Weekly Threat Landscape Digest – Week 1
This week’s cybersecurity digest highlights critical vulnerabilities and urgent advisories. Organizations are urged to take immediate action to address these threats and reduce potential risks.
Vulnerabilities
- Critical Windows LDAP Vulnerabilities
Details: Microsoft has disclosed two critical vulnerabilities in Windows Lightweight Directory Access Protocol (LDAP), impacting Active Directory Domain Controllers (DCs) and Windows Servers. These vulnerabilities pose severe risks of remote code execution and denial of service.
- CVE-2024-49112: Remote Code Execution vulnerability with a CVSS score of 9.8.
- CVE-2024-49113: Denial of Service vulnerability with a CVSS score of 7.5.
- Proof-of-concept (PoC) exploit for CVE-2024-49113 developed by SafeBreach Labs demonstrates the risks.
Mitigation:
- Apply Microsoft’s December 2024 security updates immediately.
- Monitor systems for unusual activity involving DNS SRV queries, CLDAP referral responses, and DsrGetDcNameEx2 calls.
References:
- Critical Security Update for Dell OpenManage Server Administrator
Details: A critical vulnerability (CVE-2024-52316) in Apache Tomcat within Dell OpenManage Server Administrator (OMSA) allows unauthenticated attackers to bypass authentication, potentially compromising system security.
Mitigation:
- Update affected installations to Version 11.1.0.0 or later.
References:
- High-Severity Vulnerabilities in ASUS Routers
Details: Two vulnerabilities (CVE-2024-12912 and CVE-2024-13062) in ASUS routers could allow unauthorized command execution, compromising devices and networks.
Mitigation:
- Update Firmware: Upgrade to the latest version immediately.
- Disable External Services: Turn off internet-exposed services like remote access and port forwarding.
References:
- Exploited Vulnerability in Four-Faith Routers
Details: A vulnerability (CVE-2024-12856) in Four-Faith router models F3x24 and F3x36 allows remote OS command injection via the /apply.cgi endpoint. The vulnerability is actively being exploited in the wild, enabling attackers to establish a reverse shell and compromise devices.
- Severity: CVSS 7.2 (High)
Mitigation:
- Update Firmware: Install the latest firmware from Four-Faith.
- Change Default Credentials: Replace default usernames and passwords with strong, unique credentials.
- Restrict Internet Exposure: Use firewalls and VPNs to limit access to trusted networks.
References:
- Multiple Vulnerabilities in Azure Data Factory’s Apache Airflow Integration
Details: Security flaws in Azure Data Factory’s Apache Airflow integration and related services (e.g., Azure Key Vault, Amazon Bedrock) expose sensitive data and infrastructure to attacks. Exploitation could allow shadow administrative control over AKS clusters and deep penetration into Azure environments.
Mitigation:
- Access Controls: Secure DAG files and storage accounts.
- Secure Git Repositories: Rotate credentials regularly and implement strong access controls.
- Enhance Authentication: Strengthen mechanisms for Azure services like Geneva.
References:
- D-Link End-of-Life Routers Vulnerable to Botnet Exploits
Details: D-Link has issued a critical advisory urging users to replace legacy router models that have reached End-of-Life (EOL) and End-of-Support (EOS) status. These devices are being exploited by botnets “Ficora” and “Capsaicin,” leveraging multiple vulnerabilities such as CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112.
- Affected Models and EOL Dates:
- DIR-645: EOL as of December 31, 2018.
- DIR-806: EOL as of February 1, 2016.
- GO-RT-AC750: EOL as of February 29, 2016.
- DIR-845L: EOL as of March 1, 2016.
- Exploitation Impact:
- Theft of sensitive data.
- Execution of unauthorized shell scripts.
- Large-scale Distributed Denial-of-Service (DDoS) operations.
Mitigation:
- Retire and replace affected router models immediately.
- Ensure devices are updated with the latest firmware.
- Use strong, unique passwords and enable robust Wi-Fi encryption.
References:
- Chrome Extension Supply Chain Attack
A phishing campaign has compromised 36 Chrome browser extensions, affecting approximately 2.6 million users. Attackers injected malicious code into legitimate extensions, enabling data exfiltration and credential harvesting. Extensions affected include AI assistants, VPNs, and productivity tools.
- Impact: Data theft, access token harvesting, and exposure of sensitive user information.
- Indicators of Compromise:
- Malicious Extension Version: 24.10.4
- C&C Domains: cyberhavenext[.]pro, api.cyberhaven[.]pro
- IPs: 149.28.124[.]84, 149.248.2[.]160
Mitigation:
- Remove or disable affected extensions.
- Rotate credentials and API tokens.
- Conduct an audit of Chrome extensions in use.
- Implement strict whitelisting policies and advanced monitoring.
- Educate users on browser extension risks.
References:
- Critical Vulnerabilities in Progress Software’s WhatsUp Gold
Progress Software has disclosed three vulnerabilities in its WhatsUp Gold network monitoring software, two of which are critical. These flaws could allow attackers to gain control over the server, configure sensitive settings, or extract sensitive information.
- CVE-2024-12108: CVSS 9.6 (Critical)
- Description: Allows attackers to control the server via the public API.
- Impact: Full system compromise and unauthorized data access.
- CVE-2024-12106: CVSS 9.4 (Critical)
- Description: Enables unauthenticated attackers to configure LDAP settings.
- Impact: Potential for data breaches and unauthorized access.
- CVE-2024-12105: CVSS 6.5 (Medium)
- Description: Allows authenticated users to extract sensitive information.
- Impact: Disclosure of sensitive system data.
Affected Versions:
- WhatsUp Gold versions prior to 24.0.2
Mitigation:
- Update to WhatsUp Gold version 24.0.2 immediately.
References:
- Exploited Vulnerability in Oracle WebLogic Server
Oracle WebLogic Server is affected by a remote code execution (RCE) vulnerability (CVE-2024-21182) that is actively being exploited in the wild. The flaw exists in the handling of the T3 and IIOP protocols, which are often enabled by default, allowing unauthenticated attackers to execute arbitrary code remotely.
- CVSS Score: 7.5 (High)
- Impact: Full system compromise and unauthorized access to critical data.
- Risk: High. The availability of a proof-of-concept (PoC) exploit increases the likelihood of active exploitation.
Affected Versions:
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0
Mitigation:
- Disable the T3 and IIOP protocols immediately if not required.
- Monitor Oracle’s site for the release of an official patch and apply it as soon as available.
- Conduct network monitoring to detect exploitation attempts.
- Regularly update and harden system configurations.
References:
- High-Severity Vulnerability in TrueNAS CORE
TrueNAS CORE, a widely used open-source network-attached storage (NAS) operating system, is affected by a directory traversal vulnerability (CVE-2024-11944) in the tarfile.extractall method. This flaw allows unauthenticated, network-adjacent attackers to execute arbitrary code remotely.
- CVSS Score: 7.5 (High)
- Impact:
- Arbitrary code execution with root-level privileges.
- Unauthorized access to sensitive data.
- Potential malware installation and file corruption.
Affected Versions:
- TrueNAS CORE versions prior to 13.0-U6.3
Mitigation:
- Update to TrueNAS CORE version 13.0-U6.3 or later immediately.
References:
- Exploited Vulnerability in Palo Alto Networks PAN-OS
Palo Alto Networks’ PAN-OS software is affected by a critical vulnerability (CVE-2024-3393) in its DNS Security feature. This flaw is currently being exploited in the wild, enabling attackers to disrupt firewall operations, potentially leading to a denial-of-service (DoS) state.
- CVSS Score: 8.7 (High)
- Impact: Repeated exploitation can force firewalls into maintenance mode, disrupting operations.
Affected Versions:
- PAN-OS 11.2: Versions < 11.2.3
- PAN-OS 11.1: Versions < 11.1.5
- PAN-OS 10.2: Versions >= 10.2.8 and < 10.2.10-h12, < 10.2.13-h2
- PAN-OS 10.1: Versions >= 10.1.14 and < 10.1.14-h8
- Prisma Access: Versions >= 10.2.8 and < 11.2.3
Fixed Versions:
- PAN-OS 10.1.14-h8, 10.2.10-h12, 11.1.5, 11.2.3, and later.
Exploitation Details:
- Attackers send specially crafted DNS packets through the firewall’s data plane, causing a reboot and potential DoS state.
Mitigation:
- Update to fixed PAN-OS versions immediately.
References:
- Critical Vulnerability in libxml2
A critical vulnerability (CVE-2024-40896) in the libxml2 XML parsing library has been identified, allowing attackers to exploit the SAX parser to conduct XML External Entity (XXE) attacks. This flaw poses significant risks, including unauthorized access, system compromise, and data theft.
- CVSS Score: 9.1 (Critical)
- Impact:
- Unauthorized access to sensitive information.
- Remote Code Execution (RCE) in misconfigured environments.
- Denial of Service (DoS) attacks.
Affected Versions:
- 2.11: Versions before 2.11.9.
- 2.12: Versions before 2.12.9.
- 2.13: Versions before 2.13.3.
Mitigation:
- Update to libxml2 versions 2.11.9, 2.12.9, or 2.13.3 immediately.
References:
- Local Privilege Escalation Vulnerability in Ivanti Automation
Ivanti Automation is affected by a local privilege escalation vulnerability (CVE-2024-9845) due to insecure permissions on specific files and directories in the installation path. This flaw allows local authenticated attackers to gain elevated privileges on affected systems.
- CVSS Score: 7.8 (High)
- CWE: CWE-276 (Incorrect Default Permissions)
- Impact: Escalation to administrative or root privileges, potentially compromising system security.
Affected Versions:
- Ivanti Automation 2024.4 and prior.
Resolved Version:
- Ivanti Automation 2024.4.0.1 and later.
Mitigation:
- Update to version 2024.4.0.1 or later via the Ivanti Download Portal.
References:
- Critical Vulnerability in Angular Expressions
A critical vulnerability (CVE-2024-54152) in Angular Expressions, a module of the AngularJS web framework, allows remote attackers to exploit crafted expressions to escape the sandbox and execute arbitrary code on affected systems.
- CVSS Score: 9.3 (Critical)
- Impact: Exploitation could lead to full system compromise, particularly in web applications processing user input through this module.
- Proof-of-Concept (PoC): Available, increasing the risk of exploitation in the wild.
Affected Versions:
- Angular Expressions prior to version 1.4.3.
Resolved Version:
- Angular Expressions version 1.4.3 and later.
Mitigation:
- Upgrade to Angular Expressions version 1.4.3 or later immediately.
References:
- FICORA and Kaiten Botnets Exploit Old D-Link Vulnerabilities
Vulnerable D-Link routers are being actively exploited by two botnets, FICORA (a Mirai variant) and CAPSAICIN (a Kaiten/Tsunami variant). These botnets exploit weaknesses in the Home Network Administration Protocol (HNAP) interface via documented vulnerabilities in D-Link devices, including CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112.
- Impact:
- Deployment of botnet malware for distributed denial-of-service (DDoS) attacks using UDP, TCP, and DNS protocols.
- Brute-force attacks using hard-coded credentials.
- Shell command execution and malware installation.
FICORA Botnet:
- Fetches payloads from 103.149.87[.]69 using downloader scripts (e.g., multi).
- Capable of conducting DDoS and brute-force attacks.
CAPSAICIN Botnet:
- Uses 87.10.220[.]221 for payload downloads.
- Communicates with a command-and-control (C2) server at 192.110.247[.]46.
- Features include executing shell commands, initiating TCP/UDP/DNS flooding attacks, and replacing other botnets on the compromised host.
Attack Activity:
- FICORA: Global targeting.
- CAPSAICIN: Primarily active in East Asia, with notable activity between October 21-22, 2024.
Mitigation:
- Update D-Link router firmware to address known vulnerabilities.
- Regularly audit network devices for outdated firmware and apply patches.
- Block known malicious IPs: 103.149.87[.]69, 87.10.220[.]221, and 192.110.247[.]46.
- Implement robust network monitoring to detect exploit attempts.
References:
https://thehackernews.com/2024/12/ficora-and-kaiten-botnets-exploit-old-d.html
- Malware Campaign – BellaCPP: A New Variant of BellaCiao Malware
The Charming Kitten threat group (APT35) has deployed a new malware variant, BellaCPP, written in C++. This evolution of the BellaCiao malware family was discovered on a compromised machine in Asia. While retaining much of the functionality of BellaCiao, BellaCPP lacks certain web shell features, focusing on loading additional payloads and creating SSH tunnels.
- Threat Actor: Charming Kitten (APT35, CALANQUE, ITG18).
- Capabilities:
- Leverages social engineering and exploits vulnerabilities in Microsoft Exchange Server and Zoho ManageEngine.
- BellaCPP loads additional DLL payloads, such as D3D12_1core.dll, and establishes SSH tunnels.
Targeting: Highly targeted attacks in the U.S., Middle East, and Asia.
Threat Actors
- Cloud Atlas Exploits Microsoft Office Vulnerability
Details:
The Cloud Atlas group exploits CVE-2018-0802 to target high-value organizations in aerospace, government, and economics.
- Attack Chain: Phishing emails deliver malicious RTF templates, downloading the VBShower backdoor and PowerShower module.
Targets:
Countries in Eastern Europe, Central Asia, and others.
Mitigation:
- Apply patches for Microsoft Office.
- Educate employees on phishing risks.
- Monitor traffic for unusual RTF and HTA file activity.
References:
Cybersecurity News
- Rockwell PowerMonitor Exploits Threaten Industrial Systems
Details:
Three critical vulnerabilities in Allen-Bradley PowerMonitor 1000 devices allow unauthorized administrative access, DoS attacks, and remote code execution.
- CVE-2024-12371, CVE-2024-12372, CVE-2024-12373
Mitigation:
Update to firmware version 4.020 or later, restrict device exposure, and implement network segmentation.
References:
SCWorld
- Google Ads Exploited in Malvertising Campaign Targeting Graphic Design Professionals
Details:
A sophisticated malvertising campaign leverages Google Search ads to redirect users in the graphic design and CAD sectors to malicious websites. These websites distribute harmful payloads under the guise of legitimate software.
- Method: Fake domains mimic CAD and graphic design tools to lure users.
- Infrastructure:
- Two primary IP addresses:
- 185.11.61[.]243: Active since July 29, 2024, hosting 109 unique domains.
- 185.147.124[.]110: Active since November 25, 2024, hosting 85 unique domains.
- Malicious payloads often hosted on platforms like Bitbucket.
- Two primary IP addresses:
Indicators of Compromise (IoCs):
- Malicious IP Addresses:
- 185.11.61[.]243
- 185.147.124[.]110
- Malicious Domains:
- Examples include frecadsolutions[.]cc, planner5design[.]net, onshape3d[.]org, and more. (Full list in advisory links).
Impact:
- Malware infections compromising victim systems.
- Phishing attacks harvesting user credentials.
- System compromise and unauthorized data access.
- Potential data breaches affecting sensitive files and user information.
Mitigation:
For individuals:
- Avoid clicking on ads from unverified sources.
- Download software only from official websites.
- Use browser ad blockers and updated antivirus tools.
For organizations:
- Train employees to recognize phishing and malvertising campaigns.
- Monitor traffic for interactions with malicious domains or IPs.
References:
GBHackers Report
Security Online
AlienVault Pulse
- Skuld Malware Targeting npm Developers Through Supply Chain Attacks
Details:
Skuld info stealer targets npm developers with malicious packages uploaded via typosquatting. These packages disguise themselves as legitimate tools and exfiltrate sensitive data like passwords, cookies, and browsing history.
- Attack Chain:
- Malicious packages download and execute Skuld as download.exe.
- Data exfiltration is conducted via Discord webhooks and C2 servers.
Impact:
- Over 600 downloads of malicious npm packages.
- Credential theft and compromise of development environments.
Mitigation:
- Employ automated tools to detect malicious dependencies.
- Verify npm packages before installation.
- Adopt layered security measures for supply chain threats.
References:
GBHackers Report
- Lazarus Group Employs New VNC-Based Malware in Operation DreamJob
Details:
The Lazarus Group uses malicious ISO and ZIP archives disguised as job offers to deliver advanced malware strains like CookiePlus. This campaign targets employees in critical industries, including nuclear energy.
- Key Techniques:
- DLL side-loading using trojanized VNC utilities.
- Encrypted payload delivery from WordPress-based C2 servers.
Impact:
- Espionage and operational disruptions in critical sectors.
- Persistent system compromises via modular malware techniques.
Mitigation:
- Avoid opening unsolicited archives or attachments.
- Employ robust endpoint detection tools.
- Monitor for C2 traffic and implement least privilege access controls.
References:
GBHackers Report
- NodeStealer Malware Campaign Targets Facebook Ads Manager Credentials
Details:
NodeStealer malware evolves into a Python-based variant to execute advanced data theft, including financial data and Facebook Ads Manager credentials, via spear-phishing campaigns.
- Infection Chain:
- Delivered through spear-phishing emails containing malicious links.
- Utilizes DLL sideloading and PowerShell commands to deploy a Python-based infostealer.
IoCs:
- Malicious DLL: oledlg.dll
- Malicious download link: hxxps://t[.]ly/MRAbJ
Impact:
- Theft of credit card data, browser credentials, and Facebook Ads Manager accounts.
- Potential financial fraud and data compromise.
Mitigation:
- Avoid suspicious emails and links.
- Deploy advanced endpoint protection solutions.
- Regularly update software to patch known vulnerabilities.
References:
ADGM Advisory Report
- OilRig Cyber Espionage Campaign Targeting Middle Eastern Sectors
Details:
OilRig, also known as APT34 or Helix Kitten, continues to target critical sectors in the Middle East through advanced cyber espionage campaigns. The group specializes in leveraging sophisticated malware, zero-day vulnerabilities, and supply chain compromises.
Key Observations:
- Evolution of Tools and Tactics:
- Early campaigns featured the Helminth backdoor for stealth and persistence.
- Recent campaigns employ advanced malware like QUADAGENT, ISMAgent, and STEALHOOK.
- Exploitation of vulnerabilities such as CVE-2024-30088 (Windows Kernel) for SYSTEM-level access.
- Notable Campaigns:
- Supply Chain Attacks: Targeting compromised accounts within technology providers.
- QUADAGENT Campaign (2018): PowerShell-based malware used for stealthy network infiltration.
- Tactics, Techniques, and Procedures (TTPs):
- Initial Access: Spearphishing via platforms like LinkedIn.
- Execution: PowerShell scripting for stealthy command execution.
- Persistence: Scheduled tasks and obfuscated payloads.
- Defense Evasion: Techniques like base64 encoding and Invoke-Obfuscation.
- Credential Access: Tools like Mimikatz and LaZagne for extracting plaintext credentials.
- Exfiltration: Use of FTP and DNS tunneling for undetected data extraction.
Indicators of Compromise (IoCs):
File Name | SHA256 Hash |
|---|---|
QUADAGENT | d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de |
OilRig ThreeDollars | 1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c |
mscom.exe | 0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc |
People List.xls | 9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777 |
Dell.exe | 5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b |
Mitigation:
- Review and block IoCs.
- Implement robust email filtering and provide user awareness training.
- Regularly patch and update systems for critical vulnerabilities.
- Deploy endpoint detection and response (EDR) solutions.
- Monitor for suspicious PowerShell and scripting activities.
- Enforce strong access controls and multi-factor authentication.
- Conduct regular security assessments and penetration testing.
References:
Picus Security Analysis
Indicators of Compromise (IOCs):
Indicator Type | Value |
|---|---|
MD5 Hash | 222380fa5a0c1087559abbb6d1a5f889 |
MD5 Hash | 14f6c034af7322156e62a6c961106a8c |
MD5 Hash | 44d8b88c539808bb9a479f98393cf3c7 |
Domain | systemupdate.info |
Mitigation:
- Patch Vulnerabilities: Update all publicly accessible applications, particularly Microsoft Exchange and Zoho ManageEngine.
- Monitor Suspicious Activity: Watch for unauthorized file execution, SSH tunnels, and unusual traffic.
- Network Security: Enforce segmentation and strict access control policies.
- Awareness Training: Educate users on social engineering risks and implement robust email filtering.
- Endpoint Security: Maintain up-to-date Endpoint Detection and Response (EDR) solutions.
References:
- Chrome Extension Supply Chain Attack
A sophisticated phishing campaign has compromised at least 16 Chrome browser extensions, exposing over 600,000 users to data theft and credential harvesting. Threat actors targeted extension developers through the Chrome Web Store, injecting malicious code into legitimate extensions to communicate with command-and-control (C&C) servers and exfiltrate sensitive data.
- Impact:
- Exfiltration of cookies, access tokens, and user identity information.
- Potential account takeovers and credential harvesting.
Compromised Extensions:
- AI Assistant: ChatGPT and Gemini for Chrome
- Bard AI Chat Extension
- GPT 4 Summary with OpenAI
- TinaMind AI Assistant
- VPNCity
- Internxt VPN
- VidHelper Video Downloader
- Cyberhaven
Indicators of Compromise (IOCs):
Indicator Type | Value |
|---|---|
Hash | DDF8C9C72B1B1061221A597168f9BB2C2BA09D38D7B3405E1DACE37AF1587944 |
Domains | cyberhavenext[.]pro, api.cyberhaven[.]pro |
IPs | 149.28.124[.]84, 149.248.2[.]160 |
Mitigation:
- Remove or Disable Extensions: Immediately remove compromised extensions from devices.
- Credential Rotation: Revoke and rotate all affected credentials and API tokens.
- Audit Chrome Extensions: Conduct thorough audits of extensions used within your organization.
- Enforce Whitelisting: Implement a strict policy for approved browser extensions.
- User Education: Provide training to users on the risks of browser extensions and phishing attacks.
References: