Cybersecurity researchers are warning about a new phishing campaign that targets Microsoft OneDrive users with the aim of executing a malicious PowerShell script.
"This campaign heavily relies on social engineering tactics to deceive users into executing a PowerShell script, thereby compromising their systems," Trellix security researcher Rafael Pena said in a Monday analysis.
The cybersecurity

Cybersecurity researchers are warning about a new phishing campaign that targets Microsoft OneDrive users with the aim of executing a malicious PowerShell script.

"This campaign heavily relies on social engineering tactics to deceive users into executing a PowerShell script, thereby compromising their systems," Trellix security researcher Rafael Pena said in a Monday analysis.

The cybersecurity company is tracking the "crafty" phishing and downloader campaign under the name OneDrive Pastejacking.

The attack unfolds via an email containing an HTML file that, when opened, displays an image simulating a OneDrive page and displays an error message that says: "Failed to connect to the 'OneDrive' cloud service. To fix the error, you need to update the DNS cache manually."

The message also comes with two options, namely "How to fix" and "Details," with the latter directing the email recipient to a legitimate Microsoft Learn page on Troubleshooting DNS.

However, clicking "How to fix" prompts the user to follow a series of steps, which includes pressing "Windows Key + X" to open the Quick Link menu, launching the PowerShell terminal, and pasting a Base64-encoded command to supposedly fix the issue.

"The command \[...\] first runs ipconfig /flushdns, then creates a folder on the C: drive named 'downloads,'" Pena explained. "Subsequently, it downloads an archive file into this location, renames it, extracts its contents ('script.a3x' and 'AutoIt3.exe'), and executes script.a3x using AutoIt3.exe."

The campaign has been observed targeting users in the U.S., South Korea, Germany, India, Ireland, Italy, Norway, and the U.K.

The disclosure builds upon similar findings from ReliaQuest, Proofpoint, and McAfee Labs, indicating that phishing attacks employing this technique – also tracked as ClickFix – are becoming increasingly prevalent.

The development comes amid the discovery of a new email-based social engineering campaign distributing bogus Windows shortcut files that lead to the execution of malicious payloads hosted on Discord's Content Delivery Network (CDN) infrastructure.

Phishing campaigns have also been increasingly observed, such as sending Microsoft Office Forms from previously compromised legitimate email accounts to entice targets into divulging their Microsoft 365 login credentials by clicking on a seemingly innocuous link.

"Attackers create legitimate-looking forms on Microsoft Office Forms, embedding malicious links within the forms," Perception Point said. "These forms are then sent to targets en-masse via email under the guise of legitimate requests such as changing passwords or accessing important documents, mimicking trusted platforms and brands like Adobe or Microsoft SharePoint document viewer."

What's more, other attack waves have utilized invoice-themed lures to trick victims to sharing their credentials on phishing pages hosted on Cloudflare R2 that are then exfiltrated to the threat actor via a Telegram bot.

It's no surprise that adversaries are constantly on the lookout for different ways to stealthily smuggle malware past Secure Email Gateways (SEGs) so as to increase the likelihood of success of their attacks.

According to a recent report from Cofense, bad actors are abusing how SEGs scan ZIP archive attachments to deliver the Formbook information stealer by means of DBatLoader (aka ModiLoader and NatsoLoader).

Specifically, this involves passing off the HTML payload as an MPEG file to evade detection by taking advantage of the fact that many common archive extractors and SEGs parse the file header information but ignore the file footer that may contain more accurate information about the file format.

"The threat actors utilized a .ZIP archive attachment and when the SEG scanned the file contents, the archive was detected as containing a .MPEG video file and was not blocked or filtered," the company noted.

"When this attachment was opened with common/popular archive extraction tools such as 7-Zip or Power ISO, it also appeared to contain a .MPEG video file, but it would not play. However, when the archive was opened in an Outlook client or via the Windows Explorer archive manager, the .MPEG file is (correctly) detected as being a .HTML \[file\]."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

OneDrive Phishing Scam Tricks Users into Running Malicious PowerShell Script

A recently patched security flaw impacting VMware ESXi hypervisors has been actively exploited by "several" ransomware groups to gain elevated permissions and deploy file-encrypting malware.
The attacks involve the exploitation of CVE-2024-37085 (CVSS score: 6.8), an Active Directory integration authentication bypass that allows an attacker to obtain administrative access to the host.
"A

A recently patched security flaw impacting VMware ESXi hypervisors has been actively exploited by "several" ransomware groups to gain elevated permissions and deploy file-encrypting malware.

The attacks involve the exploitation of CVE-2024-37085 (CVSS score: 6.8), an Active Directory integration authentication bypass that allows an attacker to obtain administrative access to the host.

"A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD," Broadcom-owned VMware noted in an advisory released in late June 2024.

In other words, escalating privileges on ESXi to the administrator was as simple as creating a new AD group named "ESX Admins" and adding any user to it, or renaming any group in the domain to "ESX Admins" and adding a user to the group or using an existing group member.

Microsoft, in a new analysis published on July 29, said it observed ransomware operators like Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest leveraging the post-compromise technique to deploy Akira and Black Basta.

"VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named 'ESX Admins' to have full administrative access by default," researchers Danielle Kuznets Nohi, Edan Zwick, Meitar Pinto, Charles-Edouard Bettan, and Vaibhav Deshmukh said.

"This group is not a built-in group in Active Directory and does not exist by default. ESXi hypervisors do not validate that such a group exists when the server is joined to a domain and still treats any members of a group with this name with full administrative access, even if the group did not originally exist."

In one attack staged by Storm-0506 against an unnamed engineering firm in North America, the threat actor weaponized the vulnerability to gain elevated permissions to the ESXi hypervisors after having obtained an initial foothold using a QakBot infection and exploiting another flaw in the Windows Common Log File System (CLFS) Driver (CVE-2023-28252, CVSS score: 7.8) for privilege escalation.

Subsequently, phases entailed the deployment of Cobalt Strike and Pypykatz, a Python version of Mimikatz, to steal domain administrator credentials and move laterally across the network, followed by dropping the SystemBC implant for persistence and abusing the ESXi admin access to deploy Black Basta.

"The actor was also observed attempting to brute force Remote Desktop Protocol (RDP) connections to multiple devices as another method for lateral movement, and then again installing Cobalt Strike and SystemBC," the researchers said. "The threat actor then tried to tamper with Microsoft Defender Antivirus using various tools to avoid detection."

The development comes as Google-owned Mandiant revealed that a financially motivated threat cluster called UNC4393 is using initial access obtained via a C/C++ backdoor codenamed ZLoader (aka DELoader, Terdot, or Silent Night) to deliver Black Basta, moving away from QakBot and DarkGate.

"UNC4393 has demonstrated a willingness to cooperate with multiple distribution clusters to complete its actions on objectives," the threat intelligence firm said. "This most recent surge of Silent Night activity, beginning earlier this year, has been primarily delivered via malvertising. This marked a notable shift away from phishing as UNC4393's only known means of initial access."

The attack sequence involves making use of the initial access to drop Cobalt Strike Beacon and a combination of custom and readily-available tools to conduct reconnaissance, not to mention relying on RDP and Server Message Block (SMB) for lateral movement. Persistence is achieved by means of SystemBC.

ZLoader, which resurfaced after a long gap late last year, has been under active development, with new variants of the malware being propagated via a PowerShell backdoor referred to as PowerDash, per recent findings from Walmart's cyber intelligence team.

Over the past few years, ransomware actors have demonstrated an appetite for latching onto novel techniques to maximize impact and evade detection, increasingly targeting ESXi hypervisors and taking advantage of newly disclosed security flaws in internet-facing servers to breach targets of interest.

Qilin (aka Agenda), for instance, was originally developed in the Go programming language, but has since been redeveloped using Rust, indicating a shift towards constructing malware using memory-safe languages. Recent attacks involving ransomware have been found to leverage known weaknesses in Fortinet and Veeam Backup & Replication software for initial access.

"The Qilin ransomware is capable of self-propagation across a local network," Group-IB said in a recent analysis, adding it's also equipped to "carry out self-distribution using VMware vCenter."

Another notable malware employed in Qilin ransomware attacks is a tool dubbed Killer Ultra that's designed to disable popular endpoint detection and response (EDR) software running on the infected host as well as clear all Windows event logs to remove all indicators of compromise.

Organizations are recommended to install the latest software updates, practice credential hygiene, enforce two-factor authentication, and take steps to safeguard critical assets using appropriate monitoring procedures and backup and recovery plans.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

VMware ESXi Flaw Exploited by Ransomware Groups for Admin Access

Despite getting help, NIST is not keeping up with new vulnerability reports for the National Vulnerabilities Database, according to an analysis from Fortress Information Security.

Source: Fortress Information Security

The backlog of unanalyzed vulnerabilities for the National Vulnerability Database continues to grow, with new estimates suggesting the backlog could reach nearly 30,000 unanalyzed vulnerabilities by the end of 2024.

The National Vulnerability Database (NVD), maintained by the National Institute of Standards and Technology (NIST), is the United States' official repository for common vulnerabilities and exposures. Many scanners, analysts, and vendors depend on the NVD to determine what software has been affected by a vulnerability. When vulnerabilities are not added to the database in a timely manner, it impacts an enterprise defender's ability to prioritize vulnerabilities that need immediate patching or to identify issues that affect multiple applications.

NVD currently has a backlog of 16,974 vulnerabilities and receives, on average, about 111 additional security flaws daily. Data from Fortress Information Security suggests that analysts would need to process more than 217 vulnerabilities each day just to clear the backlog and keep up with the new ones being reported. Currently, NIST is averaging just over 30 new vulnerabilities per day, according to Fortress.

Resource challenges, an increase in the volume of vulnerabilities being disclosed, and other constraints have hampered NIST's ability to process vulnerabilities in a timely manner, NIST said earlier this year. The agency announced a partnership with the Cybersecurity and Infrastructure Security Agency as well as a contract with a private cybersecurity company for help clearing the backlog. The aim was to reduce the backlog by Sept. 30, the end of the government's fiscal year.

According to Fortress, NIST has analyzed just a little over a quarter of new CVEs discovered in 2024. At the current pace, Fortress estimates 29,569 vulnerabilities will still be awaiting analysis by the end of 2024 — and that calculation is based on the assumption that analysts are working seven days a week.

With 155 days left in 2024 (and just 62 days to the end of the fiscal year), NIST would have to significantly increase resources even more to make a reasonable dent in the backlog.

**About the Author(s)**

Dark Reading

The Edge is Dark Reading's home for features, threat data and in-depth perspectives on cybersecurity.

NVD Backlog Continues to Grow

PRESS RELEASE

PLEASANTON, Calif., and ZURICH, July 26, 2024 /PRNewswire/ -- Cowbell, a leading provider of cyber insurance for small and medium-sized enterprises (SMEs), announced today that it has closed a $60 million Series C equity investment from Zurich Insurance Group (Zurich), a leading global multi-line insurer.

With the $60 million investment, Cowbell plans to scale operations to meet growing demand, extend its presence in key international markets, bolster cyber resilience services, introduce new cutting-edge products to the market, and further strengthen strategic partnerships. Leveraging existing advances in AI and GenerativeAI (GenAI), the company aims to expand its technological infrastructure to drive further efficiencies and support expedited policyholder and broker decision-making across traditional, digital and API-driven channels.

Zurich's investment in Cowbell underscores its commitment to supporting businesses with state-of-the-art cyber protection and resilience solutions, particularly within the SME and middle market segments, where companies are exposed to cyber risk more than ever. It also aligns with Zurich's ambition to leverage best-in-class technology and expertise to address the evolving complexities of cyber risk management.

The global cost of cybercrime is estimated to reach $24 trillion by 2027, and ransomware attacks alone cost small businesses $1.7 million per incident on average.

Sierra Signorelli, CEO Commercial Insurance at Zurich said: "Cyber threats remain a major concern for business leaders due to their constantly evolving nature. To address this, we continue to invest in enhancing our cyber capabilities and building a strong support system for our customers. Cowbell is an excellent partner for managing cyber risks. They use a data-centric approach to risk management, provide continuous risk assessments, actively monitor threats, and have strong underwriting expertise. And all of this is centered around a highly advanced digital platform designed to boost cyber resilience for their customers."

Jack Kudale, founder and CEO, Cowbell said, "This investment from Zurich is the strongest endorsement of Cowbell's vision and capabilities yet and deepens our footprint in the global cyber insurance market. With a refined focus on product expansion, we will accelerate our efforts to deliver advanced and efficient cyber insurance solutions to SMEs and mid-market businesses globally, ensuring they have the protection and tools they need to navigate the rising threats in the evolving cyber landscape."

Cowbell's broker-first approach and reputation for its easy-to-use platform and effective education experience for the broker community are gaining worldwide traction and trust, with licensed producer growth of nearly 3x over the last two years. With better outcomes for customers at its core, reinvestment back into the business will see Cowbell double down on advancements in AI and GenAI to bring greater transparency to cyber risk. In doing so, Cowbell will facilitate smarter decision-making and raise cyber resiliency standards for brokers and businesses worldwide.

This latest investment marks a major milestone in Cowbell's fast-scaling journey, following a year of rapid geographic and product expansion, technological growth, and the onboarding of industry-heavyweight experts, further solidifying its position in the global cyber insurance market.

With $202 million raised to-date, Cowbell has remained capital-efficient throughout its journey. Cowbell has remained steadfast in its clear vision to protect, educate and empower SMEs and mid-market businesses, and the broker community serving them - from today's and tomorrow's threats.

J.P. Morgan Securities LLC acted as financial advisor and Gunderson Dettmer Stough Villeneuve Franklin & Hachigian, LLP provided legal counsel to Cowbell in this transaction.

About Cowbell  
Cowbell is a pioneer of Adaptive Cyber Insurance, leading the way in providing small and medium-sized enterprises (SMEs) with coverage adaptable to today's and tomorrow's threats and the advanced warning of cyber risk exposures. With its unique AI-based approach in risk selection and pricing, Cowbell's continuous underwriting platform, powered by Cowbell Factors, compresses the insurance process from submission to issue in less than 5 minutes. Backed by 25 prominent global (re)insurance partners, Cowbell serves SMEs across 50 U.S. states, the District of Columbia, and the United Kingdom, assessing businesses with revenues up to $1Bglobally. Founded in 2019, Cowbell is based in the San Francisco Bay Area and has employees across the U.S., Canada, India, and the U.K.

For more information, please visit https://cowbell.insure/.    

About Zurich Insurance Group  
Zurich Insurance Group (Zurich) is a leading multi-line insurer serving people and businesses in more than 200 countries and territories. Founded 150 years ago, Zurich is transforming insurance. In addition to providing insurance protection, Zurich is increasingly offering prevention services such as those that promote wellbeing and enhance climate resilience. Reflecting its purpose to 'create a brighter future together,' Zurich aspires to be one of the most responsible and impactful businesses in the world. It is targeting net-zero emissions by 2050 and has the highest-possible ESG rating from MSCI. In 2020, Zurich launched the Zurich Forest project to support reforestation and biodiversity restoration in Brazil. The Group has about 60,000 employees and is headquartered in Zurich, Switzerland. Zurich Insurance Group Ltd (ZURN), is listed on the SIX Swiss Exchange and has a level I American Depositary Receipt (ZURVY) program, which is traded over-the-counter on OTCQX. Further information is available at www.zurich.com.

Cowbell Secures $60 Million Series C Funding From Zurich Insurance Group

PRESS RELEASE

Lakera, the world's leading real-time Generative AI (GenAI) Security company, has raised $20 million in a Series A funding round. Led by European VC Atomico, with participation from Citi Ventures, Dropbox Ventures, and existing investors including redalpine, this investment brings Lakera's total funding to $30 million. This funding positions Lakera at the forefront of the global economy's race to secure GenAI applications. As part of this round, Atomico Partner Sasha Vidiborskiy will join Lakera's board.

It's been predicted that by 2026, 80% of enterprises will have used GenAI or GenAI-enabled applications in production environments, up from less than 5% in 2023. As businesses worldwide scramble to harness the power of GenAI without exposing themselves to AI-specific risks, the demand for Lakera's platform is expected to continue growing at a rapid clip.

While GenAI could add an estimated $4.4 trillion annually to global GDP, cybersecurity remains the second most-cited risk associated with its adoption as traditional cyber tools are ill-equipped to address the novel dangers it poses. This creates a critical need for security solutions that address GenAI-specific risks, without which businesses are unable to unlock the benefits of AI.

David Haber, Founder and CEO of Lakera, explains the urgency: "With the advent of GenAI, the old cybersecurity techniques aren't sufficient. Enterprises now operate in a world where anyone who knows how to talk knows how to hack. Security solutions need to change but they can't get in the way of user experience. There is a need for real-time AI security solutions that continuously evolve and enable amazing user experiences."

David elaborates in his blog published today.

Cybersecurity-risks posed by LLMs

The spectrum of LLM vulnerabilities is both diverse and severe:

*   GenAI introduces prompt attacks as the most widely accessible hacking method. In the past, hackers needed to be able to code - but now, the only barrier to entry is being able to talk.
    
*   Prompt attacks can easily be used to manipulate GenAI so that a malicious actor can gain unauthorized access to a company's systems, steal confidential data, take unauthorized actions, and generate harmful content.
    
*   AI "sleeper agents" can lie dormant until activated for malicious purposes. Jailbreaking techniques can compromise powerful models in mere minutes.
    
*   AI-targeted worms can bypass security measures, harvesting data and launching widespread attacks.
    

Lakera's comprehensive approach to AI security delivers three key benefits for enterprises: protection that doesn't slow down their AI applications; the ability to stay ahead of AI threats with continuously evolving intelligence; and centralized implementation of AI security controls.

The company's growth comes at a pivotal moment in AI development. With the adoption of GenAI, users now direct software applications using natural language, and Lakera's real-time AI security does not compromise application interactivity. To make implementation effortless for developers, the company's API can be integrated with a single line of code, providing an ultra-low-latency security layer compatible with any GenAI model. Centralized controls allow security teams to customize application-specific policies and address emerging threats without code changes.

Lakera is uniquely positioned to tackle these fast-changing challenges, in part thanks to Gandalf - an AI educational platform created by the company which serves as the world's largest AI red team. With over 250 thousand unique users worldwide, including companies such as Microsoft where it's used in security training, Gandalf generates a real-time database of AI threats which is growing by 100 thousands of uniquely new attacks every day and keeps Lakera's software up to date, ensuring continuous protection for customers. The 50+ million data points generated by Gandalf, combined with the founding team's deep experience in building AI systems with real-time requirements, means Lakera's customers are able to stay ahead of threats and deliver amazing user experiences.

Atomico Partner Sasha Vidoborskiy, who will join Lakera's board, said: "Lakera has seen impressive commercial pull, winning customers such as Dropbox and a top 3 US bank, and already having more than 35% of Fortune 100 companies knock on their door. All those clients have an urgency to deploy GenAI applications into production, but can't do it without protection in place. Easy integration, best-in-class performance, and low latency are why they pick Lakera. But most importantly, the company is led by David and his team, who are thought leaders in the space and have a deep understanding of what the adoption of AI means for new cybersecurity risks."

"At Dropbox, ensuring the security of our systems and customers' data is a top priority," said Donald Tucker, Head of Corporate Development and Ventures at Dropbox. "Lakera's team has extensive expertise and a deep understanding of the complex security challenges companies are facing with LLMs and Generative AI. Their advanced technology is helping companies like Dropbox safeguard against vulnerabilities these new technologies pose. We're thrilled to strengthen our existing relationship with Lakera by investing in the future of the company and AI security."

Lakera plans to use this funding round to invest further in its product development and expand its presence in the US, where it already has a foothold in Silicon Valley.

About Lakera  
Lakera is the world's leading real-time GenAI security company. Customers rely on Lakera for security that doesn't slow down their AI applications. To accelerate secure adoption of AI, the company created Gandalf, an educational tool, where more than one million users have learned about AI security. Lakera uses AI to continuously evolve defenses, so customers can stay ahead of emerging threats. Lakera was founded by David Haber, Mateo Rojas-Carulla and Matthias Kraft in 2021.

About Atomico  
Atomico invests in ambitious tech founders from Seed through to IPO with a particular focus on Europe, leveraging deep operational experience to supercharge their growth. Founded in 2006, Atomico has partnered with over 100 ambitious teams - including those at Klarna, Supercell, Graphcore, Compass, MessageBird, Masterclass, Attentive Mobile, Pipedrive and Hinge Health. Atomico's team of founders, investors and operational leaders have been responsible for global expansion, hiring and marketing at companies from Skype and Google to Twitter and Uber. The firm currently has $5B in assets under management.

Lakera Raises $20M Series A to Secure Generative AI Applications

A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.

Skip to content

**Navigation Menu**

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   GitHub Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   Explore
    
    *   Learning Pathways
    *   White papers, Ebooks, Webinars
    *   Customer Stories
    *   Partners
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   *   Enterprise platform
        
        AI-powered developer platform
        
    
*   Pricing

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2024-6578

**Aim Stored Cross-site Scripting Vulnerability**

High severity GitHub Reviewed Published Jul 29, 2024 to the GitHub Advisory Database • Updated Jul 30, 2024

**Affected versions**

<= 3.19.3

**Description**

A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.

**References**

*   https://nvd.nist.gov/vuln/detail/CVE-2024-6578
*   https://huntr.com/bounties/5b1ebc67-5346-44aa-b8b8-3c1c09d79680

Published to the GitHub Advisory Database

Jul 29, 2024

Last updated

Jul 30, 2024

GHSA-p9f2-jg9w-cx69: Aim Stored Cross-site Scripting Vulnerability

PRESS RELEASE

LONDON, July 25, 2024 /PRNewswire/ -- An investigation by Heimdal reveals that the EU is facing a surge in brute force cyber attacks on corporate and institutional networks, primarily originating from Russia.

These attackers exploit Microsoft infrastructure, particularly in Belgium and the Netherlands, to avoid detection.

The investigation into the Russian brute-force campaign has revealed several critical insights:

*   Attackers are aiming for High-Value Targets (HVTs)
    
*   Key infrastructure cities like Edinburgh and Dublin have been frequently targeted
    
*   Over half of the attack IP addresses are linked to Moscow, targeting major cities in the UK, Denmark, Hungary, and Lithuania
    
*   The rest of the investigated attack IPs can be traced back to Amsterdam and Brussels
    
*   Major ISPs like Telefonica LLC and IPX-FZCO were significantly abused
    
*   Heimdal's data shows these attacks date back to May 2024 but may have been happening even longer.
    

Prevalent Infiltration and Attack Techniques

The attackers primarily target administrative accounts using various case combinations and language variants.

Over 60% of attack IPs are new, with approximately 65% recently compromised and the rest previously abused, revealing a constantly evolving threat.

The threat actors employ known attack principles such as SMBv1 crawlers, RDP crawlers, and RDP alternative port crawlers, exploiting weak or default credentials through password guessing, spraying, and stuffing.

Additionally, their use of legitimate Microsoft infrastructure broadens the attack surface and complicates detection and response.

Data shows that attackers have actively exploited Microsoft infrastructure from the Netherlands and Belgium to increase their attack range and success odds.

Russia Leveraging State-Owned Networks to Propagate Attack

Major ISPs like Telefonica LLC and IPX-FZCO are significantly abused, with the former accounting for 27.7% of attacks from Russia.

The attackers also leveraged resources from Russian allies, including Indian telecom companies Bharat Sanchar Nigam Limited and Bharti Airtel Limited, both of which have faced recent data breaches.

Scope of Brute-Force Campaign

Russia's motivation behind these cyberattacks is multifaceted.

The reasons for these actions likely include aims to destabilize and disrupt critical infrastructure in Europe, extract sensitive data, gain financial advantage to fuel ongoing cyber-war efforts, or deploy malware.

The threat actors' mandates can span multiple types of subversive cyber-warfare ops, including seek-and-destroy, disruption of critical assets, and sabotage.

A Wake Up Call for the European Union

This persistent threat underscores the need for cybersecurity measures within EU countries, including strengthening cloud security, enforcing multi-factor authentication, conducting regular security audits, and educating employees.

Morten Kjaersgaard, Founder of Heimdal, said:

"This data shows that an entity in Russia is waging a hybrid war on Europe, and may have even infiltrated it.

The threat actors are aiming to extract as much data or financial means as possible, leveraging Microsoft infrastructure to do so.

Whoever is responsible, whether it's the state or another nefarious group, they have no shame in using Russia's allies to commit these crimes.

The exploitation of Indian infrastructure is a strong example. The data also proves these attackers have strong ties with China."

Paul Vixie, Co-Founder of SIE Europe, added:

"The data that Heimdal has uncovered is explosively evil, and SIE Europe data clearly shows how well built these Russian Wasp nests are and they show no signs of stopping.

SIE Europe does not ever traffic in Personally Identifiable Information, and this case shows the investigative power of public information once cooperatively assembled."

Read the full investigation here: Russia-Linked Brute-Force Campaign Targets EU via Microsoft Infrastructure (heimdalsecurity.com).

Heimdal Security Presents its Latest Report on Brute-Force Cyberattacks

One threat actor claims to have already gathered email addresses and associated hashes from more than 110 remote IT management databases.

Source: rafapress via Shutterstock

A threat actor on BreachForums is claiming to have harvested email addresses and associated hashes from more than 105 ServiceNow databases after exploiting two recently disclosed critical vulnerabilities in the cloud-based IT service management platform.

Researchers from Resecurity's HUNTER threat team warned late last week that the two ServiceNow vulnerabilities (CVE-2024-4879, CVSS score of 9.3 out of 10; and CVE-2024-5217, CVSS score of 9.2) were being actively exploited in the wild, and said they saw the BreachForums member putting the data up for sale at $5,000 for the whole tranche.

Meanwhile, the US Cybersecurity and Infrastructure Security Agency (CISA) today added the two bugs to its known exploited vulnerabilities catalog amid multiple reports of other attempts to exploit the flaws in recent days. Federal civilian executive branch agencies have until Aug. 19 to apply ServiceNow's patches, or to discontinue use of the platform until they can remediate the issue.

Resecurity researchers said that the attacks on ServiceNow should be expected. "There has been identified chatter on multiple underground forums on the Dark Web highlighting threat actors seeking compromised access to IT service desks, corporate portals, and other enterprise systems that typically provide remote access to employees and contractors," they wrote. "These systems could be used for pre-positioning and attack planning, as well as reconnaissance."

**An Unauthenticated RCE Chain Allows Total Access**

CVE-2024-4879 is an input validation vulnerability in ServiceNow's "Vancouver" and "Washington DC" versions of the platform. It enables an unauthenticated remote attacker to execute arbitrary code. The vendor has assessed the vulnerability as easy to exploit and requiring no user interaction or special conditions. CVE-2024-5217 is a similarly critical input validation flaw in the Vancouver, Washington DC and earlier editions of Now that also allows for remote code execution (RCE) and is easy to exploit.

ServiceNow issued hotfixes for both flaws on July 10 along with a fix for a third — less severe — flaw in the same software (CVE-2024-5178). AssetNote discovered the three vulnerabilities and reported them to ServiceNow in May, describing the issues as a "chain of vulnerabilities that allows full database access and full access to any servers," that organizations might be using to access cloud-hosted instances.

A public proof-of-concept exploit (PoC) was quickly published, paving the way for widespread attacks in the wild.

"On May 14, 2024, ServiceNow learned of a vulnerability on the Now Platform impacting instances running on the Vancouver and Washington, D.C. family releases," a spokeswoman said in an emailed comment. "That day, we deployed an update and have since issued a series of patches designed to address the issue" she said.  
Based on ServiceNow's investigation to date the company has not observed evidence that the activity that Resecurity said it has observed is related to instances that ServiceNow hosts, the spokeswoman said. "We have encouraged our self-hosted and ServiceNow-hosted customers to apply relevant patches if they have not already done so. We will also continue to work directly with customers who need assistance in applying those patches.   

**In-the-Wild Attacks Start to Escalate**

Resecurity last week reported observing multiple attackers probing ServiceNow instances to check if they were vulnerable. "Initially, threat actors were injecting a payload and checking for a specific multiplication result in the response," Resecurity said. Next the attackers injected a payload that inspected the contents of the database and extracted it. "The final stage involved dumping user lists and collecting associated meta-data from compromised instances."  

The attacks so far have targeted Resecurity's clients (including an energy company, a data-center organization, a Middle Eastern government agency, and a software developer), critical infrastructure, foreign governments, as well as financial institutions, the Resecurity researchers noted in emailed comments to Dark Reading. Based on feedback from multiple victims, some of them appear to have been using on-premises or self-hosted versions of ServiceNow, or for some reason had opted out of receiving automatic updates from the company, the researchers said.

"Notably, some of them were not aware of the released patch, and in some cases used outdated or poorly maintained instances by their developers and software engineers," the company noted.

Imperva on July 23 also said it had observed attempts to exploit the vulnerabilities targeting organizations in the financial sector and multiple other industries. At the time, Imperva reported observing exploitation attempts across as any as 6,000 sites.

"Attackers are primarily leveraging automated tools to target login pages," Imperva said. "We're seeing two common payloads across attacks: one to test if remote code execution (RCE) is possible, and another command to show database users and passwords."

Estimates on the number of ServiceNow instances that are visible to Internet scans — and are hence likely targets for exploitation attempts — vary from more than 297,700 at the high-end to a less than 10,000 at the other end of the scale.

"Unfortunately, finding and exploiting these vulnerable systems isn't particularly difficult for motivated attackers," says Omri Weinberg, co-founder and CRO at DoControl.

**Self-Hosted MID Servers Could Become Targets**

ServiceNow is a widely used platform, and its instances often have public-facing components which threat actors can relatively easily find using automated scanning tools, Weinberg says. Once an adversary is able to find a vulnerable instance, "the exploit chain doesn't require a high level of technical sophistication, making it accessible to a broad range of attackers."

Weinberg recommends that organizations which cannot patch immediately focus on basic security hygiene like tightening access controls, increasing monitoring, and if possible, to restrict access to only trusted IP ranges.  

Naomi Buckwalter, director of product security at Contrast Security, says organizations using self-hosted proxy servers — called MID servers in ServiceNow speak — to connect internal systems to ServiceNow's cloud-based platform should pay special attention to the new flaws.

"While the MID server is not directly exposed to the Internet, attackers who manage to breach the internal network could potentially exploit these flaws to access sensitive data and disrupt critical business operations running on the Now Platform," Buckwalter says. "In a worst-case scenario, attackers could exfiltrate data, manipulate files, and gain unauthorized access to confidential information," she says. "ServiceNow has released patches to address these vulnerabilities, but organizations using self-hosted MID servers may still be at risk if they haven't applied the updates."

**About the Author(s)**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Patch Now: ServiceNow Critical RCE Bugs Under Active Exploit

Microsoft says that an examination of Windows crash reports around the outage shows that kernel drivers need to be carefully employed.

Source: Mundissima via Alamy Stock Photo

UPDATED

Microsoft has released more details around its assessment of the CrowdStrike Falcon outage nearly two weeks ago, noting that one takeaway is the need to reduce infosec vendors' reliance on the kernel drivers.

In a blog post published over the weekend, David Weston, vice president of enterprise and OS security at Microsoft, detailed that the company measured the impact of the incident through accessing crash reports that were voluntarily shared by customers. 

As not every customer opts to share crash reports, those are just "a subset of the number of impacted devices previously shared by Microsoft," Weston wrote. 

But the consensus that emerged was that while kernel drivers such as those employed by CrowdStrike can actually improve performance and prevent software tampering, those advantages must be rationalized against potential risk posed by their innate privileges.

"Since kernel drivers run at the most trusted level of Windows, where containment and recovery capabilities are by nature constrained, security vendors must carefully balance needs like visibility and tamper resistance with the risk of operating within kernel mode," Weston wrote.

He said he believes that if security vendors can strike the right balance, organizations can minimize kernel usage while also maintaining a strong security position.

This story was updated at 9:15 a.m. ET on July 30, 2024 to correct inaccurate reporting that Microsoft revised the original 8.5 million device estimate for how many machines were affected by the CrowdStrike outage.

**About the Author(s)**

Microsoft Talks Kernel Drivers Post CrowdStrike Outage

Security presence has been heightened in Paris to ensure that the Games are safe, and Israeli athletes have been provided with even more protection.

Source: Italy Alan King via Alamy Stock Photo

The sensitive data of several Israeli athletes in the Paris Olympic Games was published on Telegram in an alleged doxing attack on Friday.

The information includes blood test results and login credentials that required France's Anti-Cybercrime Office (OFAC) to seek removal of the data after it was first reported.

A hacking group calling itself "Zeus" (likely a nod to the Games' Greek origins) is allegedly responsible, and also purportedly leaked the military status of Israeli athletes on social media a day prior.

"There are those who seek to harm the festivities of this joyous event," stated Israeli Foreign Minister Israel Katz in a letter to his French counterpart.

Both the Israeli and Palestinian delegations at the Olympics have been provided with extra protection due to the ongoing conflict in Gaza.

Roughly 18,000 French troops are in Paris to help secure the Games, in addition to the city's regular police. Israel's 88 athletes have been assigned security details, made up of both French officers and Israeli agents.

**About the Author(s)**

Latest News