Learn about Talos' research into cracked versions of the Microsoft Windows operating system and applications. Discover why the use of cracktivator software is a growing trend.

Wednesday, October 18, 2023 11:10

Cisco Talos coined the term “Cracktivator software” to reference counterfeit or modified software for pirated versions of Windows applications. 

One of our teammates, James Nutland, led the research to look into cracked versions of the Microsoft Windows operating system and other Microsoft applications such as Office.  

Both products use Microsoft key management service (KMS), which typically allows organizations to activate systems on their own network. Cracktivators co-opt this service by altering the system to allow pirated keys. The term could also apply to other applications that have been modified or pirated in some way. 

The use of Cracktivator software is a growing trend around the world. A notable majority of the organizations using cracked software are in Europe, especially Eastern Europe, in a broad range of industries. During Talos’ Ukrainian Task Force’s threat hunting operations, which is focussed on critical infrastructure, we uncovered a substantial number of organizations running this type of illegitimate software.   

According to Talos data, North America also shows a variety in industry types using Cracktivator software, with the highest prevalence being in manufacturing and education, and, to a lesser extent, construction, financial services and retail. In the Asia Pacific region, the industries using Cracktivator software are predominantly within the manufacturing and government sectors.  

However, there seems to be less overall Cracktivator usage in Asia Pacific than in Europe and North America, which is a shift. Asia Pacific used to have a large presence of pirated enterprise software, though we are still unsure as to the exact reason why they’ve moved away from cracked software. 

Regional use of pirated Windows software for more than 30 days. 

**The security risks of using Cracktivator software **

Aside from the fact that using pirated software is illegal, the use of it brings many security risks. These include not having access to critical updates or security patches, which can leave users more open to attacks that target known vulnerabilities within Windows applications. 

During our research, we also found that other threats, such as remote access trojans (RATs) and cryptocurrency mining malware, are also commonly found on systems running Cracktivator software. We’ve detected that adversaries are bundling these types of threats into modified software as a method of initial access. 

In this situation, the user is typically unaware of any built-in malware when they download the cracked software (typically via torrent sites). In fact, Cracktivator software looks and sounds, in most cases, like the real thing. This is largely because threat actors don’t want users to spot anything amiss, so they can carry out whatever malicious intentions they may have (for example, establishing a backdoor to systems).   

**Why do organizations use Cracktivator software? **

This is a complicated question, as there are many reasons as to why organizations choose (or in some cases, turn a blind eye) to using Cracktivator software. Poor security hygiene is one reason. Organization’s may not have the appropriate tools for security training, unable to spread awareness to employees about the risks of using such software. 

Another reason is that certain people or departments may be under a time crunch to deliver a piece of work. Purchasing an illegitimate license may help speed up the completion of these deliverables or be cheaper than buying an actual license. 

Unfortunately, while users are typing away on their Word document to get that board report in on time, there is typically a lot of malicious activity going on in the background. Therefore the short-term gains are never worth the long-term pains. 

**Recommendations on how to address the growing trend of Cracktivator software use **

*   Regularly update all software and systems with legitimate, licensed versions. 
*   Employ robust cybersecurity solutions to detect and mitigate threats, including installing endpoint detection response (EDR) solutions. 
*   Regularly monitor internal systems for any suspicious activity, such as unusual PowerShell and Netsh utility usage. 
*   Conduct cybersecurity awareness and training programs to inform staff about the risks associated with downloading and using cracked software. 
*   Block and/or monitor traffic reaching out to the associated IOCs.   
*   Monitor and prevent unnecessary and/or unauthorized use of system administration tools, such as remote access software.   
*   Ensure sensitive systems are properly segmented and not exposed to the internet to prevent lateral movement from compromised machines.   

Talos’ Head of Strategic Analysis David Liebenberg recently appeared on the CyberWire podcast to talk about Talos’ Cracktivator research. Check out the conversation:

If you’d like to continue to learn more about the basics of the topics we cover on the Talos blog, read the rest of our entries in The Need to Know series.

What is Cracktivator software?

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.

**Solution**

 No fix

No patched version is available.

Found this useful? Thank thiennv for reporting this vulnerability. Buy a coffee ☕

thiennv discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Responsive Image Gallery, Gallery Album Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 3 present

 2 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45630: WordPress Gallery – Image and Video Gallery with Thumbnails  plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions.

**Solution**

 No fix

No patched version is available.

Found this useful? Thank Elliot for reporting this vulnerability. Buy a coffee ☕

Elliot discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Video Player Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 1 present

 2 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45632: WordPress SpiderVPlayer plugin <= 1.5.22 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in QROkes QR Twitter Widget plugin <= 0.2.3 versions.

**Solution**

 No fix

No patched version is available.

Found this useful? Thank Mika for reporting this vulnerability. Buy a coffee ☕

Mika discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress QR Twitter Widget Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45628: WordPress QR Twitter Widget plugin <= 0.2.3 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions.

**Solution**

 Fixed

Update the WordPress WordPress Popular Posts plugin to the latest available version (at least 6.3.3).

Found this useful? Thank Rafie Muhammad (Patchstack) for reporting this vulnerability. Buy a coffee ☕

Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WordPress Popular Posts Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.3.3.

**Other vulnerabilities in this plugin**

 0 present

 6 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45607: WordPress Popular Posts plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Reilly Get Custom Field Values plugin <= 4.0.1 versions.

**Solution**

 Fixed

Update the WordPress Get Custom Field Values plugin to the latest available version (at least 4.1).

Satoo Nakano discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Get Custom Field Values Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.1.

**Other vulnerabilities in this plugin**

 0 present

 3 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45604: WordPress Get Custom Field Values plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.785 versions.

**Solution**

 No fix

No patched version is available. No reply from the vendor.

Le Ngoc Anh discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Ebook Store Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 1 present

 2 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45602: WordPress Ebook Store plugin <= 5.785 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Theme Blvd Tweeple plugin <= 0.9.5 versions.

**Solution**

 No fix

No patched version is available.

Found this useful? Thank Elliot for reporting this vulnerability. Buy a coffee ☕

Elliot discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Tweeple Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-30781: WordPress Tweeple plugin <= 0.9.5 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Building a culture of cybersecurity is achievable by acknowledging its importance and consistently reinforcing that message.

Highly experienced information security team in place? Check.

Leading endpoint detection software and monitoring in place? Check.

Multifactor authentication enabled on all environment entry points? Check.

By all accounts, cutting-edge technology and skilled cybersecurity resources should be the end of the story for ensuring network integrity, right? If only it were that simple. With a recent survey indicating that 74% of cyber incidents include a human component to enable a threat actor, a company must do more to ensure a culture of cybersecurity and to protect its organization. 

So what does _more_ look like?

**A More Secure Organization**

More starts with understanding there is _always_ a cybersecurity risk and ultimately ends with an established culture across all levels of the organization committed to collectively mitigating that risk. Let's  run through a few approaches that can help establish that culture and, thus, a more secure organization.

*   **It starts at the top:** Building a culture from the top down is not a new concept, but its relevance to cybersecurity within organizations is gaining the traction it deserves. At a base level, in order to simply have the technical applications and experienced personnel in place to adequately protect an organization, you need the individuals with the purse strings to be onboard. The sell likely has become easier over the past several years as incidents are in the news, the visibility grows, and those in the C-suite see similarly situated organizations fall victim to cyberattacks. At the end of the day, the message needs to be loud and clear from an organization's leadership that: a) we understand and appreciate the evolving cybersecurity risk to our company; and b) we are willing to invest in the security of our environment (both from technical and non-technical standpoints) to protect our business.
*   **Demonstrate that cybersecurity matters:** It might seem like we're asking a lot of an organization's leadership when it comes to creating a culture of cybersecurity, and that might be true. But building a culture of any kind within an organization begins with leadership embracing an idea and then continuing to acknowledge and engage on the topic. In this context, it means making cybersecurity part of the lexicon of an organization and finding the right opportunities to continuously demonstrate its importance to the company. How an organization decides to do this might depend on how it communicates with its workforce generally on other important topics, but some simple options include: 1) Regularly re-engaging on the topics of cybersecurity via an email newsletter from the chief information security officer (CISO) — highlighting not just what the company is doing on the technical side, but what challenges all organizations are facing related to evolving threats (e.g., AI) and the CISO's take on how every employee can help; and 2) Discussing cybersecurity on CEO- or COO-led companywide calls and emphasizing the importance of a strong cybersecurity culture to the longevity and success of the business. The more leadership discusses the importance of a culture of cybersecurity, the more employees will acknowledge that risk and ultimately accept a level of responsibility for the organization's cybersecurity safety.
*   **Educate (and then test and test again):** Ben Franklin once said, "An investment in knowledge pays the best interest," and when the average cost of an incident globally is in excess of $4 million, that certainly rings true when it comes to cybersecurity. There can be no doubt, the investment in educating and building an employee base knowledgeable about cybersecurity has _real_ economic value to an organization. This training allows employees to act as the last line of defense against a range of cyber threats, but perhaps equally as important, it empowers every employee to be a cybersecurity advocate for the organization, reminding their colleagues the importance of vigilance in support of a culture of cybersecurity. So how do you educate your employees? It starts with implementing a robust cybersecurity training program (hopefully something both educational and fun) and it continues by keeping your employees on their toes — using test phishing emails (and even text messages). The training and testing are then followed up with subsequent "re-training," if needed, to keep cybersecurity top of mind. Organizations can then share the outcomes of these test phishing emails with all employees (on standing calls or in their CISO newsletter) to take advantage of another key opportunity to speak to and re-enforce the importance of cybersecurity with real data and then share ways to help everyone do better.

At the end of the day, building a culture of cybersecurity is achievable by acknowledging its importance and consistently reinforcing that message. The goal is to have people thinking and talking about cybersecurity as part of their normal course of business and not simply in the context of "another training" or as something completely divorced from their role. When you find your teams are having a conversation about the latest phishing test email (for a free Thanksgiving turkey) or a recent cyber event impacting a competitor, you are witnessing the true reflection of a successful culture of cybersecurity. You should take a moment to applaud your team's success, and then, of course, plan for how to keep it going.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

The Need for a Cybersecurity-Centric Business Culture

The hacktivists known as SiegedSec identify ICS targets, but there's no evidence of attacks yet.

The hacktivist group SiegedSec has claimed responsibility for a series of attacks against Israeli infrastructure and industrial control systems (ICS), but there is no indication that the listed IP addresses have experienced any attacks.

The hacking group put together a list of what it claims are its Israeli ICS targets, which was recently uncovered by SecurityScorecard's Threat Research, Intelligence, Knowledge, and Engagement (STRIKE) Team. An image of the list — found via analysis of various dark Web groups — shows a series of IP addresses with the claim "we have unleashed mass attacks on Israeli infrastructure."

**Who Made the List**

According to a new report from STRIKE, SiegedSec claims it conducted a series of denial of service (DoS) attacks against a number of ICS devices and other Israeli infrastructure with the support of the pro-Iranian hacktivist group Anonymous Sudan. The purported targets included: global navigational satellite system receivers, building automation and control networks, and Modbus ICS — a communication protocol for communication between industrial electronic devices.

However, a sample of NetFlow data seen by SecurityScorecard does not indicate that the listed IP addresses had experienced volumes of traffic consistent with a DoS attack.

"In the absence of reported disruptions to Israeli infrastructure, the available NetFlow sample appears to support assessments that SiegedSec's attacks were either unsuccessful or have not yet begun in earnest," the report said.

Other researchers' assessments also determined that these attempts were likely to have been unsuccessful, and to conduct a DoS against these targets may be outside the attacker's capability.

That said, rather than just being a list of targets the SiegedSec planned to hit, Robert Ames, staff threat researcher at SecurityScorecard, says the document could be a "call to action" to other attackers who could potentially take advantage of the target identification.

He says: "This seems particularly likely given they also mentioned collaborating with Anonymous Sudan in the same post where they listed their targets. Groups like Anonymous Sudan and KillNet have, in the past, used their Telegram channels to name specific targets in hopes of enlisting further support from their channels' followers."

Ames adds, "SiegedSec is, in certain respects, comparable to Anonymous Sudan: Neither appears to possess the same sophistication or capabilities as a nation-state-backed advanced persistent threat group, but both appear to be motivated by publicity."

**Who Are SiegedSec?**

The SiegedSec group appeared shortly after the Russian invasion of Ukraine in 2022, and has conducted a series of attacks around that conflict, including an alleged data theft on the NATO Communities of Interest Cooperation Portal in July, followed by a second attack on multiple NATO portals earlier this month.

The group was also reportedly behind the attack on Atlassian in February, where a third-party app was breached, compromising employee data and floor plans of Atlassian offices located in San Francisco and Sydney, Australia.

To avoid compromise from this or any other attacker, SecurityScorecard recommended that organizations review the business necessity of exposing ICS devices to the wider Internet and place them behind a VPN or firewall when possible. Also, organizations should consider restricting access to ICS devices by adding dependent IPs to an allow list. 

The firm also recommended blocking the listed IPs in SecurityScorecard's KillNet Bot Blocklist, putting in DDoS mitigations, and configuring DNS resolvers and proxy servers to only accept requests from internal IP addresses and authorized users.

**A Week of Attack Claims**

At the start of last week, the US National Security Agency's director of cybersecurity Rob Joyce said US intelligence had not observed evidence indicating there had been any significant cyberattacks so far in the Israeli-Hamas conflict.

Yet a number of claims of attacks were made at the start of last week, with Anonymous Sudan naming the Israeli government in online discussions as a main target, and the AnonGhost hacktivist group said it had managed to breach the "RedAlert" airstrike warning app to send messages.

Also, information operations entered the discussion last week when pro-Iranian and pro-Chinese groups were detected as being involved in anti-Israel propaganda campaigns.

Tag

#auth