In attacks on infrastructure of various companies, cybercriminals are increasingly resorting to manipulating modules that interact with the Local Security Authority (LSA) process. This enables them to steal user credentials, establish persistence in the system, elevate privileges, or extend the attack to other systems within the target company. Therefore, for the latest quarterly update of our SIEM system, the Kaspersky Unified Monitoring and Analysis Platform, we’ve added rules designed to detect such attempts. In terms of the MITRE ATT&CK classification, the new rules can detect techniques T1547.002, T1547.005 and T1556.002.
What are techniques T1547.002, T1547.005 and T1556.002?
Both variants of technique T1547 mentioned above involve using the LSA process to load malicious modules. Sub-technique 002 describes adding malicious dynamic-link libraries (DLLs) with Windows authentication packages, while sub-technique 005 involves DLLs with security support provider (SSP) packages. Loading these modules allows attackers to access the LSA process memory, which can contain critical data such as user credentials.
Technique T1556.002 describes a scenario where an attacker registers a malicious password filter DLL in the system. These filters are essentially mechanisms for enforcing password policies. When a legitimate user changes a password or sets a new one, the LSA process compares it against all registered filters, and is forced to handle the passwords in plain text form, i.e., unencrypted. If an attacker manages to introduce a malicious password filter into the system, they can collect passwords with every request.
All three techniques involve placing malicious libraries in the C:Windowssystem32 directory and registering them in the system registry under the following keys of the SYSTEMCurrentControlSetControlLSA branch: Authentication Packages for T1547.002, Security Packages for T1547.005, and Notification Packages for T1556.002.
How our SIEM counters techniques T1547.002, T1547.005 and T1556.002
To counter these techniques, the Kaspersky Unified Monitoring and Analysis Platform will be updated with rules R154_02–R154_10, which detect, among other things, the following events:
Loading of suspicious authentication packages, password filter packages, and security support provider modules using events 4610, 4614 and 4622, respectively.
Commands executed in cmd.exe and powershell.exe and aimed at modifying the LSA registry branch and the Authentication Packages, Notification Packages and Security Packages keys.
Changes (detected through registry modification event 4657) of the LSA registry branch that could enable a malicious file.
Other improvements in the Kaspersky Unified Monitoring and Analysis Platform update
In this update, we’re also introducing rule R999_99, which detects changes in Active Directory accounts’ critical attributes, such as scriptPath and msTSInitialProgram, which enable various actions to be performed upon login.
These attributes set some scripts to execute every time a user logs into the system. This makes them an attractive target for attackers aiming to establish persistence in the network. Tampering with these attributes may indicate unauthorized attempts to gain a foothold in the system or escalate privileges — technique T1037.003 under the MITRE ATT&CK classification.
The strategy for detecting these manipulations is to monitor Windows event logs — particularly event 5136. This event records any changes made to objects in Active Directory, including attribute modifications.
After the latest update, our SIEM platform will provide over 700 rules. Thus, by the end of 2024, our solution will cover 400 MITRE ATT&CK techniques. Of course, we’re not aiming to create rules to detect every technique described in the matrix. A significant portion of them cannot be fully addressed due to their nature — for example, ones involving actions performed outside the protected perimeter or the techniques not fully covered by SIEM solutions by definition. However, in the fourth quarter of this year, we’ve focused on further expanding the coverage of MITRE ATT&CK techniques while enhancing the detection logic for already covered techniques.
New and improved normalizers
In the latest update, we’ve also added normalizers to our SIEM system that support the following event sources:
[OOTB] Kaspersky Industrial CyberSecurity for Networks 4.2 syslog
In addition, our experts have improved the following normalizers:
[OOTB] Microsoft Products via KES WIN
[OOTB] Microsoft Products for KUMA 3
[OOTB] KSC from SQL
[OOTB] Ideco UTM syslog
[OOTB] KEDR telemetry
[OOTB] Vipnet TIAS syslog
[OOTB] PostgreSQL pgAudit syslog
[OOTB] KSC PostgreSQL
[OOTB] Linux auditd syslog for KUMA 3.2
The full list of supported event sources in Kaspersky Unified Monitoring and Analysis Platform 3.4 can be found in the Online Help, where you can also find information on correlation rules. In our blog you can also read about the updates for our SIEM platform for the first, second and third quarters of 2024.
To learn more about our SIEM system, the Kaspersky Unified Monitoring and Analysis Platform, please visit the official product page.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-12-06 12:06:442024-12-06 12:06:44Kaspersky SIEM improvements in Q4 2024 | Kaspersky official blog
Two Russian hacktivist groups are increasingly targeting critical infrastructure in the U.S. and elsewhere, and their attacks go well beyond the DDoS attacks and website defacements that hacktivist groups typically engage in.
The groups – the People’s Cyber Army and Z-Pentest – have posted videos to their Telegram channels allegedly showing members tampering with operational technology controls (OT), most notably in the oil and gas and water system sectors.
Those claims, documented by Cyble dark web researchers, may largely be intended to establish credibility rather than inflict damage on targets, but within the last week Z-Pentest’s claims have escalated to include disrupting one U.S. oil well system.
The groups have also accessed operational controls for critical infrastructure in other countries, notably Canada, Australia, France, South Korea, Taiwan, Italy, Romania, Germany and Poland, often claiming retaliation for a country’s support for Ukraine in its war with Russia.
Some of the attacks have been publicly reported – most notably the People’s Cyber Army attacks on water facilities – but Z-Pentest’s claims of energy sector attacks have largely flown under the radar.
It is not clear how much damage the Russian groups could do or are capable of, but given repeated warnings from U.S. cybersecurity and intelligence agencies about China’s deep penetration of U.S. critical infrastructure, these environments should be considered deeply vulnerable and strengthened accordingly.
Z-Pentest’s Activities
Z-Pentest appears to have been active only since October, but in those two months Cyble’s dark web research team has recorded 10 claims of attacks by the group, all involving accessing control panels in critical infrastructure environments. Their main Telegram channel was recently shut down but the group maintains a presence on X and claims to be based in Serbia.
Z-Pentest’s most recent claim involved disrupting critical systems at an oil well site, including systems responsible for water pumping, petroleum gas flaring, and oil collection. A 6-minute screen recording shows detailed screenshots of the facility’s control systems, showing tank setpoints, vapor recovery metrics, and operational dashboards, allegedly accessed and changed during the breach. It is not clear where that oil facility is located, but the other two U.S. oil facility claims appear to correspond with known locations and companies.
In one of the other two claimed attacks, the threat group released a 4-minute screen recording where they accessed a range of operational controls (identifying information removed from example below).
While the hackers may well be accessing sensitive environments, it is not clear how much damage they could do. Programmable logic controllers (PLCs), for example, often include safety features that can prevent damaging actions from occurring, but the fact that such environments are accessible to threat actors is nonetheless concerning.
Cyble has in general observed increased threat activity targeting the energy sector in recent months. Dark web claims and ransomware attacks have increased, and network access and zero-day vulnerabilities have been offered for sale on dark web market places. Cyble has observed instances where credentials for energy network access were offered for sale on the dark web before larger breaches and attacks occurred, suggesting that monitoring for credential leaks may be an important defense for preventing larger breaches later.
People’s Cyber Army Activities
The better-known People’s Cyber Army (PCA) – also known as the Cyber Army of Russia Reborn – has also been targeting critical infrastructure controls in the U.S. and elsewhere, and there have been some suggestions that PCA and Z-Pentest may be working together. While many of the group’s activities have involved DDoS attacks, recent claims have included access to the control panels of a U.S. environmental cleanup company and water systems in Texas and Delaware.
Water and wastewater systems are considered particularly vulnerable by some OT security specialists, in part because communities are ill-equipped to deal without them for any length of time.
The People’s Cyber Army struck twice in late August and September, releasing screen recordings showing the group tampering with system settings on control panels at the Stanton Water Treatment Plant in Stanton, Texas, and New Castle, Delaware water towers (images below).
Image above: Stanton Water Treatment Plant attack
Image above: Delaware water tower attack
In the Texas case, the hackers were able to open valves and release untreated water, but otherwise no damage is believed to have occurred.
In all, Cyble has documented eight water system attacks by the People’s Cyber Army this year in the U.S. and elsewhere, including a January attack that caused water storage tanks to overflow in Abernathy and Muleshoe, Texas. The group has been targeting Ukraine allies since 2022, and was sanctioned by the U.S. government in July 2024.
Conclusion
Security weaknesses in critical infrastructure organizations are by now a well-documented phenomenon, but the recent spate of attacks targeting energy and water facilities suggests a concerning escalation in the exploitation of these vulnerable environments. The emergence of Z-Pentest as a new threat actor in this space should be taken seriously, as the group has demonstrated an apparent ability to penetrate these environments and access – and tinker with – operational control panels.
Critical infrastructure environments often cannot afford downtime, and end-of-life devices often remain in service long after support has ended. With those challenges in mind, below are some general recommendations for improving the security of critical environments:
Organizations should follow ICS/OT vulnerability announcements and apply patches as soon as they become available. Staying up to date with vendor updates and security advisories is critical to ensuring that vulnerabilities are addressed promptly.
Segregating ICS/OT/SCADA networks from other parts of the IT infrastructure can help prevent lateral movement in case of a breach. Implementing a Zero-Trust Architecture is also advisable to limit the potential for exploitation. Devices that do not need to be exposed to the internet should not be, and those that require web exposure should be protected to the extent possible.
Regular cybersecurity training for all personnel, particularly those with access to Operational Technology (OT) systems, can help prevent human error and reduce the risk of social engineering attacks.
Ongoing vulnerability scanning and penetration testing can help identify and address weaknesses before attackers exploit them. Engaging threat intelligence services and staying updated with vulnerability intelligence reports is essential for proactive defense.
Developing a robust incident response plan and conducting regular security drills ensures that organizations are prepared for a quick and coordinated response to any security incidents that may arise.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-12-06 09:07:252024-12-06 09:07:25Russian Hacktivists Increasingly Tamper with Energy and Water System Controls
The Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Known Exploited Vulnerabilities (KEV) Catalog, adding three critical flaws that are currently being actively exploited. These vulnerabilities impact a range of products, from industrial control systems (ICS) to web-based applications. The newly added vulnerabilities include CVE-2023-45727, CVE-2024-11680, and CVE-2024-11667, each affecting high-profile systems in industries such as manufacturing, telecommunications, and energy.
The first flaw added to the Known Exploited Vulnerabilities (KEV) catalog, CVE-2023-45727, affects North Grid’s Proself product suite, including versions prior to 5.62 of Proself Enterprise/Standard Edition, 1.65 of Proself Gateway Edition, and 1.08 of Proself Mail Sanitize Edition. The second vulnerability, CVE-2024-11680, affects ProjectSend, an open-source file management application.
The last vulnerability, CVE-2024-11667, impacts several Zyxel firewall products, including the ATP series, USG FLEX series, USG FLEX 50(W), and USG20(W)-VPN series, with versions prior to 5.38 being affected. Organizations using these products are urged to apply patches promptly to mitigate the risks associated with these vulnerabilities.
Technical Details of the Vulnerabilities
CVE-2023-45727: Proself Vulnerability in North Grid Proself Systems
One of the newly cataloged vulnerabilities, CVE-2023-45727, affects North Grid Corporation’s Proself product suite. Specifically, the vulnerability is found in versions prior to 5.62 of Proself Enterprise/Standard Edition, 1.65 of Proself Gateway Edition, and 1.08 of Proself Mail Sanitize Edition. This flaw allows attackers to exploit improper restrictions on XML External Entity (XXE) processing, which can lead to remote unauthenticated attacks.
By submitting specially crafted XML data, attackers can gain access to sensitive files, including those containing account information. This opens the door for data theft or manipulation. The CVSS score for CVE-2023-45727 is notably high, signaling the severity of this flaw.
CVE-2024-11680 addresses an issue in ProjectSend, an open-source file management application. Versions prior to r1720 of ProjectSend are vulnerable to improper authentication, allowing attackers to send malicious HTTP requests to the application’s configuration files.
Exploiting this flaw, attackers can bypass authentication mechanisms and gain unauthorized access to modify system configurations, create new accounts, and upload malicious content such as webshells and embedded JavaScript.
The critical nature of this vulnerability is highlighted by its CVSS score of 9.8, categorizing it as a high-risk flaw with the potential for extensive compromise if left unaddressed. Remote attackers do not require prior access or authentication to exploit this vulnerability, making it even more dangerous to organizations using ProjectSend versions below r1720.
CVE-2024-11667: Zyxel Path Traversal in Multiple Firewalls
The third vulnerability in CISA’s latest update is CVE-2024-11667, which affects several Zyxel firewall products. Specifically, the flaw resides in the web management interface of ATP series and USG FLEX series firewalls, as well as USG FLEX 50(W) and USG20(W)-VPN series devices. Versions of these products prior to 5.38 are susceptible to a path traversal vulnerability, which allows attackers to manipulate file paths and potentially download or upload arbitrary files.
The flaw could allow attackers to access sensitive files or upload malicious software onto affected devices. With a CVSS score of 7.5, this vulnerability is deemed high-risk but not as critical as CVE-2024-11680. However, for organizations relying on Zyxel products to secure their networks, addressing this flaw is essential to prevent unauthorized access and maintain the integrity of their firewalls.
Sector-Wide Impact of Known Exploited Vulnerabilities
These newly cataloged vulnerabilities stress the ongoing risks in industrial control systems (ICS) and critical infrastructure. For example, flaws in systems like Proself, ProjectSend, and Zyxel firewalls can expose vulnerable systems to a range of cyberattacks, including unauthorized access, data exfiltration, and service disruption. Such vulnerabilities are particularly concerning for sectors like energy, critical manufacturing, and telecommunications, where any disruption can have far-reaching consequences.
With CVE-2023-45727, CVE-2024-11680, and CVE-2024-11667 now added to the list of Known Exploited Vulnerabilities, organizations using these products must adopt upgraded cybersecurity measures to defend against attacks. Organizations are strongly encouraged to follow best practices in patch management, including regularly applying vendor-issued patches and updates.
For example, users of Proself should upgrade to newer versions that address the XXE vulnerability, while ProjectSend users should ensure they are running r1720 or later. Additionally, Zyxel firewall users should promptly update firmware versions to mitigate the path traversal flaw.
Mitigation and Recommendation Strategies
To mitigate the risks associated with these vulnerabilities, organizations are advised to implement several key cybersecurity measures:
Ensure that all systems are regularly updated with the latest security patches to reduce the risk of exploitation from Known Exploited Vulnerabilities.
Adopt a zero-trust model where all access requests are treated as potentially hostile, requiring stringent verification before granting access.
By segmenting networks, organizations can contain potential breaches and prevent attackers from moving laterally through critical systems.
Implement multi-factor authentication (MFA) to protect sensitive systems and reduce the likelihood of unauthorized access.
Regularly conduct vulnerability scans, penetration testing, and security audits to identify and address weaknesses before they can be exploited.
Conclusion
The recent updates to CISA’s Known Exploited Vulnerabilities catalog highlight the urgency to address critical security flaws in widely used products. The vulnerabilities in North Grid’s Proself, ProjectSend, and Zyxel firewall systems can expose businesses to a range of cyber threats, including unauthorized access, data theft, and system manipulation.
As these vulnerabilities can be leveraged for cyberattacks, organizations must apply timely patches, follow best practices in patch management, and adopt cybersecurity strategies. Implementing security measures such as multi-factor authentication, network segmentation, and regular vulnerability assessments will help organizations protect against potential breaches and reduce the risk of exploitation.
Welcome to this week’s edition of the Threat Source newsletter.
I am unbelievably lucky to do the work that I do. My title is technically ‘Senior Security Strategist’. It’s a very fancy title, but basically: I get to research threats with my colleagues and friends to keep people safe here at Talos. I also get to travel and talk to our customers and communities about that work and how we fight that good fight. This has taken me to some interesting places – from Ukraine to California and lots of places in between. Not bad for a guy from a small town in Alabama.
This gig isn’t for everyone. You must have some extroverted tendencies, and as the youth would say, some ‘rizz’. It’s not enough to talk about something like, say, ransomware. You need to be able to explain it in high technical detail if needed and then explain it to a board of C-levels and speak the language of business they understand. And you need to do it in an engaging way to keep your audiences bought in. It’s a unique blend of security practitioner expertise and the ability to communicate that to audiences, some technical, some not.
If you’re thinking this also requires some kind of social media influencer level of Hemsworth caliber good looks and hyper charisma, have no fear. I’m about as much a security influencer as Chris Farley was a Beverly Hills ninja. I am just a security nerd who likes to talk. Like I said – I’m very lucky.
Sometimes this gig takes you to very unexpected places. A couple of weeks ago I found myself at the Ford Foundation Center for Social Justice. I was there to attend and support the NGO-ISAC annual summit. The NGO-ISAC ‘is a non-profit organization improving the cybersecurity of US-based nonprofits.’ They do amazing work supporting cyber security for non-governmental organizations that help protect and promote civil society. We’re also fortunate at Talos to be a partner with them and donate time and resources to support their mission of helping the helpers.
We are proud to be partners and volunteer our time with NGO-ISAC and it’s members. If you ever want to be truly humbled, spend time with an NGO and learn about what they do. The energy and heart those people have is incredible and will inspire you. They help feed the hungry, cloth the homeless, protect refugees, promote democracies, and generally help take care of some of the most vulnerable people and institutions our society relies upon. They also traditionally struggle with cybersecurity – security investments and practitioner expertise can be difficult to obtain when your budgets are built upon donations to support your mission. They are the embodiment of fighting the good fight, and we at Talos will always have the time to help them help others.
While I was there, we debuted a custom NGO version of Backdoors & Breaches I helped co-develop with the NGO-ISAC. It was a real hit, and we ran demo games that resonated very well with the audiences. Helping teach cybersecurity to NGOs is fantastic. If we can help them stay secure, there’s so many others who will be helped by it. Also, keep your eyes peeled for a blog post in January about how we designed and created a custom expansion for Backdoors & Breaches.
Also, the Ford Foundation? Amazing building. It’s in the heart of NYC and is an island of pure serenity. They have an indoor atrium/park that is next level. They pipe in some absolute jazz bangers throughout the entire building that, mixed with the decor, exudes a class I’ve rarely encountered in my travels. If I could make a blanket out of that entire vibe and wrap myself up in it, I’d do it.
The one big thing
QR Codes, am I right? Sometimes you can scan one with your phone and maybe win a free cheeseburger, sometimes it can take you to a fake O365 phishing site. The tricky bit with QR codes in e-mails is how easily they can avoid spam filters. My man Jaeson Schultz did some great research on attacks, prevalence, and detection of QR codes in e-mail messages. The parts on AI-generated QR imagery are fantastic – be careful what you scan!
Why do I care?
E-mail phishing and evading defenses are a tried and tested tactic with attackers. QR codes are another method of attack, and because they can be difficult to defang/detect, defenders have to work extra hard to understand those threats and stop them.
So now what?
Exercise serious caution when scanning a QR code. If possible, detonate those suspicious QR code e-mails in a sandbox, like Threat Grid.
Top security headlines of the week
At least 97 major water systems in the US have serious cybersecurity vulnerabilities and compliance issues, raising concerns that cyberattacks could disrupt businesses, industry, and the lives of millions of citizens. (Dark Reading)
The NSA updated its mobile devices security best practices report. Reboot those phones at least once a week friends. (ZDNet)
The United States and other Western nations released guidance Tuesday designed to evict the China-linked group in the wake of the high-profile hack. (CyberScoop)
Vanja Svancer and Chetan Raghuprasad from Cisco Talos will both present, Vanja will be discussing Exploring Vulnerable Windows Drivers, while Chetan presents Sweet and Spicy Recipes for Government Agencies by SneakyChef.
Most prevalent malware files from Talos telemetry over the past week
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-12-05 19:06:562024-12-05 19:06:56The adventures of an extroverted cyber nerd and the people Talos helps to fight the good fight
Cyble Research and Intelligence Labs (CRIL) identified a malicious campaign targeting the manufacturing industry, leveraging a deceptive LNK file disguised as a PDF file.
This campaign leverages multiple Living-off-the-Land Binaries (LOLBins), such as ssh.exe, powershell.exe, and mshta.exe, to bypass traditional security mechanisms and remotely execute the next-stage payload.
The Threat Actor (TA) used Google Accelerated Mobile Pages (AMP) URL along with a shortened URL to evade detection by traditional URL scanners.
The attack heavily relies on file injection techniques, where the TAs execute malicious payloads directly in memory to bypass conventional security mechanisms.
The attack chain leverages DLL sideloading and IDATLoader to deploy the Lumma stealer and Amadey bot, enabling the attacker to gain control and exfiltrate sensitive information from the victim’s machine.
Overview
CRIL recently identified a multi-stage cyberattack campaign originating from an LNK file. The initial infection vector remains unknown; however, the attack likely begins with a spear-phishing email, prompting the recipient to click on a link that leads to an LNK shortcut file disguised as a PDF document. The file is hosted on a remote WebDAV share at
Upon searching for the file name “695-18121-002_Rev” on Google, we discovered a technical engineering drawing for a component. Additionally, we observed similar samples using the name “Instruction_18112,” which led us to another technical document detailing the installation of a chair. The malicious LNK file hosted on the URL impersonates LogicalDOC, a cloud-based document management system commonly used in Manufacturing and Engineering firms. Based on the targeting and nature of these attacks, we suspect that the campaign is likely targeting the manufacturing industry.
Once executed, the LNK file triggers a command to launch ssh.exe, which subsequently runs a PowerShell command. This PowerShell command fetches and executes an additional malicious payload from a remote server using mshta.exe.
The remote server is accessed via a URL that abuses Google’s Accelerated Mobile Pages (AMP) framework, combined with a shortened URL that redirects to a location hosting malicious PowerShell code.
The PowerShell code then triggers another malicious script hosted on Pastebin, controlled by the TA. This script contains an encoded PowerShell command that downloads a ZIP archive to the Temp directory, extracts its contents, and executes a legitimate executable. The executable, in turn, sideloads a malicious DLL file.
In this sophisticated campaign, the TA uses multiple stages of code injection to deploy the Lumma stealer, which then downloads the Amadey Bot onto the victim’s system. The figure below shows the infection chain.
Figure 1 – Infection chain
Technical Analysis
Threat Actors are increasingly exploiting LNK files as their initial vector for malware distribution due to their flexibility in executing various commands. In this campaign, they specifically leveraged the Windows SSH client (C:WindowsSystem32OpenSSHssh.exe) as an alternative target in the LNK file’s “Target” field. This approach reduces the likelihood of detection compared to using cmd.exe or powershell.exe as the target. The image below shows the LNK command.
Figure 2 – LNK using SSH as a target
When a user opens the disguised LNK file, it triggers “ssh.exe” to run a PowerShell command through the ProxyCommand option in ssh.exe. The embedded PowerShell command contains obfuscated content, as shown in the image above. The de-obfuscated code attempts to execute PowerShell content hosted at the AMP URL “hxxps://www.google[.]ca/amp/s/goo.su/IwPQJP” using mshta.exe. In this case, the hosted content contains AES-encrypted data, as shown in the image below.
Figure 3 – AES-encrypted content hosted in AMP URL
Upon decryption, the data reveals Base64-encoded content, which is displayed in the image below.
Figure 4 – Base64-encoded content
The decoded Base64 content reveals an obfuscated PowerShell command, as shown in the image below.
Figure 5 – Obfuscated PowerShell command
This PowerShell command manipulates security protocols and performs the following actions:
First, it configures various security protocols, including TLS 1.0, TLS 1.1, TLS 1.2, and SSL 3.0, using the .NET ServicePointManager class.
Then, it initiates a web request using Invoke-WebRequest (iwr) to fetch a payload from the URL hxxps://Pastebin[.]com/raw/0v6Vhvpb, which is then immediately executed using Invoke-Expression (iex).
The image below shows the retrieved payload from the Pastebin URL.
Figure 6 – Partial PowerShell script fetched from the Pastebin URL
The retrieved content from the Pastebin link consists of a PowerShell script that performs several actions:
The script begins by sanitizing the content fetched from Pastebin, removing newline characters (“n”) and commas (,).
The cleaned string is then decoded from Base64 into binary data.
Using a hardcoded decryption key, the script decrypts the binary data.
Once decrypted, the script extracts a portion of the data starting from the 64th byte to the end, which is the actual code to execute. This code is then converted into a readable PowerShell command using UTF-8 encoding.
Before executing the decoded command, a 2-second delay is introduced with Start-Sleep. Finally, the decoded PowerShell command is executed in memory using Invoke-Expression.
The image below shows the decrypted PowerShell code extracted using the above steps.
Figure 7 – Decrypted PowerShell code
The newly introduced script represents the final stage in delivering malicious files to the system. The script operates as follows:
The script first verifies the system’s internet connectivity by sending HTTP requests to two distinct domains: 360.net and baidu.com. These requests ensure the system is online before proceeding with further actions.
Once the victim’s system is connected to the internet, the script downloads a malicious CPL file named naailq0.cpl from the remote URL hxxps://berb.fitnessclub-filmfanatics.com/naailq0.cpl.
The downloaded CPL file is saved as a ZIP file within the Temp directory. This ZIP file is then copied to a newly created folder under the LocalAppData folder. The folder name is dynamically generated using a GUID (Globally Unique Identifier).
After extraction, the script scans the folder for any executable files (EXEs). Any EXE files found within the extracted contents are then executed.
The script includes a commented-out line that, if activated, would delete the extracted files and folder after execution, potentially covering its tracks.
The image below shows the contents of the downloaded ZIP file. The ZIP file also contains encrypted files, which will be decrypted and loaded in the subsequent stages of infection.
Figure 8 – Extracted files in the archive
In this case, the script executes “syncagentsrv.exe”, which performs DLL sideloading by loading the malicious “Qt5Network.dll” upon execution. The malicious DLL then reads an encrypted file named “shp” from the same directory, decrypts its contents, and reveals strings such as LoadLibraryA, VirtualProtect, and dbghelp.dll, as shown in the figure below.
Figure 9 – Decrypted content
After decryption, the malicious DLL extracts the string “dbghelp.dll” from the decrypted content and utilizes it to load the DLL via the LoadLibraryA API. The “dbghelp.dll” is a Microsoft Windows library designed for debugging and managing symbol information. After loading the DLL, the malicious code employs the VirtualProtect API to modify the memory region permissions of “dbghelp.dll” to PAGE_EXECUTE_READWRITE, as illustrated below.
Figure 10 – Modifying permission of dbghelp.dll
It then overwrites the contents of “dbghelp.dll” with the decrypted data and subsequently modifies the memory protection of the overwritten region to PAGE_EXECUTE_READ, as depicted below.
Figure 11 – Modifying the permissions of dbghelp.dll
After modifying the memory protection, the malicious code begins executing the injected content within “dbghelp.dll“. The injected code then proceeds to read another file named “bwvrwtn“, located in the same directory. The file “bwvrwtn” is an encrypted IDAT file containing multiple encrypted chunks, each prefixed with the string “IDAT,” as illustrated below.
Figure 12 – IDAT marker
The DLL now searches the strings IDAT, takes four bytes following IDAT, and performs a comparison with C6 A5 79 EA. If the comparison is successful, the DLL proceeds to copy all the data following IDAT into memory, decrypts it using the XOR key, and then decompresses the decrypted content using the RTLDecompressBuffer API, as shown below.
Figure 13 – Decompressed data
It then loads a legitimate “pla.dll” from the %syswow64% directory using the LoadLibraryW API. After loading, it changes the memory permissions of “pla.dll” to PAGE_EXECUTE_READWRITE, copies the decrypted content into its memory, changes the permissions to PAGE_EXECUTE_READ, and finally executes the injected code in the “pla.dll” as shown below.
Figure 14 – Executing the injected code
The code within “pla.dll” proceeds to inject malicious code into “more.com” and then executes it. The malicious code in “more.com” is responsible for deploying the final payload by injecting it into a newly created process, “msiexec.exe.” The injected payload is Lumma Stealer – which is capable of stealing sensitive information from the victim’s machine. The figure below shows the memory string of “msiexec.exe” containing Lumma Stealer’s C2 details.
Figure 15 – Msiexec Process memory strings
Amadey Bot
The TA behind this campaign also deploys the Amadey bot in the “%temp%” directory, employing the same technique of injecting code into “more.com.” This injected code further injects the final Amadey bot payload into “explorer.exe“. To achieve persistence, the malware creates a Task Scheduler entry named “NodeJS Web Framework.” This task is configured to execute a copy of the Amadey bot stored in the %Appdata% directory, as illustrated below.
Figure 16 – Task Scheduler for Persistence
The figure below shows the execution flow of Lumma Stealer and Amadey bot.
Figure 17 – Execution Flow
Conclusion
This multi-stage cyberattack campaign demonstrates the increasing sophistication and adaptability of threat actors. By leveraging various evasion techniques such as URL shortening and AMP URLs, the attackers successfully bypass traditional security mechanisms.
The use of legitimate system tools like ssh.exe and mshta.exe to execute malicious PowerShell commands further illustrates the complexity of the attack. The final payload, which involves the deployment of both Lumma stealer and Amadey bot, highlights the TA’s intent to steal sensitive information and maintain persistent control over compromised systems.
Yara and Sigma rule to detect this campaign, available for download from the Github repository.
Recommendations
The initial breach may occur via spam emails. Therefore, it’s advisable to deploy strong email filtering systems to identify and prevent the dissemination of harmful attachments.
Exercise caution when handling email attachments or links, particularly those from unknown senders. Verify the sender’s identity, particularly if an email seems suspicious.
Disable WebDAV if it is not required for business operations to minimize potential attack vectors.
Consider disabling the execution of shortcut files (.lnk) originating from remote locations, such as WebDAV links, or implementing policies that require explicit user consent before executing such files.
The campaign abused the legitimate ssh utility; hence, it is advised to monitor the activities conducted by the ssh utility and restrict access to limited users.
Consider limiting the execution of scripting languages, such as PowerShell and mshta.exe, on user workstations and servers if they are not essential.
Implement application whitelisting to ensure only approved and trusted applications and DLLs can be executed on the systems.
Monitor AMP links using advanced URL filtering and threat intelligence feeds to detect suspicious activity.
Set up network-level monitoring to detect unusual activities or data exfiltration by malware. Block suspicious activities to prevent potential breaches.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-12-05 12:07:432024-12-05 12:07:43Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot
Recently, our analyst team shared their research into a zero-day attack involving the use of corrupted malicious files to bypass static detection systems. Now, we present a technical analysis of this method and its mechanics.
In this article, we will:
Demonstrate how attackers corrupt archives, office documents, and other files
Explain how this method successfully evades detection by security systems
Show how corrupted files get recovered by their native applications
Let’s get started.
Sandbox Analysis of a Corrupted File Attack
To first see how such attacks unfold, we can upload one of the corrupted filles used by attackers to ANY.RUN’s sandbox.
Analysis of a corrupted docx file in the ANY.RUN sandbox
Thanks to its interactivity, the sandbox lets us simulate a real scenario of user opening the broken malicious file inside the file’s corresponding application.
Word asking to restore a corrupted file
In our case, it’s a docx file. When we open it with Word, the program immediately offers us the option to recover the content of the file and successfully does it.
ANY.RUN allows you to manually open a broken file with Word
Inside, we find a QR code with a phishing link. The sandbox also automatically detects malicious activity and notifies us about this.
Black Friday 2024: Get up to 3 sandbox licenses for free
How Corrupted Files Bypass Antivirus Software and Other Automated Solutions
Analysis inside the ANY.RUN sandbox showed how a corrupted file gets restored thanks to Word’s built-in recovery mechanisms, which allows us to identify its malicious nature.
VirusTotal shows no detections for such corrupted files
The answer is simple: most antivirus software and automated tools arenot equipped with the recovery functionality that is found in applications, such as Word. This prevents them from accurately identifying the type of the corrupted file, resulting in a failure to detect and mitigate the threat.
Docx is not the only file format used by attackers. There are also corrupted archives with malicious files inside, which easily bypass spam filters because security systems cannot view their contents due to corruption.
Once downloaded onto a system, tools like WinRAR easily restore the damaged archive, making its contents available to the victim.
Now, let’s see how exactly it works on a technical level.
Technical Analysis of a Corrupted Word Document
The Structure of a Word Document
Since the mid-2000s, office documents (OpenOffice.org 2.0 — released in 2005) have been structured as archives containing the document’s content.
In the image below, you can see the structure of a Word document.
Word document structure (Figure 1)
As we can see, all structures within this archive are interconnected, and this relationship begins from the end.
At the end of the archive, there is a structure called the End of Central Directory Record (EOCD). This structure contains information about the size of the Central Directory File Header (CDFH), its offset, and the total number of entries in the archive. This structure helps locate the CDFH.
The CDFH duplicates the data stored in the Local File Header (LFH) and the offsets to it. Yet, this structure does not contain the compressed data itself but rather represents a hierarchy of files within the archive. This part of the structure allows you to find the LFH of each file in the archive.
The LFH is considered the header for each file in the archive. It contains important data such as the file name, compressed and uncompressed sizes, CRC32 checksum, and other parameters.
The compressed data is located after the header.
How the File Structure Can Be Manipulated by Attackers
As shown in the image above (Figure 1), the archive is structured backward, starting with the end, while all parts are linked together.
This has led us to test three different hypotheses (Figure 2):
Three hypotheses we tested (Figure 2)
1. Can Word or an archiving program recover and successfully open a file if additional data is added to the beginning of the archive?
2. Can Word or an archiving program recover and successfully open a file if we corrupt the linking between the parts and delete the CDFH, which does not contain the file data itself?
3. Can Word or an archiving program recover and successfully open a file if we corrupt the linking between the parts and erase the EOCD, which is a crucial part of the recovery process?
You can see the results of our hypothesis testing in the table below.
Word
ZIP
Hypothesis 1
Success
Fail (the file is no longer an archive)
Hypothesis 2
Success
Success
Hypothesis 3
Success (thanks to undamaged Local File Headers)
Success (thanks to undamaged Local File Headers)
During our hypothesis testing, we’ve made several noteworthy observations:
1. For minimal recovery of a Word document, the following files are essential:
[Content_Types].xml,
Word/document.xml,
word/_rels/document.xml.rels,
_rels/.rels;
These contain crucial information regarding the relationships between elements and form the standard file hierarchy required for Word to interpret the document.
2. A ZIP archive with corrupted Local File Headers will only show the file structure. The actual file content will be empty.
3. If the end part of the ZIP file is damaged, the archiving software and Word will attempt to use an alternative recovery method: by leveraging intact Local File Headers.
Our findings demonstrate that Word is more resilient to file corruption than ZIP. While Word successfully recovered files with corrupted CDFH, EOCD, and even when random bytes were added to create a non-existent LFH structure, ZIP failed in the first hypothesis, where random bytes were added to the beginning of the file.
Why Security Systems Fail to Read Corrupted Files
Security systems attempt to identify file types, including by using Magic Bytes in File Headers. In the case of office documents and ZIP archives, because the file effectively starts from the end, we can corrupt the archive structure and magic bytes, making it difficult for detection systems to identify the file type.
This leads to the inability to unpack and inspect the contents.
ANY.RUN’s Sandbox identifies malicious activityof the corrupted file
The sandbox once again has no problem detecting the threat, returning a “malicious activity” verdict.
Only one detection in VirusTotal
But, when run in VirusTotal, almost zero threat detections come back for this file.
Learn to analyze cyber threats
See a detailed guide to using ANY.RUN’s Interactive Sandbox for malware and phishing analysis
Read full guide
Conclusion
Our study revealed a vulnerability in document and archive structures. By manipulating specific components like the CDFH and EOCD, attackers can create corrupted files that are successfully repaired by applications but remain undetected by security software. As a result, we face a situation when security systems have not yet developed a clear logic for detecting such attacks, exposing the security of their users.
About ANY.RUN
ANY.RUN helps more than 500,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, YARA Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.
With ANY.RUN you can:
Detect malware in seconds
Interact with samples in real time
Save time and money on sandbox setup and maintenance
Just a decade ago, people who taped over their webcam were seen as a little eccentric, shall we say. Fast forward to today, and many laptop models feature a built-in privacy shutter that lets you cover the webcam with a single swipe. Useful, yes – but if the mic is still on, the overall benefit is less clear. Is it still worth covering your webcam in 2024, or is such practice a relic of the past?
Spies in the woodwork
Ever heard of spyware? That’s what we call Trojans designed for spying and stalking. And just like they did ten years ago, many members of this family are still spying on victims through their webcam and mic. Back then, however, malware was limited mostly to taking webcam screenshots, while today, besides this, it can steal passwords from the clipboard, intercept keystrokes, remotely control your device, and play cat-and-mouse with security solutions (but not with ours). One example is the SambaSpy Trojan, which was recently discovered by our experts.
As for peeping, attackers’ motives can vary: some are just voyeurs; others might organize commercial surveillance against a CEO; still others might add such functionality to their malware on the off-chance that something interesting crops up.
Tracking can take many forms, and we’ve covered them all many times. But how to defend yourself? There are many protection methods, but they can all be divided into two groups: physical and software. Meanwhile, for those without reliable protection, covering the webcam, turning off the mic, and checking the permissions granted to newly installed programs is a no-brainer.
How to physically guard against webcam and mic surveillance
Physical protection methods are both useful and inconvenient at the same time, and compromises have to be made to ensure your privacy. What to do?…
Buy a device without a webcam or mic
Just think: intruders won’t be able to spy and eavesdrop even if they somehow get malware onto your device. But it’s hard to find such devices these days, and in most cases they’ll be either outdated or very low-performance. That said, some companies are modifying smartphones on the market by removing cameras: how do you like, for example, the non-camera iPhone? Such devices are in high demand at government and military agencies and restricted-access facilities, and even by highly religious people.
Disable the webcam and mic
Owners of desktop computers, nettops, or the above-mentioned laptop models without built-in webcam and mic can use external wired accessories. The most reliable option would be to disconnect them with a physical switch or pull them out of the socket when not in use. But there’s a danger of laziness creeping in: some users won’t bother doing it more than a couple of times, which is when RATs and nasties can appear.
In addition, there are tons of online guides on how to physically disable the laptop webcam or mic yourself. But not all devices make the procedure painless: for example, modern MacBooks use the camera as a sensor, and go into Safe Mode if it’s disabled. And once it is disabled – there’s no way back.
Opt for a “super-private” device
Some companies – such as Purism – make laptops with hardware switches that let you physically turn off the camera, microphone, Wi-Fi, or Bluetooth. However, they’re expensive, and demanding users are often left dissatisfied with the features available.
Cover the webcam
A good and common option – but not foolproof. Sure, it will thwart video surveillance, but the sound from the mic can still be potentially eavesdropped and used against you. Cover the microphone too? Modern laptops often have several mics to enhance sound quality, and taping over them all will be difficult. In some models, however, built-in microphones are disabled when you connect an external one. A life hack for them is to plug a dummy into the microphone jack (or the universal jack for mics and headphones). Your laptop will think that an external mic is connected and turn off all its built-in ones.
Software protection against tracking
In most cases, software protection is more convenient than physical – but not always as reliable.
Disable the built-in webcam and mic in the BIOS/UEFI
On many PC-compatible laptops – especially business models – you can go into the BIOS/UEFI settings at startup (if this sounds Greek to you, just scroll to the next method), find there the lines Integrated camera, Camera, Webcam, CMOS camera, Microphone or similar, and select Disabled mode. This is a good way to restrict laptop-based spying, but there’s a catch: you’ll have to reboot and undo everything should you ever need to video-call someone.
Disable devices in the OS settings
On a Windows PC, you need to do this in Device Manager. In the Start menu, go to Device Manager, find there Cameras or Audio inputs and outputs, right-click the device you need and select Disable device. You can just as easily turn it back on later, if necessary. This is much faster than rebooting the computer every time and poking around in the BIOS – but where’s the guarantee that a Trojan can’t do the same thing and turn the camera back on?
Disabling a built-in webcam and microphone in Windows Device Manager
Control permissions
Android device owners can view information about dangerous and special permissions in the Permissions section in Kaspersky for Android: All functions → My apps → Permissions. This way, only apps authorized by you will have access to the camera and microphone.
Viewing permissions in Kaspersky for Android
iOS devices offer similar functionality. To check permissions, open the Settings and go to Privacy & Security. In the menu that opens, like in Android, you can view app permissions.
Viewing permissions on iPhones
Users of the Windows versions of our Kaspersky Standard, Kaspersky Plus and Kaspersky Premium can protect their devices against webcam and microphone tracking with Webcam and Mic Control, which lets you configure your own access settings: Gear icon at the bottom of the Home window → Privacy Settings → Webcam and Mic Control Settings. There you can ask Kaspersky to:
Notify you when an app uses the camera or microphone.
Deny access for all apps without exception.
Allow only trusted apps to connect to the webcam and microphone.
Webcam and Mic Control Settings on a Windows device
Mac owners too have the option to completely block the webcam with Kaspersky Standard, Kaspersky Plus, and Kaspersky Premium: Home → Block Webcam. Our application completely blocks access to system libraries used by the webcam, so no programs can access it.
Block Webcam on a Mac device
Protect yourself
Physical or software protection — the choice is yours, but we recommend a combination of the two. For example, buy a webcam shutter and configure Kaspersky to disable the mic. The main thing is that your device – whether a smartphone, laptop or desktop – must be properly protected.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-12-05 11:06:412024-12-05 11:06:41How to guard against webcam and microphone tracking | Kaspersky official blog
A coalition of cybersecurity agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), Australia’s Australian Signals Directorate (ASD), the Australian Cyber Security Centre (ACSC), as well as counterparts from Canada and New Zealand, has issued a hardening guidance to strengthen communications infrastructure against cyber espionage and other malicious cyber activities.
This hardening guidance focuses on visibility enhancements and hardening practices for network devices. It aims to help engineers and defenders safeguard their systems from the growing threats posed by China-affiliated threat actors. The latest intelligence reports reveal that Chinese hackers have compromised networks of major telecommunications providers globally, conducting extensive cyber espionage campaigns.
These groups have been targeting vulnerabilities in telecommunications networks, gaining unauthorized access to sensitive data. This activity aligns with known weaknesses in existing network infrastructure and highlights the urgent need for organizations to address security gaps.
The agencies involved in this effort, including the ASD and the ACSC, emphasize that while the tactics used by these threat actors are not novel, their success stems from exploiting well-established vulnerabilities in communications infrastructure. The newly issued hardening guidance, therefore, provides actionable steps for network engineers and defenders to strengthen visibility, detect malicious activities, and harden systems against future exploitation.
Hardening Guidance: Enhancing Visibility in Communications Networks
One key strategy in this guidance is to improve visibility across communication networks. For organizations to effectively monitor, detect, and respond to cyber threats, they must have thorough insight into network traffic, user behavior, and overall data flow. High visibility enables swift identification of anomalies that may indicate a cyber intrusion, allowing defenders to take immediate action.
Monitoring Network Configurations and Changes
Network engineers are advised to closely monitor configuration changes in critical network devices, such as routers, switches, and firewalls. Any alterations outside the formal change management process should raise red flags. Additionally, regular audits and monitoring for unusual activities, such as unauthorized changes to routes or protocols, can help detect malicious intrusions early.
Centralized Configuration Management
The guidance recommends centralizing configurations and storing them in a secure, centralized location. This prevents devices from becoming the sole source of truth for their own configurations, which could be manipulated in the event of a breach. Network engineers should also implement strong network flow monitoring solutions to gain insights into the ingress and egress points of data across the network.
Monitoring Accounts and Logging
A proactive approach to monitoring user accounts and logins is also essential for mitigating threats. Monitoring anomalies in user and service account activity—such as abnormal login times, failed login attempts, or logins from unexpected locations—can help identify malicious actors who have gained unauthorized access to the network.
Organizations should also ensure that logging mechanisms are vigorous, secure, and centralized. Logs should be encrypted in transit and stored off-site to prevent tampering. Using Security Information and Event Management (SIEM) systems is encouraged to help analyze logs and correlate data from various devices for rapid incident detection.
Hardening Network Systems
Beyond improving visibility, securing the underlying network systems through hardening is a critical defense strategy. Hardening aims to reduce vulnerabilities by ensuring that network devices and protocols are securely configured to minimize the attack surface. The collaboration between CISA, ACSC, and other agencies has provided valuable hardening guidance that organizations can apply to their communications infrastructure.
Isolated Management Networks
One of the most critical recommendations in the guide is the use of out-of-band management networks. By ensuring that network infrastructure devices can only be managed from physically separate, trusted networks, organizations can prevent the lateral movement of hackers within their systems. This isolation limits the potential impact of a breach, as attackers cannot easily move between devices on the network once one device has been compromised.
Segmentation and Access Control
Segmentation of networks into isolated zones, such as using Virtual Local Area Networks (VLANs) and private VLANs (PVLANs), helps protect critical systems and restricts access to sensitive data. Access Control Lists (ACLs) should be configured with a default-deny policy to control both inbound and outbound traffic, ensuring that only authorized connections are allowed.
Securing Virtual Private Networks (VPNs)
The guidance stresses the importance of securing VPN gateways by limiting their exposure to the internet and enforcing strong cryptographic protocols for key exchange and data encryption. VPNs should be configured to only allow strong authentication methods, and unused cryptographic algorithms should be disabled to reduce the risk of exploitation.
Proactive Authentication and Account Management
In addition to securing network devices, organizations should focus on improving authentication methods to ensure that only authorized users can access their networks. Implementing phishing-resistant multi-factor authentication (MFA) for all users, especially those with administrative privileges, is one of the primary strategies to prevent unauthorized access.
The guidance also emphasizes the importance of strong password policies, including the use of secure hashing algorithms and the requirement to change default passwords immediately upon deployment. Additionally, organizations should regularly review user accounts to ensure that inactive or unnecessary accounts are removed, and all accounts are assigned the minimum necessary permissions.
Conclusion
Adopting a “secure by design” approach is crucial for software manufacturers to enhance the security of their products and reduce the need for customers to manually implement hardening measures.
As cyber threats, especially Chinese threat actors, continue to target global organizations, collaboration between international agencies like CISA, ACSC, and other stakeholders is important to protect global communications infrastructure. Australia’s leadership, through agencies such as the ASD and ACSC, plays an important role in fighting cybercrime.
By focusing on hardening guidance, improving visibility, and working together internationally, organizations can strengthen their security posture, mitigate vulnerabilities, and contribute to the collective global effort to protect digital life.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-12-04 15:06:352024-12-04 15:06:35Australia’s ACSC and ASD Team Up with CISA, NSA, FBI, and International Allies to Protect Communications Infrastructure
The recent Weekly Industrial Control System Vulnerability Intelligence Report from Cyble Research & Intelligence Labs (CRIL) covers the vulnerabilities disclosed by the Cybersecurity and Infrastructure Security Agency (CISA) from November 26, 2024, to December 02, 2024.
The report sheds light on online threats, especially vulnerabilities affecting critical systems such as those from Schneider Electric and Hitachi Energy, two of the most prominent vendors in the ICS sector. During the report’s timeframe, CISA issued five major security advisories, focusing on 12 vulnerabilities that impact a wide range of ICS products.
These vulnerabilities have been identified in devices and systems from key vendors, including Schneider Electric and Hitachi Energy. The vulnerabilities identified in these systems are critical to address due to their potential to expose vital infrastructures to cyberattacks.
Schneider Electric: A Major Focus for ICS Vulnerabilities
Schneider Electric, a leading vendor of control systems, was prominently featured in the advisories due to the numerous vulnerabilities impacting their devices. These vulnerabilities range from issues with weak password recovery mechanisms to the use of hard-coded credentials, both of which pose a risk to the integrity of ICS devices.
Among the affected products is the PM5560 series, which includes multiple versions susceptible to vulnerabilities like weak password recovery mechanisms for forgotten passwords (CVE-2021-22763). This flaw, coupled with improper authentication (CVE-2021-22764), increases the potential for unauthorized access. Such vulnerabilities undermine the effectiveness of ICS security, allowing attackers to potentially take control over critical systems like actuators, sensors, and power supplies.
One particularly concerning vulnerability (CVE-2023-6408) affects the Modicon M340 CPU and other related Schneider Electric products. This vulnerability arises from improper message integrity enforcement during transmission across communication channels, which could allow attackers to manipulate the integrity of communications between devices, creating openings for man-in-the-middle attacks. The high-severity nature of this vulnerability highlights the ongoing need for organizations to implement stronger security practices, including effective patch management and encryption protocols.
Additionally, Schneider Electric’s use of hard-coded credentials (CVE-2023-6409) in its devices presents a high-risk issue, making it easier for attackers to gain access to systems. This particular vulnerability is found in several product lines, including the Modicon M580 and Modicon M340 CPUs, which are integral to many ICS operations. These devices are widely used in critical sectors such as energy and manufacturing.
Hitachi Energy: Security Flaws in SCADA and Control Systems
Another major player in the ICS sector, Hitachi Energy, also faced critical security challenges during the same reporting period. The vulnerabilities affecting Hitachi’s MicroSCADA Pro/X SYS600 system are especially concerning because they affect key operational components within control systems and supervisory control and data acquisition (SCADA) environments.
These vulnerabilities could allow attackers to bypass authentication (CVE-2024-3982), potentially gaining unauthorized access to control systems that are vital for managing electricity grids and other industrial processes. Additionally, path traversal vulnerabilities (CVE-2024-3980) were identified, which could allow an attacker to manipulate file paths within the system, gaining unauthorized access to sensitive files.
These vulnerabilities are classified as high and critical risks, as they could be exploited by attackers to infiltrate ICS systems, causing online disruption to operations. A notable vulnerability in Hitachi Energy’s systems is the authentication bypass by the capture-replay flaw (CVE-2024-3982), which allows attackers to bypass authentication mechanisms by replaying captured credentials.
Given the high-security requirements of control systems like SCADA, the existence of this vulnerability calls for immediate attention from organizations to ensure these critical systems remain secure. The MicroSCADA Pro/X SYS600 system is also affected by a missing authentication for critical functions (CVE-2024-7940) vulnerability. This flaw could enable attackers to exploit critical functions within the system without proper authentication, allowing them to manipulate system settings or gain unauthorized access to sensitive data.
The Severity of ICS Vulnerabilities
The vulnerabilities analyzed in the CRIL report show that the majority of the vulnerabilities in ICS systems fall under high severity. This highlights the critical need for organizations operating ICS devices to adopt proactive cybersecurity measures. Weak passwords, improper authentication, and hard-coded credentials are among the most common issues found across various ICS products. Addressing these vulnerabilities requires rigorous patch management practices, including regular updates and configuration checks.
The vulnerabilities disclosed by CISA and highlighted in the report are particularly important as they impact critical infrastructure sectors such as energy, critical manufacturing, and communications. Schneider Electric and Hitachi Energy alone account for a notable portion of the vulnerabilities in the ICS space, underlining the need for greater focus on security within the industrial sector.
Impact on Critical Infrastructure Sectors
A sector-wise analysis of the vulnerabilities reveals that Critical Manufacturing accounts for the largest portion of vulnerabilities, with an overwhelming 83.3% of the cases. This is due to the expansive operations and critical nature of manufacturing processes that rely heavily on ICS.
In contrast, the Energy sector, which includes power grids and electrical infrastructure, accounts for 8.3% of the reported vulnerabilities, while the Wastewater Systems sector is also impacted with a similar share. The Commercial Facilities sector reports the smallest share, with only 0.8% of the vulnerabilities.
This distribution denotes the varied risk levels across critical infrastructure sectors and emphasizes the importance of prioritizing cybersecurity efforts, particularly in manufacturing and energy, where ICS vulnerabilities could lead to more severe consequences.
Mitigation Strategies and Recommendations
Here are some of the best practices recommended to mitigate potential risks:
It is essential to regularly update systems and apply patches as soon as they are released. Many vulnerabilities in ICS are a result of outdated software or firmware, which can be addressed by keeping systems up to date.
Implementing a zero-trust security model is crucial in preventing unauthorized access. This involves treating every request for access as if it originates from an untrusted source, requiring strict verification before granting access.
By segmenting networks, organizations can limit the ability of attackers to move laterally across systems, thus reducing the risk of widespread damage.
Strengthening authentication protocols, such as using multi-factor authentication (MFA), is critical to reducing the likelihood of unauthorized access to ICS devices.
Continuous security assessments through vulnerability scans, penetration testing, and audits help identify potential security gaps in ICS before they can be exploited by attackers.
Organizations should invest in cybersecurity training programs for employees to ensure they are aware of the risks posed by phishing, social engineering, and other attack methods.
Conclusion
The vulnerabilities in ICS highlighted in the latest report from CISA, along with those analyzed by Cyble Research & Intelligence Labs, highlight the increasing risks faced by critical infrastructure sectors. With vulnerabilities in high-severity products from vendors like Schneider Electric and Hitachi Energy, it is important that organizations address these potential threats before they can compromise sensitive information.
By implementing security measures, including effective patch management, strong authentication protocols, and comprehensive training programs, organizations can better protect their ICS systems from cybersecurity risks.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-12-04 15:06:342024-12-04 15:06:34Vulnerabilities in ICS: A Detailed Analysis of Recent Security Advisories and Threats
Finding information on specific cyber threats in a vast amount of data can be challenging. Threat Intelligence Lookup from ANY.RUN simplifies this task with wildcards and operators that provide you with the ability to create flexible and precise search queries.
Let’s take a look at how you can use them to identify and collect intel on malware and phishing attacks more effectively.
About Threat Intelligence Lookup
Main page of TI Lookup
Threat Intelligence (TI) Lookup is a fast and efficient tool designed to simplify cyber threat investigations. It allows for flexible searches for Indicators of Compromise (IOCs), Indicators of Attack (IOAs), and Indicators of Behavior (IOBs).
TI Lookup provides access to a constantly updated database of threat data collected from millions of public malware and phishing samples analyzed in ANY.RUN’s Interactive Sandbox.
Each sandbox session contains detailed logs of system and network events that occur while a threat is executing. By searching through this comprehensive data, you can easily find connections between seemingly unrelated pieces of information and tie them to a specific threat.
Here’s how TI Lookup can help you and your organization:
Investigate Threats Quickly: Gather extensive and in-depth information on emerging and persistent cyber threats with over 40 search parameters (e.g. threat names, command lines, registry logs, etc.).
Receive Real-Time Updates: Stay informed with real-time updates on results for your search queries.
Enrich Threat Intelligence: Get relevant context, indicators, and samples manually analyzed by threat analysts.
Black Friday 2024: Get 2x search requests for your TI Lookup plan
Search operators are essential tools in TI Lookup that allow you to combine several indicators to refine your search queries effectively. They act as logical connectors that help you specify the relationships between different conditions in your search and achieve greater flexibility and precision in your searches.
TI Lookup supports logical operators like AND, OR, and NOT, as well as grouping with parentheses. Let’s take a closer look at each of these.
AND
What it does
The AND operator helps you combine multiple conditions.
Why use it
AND is great for narrowing down your search to find threats by including as many unique indicators as possible.
It is equally effective in situations when you have several completely disparate artifacts, like an IP address and a mutex, and want to link them to a particular threat.
This query is designed to search for sandbox sessions where both thum[.]io and logo[.]clearbit[.]com domains were found.
Thum[.]io is a real-time website screenshot generator.
logo[.]clearbit[.]com is a service for fetching company logos.
TI Lookup lets you navigate to the ANY.RUN sandbox to see and run analysis of each sample
TI Lookup almost instantly provides results: associated IP addresses and sandbox sessions, all of which contain a “malicious activity” label and a “phishing” tag.
We can click any session of our interest to investigate the threat further.
The phishing page contains a fake form for stealing victim’s credentials
By reviewing the analysis report, we can spot that this is a cyber attack which uses thum[.]io to dynamically generate phishing pages with the backgrounds of a website that coincides with that of the victim. Attackers also use logo[.]clearbit[.]com to add corresponding company logos to make fake pages appear more legitimate.
OR
What it does
The OR operator helps return matches where at least one of the given conditions is found.
Why use it
OR is excellent in situations when you are not sure which one of two indicators is related to a threat. It is also useful for broadening your search to include results where both indicators are found, but necessarily together in the same session.
You see how these mutexes are used by exploring their corresponding sandbox sessions
It searches for entries where the synchronization object name is “DocumentUpdater” or “PackageManager”. If you’re investigating a threat that could be using either of these sync objects, this query ensures you don’t miss any relevant information.
TI Lookup shows that the synchronization objects are mutexes and provides sandbox sessions where they were previously discovered.
NOT
What it does
The NOT operator excludes results that match the specified condition.
Why use it
NOT is helpful when you want to refine your search and see sandbox sessions where no certain item, like a domain or file name, was observed.
This query searches for sandbox sessions and their related data where the process “mshta.exe” was observed along with connections to destination ports of either 80 or 443. The parentheses ensure that the OR condition is processed first, making the search more precise.
You can explore domains, IPs, synchronization objects, events, files, and other details related to the query
TI Lookup returns a wealth of threat data related to our query. Some of the results include malicious domains and IP addresses, as well as a list of network threats detected during analyses.
Wildcard Characters
Wildcards in TI Lookup act as placeholders in your search queries. They can represent different types of character sequences.
Asterisk (*)
What it does
The asterisk represents any number of characters, including none. This means it can stand in for zero, one, or multiple characters. The asterisk is added by default at the start and end of each query, so you in most cases there is no need to enter it manually.
Why use it
The asterisk is great for when you’re not sure about the exact content of a string. It helps you find matches even if there are unknown parts or certain variations in your query string.
This query searches for sandbox sessions where the command line includes paths to specific script files located in the C:UsersPublic directory. The scripts must be of types .vbs (Visual Basic Script), .bat (Batch file), and .ps1 (PowerShell script).
Yet, the names of these scripts are replaced with the asterisk wildcard, representing any string of characters, as they can vary.
Asterisks are used to replace any string of characters
This helps us discover scripts with different file names and see how each of them fits into a wider context of the entire attack analyzed in the sandbox.
Here, we can borrow a query from Jane_0sint’s article on phishing investigations, which is intended for identifying samples of Mamba2FA attacks.
A notable part of this query is that we can see the question mark being used twice. Yet, there is a difference between these two instances:
The first one is the wildcard that serves as a stand-in for the characters “m”, “n”, and “o” that are commonly used in Mamba2FA URLs.
The second question mark is a part of the address. To escape it, we use the slash symbol.
Make sure to escape ? when it is part of your search string
We once again can observe a variety of results, including command lines that contain different URLs matching our query.
Dollar Sign ($)
What it does
The dollar sign ensures that the search term must appear at the end of the string. It excludes matches with any characters after the specified content.
Why use it
The dollar sign is useful when you know the exact ending of a string but are unsure about the beginning. It helps you find matches that end with your specified term.
This query searches for any synchronization object whose name ends with _STOP.
Each mutexcan be explored in detail in its corresponding sandbox session
Among the results, we can see mutex names such as biudfw_stop, jeboi_stop, and nonij_stop. As always, we can explore each of them in detail by navigating to their corresponding sandbox sessions.
Caret (^)
What it does
The caret ensures that the search term must appear at the beginning of the string. It prevents matches with any characters before the specified query content.
Why use it
The caret is helpful when you know the exact starting point of a string but are unsure about the rest. It narrows down your search to items that begin with your specified term.
This query finds domain names that start with 0ffice and end with .com, with any characters allowed in between. The caret (^) and dollar sign ($) ensure the exact start and end.
TI Lookup returns all matching domains found across its database over the past 180 days
TI Lookup provides us with domains that match our query along with sandbox sessions, where they were found.
Conclusion
wildcards and operators in TI Lookup provide the flexibility and precision needed to perform threat intelligence searches. By learning how to use these tools, you can make your threat hunting efforts more effective.
ANY.RUN’s Threat Intelligence Lookup and YARA Search services allow for precise threat hunting and the extraction of valuable insights into current cyber threat trends. What’s impressive is how fast these scans are—they significantly speed up the analysis process, allowing for quick detection of threats and malware.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-12-04 12:06:352024-12-04 12:06:35Search Operators and Wildcards for Cyber Threat Investigations
