chrome was also discussed widely on dark web channels, where exploits for this high-severity flaw were being weaponized to target vulnerable versions of the browser.

Recommendation and Mitigation Strategies

As always, CRIL stresses the importance of prompt patching and network defenses to protect against these cyber threats. Key recommendations include:

  1. Ensure that all systems are up to date with the latest patches from official vendors. Timely patching is critical to prevent attackers from exploiting known vulnerabilities.

  2. Develop a comprehensive patch management strategy that includes asset tracking, patch assessment, and deployment. Automate the process where feasible to improve efficiency.

  3. Implement network segmentation to minimize the exposure of critical systems. Use firewalls, VLANs, and access controls to restrict access to sensitive assets.

  4. Enforce strong password policies and implement multi-factor authentication (MFA) to prevent unauthorized access.

  5. Use Security Information and Event Management (SIEM) tools to detect suspicious activities in real time and generate alerts for potential exploits.

  6. Maintain an updated incident response and recovery plan to ensure quick action in the event of a security breach.

  7. Regularly perform vulnerability assessments and penetration tests to identify and mitigate security gaps.

  8. Stay updated with the latest vulnerability disclosures and security advisories from trusted sources such as CISA and official vendors.

Conclusion

The latest Weekly Vulnerability Report from Cyble highlights critical security flaws across prominent platforms, such as D-Link, Apache, and Palo Alto. These vulnerabilities present significant risks to organizations worldwide. By leveraging Cyble’s advanced threat intelligence solutions, including proactive AI-powered platforms like Cyble Vision, businesses can better protect themselves from emerging threats, ensuring rapid response and reduced exposure to cyber risks. Stay ahead of cybercriminals with Cyble’s cutting-edge cybersecurity tools and expert guidance.

The post Weekly Vulnerability Insights Report: Critical Vulnerabilities Highlighted from December 25-31, 2024 appeared first on Cyble.

Blog – Cyble – ​Read More

Weekly Vulnerability Roundup: Highlights from SingCERT’s Security Bulletin

/in

Cyble Weekly Vulnerability Roundup: Highlights from SingCERT's Security Bulletin

Overview

The Singapore Computer Emergency Response Team (SingCERT) has released its latest Security Bulletin, summarizing vulnerabilities reported in the past week from the National Institute of Standards and Technology (NIST)’s National Vulnerability Database (NVD).

This bulletin provides essential insights for businesses and security professionals to mitigate risks associated with these vulnerabilities.

The vulnerabilities have been categorized based on the Common Vulnerability Scoring System v3 (CVSSv3) base scores, which assess their severity levels:

  • Critical: CVSS score of 9.0 to 10.0

  • High: CVSS score of 7.0 to 8.9

  • Medium: CVSS score of 4.0 to 6.9

  • Low: CVSS score of 0.1 to 3.9

  • None: CVSS score of 0.0

Let’s take a closer look at the critical vulnerabilities reported this week and the potential threats they pose.

Critical Vulnerabilities

  1. CVE-2024-56064
    Product: Azzaroco WP SuperBackup
    Description: This vulnerability allows unrestricted uploads of malicious files, such as web shells, to a server. Exploited attackers can execute arbitrary code.
    Affected Versions: Up to 2.3.3
    CVSS Score: 10.0

  2. CVE-2024-56046
    Product: VibeThemes WPLMS
    Description: Similar to the above, this vulnerability allows attackers to upload malicious files, compromising server integrity.
    Affected Versions: Up to 1.9.9
    CVSS Score: 10.0

  3. CVE-2024-56799
    Product: Simofa (Static Website Deployment Tool)
    Description: A design flaw in the RouteLoader class leaves certain API routes accessible without authentication.
    Affected Versions: Prior to 0.2.7
    CVSS Score: 10.0

  4. CVE-2024-8950
    Product: Arne Informatics Piramit Automation
    Description: SQL Injection vulnerability enabling attackers to execute blind SQL injection, potentially exposing sensitive data.
    Affected Versions: Before 27.09.2024
    CVSS Score: 9.9

  5. CVE-2024-56066
    Product: Inspry Agency Toolkit
    Description: A missing authorization vulnerability that allows privilege escalation, compromising user roles and permissions.
    Affected Versions: Up to 1.0.23
    CVSS Score: 9.8

  6. CVE-2024-13061
    Product: Electronic Official Document Management System (2100 Technology)
    Description: Authentication bypass vulnerability where attackers can deceive the server to obtain user tokens, granting unauthorized access.
    CVSS Score: 9.8

  7. CVE-2024-12108
    Product: WhatsUp Gold
    Description: Public API vulnerability allowing attackers to gain unauthorized access to the server.
    Affected Versions: Released before 2024.0.2
    CVSS Score: 9.6

Other Notable Vulnerabilities

  • CVE-2024-47919
    Product: Tiki Wiki CMS
    Description: OS Command Injection vulnerability, potentially allowing attackers to execute arbitrary commands.
    CVSS Score: 9.8

  • CVE-2024-11281
    Product: WooCommerce Point of Sale Plugin
    Description: Insufficient validation on user IDs allows unauthenticated attackers to change admin account emails and reset passwords.
    CVSS Score: 9.8

  • CVE-2024-54450
    Product: Kurmi Provisioning Suite
    Description: Forged IP addresses in authentication logs may deceive admins, complicating forensic investigations.
    CVSS Score: 9.4

  • CVE-2024-56431
    Product: libtheora
    Description: Integer overflow in the Huffman tree unpacking functionality, leading to potential memory corruption.
    CVSS Score: 9.8

Vulnerabilities in Focus

The bulletin highlighted recurring patterns among this week’s critical vulnerabilities:

  • Privilege Escalation: Many vulnerabilities, such as those in AI Magic, Simple Dashboard, and SSL Wireless SMS Notification, involve incorrect privilege assignments, enabling attackers to escalate their privileges.

  • SQL Injection: Products like SmartAgent and VibeThemes WPLMS suffer from SQL injection vulnerabilities, exposing sensitive databases.

  • Authentication Bypass: Products such as Electronic Official Document Management System and Kurmi Provisioning Suite lack robust authentication mechanisms, allowing attackers unauthorized access.

What This Means for Organizations

These vulnerabilities underline the importance of patch management and proactive monitoring. Affected organizations must:

  1. Apply Patches Promptly: Ensure that systems and software are updated with the latest security patches as soon as possible.

  2. Strengthen Access Controls: Implement robust authentication and privilege management mechanisms to minimize unauthorized access.

  3. Conduct Regular Security Audits: Periodic vulnerability assessments and penetration tests can help identify and fix weaknesses.

  4. Educate Employees: Train staff on cybersecurity best practices, especially for avoiding phishing and social engineering attacks that exploit these vulnerabilities.

Conclusion

The SingCERT Security Bulletin serves as a vital resource for identifying and addressing vulnerabilities that could significantly impact organizations. By taking immediate action on these critical threats, businesses can safeguard their systems, data, and users from exploitation.

For detailed information, visit the full report at SingCERT’s Security Bulletin.

Source: https://www.csa.gov.sg/alerts-advisories/security-bulletins/2025/sb-2025-001

The post Weekly Vulnerability Roundup: Highlights from SingCERT’s Security Bulletin appeared first on Cyble.

Blog – Cyble – ​Read More

Predictions for cyberthreats and trends in 2025 from Kaspersky experts | Kaspersky official blog

/in

Every year, Kaspersky experts briefly turn into soothsayers. No, our colleagues don’t reach for crystal balls, tarot cards or horoscopes to see into the cybersecurity future; their predictions are based on an analysis of the global trends and threats we encounter in our daily work.

And they’re often spot-on: for 2024, we predicted a rise in scams tied to play-to-earn (P2E) games, the proliferation of voice deepfakes, and other trends.

Now, let’s look at which cyberthreats and trends we believe will dominate in 2025:

  • AI will become an everyday work tool.
  • Scammers scamming in relation to new games and movies.
  • Subscription scams will flourish.
  • Social networks could be banned.
  • User rights over personal data will expand.

AI will become an everyday work tool

In 2025, we expect artificial intelligence to solidify its role in our everyday lives. Major platforms like Google and Bing have integrated AI into search results over the past year, and users worldwide are hooked on ChatGPT and its many counterparts. Predicting how exactly AI will develop is tricky, but one thing is certain: what’s popular with regular users is inevitably twice as popular with scammers. Therefore, we urge you to exercise caution when using AI tools — and remind you that throughout 2024, we repeatedly reported on the associated threats.

How hackers can read your chats with ChatGPT or Microsoft Copilot

How to use ChatGPT, Gemini, and other AI securely

Trojans in AI models

With the popularization of artificial intelligence in 2025, the associated risks will be seen more clearly and frequently. Malicious actors are already adept at exploiting AI, so we should expect even more problems, such as those linked to deepfakes.

Scammers look forward to new games and movies

Fraudsters never miss major releases in the entertainment industry, and 2025 will be no exception. While gamers eagerly anticipate long-awaited titles like Mafia: Old Country, Civilization VII, and Death Stranding 2, attackers are already devising new schemes involving fake preorders and digital keys. We won’t even mention the dangers of downloading games from torrent sites — the risks are abundantly clear.

Movie enthusiasts won’t be overlooked either, as scammers join the rest of us in anticipating sequels and remakes like Superman, Jurassic World Rebirth, Captain America: Brave New World, Return to Silent Hill, and Tron: Ares. Be especially cautious — fraudsters may offer tickets to early screenings, sell fake merchandise, and exploit the love of cinema in every possible way. So get some reliable protection to be entertained securely.

Subscription scams will flourish

In recent years, the world has shifted significantly toward subscription-based models for goods and services, and scammers have capitalized on the trend — just think of the fake Telegram Premium subscription scam we’ve detailed on our blog.

As the number of subscription services continues to grow, some users might be tempted to “buy a subscription at a discount” or even “download the program for free”, playing right into the hands of scammers. Remember: if it sounds too good to be true, it probably is. Download programs and apps only from official sources, and ensure your devices have reliable protection, as malware can even be found in legitimate app stores.

Social networks may be banned

In Australia, access to popular social-media platforms has already been banned for all children under 16 without exception. Ten years ago, such an initiative would have been laughed off: “Just set your age to over 16 and carry on as usual”. But advancements in AI have changed everything. Reliable age verification systems are now being implemented, making it much harder to bypass such restrictions. The future of children’s access to social media, not only in Australia but worldwide, depends largely on the effectiveness of these systems.

If successful, this practice could easily be adopted by other countries, starting with Australia’s closest economic partners. While a complete ban on social media in 2025 seems unlikely, it’s highly probable that similar practices will be introduced elsewhere, leading to restrictions for certain user groups.

User rights over personal data will expand

Good news for anyone concerned about their personal data privacy: in 2025, users will gain greater control over their information! This is thanks to the gradual expansion of rights related to data portability, which may simplify the transfer of data between the platforms processing it.

Privacy policies such as the GDPR (EU) and CRPA (California, USA) are inspiring similar reforms across other U.S. states and in Asia. And let’s not forget the 2024 case where the European Center for Digital Human Rights upheld user rights against Meta, preventing the tech giant from using private personal data to train its AI models. So, we could see a shift in 2025 in the digital world’s balance of power — tilting it more in favor of individual users.

Kaspersky official blog – ​Read More