Solar Monitoring Solutions in Hacktivists’ Crosshairs

/in

Executive Summary

In September 2024, the pro-Russian hacktivist group Just Evil and possibly the state-backed Beregini group led a coordinated cyberattack on Lithuanian energy infrastructure. The attackers claimed to target the PV monitoring solution used by the state-owned Energy holding company Ignitis Group.  

Just Evil is a faction that emerged from the split of the Killnet group, while Beregini exemplifies the complex interplay of hacktivism and state-sponsored cyber operations within the context of the Russia-Ukraine conflict. It operates under the guise of a Ukrainian group while aligning closely with pro-Russian interests.

Just Evil allegedly accessed the power monitoring dashboard of 22 Ignitis’ clients, including hospitals and military academies, via a compromised PV Monitoring Platform in the city of Kaunas. This is the latest in a series of cyberattacks on Ignitis, following earlier DDoS incidents in 2022 and more in 2024, impacting the company’s energy distribution services.

Previous Attacks on Lithuanian Energy Infrastructure

The first significant attack against Ignitis was orchestrated by Killnet in 2022 in retaliation to Lithuania’s ban on the transit of goods to Russia’s Kaliningrad region. The severity of the attack can be adjudged from the fact that the Lithuanian National Cyber Security Centre had to intervene to contain it, and this was widely reported in the media.

In early February 2024, the Russian cybercriminal group Just Evil allegedly gained unauthorized access to the Ignitis ON app control panel, a service that helps electric vehicle owners charge their cars.

The hacktivist group provided video evidence of shutting down user access to charging stations and deleting the users from the control panel. They also demanded a ransom to cease the attacks and for not leaking the user data. As per local media, Ignitis accepted the breach and did not pay the ransom. As a result, Just Evil leaked user data containing details of over 20,000 EV car owners, employee data, access keys, and firmware for car charging stations.

Just Evil later on also advertised selling admin access to Igntis ON platform for Euros 50,000. 

A few days later, the group claimed that they were able to gain access to the Ignitis On app via a vulnerability called ‘Human Factor’, possibly indicating social engineering and the use of valid credentials to gain access. The group also mentioned defacing the panel after gaining illicit access.

Analysis of the Incident Targeting PV Solar Monitoring Solution

Upon closer investigation of the screenshots shared by Just Evil on their telegram channel, Cyble Research & Intelligence Labs (CRIL) investigated the plausibly impacted PV monitoring solutions of Ignitis and ascertained them to be Sungrow’s iSolarCloud. Our open-source search also cemented the fact that Ignitis does use iSolarCloud for managing solar-generated electricity. Hence, considering the compromised panel screenshots, Just Evil’s claims seem credible.  

iSolarCloud by Sungrow offers several features for centralized management, monitoring, and optimization of solar energy systems. The platform offers real-time monitoring of solar systems, tracking energy production, consumption, and inverter performance. It provides data analytics for performance trends, efficiency tracking, and fault alerts, allowing remote diagnostics and predictive maintenance.  

 While the TA claimed to target multiple Lithuanian entities such as hospitals, gymnasiums, and educational facilities, CRIL assessed that the TA was able to access the solar power plants of the institutions mentioned above via the iSolarCloud Platform that provides a centralized PV management solution for managing them, rather than individually compromising them. Considering the names of Lithuanian entities as indicated in the screenshot below, we assess that this iSolarCloud Platform may be in use by Ignitis.  

Looking at the group’s history of attacks, CRIL appraises that the ‘Use of Valid Credentials’ could be the likely initial attack vector in this incident. Conjugate to this hypothesis, Cyble Vision, too, identified recently compromised credentials pertaining to ISolarCloud instances in Europe.

Using Cyble’s ODIN scanner, CRIL investigated other PV monitoring solutions from Lithuania and found that they were exposed on the Internet and could be targeted in the near future.

Conclusion

Solar energy generation and distribution are critical to a nation’s essential services. The recent attack on a centralized PV monitoring platform, which targeted multiple locations simultaneously, represents a significant threat to Lithuania’s energy sector. As observed by Cyble Vision, numerous compromised credentials exist for iSolarCloud platform users from various regions, including Europe and China. CRIL suggests that such compromised credentials could pose a serious risk, potentially being used to target critical infrastructure systems.

Globally, the solar energy sector has increasingly become a target for cybercriminals, with incidents such as ransomware attacks, data breaches, and remote access exploitation growing in frequency.

The impact of such attacks extends beyond immediate operational disruptions, potentially undermining national energy security, causing financial damage, and affecting public trust in renewable energy technologies.

Recommendations

Enhance Network Segmentation: Use firewalls and virtual LANs (VLANs) to separate critical control systems from non-essential networks. Isolate monitoring platforms from other network segments to limit the lateral movement of threats.

Implement Strong Authentication Measures: A key method of preventing unauthenticated access due to compromised credentials is implementing mandatory multi-factor authentication (MFA) for accessing solar monitoring and control systems. Employ strong, unique passwords and regularly update them.

Regular Security Audits and Penetration Testing: Foster a cyber-aware culture with routine security assessments and penetration tests on solar energy systems, including inverters, monitoring platforms, and network devices, to help detect and address vulnerabilities before they can be exploited.

Patch Management and Firmware Updates: Establish a robust patch management policy to ensure all systems, including inverters and monitoring platforms, are up-to-date with the latest security patches and firmware updates. Regularly check for updates from equipment manufacturers.

Implement Advanced Threat Detection and Response: Remember to utilize intrusion detection systems (IDS) alongside intrusion prevention systems (IPS) and Security Information and Event Management (SIEM) tools to oversee, identify, and address potentially malicious activities throughout the network.

Secure Remote Access: Restrict remote access to critical systems through VPNs, limit access to authorized personnel only, and monitor remote sessions for any unusual activity. Disable unused ports and services to reduce attack surfaces.

Employee Training and Awareness Programs: Train employees and operators on cybersecurity best practices, including recognizing phishing attempts and proper handling of sensitive information. Regularly update staff on emerging threats and attack vectors specific to the solar sector.

Incident Response Planning and Disaster Recovery: Create detailed incident response and disaster recovery plans tailored to the solar sector. Ensure that response procedures are in place to quickly isolate and mitigate attacks, minimize downtime, and restore normal operations.

Implement Dark Web Monitoring: Regularly monitor dark web forums, marketplaces, and other underground channels for stolen credentials, sensitive data, or discussions related to your solar infrastructure. Utilize threat intelligence platforms to detect compromised information early, allowing for proactive measures such as credential resets, system audits, and enhanced security protocols to prevent further exploitation.

Minimize Internet Exposure of Critical Systems: Restrict Internet exposure of critical solar monitoring and control systems by ensuring they are not directly accessible from the public internet. Use secure gateways, VPNs, and access controls to shield critical assets. Implement strict firewall rules and regularly scan your network for exposed services to reduce the risk of unauthorized access.

References:

https://faq.isolarcloud.com/web_faq/manage/#/_en_US/a2
https://web3.isolarcloud.com.hk/#/login
https://en.sungrowpower.com/productDetail/987/cloud-platform-isolarcloud

https://ignitis.lt/sites/default/files/inline-files/saules-elektrines-su-sungrow-keitikliu-naudojimosi-ir-eksploatavimo-instrukcija.pdf

The post Solar Monitoring Solutions in Hacktivists’ Crosshairs appeared first on Cyble.

Blog – Cyble – ​Read More

Talk of election security is good, but we still need more money to solve the problem

/in

Last week, six Secretaries of State testified to U.S. Congress about the current state of election security ahead of November’s Presidential election. 

Some of the same topics came up as usual — disinformation campaigns, influence from foreign actors, and the physical protection of poll workers on election day. 

It’s good that these conversations are continuing after the various revelations that came out after the 2016 presidential election, and election security is an issue globally, especially this year when there are major elections taking place in hundreds of countries.  

As with many things in politics and life, though, there is still an issue of money. 

Talk of the importance of election security is positive, but at the end of the day, states and municipalities will need monetary and human resources to implement the appropriate defenses and protect everything from voting machines to online vote-tallying systems and social media disinformation campaigns.  

Arizona Secretary of State Adrian Fontes used his time in front of Congress to ask for additional funding, because his state has been unable to execute all their election security goals.  

“None of this is free and none of it is cheap,” he said. “Our operations, administration and security depend on intermittent, rare and never enough funding for the Help America Vote Act grants that we are occasionally given by Congress.” 

Additional federal funds became available for U.S. elections in 2017 after the Department of Homeland Security deemed election systems to be critical infrastructure. But this year, Congress only allocated $55 million in federal grant dollars to states for security and other improvements to elections. For comparison’s sake, presidential and Congressional candidates in the U.S. spent $14 billion on their election campaigns, more than double the amount from 2016. 

At the time, Republican lawmakers in the House voted to totally zero out the fund for the Help America Vote Act, or HAVA, grants, which have existed since 2002. 

One lobbyist even told the Stateline outlet earlier this year that many states were trying to stretch the money they do get from the HAVA program across multiple years for fear of a lack of funding in the coming election cycles.  

JP Martin, deputy communications director for the Arizona secretary of state, said in that same article that Arizona (a crucial swing state in most presidential elections) has had to put a hiring freeze in place because a lack of federal funding. 

So, talk, awareness and planning to secure elections are all positive things. But at the end of the day, all these technologies and solutions, and the people that provide them, cost money. 

The one big thing 

Cisco Talos’ Vulnerability Research team discovered two vulnerabilities have been disclosed and fixed over the past few weeks. Talos discovered a time-of-check time-of-use vulnerability in Adobe Acrobat Reader, one of the most popular PDF readers currently available, and an information disclosure vulnerability in the Microsoft Windows AllJoyn API. 

Why do I care? 

AllJoyn is a DCOM-like framework for creating method calls or sending one-way signals between applications on a distributed bus. It primarily is used in internet-of-things (IoT) devices to tell the devices to perform certain tasks, like turning lights on or off or reading the temperature of a space. TALOS-2024-1980 (CVE-2024-38257) could allow an adversary to view uninitialized memory on the targeted machine. Adobe Acrobat Reader, one of the most popular pieces of PDF reading software currently available, contains a time-of-check, use-after-free vulnerability that could trigger memory corruption, and eventually, arbitrary code execution. 

So now what? 

For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerability Advisories are always posted on Talos Intelligence’s website.  

Top security headlines of the week 

Experts and governments are still unpacking a wave of pager and handheld radio explosions in the Middle East. The attacks appeared to target members of the armed group Hezbollah in Lebanon when hundreds of devices exploded simultaneously on Tuesday, killing multiple people. The international community has been left wondering if this was some type of cyber attack or intentional physical implants in the devices. Messages sent at the time of the attack appeared to come from Hezbollah leadership but instead triggered the explosions. Most analysts are assuming that this was a hardware supply chain attack, in which the pagers were tampered with somehow during manufacturing or while they were in transit. Supply chain attacks are normally carried out at the software level. So far, no one has taken credit for the attacks, though Hezbollah is blaming Israel, one of its chief antagonists. (Reuters, BBC) 

Ransomware gangs are increasingly leveraging Microsoft Azure to steal victims’ information and store it. New research findings indicate that groups like BianLian and Rhysida use Microsoft’s Azure Storage Explorer and AzCopy to steal data from infiltrated networks, then store it in Azure Blob storage until it can be transferred to an attacker-controlled network. Because Azure is a popular and trusted service, corporate firewalls and security tools are unlikely to block it, making the data transfers more likely to pass undetected. Potential targets that use Azure are recommended to log out of the application after each use to prevent attackers from using the active session for file theft. (Bleeping Computer, modePUSH) 

Health care facilities and medical devices continue to be top targets for ransomware actors, and industry leaders are calling on the U.S. federal government to do more to assist them. This year, several massive health care providers across the globe have been affected by cyber attacks, forcing countless surgeries and appointments to be rescheduled and putting sensitive medical records at risk. Past victims include Change Healthcare, Kaiser Permanente and Ascension. One health care executive told NPR that their company was still trying to calculate the financial impact of the Change attack, which paused payments from insurance for months. They are only just now being paid out for services rendered in July. U.S. Sen. Ron Wyden, the chair of the Senate Finance Committee, recently publicly called on the Health and Human Services Department to revise its current approach to cybersecurity, because the current system “is woefully inadequate and has left the health care system vulnerable to criminals and foreign government hackers.” Other experts have said that HHS has traditionally focused on physical disasters like earthquakes, storms and power outages, and not enough on cyberspace. (NPR, Security Intelligence) 

Can’t get enough Talos? 

Despite Russia warnings, Western critical infrastructure remains unprepared The Cybersecurity Cat-And-Mouse Game DragonRank Manipulates SEO Rankings To Direct Users To Malicious Sites 

Upcoming events where you can find Talos

VB2024 (Oct. 2 – 4) 

Dublin, Ireland 

MITRE ATT&CKcon 5.0 (Oct. 22 – 23) 

McLean, Virginia and Virtual

Nicole Hoffman and James Nutland will provide a brief history of Akira ransomware and an overview of the Linux ransomware landscape. Then, morph into action as they take a technical deep dive into the latest Linux variant using the ATT&CK framework to uncover its techniques, tactics and procedures.

misecCON (Nov. 22) 

Lansing, Michigan

Terryn Valikodath from Cisco Talos Incident Response will explore the core of DFIR, where digital forensics becomes detective work and incident response turns into firefighting.

Most prevalent malware files from Talos telemetry over the past week 

SHA 256: b9ddbd1a4cec61e6b022a275d66312b5b676f9a0a9537a7708de9aa8ce34de59 
MD5: 3b100bdcd61bb1da816cd7eaf9ef13ba 
Typical Filename: vt-upload-C6In1 
Claimed Product: N/A  
Detection Name: Backdoor:KillAV-tpd  

SHA 256: 47ecaab5cd6b26fe18d9759a9392bce81ba379817c53a3a468fe9060a076f8ca 
MD5: 71fea034b422e4a17ebb06022532fdde 
Typical Filename: VID001.exe 
Claimed Product: N/A 
Detection Name: RF.Talos.80 

SHA 256: 70ff63cd695033f624a456a5c8511ce8312cffd8ac40492ffe5dc7ae18548668 
MD5: 49d35332a1c6fefae1d31a581a66ab46 
Typical Filename: 49d35332a1c6fefae1d31a581a66ab46.virus 
Claimed Product: N/A   
Detection Name: W32.Auto:70ff63.in03.Talos 

SHA 256: 3a2ea65faefdc64d83dd4c06ef617d6ac683f781c093008c8996277732d9bd66 
MD5: 8b84d61bf3ffec822e2daf4a3665308c 
Typical Filename: RemComSvc.exe 
Claimed Product: N/A 
Detection Name: W32.3A2EA65FAE-95.SBX.TG 

SHA 256: 35dcf857f0bb2ea75bf4582b67a2a72d7e21d96562b4c8a61b5d598bd2327c2c 
MD5: fab8aabfdabe44c9a1ffa779fda207db 
Typical Filename: ACenter.exe 
Claimed Product: Aranda AGENT 
Detection Name: Win.Trojan.Generic::tg.talos  

Cisco Talos Blog – ​Read More

Spearphishing tricks in mass emails | Kaspersky official blog

/in

The trend of using spearphishing techniques in mass emails continues to gain momentum. We recently came across a sample email in which attackers used a whole box of relatively sophisticated spearphishing tricks. Now, one might think that use of such tactics for a “mere” mass phishing attack would be somewhat OTT in terms of effort on the attackers’ side; not so – it transpired in this case: the attackers still gave it a shot (though detailed analysis reveals the attack was doomed from the start). In any case, it presented us with an excellent opportunity to take a dive into the techniques employed by phishers.

Email mimicking update of corporate guidelines

Almost everything about the email is spot on. It’s addressed to a specific individual within a specific organization, and uses ghost spoofing for the sender’s name — that is, the “From” field displays a forgery of the legitimate address of the target company (which, of course, has no relation to the address in the “Reply To” field).

The email is sent through the infrastructure of a reputable marketing company, raising no red flags with email filters. What’s more, the name of this company and the top-level domain hosting its website are deliberately chosen to lull the recipient’s vigilance — the website’s based in Indonesia, and the victim may well perceive the “.id” domain as an abbreviation for “identifier” rather than a country code. Alongside the spoofed address in the “From” field, it looks convincing enough:

Email mimicking update of corporate guidelines.

But that’s not all. In the email body there’s practically zero text — only a copyright line and an unsubscribe link (both of which, as it happens, are inserted by the mail engine of the legitimate company used to send the message). Everything else, including the recipient’s name, is an image. This is to prevent anti-phishing mechanisms from applying text-based filtering rules.

An attached PDF file is used instead of a direct phishing link for the same reason. Websites can easily be blacklisted and blocked at the mail-server level. A PDF file, on the other hand, appears as a completely legitimate attachment.

PDF attachment

In actual fact, attackers have long been concealing links in PDF files. Thus, in theory, security software should be able to analyze a PDF — including any text and links within. But the creators of this phishing campaign were wise to that as well. Their PDF technically has no text or links in it whatsoever. Instead, it presents another image featuring a QR code and embedded accompanying text.

Contents of the attached PDF file: the QR code contains a malicious link.

In addition, the PDF mimics the interface of DocuSign, a well-known service used for electronic document management. DocuSign does indeed allow you to send documents for signing, and to track their status. But, of course, it has nothing to do with PDF files housing a QR code.

At this point, it becomes painfully obvious that the attackers overcooked the attack. The victim receives what seems to be confidential corporate guidelines by email, but to read them they need to scan a QR code with a mobile phone… — not exactly realistic. Most employees won’t bother — especially if they use their own (non-corporate) phone.

Epic fail: the phishing website

So what happens if the victim does pull out their phone and scan the code? Well, for starters, they’ll be greeted by Cloudflare’s verification system and asked to prove they’re human. Cloudflare is a legitimate service to guard against DDoS attacks, and cybercriminals like to put their phishing pages behind it to add plausibility.

But after that it’s a disaster. The website plays an animation of an envelope opening, then crashes with an error message.

Phishing site that appears to have an overdue bill,

It appears the attackers forgot to renew their subscription to the hosting services. Maybe the site had some more kooky tricks in store for the victim, but by the time the phishing emails were being pumped out, it was already defunct.

How to stay safe

To protect company employees from phishing:

Secure corporate email at the mail-gateway level.
Use local security solutions with anti-phishing technologies on all work devices (including mobile ones).
Inform employees of the latest phishing tricks (for example, by pointing them toward our posts regarding signs of phishing).
Hold regular cybersecurity awareness training for staff.

Kaspersky official blog – ​Read More

What is Spearphishing: Definition, Techniques, Real-world Example 

/in

Roughly 70% of malware incidents are a result of social engineering, with spearphishing being a common method. Let’s learn more about this phenomenon and discover:

What is spearphishing and what makes it so dangerous

Common techniques used in spearphishing attacks

Tools you can employ in your defense strategy

An example of a real-world spearphishing attack

What is spearphishing? 

It is a targeted form of phishing attack where the adversary focuses on a specific individual or organization. Unlike generic phishing, spearphishing is often more sophisticated and uses personalized information to make the attack more convincing.

What are the main goals of spearphishing? 

The most common objectives are delivering a malicious payload, but other goals can be pursued, too:

Disclosure of sensitive information: obtaining personal, financial, or business-critical information for fraudulent use or selling on the dark web.

Unauthorized system access: capturing credentials for unauthorized access, potentially leading to further compromise within a network or system.

What makes spearphishing dangerous?

It is highly targeted and tailored to each victim, making it more challenging to defend against compared to generic phishing attacks. 

Spoofing genuine connections of the victim, impersonating business associates, or tailoring a message around the receiver’s interests — all of these factors make spearphishing even more challenging to recognize than common phishing.

For example, attackers may impersonate a high-ranking executive within a company, sending an email to an employee requesting urgent payment or confidential information. The email will appear genuine, leaving little chance for the victim to recognize an attack. 

Another tactic attackers sometimes use is gaining access to an actual business associate’s email account. Then, they will lead the recipient to believe that the email is from a trusted contact, but in reality, it contains malware.

Try advanced phishing and malware analysis with ANY.RUN 



Sign up for free


Spearphishing and phishing compared

We’ve created this table show what aspects make spearphishing so destructive and why you should be concerned about this potential threat:

Aspect

Spearphishing

Phishing

Targeting

Specific targeting: focuses on specific individuals or organizations, making the attack more dangerous as it can exploit known vulnerabilities or personal connections.

General targeting: mass-targeting approach makes it less dangerous per individual, as it’s less likely to exploit personal weaknesses.

Personalization

Highly tailored: utilizes personal or professional information, making it more convincing and dangerous as it appears more legitimate.

Generic: little or no personalization makes it less dangerous as it is often less convincing.

Research required

Extensive research: the detailed research increases danger by enabling precise targeting, exploiting specific vulnerabilities.

Minimal research: lack of research on individual targets makes it less effective and dangerous.

Success rate

Higher success rate: customization leads to more successful attacks, posing greater risk.

Lower success rate: The broader approach results in a lower success rate, making it less dangerous on an individual level.

Difficulty to detect

Harder to detect: relevance and customization make detection more challenging, increasing danger.

Easier to detect: generic nature often makes it more noticeable, reducing danger.

Potential impact

More damaging: focused targeting can lead to significant harm to the individual or organization, making it more dangerous.

Less damaging: typically less damaging on a per-victim basis, as the attack is not personalized to exploit specific weaknesses.

Who are the most likely targets of spearphishing?

Medium-sized businesses and enterprises. These attacks take a lot of effort to prepare, which is why adversaries typically pursue high-risk, high-reward targets.

Within these organizations, the most vulnerable individuals to spear-phishing are often those with access to critical information but may lack adequate training or awareness regarding cybersecurity. 

These might include:

Senior executives: they often have access to critical company information but might not be as tech-savvy or aware of the latest security threats.

Human resources and administrative staff: these individuals typically have access to personal employee data and might be targeted due to their role in internal communications.

IT staff: although usually more aware of threats, their high-level access makes them a prime target.

New or temporary employees: They may not be as familiar with organizational policies or may lack training in cybersecurity awareness.

It is likely that adversaries will blur the border between phishing in spearphishing in the near future and start targeting a wider range of victims. This likely shift is the result of new AI tools which simplify spearphishing attacks.

What are some common spearphishing techniques?

Spearphishing employs targeted techniques to deceive recipients and achieve specific objectives:

Personalized emails: leveraging information about the victim to craft convincing emails, often to deliver malware or solicit sensitive information.

Using compromised accounts: taking over legitimate accounts to send emails that seem trustworthy, with the objective of spreading malware or gathering further credentials.

Website spoofing: creating fake websites that resemble legitimate ones to capture login credentials, leading to unauthorized access to sensitive systems.

Social engineering: manipulating individuals through phone calls or direct interaction to obtain personal or financial information.

Targeting mobile devices: sending SMS or leveraging mobile apps to install malicious software or gather data directly from the user’s device.

What tools can help an organization defeat these techniques? We’ve made a table listing some useful resources that organizations can utilize to protect against spearphishing:

Resource type

Description

Examples or providers

Online interactive sandboxes

Environments to safely analyze and investigate suspicious files and links.

ANY.RUN

Training platforms

Tools and platforms for employee training on recognizing spearphishing.

KnowBe4, PhishMe, Wombat Security Technologies

Email security solutions

Systems to authenticate and filter email, blocking potential spearphishing.

Mimecast, Barracuda, Proofpoint, Cisco Email Security

Multi-Factor Authentication

Technologies providing additional authentication layers.

Microsoft Authenticator, Google Authenticator, Duo

SIEM Tools

Tools for monitoring and analyzing network behavior.

Splunk, IBM QRadar, ArcSight

Privileged Access Managements systems

To manage and limit user access rights.

CyberArk, Thycotic, BeyondTrust

Analyzing a real-world spearphishing attack in a malware sandbox

What is a malware sandbox

A malware sandbox is a service that offers a safe isolated environment for exploring malware and phishing attacks. ANY.RUN provides a cloud-based sandbox that lets you interact with threats just like you would on your own computer. 

The interactivity is particularly useful when analyzing spearphishing, as it makes it possible to manually explore the entire chain of attack, from the initial email or URL and to the final phishing page or malicious payload.

Let’s see how the ANY.RUN sandbox works using the example of a malicious email.

Analysis of a spearphishing attack

Consider this analysis session. 

Phishing email analyzed in the ANY.RUN sandbox

We start with a suspicious email targeting a particular person. Attackers often mimic the style and design of official emails from trusted organizations like banks, postal services, and manufacturers to make their phishing attempts appear more legitimate. 

In our case, the message claims that the sender had transferred a certain amount of money and asks the recipient to review an attached archive, which supposedly contains an invoice, and verify the amount.

Thanks to ANY.RUN’s interactivity, we can download the attachment and open it directly inside the sandbox with no problem.

The downloaded archive

Inside the downloaded archive, there is a file named “STATEMENT OF ACCOUNT”. This is a common technique used by cyber criminals, who often disguise malicious files with legitimate-sounding names. 

The fact that the file is an executable also raises suspicion, as this type of file is not typically sent in business correspondence. Yet, using a sandbox, we can safely extract and launch it to observe its behavior.

ANY.RUN sandbox give an overview of the threats identified during analysis

Upon launch, the service instantly notifies us about malicious activity and informs us that the system has been infected with Agent Tesla, a widespread malware family that lets criminals steal sensitive information and spy on their victims.

ANY.RUN generates a report after each session

To complete our analysis, we can download and share a detailed threat report with colleagues to let them know about the danger and collect indicators of compromise (IOCs) to improve the organization’s threat detection capabilities.

Wrapping up

As you can see, spearphishing is a high-risk threat to an organization’s security, mainly due to its highly targeted and personalized tactics. But with the right tools at hand, the risk can be minimized.

Using tools like the interactive sandbox ANY.RUN can provide actionable insights, as shown in our real-world example of analyzing a spearphishing attack. It’s an essential part of modern cybersecurity efforts that can help in quickly understanding and mitigating threats.

About ANY.RUN  

ANY.RUN helps more than 400,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, Yara Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.  

With ANY.RUN you can: 

Detect malware in seconds

Interact with samples in real time

Save time and money on sandbox setup and maintenance

Record and study all aspects of malware behavior

Collaborate with your team 

Scale as you need

Request free trial → 

The post What is Spearphishing: Definition, Techniques, Real-world Example  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Top ICS Vulnerabilities This Week: Critical Bugs in Rockwell Automation, Siemens, and Viessmann

/in

Key Takeaways


Cyble highlights eight significant vulnerabilities affecting industrial control systems (ICS), as disclosed by the Cybersecurity and Infrastructure Security Agency (CISA).

Among the critical issues identified, CVE-2024-45032, affecting Siemens Industrial Edge Management, stands out due to its critical CVSS score of 10. Exploitation of this bug requires no permissions or user interaction.

Major vendors impacted by these vulnerabilities include Rockwell Automation, Siemens, and Viessmann Climate Solutions.

Several critical vulnerabilities affecting Viessmann Vitogate 300 are at high risk of exploitation due to the availability of a proof of concept and the product’s internet exposure recorded by Cyble’s Internet of Things search engine – ODIN. 

In the past week, U.S. CISA advisories disclosed multiple vulnerabilities impacting Sinema Remote Connect from Siemens. Cyble researchers using ODIN discovered over 1,000 internet-exposed instances that could become targets for attackers in the near future. 

A critical Authorization Bypass vulnerability (CVE-2024-45032) in Siemens’ Industrial Edge Management has also been flagged, with Cyble’s ODIN scanner detecting over 52 internet-facing instances.

Overview

Cyble Research and Intelligence Labs (CRIL) has observed multiple vulnerabilities in its Weekly Industrial Control System (ICS) Vulnerability Intelligence Report. This report provides a comprehensive overview of critical vulnerabilities disclosed from September 10 to September 16.

The Cybersecurity and Infrastructure Security Agency (CISA) issued 29 security advisories concerning Industrial Control Systems (ICS) in the past week. These advisories highlight eight significant vulnerabilities in products from various vendors, including Rockwell Automation, Siemens, and Viessmann Climate Solutions.

Key vulnerabilities include command injection and heap-based overflow issues that could severely affect critical infrastructure.

The Week’s Top ICS Vulnerabilities

1. CVE-2024-45824: Command injection – Rockwell Automation

CVE-2024-45824 is a critical vulnerability found in Rockwell Automation FactoryTalk View Site Edition up to version 14.0. The vulnerability involves an unspecified functionality with a CVSS score of 9.8, indicating its severity. Exploiting this vulnerability requires network conditions but does not require any permissions or user interaction and is considered to have low difficulty of exploitation.

Mitigation: Upgrading the affected software eliminates the vulnerability. Utilize ODIN’s capabilities to determine if devices are exposed and secure them accordingly.

2. CVE-2024-35783: Execution with Unnecessary Privileges – Siemens

A critical vulnerability with a CVSS score of 9.1 has been identified in Siemens SIMATIC BATCH, SIMATIC Information Server (2020, 2022), SIMATIC PCS 7, SIMATIC Process Historian (2020, 2022), and SIMATIC WinCC (Runtime Professional, SCADA Software). This flaw, found in the DB Server component, allows for exploitation under network conditions with low difficulty but requires high privileges.

Mitigation: Upgrading the affected software eliminates the vulnerability.

3. CVE-2023-44373: Improper Neutralization of Special Elements – Siemens

CVE-2023-44373 refers to a vulnerability in Siemens devices where input fields are not properly sanitized, allowing an authenticated remote attacker with administrative privileges to inject code or gain root shell access by exploiting improper neutralization of special elements, essentially enabling a command injection attack due to missing server-side input validation. The affected devices include Siemens RUGGEDCOM and SCALANCE M-800/S615 family.

Mitigation: Update to the latest firmware version, specifically version 3.0.2 or higher.

4. CVE-2024-45032: Authorization Bypass – Siemens Industrial Edge Management

Siemens Industrial Edge Management Pro and Industrial Edge Management Virtual have identified a critical vulnerability in the Device Token Handler component. This flaw allows attackers to bypass authorization. The vulnerability has a CVSS score of 10.0, indicating its severity. Exploitation is feasible over a network with low difficulty, requiring no permissions or user interaction.

Mitigation: Upgrading the affected systems is necessary to mitigate this issue.


Industrial Edge Management Pro: Version 1.9.5 and later

Industrial Edge Management Virtual: Version 2.3.1-1 and later

5. CVE-2023-46850: Use after free – Siemens

This vulnerability in OpenVPN (versions 2.6.0 to 2.6.6) is a use-after-free issue, potentially leading to undefined behavior, memory leaks, or remote code execution when network buffers are sent to a remote peer. The CVSS score is 9.8, indicating a critical severity. Exploitation requires network access but no special permissions or user interactions.

Mitigation: The most effective way to mitigate CVE-2023-46850 is to install the latest software updates from Siemens, containing the necessary fixes.

6. CVE-2024-33698: Heap-based Buffer Overflow – Siemens User Management Components

CVE-2024-33698 is a critical vulnerability in several Siemens products, including SIMATIC Information Server 2022 and 2024, SIMATIC PCS neo, SINEC NMS, and Totally Integrated Automation Portal. The issue resides in the User Management Components (UMC) and is classified as a heap-based buffer overflow. This vulnerability has a CVSS score of 9.8, indicating its high severity. Exploiting this vulnerability requires network access but no special permissions or user interaction.

Mitigation and Workaround: Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:


CVE-2024-33698:

Filter the ports 4002 and 4004 to only accept connections to/from the IP addresses of machines that run UMC and are part of the UMC network, e.g., with an external firewall

In addition, if no RT server machines are used, port 4004 can be filtered completely

Product-specific remediations or mitigations can be found in the section Affected Products and Solution.

7. CVE-2023-45852: Command Injection – Viessmann Climate Solutions SE

CVE-2023-45852 is a command injection vulnerability in the Viessmann Vitogate 300 firmware (version 2.1.3.0). An unauthenticated attacker can exploit this vulnerability by injecting shell metacharacters into the ipaddr parameter in the JSON data for the put method in the /cgi-bin/vitogate.cgi endpoint. This allows the attacker to bypass authentication and execute arbitrary commands, potentially compromising the system. The vulnerability has a CVSS score of 9.8, indicating a critical severity level. No user interaction or specific permissions are required to exploit this flaw, and it can be exploited over a network with low difficulty.

Mitigation: Update to the latest version to fix the issue.

8. CVE-2023-5222: Use of Hardcoded Credentials – Viessmann Climate Solutions SE 

A critical vulnerability (CVSS score: 9.8) exists in Viessmann Vitogate 300 firmware up to version 2.1.3.0, specifically in the isValidUser function of the /cgi-bin/vitogate.cgi component within the Web Management Interface. This vulnerability is due to use of hard-coded password, making it exploitable over the network with low difficulty and no user interaction or permissions required. Public exploit details are available. The vendor has not responded to disclosure attempts.

Conclusion

The vulnerability severity distribution for ICS vulnerabilities shows a predominance of critical and high-severity issues in products belonging to known ICS vendors. The majority of affected products come from vendors like Siemens and Rockwell Automation. This calls for a prompt response to mitigate potential impacts on industrial control systems.

Organizations must prioritize patching these vulnerabilities, implement robust security measures, and follow recommended best practices to protect their ICS environments from potential threats. Regular updates, security monitoring, and proactive risk management are essential for maintaining the integrity and security of critical infrastructure.

Recommendations for Mitigation


Implement network segmentation to separate ICS networks from corporate and internet networks. Use firewalls and demilitarized zones (DMZs) to control traffic and limit exposure.

Apply multi-factor authentication for ICS system access. Limit user permissions based on the principle of least privilege to minimize potential damage.

Keep all ICS hardware and software updated with the latest patches to protect against known vulnerabilities. Regular patching is crucial for maintaining system security.

Deploy comprehensive security monitoring tools to detect and alert suspicious activities. Maintain detailed logs for forensic investigations and incident response.

Develop a robust incident response plan tailored to ICS environments. Regularly test and update the plan to ensure effective response to security incidents.

Train personnel on ICS-specific security risks and best practices. Awareness of potential threats and social engineering attacks is essential for maintaining security.

Use secure remote access methods such as VPNs and strong encryption. Minimize direct remote access and monitor remote sessions for potential threats.

Continuously review and update security policies to adapt to evolving threats and changes in the ICS environment. Ensure alignment with industry best practices and regulatory requirements.

Conduct vulnerability assessments and penetration testing to identify and address weaknesses in ICS systems. Regular assessments are vital for proactive security management.

The post Top ICS Vulnerabilities This Week: Critical Bugs in Rockwell Automation, Siemens, and Viessmann appeared first on Cyble.

Blog – Cyble – ​Read More

How to Collect Threat Intelligence Using Search Parameters in TI Lookup

/in

ANY.RUN‘s Threat Intelligence Lookup is a valuable resource for security professionals searching for information on the latest cyber threats. 

One of the key features of Threat Intelligence Lookup is its extensive search capabilities. The service offers over 40 different search parameters that can be combined to form specific queries. These parameters allow you to filter and refine your search results based on various criteria, such as IOCs, behavioral indicators, and other relevant information. 

Let’s explore each search parameter and provide examples of how they can be used in your investigations.

About Threat Intelligence Lookup

Threat Intelligence Lookup is a centralized platform for threat data exploration, collection, and analysis.

At the core of Threat Intelligence Lookup lies a global network of over 400,000 security experts. These individuals actively contribute by submitting suspicious samples to the ANY.RUN sandbox for advanced analysis on a daily basis. 

The submission process generates a wealth of valuable threat data, including indicators of compromise (IOCs), which are then extracted and integrated into Threat Intelligence Lookup.

See how ANY.RUN’s TI Lookup can help your team 



Request a free trial


Thanks to its integration with ANY.RUN’s Interactive Sandbox, users can access real-time search results, each one linked to a corresponding sandbox session, enabling in-depth analysis of the identified threats.

Search Parameters in TI Lookup

Search parameters in TI Lookup are divided into separate groups: tasks, registry, environment, detection, module, connection, process, network threats, file, synchronization, and URL.

Task

Task parameters refer to the characteristics of tasks (sandbox sessions). 

threatName

The name of a particular threat: malware family, threat type, etc., as identified by the sandbox.

Examples: “Phishing”, “xworm”, “ransomware”, “tycoon”.

submissionCountry

The country from which the threat sample was submitted.

Examples: “es”, “us”, “de”.

Results for a query that includes a threat name (Remcos) and country (Brazil) 

Here is an example of a query for samples of the Remcos malware submitted by users in Brazil. The service provides a list of sandbox sessions that correspond to the request.

Try it:

threatName:”remcos” AND submissionCountry:”es”

threatLevel

A verdict on the threat level of the sample.

Examples: “malicious”, “suspicious”.

taskType

The type of the sample submitted to the sandbox.

Examples: “URL”, “file”.

You can adjust the timeframe of your search to 180, 90, 60, 30, 7, 3, or 1 days

In this screenshot, you can see a query for malicious URLs uploaded to the sandbox over the past 24 hours. TI Lookup displays a list of the latest one hundred sessions.

Try it:

threatLevel:”malicious” AND taskType:”URL”

Registry

Registry parameters refer to specific attributes related to registry modifications detected within sandbox sessions. These parameters provide insights into how a threat interacts with the Windows registry.

registryKey

The specific key within the registry hive where the modification occurred. Please note: when entering registry keys, use a double backslash () to escape the single backslash.  

Examples: “Windows\CurrentVersion\RunOnce”, “Windows NT\CurrentVersionWindows”.

registryName

The name of the Windows Registry key field.

Examples: “browseinplace”, “docobject”, “isshortcut”.

registryValue

The value of the Windows Registry key.

Examples: “internet exploreriexplore.exe”.

The service provides events, synchronization, and network threats associated with the query

Using the query above, we can identify threats that aim to execute malicious code through scheduled tasks.

Try it:

registryKey:”CurrentVersion\Schedule” AND registryValue:”.exe”

Environment

These parameters are used to provide context about the environment where a threat was detected or executed.

os

The specific version of Windows used in the environment.

Examples: “11”, “10”, “7”.

osSoftwareSet

The software package of applications installed on the OS.

Examples: “clean”, “office”, “complete”.

osBitVersion

The bitness of the operating system, 32-bit or 64-bit.

Examples: “32”, “64”.

The service provides Lumma analysis sessions that you can explore

We can use these parameters to, for instance, discover Windows 11 x64 sandbox sessions containing analysis of the Lumma stealer launched in the service over the past 14 days.

Try it:

threatName:”lumma” AND os:”10″ AND osSoftwareSet:”complete” AND osBitVersion:”64″

Detection

These parameters are utilized to describe the detection signatures and MITRE TTPs relating to the execution of threats in the sandbox.

ruleName

The name of the detection rule.

Examples: “Executable content was dropped or overwritten”, “Phishing has been detected”.

ruleThreatLevel

The threat level assigned to a particular event.

Examples: “malicious”, “suspicious”, “info”.

MITRE

Techniques used by the malware according to the MITRE ATT&CK classification.

Examples: “T1071”, “T1114.001”.

The service provides events, mutexes, files, network threats, and sessions

Let’s consider a query combining the MITRE ATT&CK technique T1053.005, which describes a common persistence mechanism, with a detection rule for threats that steal browser credentials. 

Try it:

MITRE:”T1053.005″ AND ruleName:”Steals credentials from Web Browsers”

Module

Module parameters refer to specific modules or components within a threat. This can be a DLL, library, or other executable that is loaded by the main executable.

moduleImagePath

The full path to the module’s image file, the location on the disk where the module’s executable is stored.

Examples: “SysWOW64\cryptbase.dll”, “SysWOW64\msasn1.dll”.

The service yields events, files, and other results in response to the query

Above you can see an example of a query that looks for all instances of sandbox sessions where KernelBase.dll was called.

Try it:

moduleImagePath:”SysWOW64\KernelBase.dll”

Connection

The Connection parameters describe network-related aspects of a threat.

domainName

The domain name that was recorded during the threat execution in a sandbox.

Examples: “tventyvd20sb[.]top”, “5.tcp.ngrok[.]io”.

destinationIP

The IP address of the network connection that was established or attempted.

Examples: “147[.]185[.]221[.]22”, “162[.]125[.]66[.]15”.

destinationPort

The network port through which the connection was established.

Examples: “49760”, “49780”.

Try ANY.RUN’s TI Lookup for free 



Leave a trial request


destinationIpAsn

Detected ASN.

Examples: “akamai-as”, “akamai international b.v.”.

destinationIPgeo

Two-letter country or region code of the detected IP geolocation.

Examples: “ae”, “de”.

ja3, ja3s, jarm

Types of TLS fingerprints that can indicate certain threats.

Examples: “1af33e1657631357c73119488045302c” (JA3S), “a0e9f5d64349fb13191bc781f81f42e1” (JA3).

You can explore network threats tab to see triggered Suricata IDS rules

In the picture above, we can see a query that searches for threats that made connections to IP addresses located in the Czech Republic (CZ), belonging to Cogent Communications.

Try it:

destinationIpAsn:”cogent-174″ AND destinationIPgeo:”cz” AND threatLevel:”malicious”

Process

The following parameters relate to processes registered during active sandbox sessions.

imagePath

Full path to process image.

Examples: “System32\conhost.exe”, “Framework\v4.0.30319\RegAsm.exe”.

commandLine

The full command line that initiated the process.

Examples: “PDQConnectAgent\pdq-connect-agent.exe –service”, “system32\cmd.exe /c”.

The events tab shows the exact processes corresponding to the query

Using these parameters, we can find Strela stealer samples that use net.exe to mount a C2 server containing a ‘davwwwroot’ folder.

Try it:

commandLine:”davwwwroot*dll” AND imagePath:”net.exe”

Network Threats

These parameters describe network-based threats detected by the Suricata intrusion detection system (IDS).

suricataMessage

The description of the threat according to Suricata.

Examples: “ET INFO 404/Snake/Matiex Keylogger Style External IP Check”, “STEALER [ANY.RUN] Stealc HTTP POST Request”.

Search using Suricata message reveals malconf IPs of Redline

 We can use a Suricata message to discover more samples, as well as IOCs, including those extracted directly from malware’s configs, relating to a particular threat.

Try it:

suricataMessage:”ET MALWARE Redline Stealer TCP CnC Activity”

suricataClass

The category assigned to the threat by Suricata based on its characteristics.

Examples: “misc activity”, “a network trojan was detected”.

suricataID

The unique identifier of the Suricata rule.

Examples: “2044767”, “8001997”.

suricataThreatLevel

The verdict on the threat according to Suricata based on its potential impact.

Examples: “malicious”, “suspicious”, “info”

The service returns Suricata IDS rules detecting njRAT

By combining this parameter with threaName, we can collect Surica rules relating to a specific malware.

Try it:

suricataThreatLevel:”malicious” AND threatName:”njrat”

File

These parameters describe file-related aspects of a threat.

filePath

The full path to the file on the system.

Examples: “invoice”, “order”

A query searching for sessions where a readme.txt file was dropped on the desktop, a common ransomware sign

We can use this parameter along with threatLevel to find specific files in sandbox sessions with malicious content.

Try it: filePath:”Users\admin\Desktop\README.TXT” AND threatLevel:”malicious”

fileExtension

The extension that indicates the file type.

Examples: “exe”, “dll”.

sha256, sha1, md5

Hash values relating to a file.

Examples: “1412faf1bfd96e91340cedcea80ee09d”, “ce554fe53b2620c56f6abb264a588616”

In response to a hash query, the service returns events, network threats, files, and other data

We can use the hash of a malicious file to discover the specific malware family it relates to.

Try it:

md5:”4d77626d9f9d029f9f5059d72264231d”

Synchronization

These parameters describe synchronization-related activities within a threat, such as mutexes.

syncObjectName

The name or identifier of the synchronization object used.

Examples: “rmc”, “m0yv”.

syncObjectType

The type of synchronization object used.

Examples: “event”, “mutex”.

Get a 14-day free trial of ANY.RUN’s TI Lookup 



Contact Sales


syncObjectOperation

The operation performed on the synchronization object.

Examples: “create”, “open”.

The service provides a long list of objects found in sessions containing analysis of the Xworm malware

By combining operation and type parameters with threatName, we can search for specific mutexes or events created during the execution of a particular malware

Try it:

syncObjectOperation:”create” AND syncObjectType:”mutex” AND threatName:”xworm”

URL

These parameters describe network traffic related to HTTP requests and responses.

url

The URL called by the process.

Examples: “http://192[.]168[.]37[.]128:8880[/]zv8u”, “http://tventyvd20sb[.]top/v1/upload[.]php”.

httpRequestContentType

The content type of the HTTP request sent to the server.

Examples: “application/octet-stream”.

httpResponseContentType

The content type of the HTTP response received from the server.

Examples: “text/html”.

httpRequestFileType

The file type of the file being uploaded in the HTTP request.

Examples: “binary”.

httpResponseFileType

The file type of the file being downloaded in the HTTP response.

Examples: “binary”.

Results for binary file requests in HijackLoader sandbox sessions

It is possible to use the parameter with threatName again to find binary files that were requested during the analysis in the sandbox.

Try it:

httpRequestFileType:”binary” AND threatName:”hijackloader”

Conclusion

ANY.RUN’s Threat Intelligence Lookup offers a comprehensive set of search parameters that enable security professionals to effectively analyze and investigate threats. Using these search options, you can identify and enrich your information on emerging threats.

Try Threat Intelligence Lookup for free →

About ANY.RUN  

ANY.RUN helps more than 400,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, Yara Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.

The post How to Collect Threat Intelligence Using Search Parameters in TI Lookup appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

SambaSpy, a new RAT | Kaspersky official blog

/in

Today, let’s talk about rats. Not the long-tailed rodents, but the digital kind – Remote Access Trojans, or RATs. These are Trojans that attackers use to gain remote access to a device. Typically, these RATs can install and uninstall programs, control the clipboard and log keystrokes.

In May 2024, a new breed of RAT, SambaSpy, wandered into our rat trap. To learn how this malware infects its victims’ devices and what it does once it’s inside, read on.

What SambaSpy is

SambaSpy is a feature-rich RAT Trojan obfuscated using Zelix KlassMaster, making it much more difficult to detect and analyze. However, our team was up to the challenge and discovered that this new RAT is capable of:

Managing the file system and processes
Downloading and uploading files
Controlling the webcam
Taking screenshots
Stealing passwords
Loading additional plug-ins
Remotely controlling the desktop
Logging keystrokes
Managing the clipboard

Impressed? It seems SambaSpy can do it all – the perfect tool for a 21st century James Bond villain. But even this extensive list isn’t exhaustive: read more about this RAT’s capabilities in the full version of our study.

The malicious campaign we uncovered was exclusively targeting victims in Italy. You may be surprised, but this is actually good news (for everyone except Italians). Threat actors usually try to cast a wide net to maximize their profits, but these attackers are focused on just one country. So why is that a good thing? It’s likely that the attackers are testing the waters with Italian users before expanding their operation to other countries – and we’re already one step ahead, since we’re familiar with SambaSpy and how to counter it. All that our users worldwide need to do is make sure they have a reliable security solution, and read on knowing that we’ve got this.

How attackers spread SambaSpy

In short, just like many other RATs, via email. The attackers used two primary infection chains, both involving phishing emails disguised as communications from a real estate agency. The key element in the email is a CTA to check an invoice by clicking a hyperlink.

At first glance, the email appears legitimate – except that it’s sent from a German email address, but written in Italian

Clicking the link redirects users to a malicious website that checks the system language and the browser used. If the potential victim’s OS is set to Italian and they open the link in Edge, Firefox or Chrome, they receive a malicious PDF file that infects their device with either a dropper or a downloader. The difference between the two is minimal: the dropper installs the Trojan immediately, while the downloader first downloads the necessary components from the attackers’ servers.

Before starting, both the loader and the dropper check that the system isn’t running in a virtual machine and, most importantly, that the OS language is set to Italian. If both conditions are met, the device is infected.

Users who don’t meet these criteria are redirected to the website of FattureInCloud, an Italian cloud-based solution for storing and managing digital invoices. This clever disguise allows the attackers to target only a specific audience – everyone else is redirected to a legitimate website.

Who’s behind SambaSpy?

We’ve yet to determine which group is behind this sophisticated distribution of SambaSpy. However, circumstantial evidence has shown us that the attackers speak Brazilian Portuguese. We also know that they’re already expanding their operations to Spain and Brazil – as evidenced by malicious domains used by the same group in other detected campaigns. By the way, these campaigns no longer include the language check.

How to protect yourself from SambaSpy

The key takeaway from this story is the method of infection, which suggests that anyone, anywhere, speaking any language could be the target of the next campaign. For the attackers, it doesn’t really matter who they hit, nor are the particulars of the phishing bait important. Today, it might be an invoice from a real estate agency; tomorrow, a tax notification; and the day after that, airline tickets or travel vouchers.

Here are a few tips and recommendations to help you stay safe from SambaSpy:

Install Kaspersky Premium before your device shows any signs of infection. Our solution reliably detects and neutralizes both SambaSpy and other malware.
Always be wary of phishing emails. Before you click on a link in your inbox, take a moment to ask yourself: “Could this be a scam?”

Kaspersky official blog – ​Read More

CISA Adds Progress WhatsUp Gold and MSHTML Vulnerabilities to Known Exploited Vulnerabilities Catalog

/in

Key Takeaways


CISA has added vulnerabilities affecting the Microsoft Windows MSHTML Platform (CVE-2024-43461) and Progress WhatsUp Gold network monitoring solution (CVE-2024-6670) to its Known Exploited Vulnerabilities catalog.

Proofs of Concept and observed exploits of these vulnerabilities mean that users should update affected products as soon as possible.

Progress WhatsUp Gold was observed under exploit within hours after a Proof of Concept emerged, suggesting an urgent need to patch this 9.8-severity vulnerability.

Cyble researchers have detected 381 internet-exposed Progress WhatsUp Gold instances; patching these instances is critical.

Microsoft has patched two high-severity vulnerabilities chained together in Windows MSHTML platform spoofing attacks.

Overview

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerabilities affecting the Microsoft Windows MSHTML Platform and Progress WhatsUp Gold network monitoring solution to its Known Exploited Vulnerabilities catalog (KEV) after proofs of concept (PoCs) emerged, and security researchers observed active exploits of the vulnerabilities.

We’ll examine the vulnerabilities, the following steps for affected products, and the best practices that all organizations should follow.

CVE-2024-6670: Progress WhatsUp Gold

CVE-2024-6670 is a critical 9.8 severity SQL Injection vulnerability affecting versions of Progress WhatsUp Gold released before 2024.0.0.

The vulnerability in affected versions of the network monitoring software allows an unauthenticated attacker to retrieve the user’s encrypted password if the application is configured with only a single user.

Exploits began within hours after a Proof of Concept for the vulnerability was made available publicly on GitHub, even though a patch had been available for the vulnerability since mid-August, suggesting that some users were slow to update affected versions.

Trend Micro researchers detected remote code execution (RCE) attacks against WhatsUp Gold that exploited the Active Monitor PowerShell Script, leveraging CVE-2024-6670 and CVE-2024-6671, a companion vulnerability also rated 9.8.

Both vulnerabilities are patched starting with version 2024.0.0.

The Cyble ODIN scanner detected 381 internet-exposed Progress WhatsUp Gold instances, as shown in the figure below. Progress WhatsUp Gold is urged to upgrade as soon as possible and check for indicators of compromise in their environments.

CVE-2024-43461: Microsoft Windows MSHTML

CVE-2024-43461 is a high-severity (CVSS: 8.8) vulnerability in the Microsoft Windows MSHTML Internet Explorer browser engine platform containing a UI misrepresentation flaw that allows attackers to spoof web pages. This vulnerability was exploited in conjunction with CVE-2024-38112.

Microsoft has announced the retirement of Internet Explorer 11 and deprecated Microsoft Edge Legacy. However, MSHTML, EdgeHTML, and related scripting platforms remain supported. MSHTML is used in Internet Explorer mode in Microsoft Edge and other applications via WebBrowser control. WebView and some UWP apps utilize EdgeHTML. Updates for vulnerabilities in MSHTML and scripting platforms are included in IE Cumulative Updates, but EdgeHTML and Chakra updates are not.

CVE-2024-43461 was exploited in conjunction with CVE-2024-38112 before July 2024. A fix for CVE-2024-38112, released in July 2024, disrupted this attack chain. To ensure complete protection, customers should install both the July 2024 and September 2024 security updates.

Affected Windows products include:


Windows Server 2012

Windows Server 2012 R2

Windows Server 2008 R2

Windows Server 2008

Windows Server 2016

Windows 10

Windows Server 2022

Windows 11

Conclusion

The recent addition of these vulnerabilities to the CISA KEV database underscores their active exploitation. These vulnerabilities can lead to severe security breaches, including unauthorized access to sensitive information and effective spoofing of web pages. Owners of affected products are urged to update their systems with the latest patch released by the official vendor.

Cyble Recommendations

Cyble urges the following best practices:


Ensure that you install the latest security updates for all affected systems and regularly check for and apply updates to stay protected against known vulnerabilities.

Implement robust monitoring to detect any unusual activity that could indicate the exploitation of these vulnerabilities. This includes monitoring network traffic, system logs, and user behavior.

Review and strengthen your security configurations, including access controls and permissions. Ensure that applications are not unnecessarily exposed to the internet and that strong authentication mechanisms are in place.

Perform regular vulnerability assessments and penetration testing to identify and address potential security weaknesses before they can be exploited.

Develop a comprehensive patch management strategy that includes inventory management, patch assessment, testing, deployment, and verification.

Implement proper network segmentation to avoid exposure of critical assets over the internet.

Maintain an up-to-date inventory of all internal and external assets, including hardware, software, and network components.

The post CISA Adds Progress WhatsUp Gold and MSHTML Vulnerabilities to Known Exploited Vulnerabilities Catalog appeared first on Cyble.

Blog – Cyble – ​Read More

CERT India reports vulnerabilities in multiple QNAP products

/in

Earlier today, CERT India (CERT-In) released an advisory announcing multiple vulnerabilities in various QNAP products. QNAP is best known for the Network-Attached Storage (NAS) systems used by firms with their enterprise environments. This batch of vulnerabilities primarily affects the QTS and QuTS Hero operating systems – both key parts of QNAP’s offerings.

The high-severity advisory describes the critical flaws that could potentially allow attacks to elevate privileges on a compromised device, execute code remotely, and even access sensitive data without authorization. The advisory goes on to detail the specific QNAP products affected, the range and type of vulnerabilities, and the steps affected users can take to secure themselves.

Affected QNAP Products

The vulnerabilities impact the following versions of QNAP’s QTS and QuTS hero systems:


QTS 5.1.0.2823 and prior versions.

QTS hero h5.1.0.2823 and prior.

QTS 4.5.4.2790 and prior.

QTS hero h4.5.4.2790 and prior.

QuTS h5.2.0.2782 and prior.

The affected versions of QNAP are used across multiple enterprise environments, necessitating swift and decisive action from system administrators to follow CERT-In’s guidance and apply the latest patches to ensure system security.

Vulnerability Overview

These vulnerabilities can be exploited remotely to carry out a plethora of malicious activities. Given the number and size of the affected users, it is imperative that these be patched immediately, or they could lead to the following consequences:


Exposure of Sensitive Information: Attackers might be able to remotely extract confidential data stored on affected NAS devices.

Bypassing Authorization Checks: These flaws potentially allow attackers to successfully bypass the authentication processes put in place by users.

Escalation of Privileges: Unauthorized users will be able to escalate their privileges within the system to further expand the scope of their nefarious activities.

Execution of Arbitrary Code: These vulnerabilities can potentially enable arbitrary code execution, causing significant damage since it would make it possible to inject malicious commands, potentially affecting the entire environment/system.

Detailed Description of Vulnerabilities

The cause for these vulnerabilities arises from several known issues that are detailed in CERT-In’s advisory. A brief summary has been provided below:


Boundary Errors: Flaws in boundary handling can allow attackers to manipulate the memory space.

Improper Input Validation: Inadequate validation of input allows attackers to introduce harmful data into the system.

OS Command Injection Vulnerability: This flaw allows malicious users to inject harmful commands into the operating system.

Improper Restriction of Authentication Attempts: Attackers can bypass rate-limiting measures or brute force their way into systems.

Heap-based Buffer Overflow: Memory corruption through buffer overflow can crash systems or open them up to exploitation. 

The aforementioned security weaknesses can allow hackers to corrupt memory, insert commands from a remote location, or employ brute force to infiltrate QNAP systems, greatly heightening the potential threat to data and operational stability.

CVEs tracked in the advisory

For easier tracking and reporting, CERT-In’s advisory has also listed the relevant Common Vulnerabilities and Exposures (CVEs) associated with the aforementioned flaws:


CVE-2023-34974

CVE-2023-34979

CVE-2023-39298

CVE-2024-21906

CVE-2024-32763

CVE-2024-32771

CVE-2024-38641

Every CVE is linked to a particular weakness that attackers could potentially exploit in different ways, such as injecting commands or gaining higher-level privileges. System administrators should review the specifics of these CVEs to acquire a more thorough idea of how these vulnerabilities might affect their system(s).

Potential Impact

If successfully exploited, these vulnerabilities can result in severe consequences, such as:


Data Breaches: Exposure to sensitive information could lead to significant reputational damage, especially for businesses that handle sensitive client data.

Service Downtime: Arbitrary code execution could lead to system crashes, disrupting business operations.

Unauthorized Access: Privilege escalation may allow attackers to gain admin rights, giving them complete control over the NAS systems.

Financial and Legal Ramifications: Depending on the type of information compromised, organizations could face financial losses, legal challenges, and regulatory penalties.

Next steps to secure systems and mitigate the impact of these vulnerabilities

To help mitigate the risk, QNAP rapidly patched several affected systems along with detailed instructions, the links for which can be found below. We highly recommend that system administrators download and install these patches as soon as possible prior to these vulnerabilities being exploited to compromise their organization’s systems.


QNAP Security Advisory QSA-24-28

QNAP Security Advisory QSA-24-32

QNAP Security Advisory QSA-24-33

Conclusion

Despite QNAP’s timely response in identifying and patching affected systems, such severe vulnerabilities with potentially devastating consequences highlight the need for cybersecurity personnel in organizations to take a proactive stance on system and platform security. If immediate corrective action is not taken, malicious actors may gain unauthorized access to critical systems, confidential data may be breached, and even the system may be compromised.

Employees are the first line of defense against cyber threats. Thus, fostering a culture of cyber-awareness and educating the workforce is a time-tested method to increase cyber-resilience by creating a habit of timely patch management, conducting frequent system audits, and implementing security best practices.

The post CERT India reports vulnerabilities in multiple QNAP products appeared first on Cyble.

Blog – Cyble – ​Read More

Kaspersky AI Technology Research Center | Kaspersky official blog

/in

For nearly two decades, Kaspersky has been at the forefront of integrating artificial intelligence (AI), particularly machine learning (ML), into its products and services. Our deep expertise and experience in applying these technologies to cybersecurity, coupled with our unique datasets, efficient methods, and advanced model-training infrastructure form the bedrock of our approach to solving complex ML challenges. Our Kaspersky AI Technology Research Center brings together data scientists, ML engineers, threat experts, and infrastructure specialists to tackle the most challenging tasks at the intersection of AI/ML and cybersecurity. This includes not only the development of applied technologies but also research into the security of AI algorithms, including the use of promising approaches such as neuromorphic ML, AI risk awareness, and much more.

Our technologies and products

At Kaspersky we’ve developed a wide range of AI/ML-powered threat detection technologies, primarily for identifying malware. These include a deep neural network algorithm for detecting malicious executable files based on static features, decision-tree ML technology for automated creation of detection rules that work on user devices, and neural networks for detecting malicious behavior of programs during execution. We also utilize a system for identifying malicious online resources based on anonymous telemetry received from solutions installed on customer devices and other sources. You can read more about them in our white paper Machine Learning for Malware Detection. Other models – such as the ML model for detecting fake websites and DeepQuarantine for quarantining suspected spam emails – protect users from phishing and spam threats. KSN’s cloud infrastructure makes our AI developments available almost instantly to both home and enterprise users.

Guided by the promise of generative AI, particularly large language models (LLM), we’ve built an infrastructure to explore its capabilities and rapidly prototype new solutions. This infrastructure, which deploys LLM tools akin to ChatGPT, is not only accessible to employees across all departments for everyday tasks but also serves as a basis for new solutions. For example, our Kaspersky Threat Intelligence Portal will soon have a new LLM-based OSINT capability that will quickly deliver threat report summaries for specific IoCs.

To enhance the security of our customers’ infrastructures, we’re actively developing AI technologies tailored to our flagship corporate products and services. For several years now, the AI Analyst in Kaspersky Managed Detection and Response has been helping to reduce the workload of SOC teams by automatically filtering out false positives. Last year alone, this technology closed over 100,000 alerts without human intervention. This allows SOC experts to respond to real threats faster and devote more time to investigating complex cases and proactively hunting for threats. Another of our solutions – AI-based host risk scoring in Kaspersky SIEM (Kaspersky Unified Monitoring and Analysis platform) and Kaspersky XDR – uses ML algorithms to search for suspicious host behavior without the need to transfer data outside a company.

Another key area of Kaspersky’s development is the use of AI/ML in industrial environments. This includes Kaspersky MLAD (Machine Learning for Anomaly Detection) – a predictive analytics software solution that automatically recognizes early (hidden) signs of impending equipment failure, process disruption, human error or cyberattack in telemetry signals. By continuously training the neural network, MLAD analyzes the stream of “atomic” events from the object, structures them into patterns and identifies abnormal behavior. Another of our projects is Kaspersky Neuromorphic Platform (KNP) – a research project and software platform for AI solutions based on spiking neural networks and AltAI, the energy-efficient neuromorphic processor developed by Russian-based Motive Neuromorphic Technologies (Motive NT) in collaboration with Kaspersky.

The widespread adoption of AI technologies requires security control, which is why we’ve also established an AI security team. It offers a range of services aimed at ensuring reliable protection of AI systems and thwarting potential threats to data, business processes and AI infrastructure.

Our people

In the past, ML-based tasks were performed by departments directly involved in detecting specific threats. However, with the growing number of tasks and the increasing importance of ML technologies, we decided to hive off our expertise in AI-based systems to a separate Expertise Center: Kaspersky AI Technology Research. This resulted in the creation of three main teams that drive the use of AI at Kaspersky:

The Detection Methods Analysis Group develops ML algorithms for malware detection in collaboration with the Global Research and Analysis Team (GReAT) and the Threat Research Center. Their AI systems for both static and behavior-based malware detection directly contribute to the security of our users.
Technology Research, under the Future Technologies Department, specializes in: researching promising AI technologies; developing Kaspersky MLAD and KNP; developing the next-generation AltAI neuromorphic processor in collaboration with Motive NT; and providing AIST services for AI security.
The MLTech team is responsible for developing the corporate ML infrastructure for training ML models, creating content threat detection models (phishing and spam), and implementing AI technologies, including LLM-based, into our advanced corporate services and solutions, such as MDR, Kaspersky SIEM (Unified Monitoring and Analysis platform), and Kaspersky XDR.

This doesn’t mean that our AI expertise is limited to the above teams. The field of AI is currently so complex and multifaceted that it’s impossible to concentrate all the know-how in a few research groups. Other teams also make significant contributions to the Expertise Center’s work, and apply ML in many tasks: machine vision technologies in the Antidrone team; research into AI coding assistants in the CoreTech and KasperskyOS departments; APT search in GReAT; and AI legislation study in the Government Relations team.

Our research and patents

The uniqueness of our AI technologies is underscored by the dozens of patents we’ve obtained worldwide. First and foremost, these are patents for detection technologies, such as malware detection based on program behavior logs, detection of malicious servers in telemetry, fake websites, and spam with the aid of ML. But the Kaspersky portfolio covers a much wider range of tasks: technologies for improving datasets for ML, anomaly detection, and even searching for suspicious contacts of kids in parental control systems. And, of course, we are actively patenting our AI technologies for industrial systems and unique neural network approaches to processing event streams.

In addition, Kaspersky actively shares its AI expertise with the community. Some studies, such as those on monotonic ML algorithms or the application of neural networks for spam detection, are published as academic papers at leading ML conferences. Others are published on specialized portals and at information security conferences. For example, we publish research on the security of our own AI algorithms, in particular attacks on spam detection and malware detection algorithms. We study the application of neural networks for time series analysis and explore the use of neuromorphic networks in industry-relevant tasks. Our Kaspersky Neuromorphic Platform (KNP) is open-source software that will be available for use and development by the entire ML community.

The topic of secure AI development and application is of fundamental importance to us, as we need to be able to trust our algorithms and be confident in their reliability. Other topics we cover include our participation in cybersecurity challenges that simulate attacks on ML systems and the use of advanced technologies such as LLMs to detect threats in system logs and phishing links. We also talk about threats to generative AI, including from a privacy standpoint, attacks on various LLM-based systems, the use of AI by attackers, and the application of our technologies in SOCs. Sometimes we open the door and reveal our inner workings, talking about the process of training our models and even the intricacies of assessing their quality.

 

Raising awareness

Finally, the most important function of the Kaspersky AI Technology Research Center is to raise awareness among our customers and the general public about the pros and cons of AI technologies and the threats they pose. Our experts at the Expertise Center demonstrate the dangers of deepfake videos. We talk about the finer points of AI usage (for example, how ChatGPT affects the process of hiring developers) and share our experiences through webinars and roundtable discussions.

The FT Technology Research team organizes conferences on neuromorphic technologies with a separate track devoted to AI security issues, including systems based on the neuromorphic approach. Together with our partner, the Institute for System Programming of the Russian Academy of Sciences (ISP RAS), we’re researching various attack vectors on neural networks in the areas of Computer Vision, LLM, and Time Series, and ways to protect them. As part of Kaspersky’s industrial partnership with ISP RAS, the team is testing samples of trusted ML frameworks.

We’re also involved in the development of educational courses, including a module on the use of AI in cybersecurity at Bauman Moscow State Technical University. Another example is our module on the safe use of AI in Kaspersky ASAP, our solution for raising employee awareness of cyberthreats. Finally, we’re contributing to the creation of a set of international standards for the use of AI. In 2023, we presented the first principles for the ethical use of AI systems in cybersecurity at the Internet Governance Forum.

 

To sum up, the main tasks of the Kaspersky AI Technology Research Center are the development of AI technologies, their safe application in cybersecurity, threat monitoring for improper or malicious AI usage, and forecasting trends. All these tasks serve a single purpose: to ensure the highest level of security for our customers.

Kaspersky official blog – ​Read More