Headline

Threat Source newsletter (Feb. 16, 2023) — Recapping what we may have missed so far this year

Jon is back from parental leave and recapping the top security stories from late 2022 and early 2023 that totally blew by him.

1 year ago

TALOS

Open in Source

#vulnerability #windows #microsoft #cisco #rce #auth #zero_day

Thursday, February 16, 2023 14:02

Welcome to this week’s edition of the Threat Source newsletter.

I am back after more than three months away from Talos on parental leave. Having a baby really resets your expectations for “keeping up” with the world. From November through mid-January or so I had no idea what was going on with the outside world, I only cared about my daughter’s feeding schedule and tried to squeeze in 30-minute naps where I could.

I’ve slowly started to re-introduce myself to social media and the news world at large over the past few weeks so my return to work wasn’t so abrupt, and I missed quite a bit. There was a stretch there where I was only getting the latest headlines from Weekend Update on “Saturday Night Live.”

My teammates Madison Burns and Bill Largent did a fantastic job filling in for me on the newsletter while I was out, but I figured it was worth taking the time to recap some major stories it seemed like I missed since Nov. 1.

Maybe our readers were also distracted during this period, it was the holidays after all and it’s easy for stories to slip through the cracks while we all have so much going on. Here are a few major trends and storylines that stood out to me while I caught up on the top security stories of late 2022 and early 2023.

The Russia-Ukraine war continues to evolve on all fronts, and the cyber attacks certainly haven’t slowed. Ukraine reported several state-sponsored attacks in early 2023, including against the country’s national news agency. The infamous WhisperGate malware came back, too, looking to wipe data and steal sensitive information from high-profile Ukrainian targets. And the Gamaredon APT continues to do its thing. Thankfully, defenders made some headway in combatting Russian state-sponsored groups, as I’ll cover below.
The spyware industry boomed in 2022 and I suspect we’ll be hearing a lot about it going forward. This type of borderline-illegal software installed on users’ phones can track their every move and message and is often used to target high-profile users like politicians, activists and journalists. Spyware is proliferating all over the world and is now being used by many countries’ governments, including the U.S. But President Joe Biden’s administration has several moves in the works to try and combat foreign company’s spyware from making onto Americans’ phones.
The Lapsus$ ransomware group is still one of the most prolific threat actors out there. Cisco Talos researchers have extensively covered Lapsus$ throughout 2022, but it struck several times in late 2022 and early 2023, including threatening to leak “League of Legends’” source code and breaching authentication company Okta. That’s on top of other major attacks from earlier in ‘22 against T-Mobile, Uber and more.
AI is all over the place, from art, to voice acting and now full-on search engines. One of the most controversial tools, ChatGPT, has already entered the malware space. The chatbot, released in November, has already shown it can write “polymorphic” malware that can repeatedly mutate to avoid traditional detection methods. Scammers and threat actors are also using ChatGPT to generate convincing spear-phishing emails quickly and impersonate people the targeted user may personally know.

The one big thing

This month’s Microsoft Patch Tuesday updates included three zero-day vulnerabilities that the company says are being actively used in attacks in the wild. CVE-2023-23376, CVE-2023-21715 and CVE-2023-21823 have all already been spotted in active attacks, according to Microsoft’s monthly patch release. In all, Microsoft disclosed 73 vulnerabilities. Of these vulnerabilities, eight are classified as “critical,” 64 are classified as “important” and one vulnerability is classified as “moderate.”

Why do I care?

The most severe of the issues disclosed Tuesday is CVE-2023-21823, a Windows graphics component remote code execution vulnerability. An attacker could exploit this vulnerability to gain System-level privileges. Outside of that, it’s always important to update all Microsoft products anyway after a Patch Tuesday.

So now what?

Users of any Microsoft products should apply these updates as soon as possible. Additionally, Talos released new Snort rules that detect attempts to exploit some of these vulnerabilities. Cisco Secure Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Top security headlines of the week

Several Russian nationals are facing new sanctions and have been unmasked as members of the Trickbot and Conti ransomware gangs. The actors are involved in various activities with these groups, ranging from developing ransomware code, to money laundering and managing command and control servers. The U.S. and U.K. governments also made a renewed push to unmask and name many of these actors, removing their anonymity and making it more difficult for them to operate in secrecy. Recent studies have shown that these types of sanctions are working to slow Russian state-sponsored ransomware attacks. (Wired, CPO Magazine)

While much of the headlines recently have centered around the infamous Chinese spy balloon and other unknown objects the U.S. military keeps shooting out of the sky, global government officials are warning that China’s cyber attack capabilities are still the most pressing threat. Taiwan’s government has already been the target of several high-profile defacement attacks in recent years, and the country recently established an entirely new government bureau to bolster its cyber security capabilities. The FBI’s Director is also offering new services and olive branches to private security companies who are looking to combat China’s growing surveillance and cyber capabilities. (Bloomberg, Wall Street Journal)

Social media site Reddit says it was the recent target of a “sophisticated and highly targeted phishing attack.” The adversaries gained access to “documents, code and some internal business systems,” though the company said no usernames or passwords are affected. Attackers duped a Reddit employee into approving a multi-factor authentication push notification, though the employee acted quickly and notified Reddit’s security team immediately upon realizing their mistake. (Dark Reading, Reddit)

Can’t get enough Talos?

New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign
Talos Takes Ep. #128: Year in Review — Ransomware and Commodity Loaders
Cisco Live EMEA 2023 — Simplicity, Security And Sustainability
MortalKombat ransomware found punching targets in US, UK, Turkey, Philippines
Financially Motivated Threat Actor Strikes with New Ransomware and Clipper Malware

Upcoming events where you can find Talos

WiCyS (March 16 - 18)

Denver, CO

RSA (April 24 - 27)

San Francisco, CA

Most prevalent malware files from Talos telemetry over the past week

SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934
MD5: 93fefc3e88ffb78abb36365fa5cf857c
Typical Filename: Wextract
Claimed Product: Internet Explorer
Detection Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg

SHA 256: e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c
MD5: a087b2e6ec57b08c0d0750c60f96a74c
Typical Filename: AAct.exe
Claimed Product: N/A
Detection Name: PUA.Win.Tool.Kmsauto::1201

SHA 256: 59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa
MD5: df11b3105df8d7c70e7b501e210e3cc3
Typical Filename: DOC001.exe
Claimed Product: N/A
Detection Name: Win.Worm.Coinminer::1201

SHA 256: 36efad0617db0d45de00cc4f3cf49af7c2d6b5b15ca456d13703b5d366c58431
MD5: 147c7241371d840787f388e202f4fdc1
Typical Filename: EKSPLORASI.EXE
Claimed Product: N/A
Detection Name: Win32.Generic.497796

SHA 256: 125e12c8045689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645
MD5: 2c8ea737a232fd03ab80db672d50a17a
Typical Filename: LwssPlayer.scr
Claimed Product: 梦想之巅幻灯播放器
Detection Name: Auto.125E12.241442.in02

The banking malware known as Carbanak has been observed being used in ransomware attacks with updated tactics. "The malware has adapted to incorporate attack vendors and techniques to diversify its effectiveness," cybersecurity firm NCC Group said in an analysis of ransomware attacks that took place in November 2023. "Carbanak returned last month through new

8 months ago

The Hacker News

Open in Source

#web #windows #microsoft #git #intel #auth #The Hacker News

Storm-0324 Exploits MS Teams Chats to Facilitate Ransomware Attacks

By Deeba Ahmed KEY FINDINGS Microsoft Threat Intelligence Team has published a new report highlighting the activities of a notorious, financially… This is a post from HackRead.com Read the original post: Storm-0324 Exploits MS Teams Chats to Facilitate Ransomware Attacks

12 months ago

HackRead

Open in Source

#vulnerability #windows #microsoft #js #git #java #intel #ssl

Urgent: Microsoft Issues Patches for 97 Flaws, Including Active Ransomware Exploit

It's the second Tuesday of the month, and Microsoft has released another set of security updates to fix a total of 97 flaws impacting its software, one of which has been actively exploited in ransomware attacks in the wild. Seven of the 97 bugs are rated Critical and 90 are rated Important in severity. Interestingly, 45 of the shortcomings are remote code execution flaws, followed by 20

Apple Users Need to Update iOS Now to Patch Serious Flaws

Plus: Microsoft fixes several zero-day bugs, Google patches Chrome and Android, Mozilla rids Firefox of a full-screen vulnerability, and more.

1 year ago

Wired

Open in Source

#vulnerability #web #ios #android #mac #windows #apple #google #microsoft #dos #java #vmware #buffer_overflow #samsung #zero_day #chrome #webkit #firefox #sap

Microsoft Patch Tuesday February 2023: Win Graphics RCE, Edge RCE, Publisher SFB, CLFS EoP, Exchange RCEs, Word RCE, HoloLens1

Hello everyone! This episode will be about Microsoft Patch Tuesday for February 2023, including vulnerabilities that were added between January and February Patch Tuesdays. Alternative video link (for Russia): https://vk.com/video-149273431_456239118 This month I decided to change the format a bit. Now I share my impression of Microsoft Patch Tuesday on the same Patch Tuesday day […]

1 year ago

Alexander V. Leonov

Open in Source

#vulnerability #web #mac #windows #microsoft #git #rce #auth #wifi #blog

Update Now: Microsoft Releases Patches for 3 Actively Exploited Windows Vulnerabilities

Microsoft on Tuesday released security updates to address 75 flaws spanning its product portfolio, three of which have come under active exploitation in the wild. The updates are in addition to 22 flaws the Windows maker patched in its Chromium-based Edge browser over the past month. Of the 75 vulnerabilities, nine are rated Critical and 66 are rated Important in severity. 37 out of 75 bugs are

Update Now: Microsoft Releases Patches for 3 Actively Exploited Windows Vulnerabilities

Update now! February's Patch Tuesday tackles three zero-days

Categories: Exploits and vulnerabilities Categories: News Tags: patch Tuesday Tags: Microsoft Tags: Apple Tags: Adobe Tags: SAP Tags: Citrix Tags: Cisco Tags: Atlassian Tags: Google Tags: Mozilla Tags: Forta Tags: OpenSSH Tags: CVE-2023-21823 Tags: CVE-2023-21715 Tags: OneNote Tags: CVE-2023-23376 Tags: CVE-2023-21706 Tags: CVE-2023-21707 Tags: CVE-2023-21529 Tags: CVE-2023-21716 Tags: CVE-2023-23378 Tags: CVE-2023-22501 Tags: CVE-2023-24486 Tags: CVE-2023-24484 Tags: CVE-2023-24484 Tags: CVE-2023-24483 Tags: CVE-2023-25136 Tags: GoAnywhere Microsoft has released updates to patch three zero-days and lots of other vulnerabilities and so have several other vendors (Read more...) The post Update now! February's Patch Tuesday tackles three zero-days appeared first on Malwarebytes Labs.

1 year ago

Malwarebytes

Open in Source

#vulnerability #web #ios #android #mac #windows #apple #google #microsoft #cisco #rce #auth #ssh #zero_day #jira #firefox #sap

Update now! February's Patch Tuesday tackles three zero-days

1 year ago

Malwarebytes

Open in Source

#vulnerability #web #ios #android #mac #windows #apple #google #microsoft #cisco #rce #auth #ssh #zero_day #jira #firefox #sap

Update now! February's Patch Tuesday tackles three zero-days

1 year ago

Malwarebytes

Open in Source

#vulnerability #web #ios #android #mac #windows #apple #google #microsoft #cisco #rce #auth #ssh #zero_day #jira #firefox #sap

9 New Microsoft Bugs to Patch Now

78 new CVEs patched in this month's batch — nearly half of which are remotely executable and three of which attackers already are exploiting.

1 year ago

DARKReading

Open in Source

#vulnerability #mac #windows #microsoft #cisco #dos #intel #rce #ssrf #auth #zero_day

9 New Microsoft Bugs to Patch Now

78 new CVEs patched in this month's batch — nearly half of which are remotely executable and three of which attackers already are exploiting.

1 year ago

DARKReading

Open in Source

#vulnerability #mac #windows #microsoft #cisco #dos #intel #rce #ssrf #auth #zero_day

9 New Microsoft Bugs to Patch Now

78 new CVEs patched in this month's batch — nearly half of which are remotely executable and three of which attackers already are exploiting.

1 year ago

DARKReading

Open in Source

#vulnerability #mac #windows #microsoft #cisco #dos #intel #rce #ssrf #auth #zero_day

CVE-2023-21823

Windows Graphics Component Remote Code Execution Vulnerability

1 year ago

CVE

Open in Source

#vulnerability #windows #rce

Microsoft Patch Tuesday, February 2023 Edition

Microsoft is sending the world a whole bunch of love today, in the form of patches to plug dozens of security holes in its Windows operating systems and other software. This year's special Valentine's Day Patch Tuesday includes fixes for a whopping three different "zero-day" vulnerabilities that are already being used in active attacks.

1 year ago

Krebs on Security

Open in Source

#vulnerability #web #ios #windows #apple #microsoft #intel #rce #auth #zero_day #webkit #blog

Microsoft Patch Tuesday, February 2023 Edition

1 year ago

Krebs on Security

Open in Source

#vulnerability #web #ios #windows #apple #microsoft #intel #rce #auth #zero_day #webkit #blog

Microsoft Patch Tuesday, February 2023 Edition

1 year ago

Krebs on Security

Open in Source

#vulnerability #web #ios #windows #apple #microsoft #intel #rce #auth #zero_day #webkit #blog

CVE-2023-23376

Windows Common Log File System Driver Elevation of Privilege Vulnerability

1 year ago

CVE

Open in Source

#vulnerability #windows

CVE-2023-21715

Microsoft Publisher Security Features Bypass Vulnerability

1 year ago

CVE

Open in Source

#vulnerability #microsoft

Microsoft Patch Tuesday for February 2023 — Snort rules and prominent vulnerabilities

Microsoft released its monthly security update on Tuesday, disclosing 73 vulnerabilities. Of these vulnerabilities, 8 are classified as “Critical”, 64 are classified as “Important”, one vulnerability is classified as “Moderate.” According to Microsoft none of the vulnerabilities has been publicly disclosed before Patch Tuesday

1 year ago

TALOS

Open in Source

#vulnerability #web #mac #windows #microsoft #cisco #rce #auth

Microsoft Patch Tuesday for February 2023 — Snort rules and prominent vulnerabilities

1 year ago

TALOS

Open in Source

#vulnerability #web #mac #windows #microsoft #cisco #rce #auth

Microsoft Patch Tuesday for February 2023 — Snort rules and prominent vulnerabilities

1 year ago

TALOS