Likely China-linked adversary has blanketed the Internet with DNS mail requests over the past five years via open resolvers, furthering Great Firewall of China ambitions. But the exact nature of its activity is unclear.

Source: Mrinal Pal via Shutterstock

During an investigation into the activities of a threat group providing domain name system (DNS) infrastructure for illicit online gambling sites, threat researcher Renée Burton discovered something completely novel: Covert traffic immune to China's government-run firewall using open DNS resolvers and mail records to communicate.

The China-linked group — dubbed Muddling Meerkat — has demonstrated its ability to get specific DNS packets through the Great Firewall, one of the technologies separating China's Internet from the rest of the world, Burton, vice president of threat research at network security firm Infoblox, wrote in an analysis published this week.

While most requests for restricted domains return a seemingly random IP address, Muddling Meerkat is able to get DNS mail (MX) records with random-looking prefixes in response to certain requests, even when the domain has no mail service.

The goal of the capability remains unclear — most likely it's for reconnaissance or establishing the foundations of a DNS denial-of-service attack, Burton says — but the demonstrated expertise and ability to pierce the GFW deserves additional research, she says.

"We have a deliberate, very cunning use using very detailed knowledge of DNS — this is not your average cybercriminal; this is not your average teenager; these people are experts in DNS," Burton says. "So we have something that has been going on for four and a half years at this point, which isn't observable in any one location, but is deliberate and constant — and that combination of things, to me, is worrisome."

The threat research comes as the governments of the United States and other nations have warned that China's military has infiltrated critical infrastructure networks with a goal of pre-positioning their cyber operators for potential future conflicts. While many threat researchers have noted China-linked hacking groups' expertise in finding and exploiting zero-days in edge devices such as firewalls and virtual private network (VPN) appliances, the current research underscores their capabilities in utilizing the domain name system (DNS) for their own purposes.

**Great Chinese Firewall: "Operator on the Side"**

The Chinese Communist Party prevents its citizens from going to content that the government considers inappropriate or illegal — not by blocking the traffic, but by returning fake responses to DNS queries that prevent a user in China from connecting to the desired site. The approach, dubbed the Great Firewall (GFW), is not an inline traffic filter nor a platform that alters DNS responses on the fly, but rather an "operator on the side" that issues a response that competes with any packet from the original intended destination, says Burton.

While the Great Firewall does not intercept traffic, China does operate another system — often referred to as the Great Cannon (GC) — that takes the adversary-in-the-middle (AitM) approach, modifying packets en route to their destination, she wrote in the report.

"In combination, the GFW and GC create a lot of noise and misleading data that can hinder investigations into anomalous behavior in DNS," the report said. "Muddling Meerkat operations are complex and demonstrate that the actor has a strong understanding of DNS, as well as internet savvy."

Mail (MX) records from kb.com, even though the domain has no mail service. Source: Infoblox

Typically, researchers can see the Great Firewall in operation. When they send a DNS request to a domain considered to be out of bounds by the Chinese government, the GFW will return a seemingly random IP address. When they ask for a non-existent service for that domain, such as a mail (MX) record, the GFW still sends an IP address. However, Infoblox researchers and their industry partners instead saw mail records for domains that had no mail services, and each MX records had a seemingly random, albeit short, host name.

Kb.com, for example, has no MX records, but the researchers have seen a large number of mail responses, seemingly from the domain for servers with names such as "pq5bo\[.\]kb\[.\]com" and "uff0h\[.\]kb\[.\]com".

**Covert Widespread DNS Traffic**

The unexplained Internet traffic — which was initially detected as far back as Oct. 15, 2019 — could be some sort of reconnaissance that uses open resolvers and "super-aged" domains that foil many DNS block lists, says Burton.

"It's super under the radar, right? So that's kind of a recon-y looking thing," she says. "The other thing about it, though, is it has that DNS denial-of-service aspect. There are concerns that the Chinese are positioning themselves for operations against critical infrastructure, and here they've positioned themselves in DNS in a really weird way."

Combined with the recent announcement by the US Cybersecurity and Infrastructure Security Agency (CISA) that China is pre-positioning itself inside other organizations' infrastructures, Infoblox decide to go public with what the company and its anonymous partners had discovered.

Infoblox collaborated with other organizations, which the company declined to name due to worries of retribution and the potential loss of access to the DNS activity data. While the Muddling Meerkat operation appears similar to some "slow drip" DNS denial-of-service attacks, determining the purpose of the traffic will likely require more research participants, Burton says.

"I don't believe there's anyone who can see this operation in totality," she says. "Every single piece is seen individually, and then what we did was we brought a bunch of different pieces together, so we could see the whole thing. This is a complete mystery ... but it definitely is there."

**About the Author(s)**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

'Muddling Meerkat' Poses Nation-State DNS Mystery

By Deeba Ahmed
Beware! Agent Tesla & Taskun Malware are targeting US Education & Gov. This cyberattack steals data & exploits vulnerabilities. Learn how to protect schools & government agencies from this double threat!
This is a post from HackRead.com Read the original post: Agent Tesla and Taskun Malware Targeting US Education and Govt Entities

A new wave of cyberattacks has set its sights on the sensitive data within the US education and government sectors, discovered cybersecurity researchers at the cybersecurity platform, Veriti. This campaign leverages a combination of two malware strains: Agent Tesla and Taskun.

****Agent Tesla and Taskun- The Deceptive Duo****

Agent Tesla is an infamous malware and sophisticated spyware, designed to steal a user’s most valuable data. The malware is known for capturing keystrokes, screenshots, and even login credentials for various applications including browsers and VPNs. With this stolen information, attackers gain unauthorized access to user’s accounts and potentially sensitive systems.

On the other hand, according to Veriti’s blog post, Taskun serves as the perfect accomplice for Agent Tesla’s malicious activities. It works by compromising a system’s integrity, creating a backdoor for Agent Tesla to infiltrate and establish persistence. This allows Agent Tesla to remain undetected for extended periods, deepening its hold on the system and maximizing data theft.

It’s important to highlight that Taskun and Agent Tesla were recently discovered as accomplices in a similar campaign. Researchers observed TicTacToe Dropper targeting Windows devices, subsequently infecting them with Leonem, AgentTesla, SnakeLogger, LokiBot, Remcos, RemLoader, Sabsik, Taskun, Androm, and Upatre.

****Attackers’ Calculated Approach****

As for the latest, campaign, the attack is launched through malicious email attachments exploiting vulnerabilities in Windows OS software like Microsoft Office, one of the most exploited software in malware attacks.

The attackers’ strategy centers around performing reconnaissance to identify vulnerabilities within the targeted systems. This approach often exploits weaknesses in commonly used office applications and operating systems. By targeting these widespread vulnerabilities, the attackers can maximize the impact of their attack, potentially compromising a vast number of devices within an organization.

Phishing emails as observed by Veriti

****Why Education and Government Sectors are Vulnerable****

Educational institutions and government agencies often hold a treasure trove of sensitive data, making them prime targets for cybercriminals. This data can include student records, research findings, social security numbers, and other confidential information.

Moreover, schools have been identified as highly lucrative targets for cybercriminals. Both in the past and recently, hackers have targeted over 900 schools in the United States by exploiting the notorious MOVEit vulnerability.

A successful attack using Agent Tesla and Taskun could result in a significant data breach, causing immense financial loss, reputational damage, and even identity theft for affected individuals.

****How to Fight Back?****

Institutions can strengthen their cybersecurity defences against cyber threats by applying security patches promptly, educating users on cybersecurity awareness, and implementing a multi-layered security approach. Regularly patching vulnerabilities, providing cybersecurity awareness training, and implementing a multi-layered security approach can help protect sensitive data.

1.  Microsoft Outlook Flaw Exploited by Russian Forest Blizzard
2.  Retired Software Exploited To Target Power Grids, Microsoft
3.  Microsoft Teams Flaw Sends Malware to Employees’ Inboxes
4.  Researchers Warn of New Microsoft Office 0-Day Flaw Follina
5.  NodeStealer Mimics ‘Microsoft’ to Hack Facebook, Browser Data

Agent Tesla and Taskun Malware Targeting US Education and Govt Entities

Plus: Google holds off on killing cookies, Samourai Wallet founders get arrested, and GM stops driver surveillance program.

Controversial gunshot-detection company ShotSpotter has deployed more than 25,000 microphones across 170 cities worldwide. This week, WIRED and _South Side Weekly_ revealed the company may continue to provide gunshot data to police in cities even after contracts have ended. Internal emails seen by the publications suggest ShotSpotter sensors may have stayed online despite law enforcement deals having expired, raising questions about what will happen to 2,500 microphones in Chicago when its contract runs out at the end of the year.

Elsewhere, Change Healthcare finally admitted to paying a ransom to the AlphV hackers, also known as BlackCat, that extorted the medical company. Weeks ago, WIRED revealed the attackers were paid $22 million, one of the largest ransomware payments ever. However, in a statement this week the company admitted for the first time that it paid the ransom as part of its effort “to do all it could to protect patient data from disclosure.” Some of that data still found its way onto the dark web.

In another successful grift, researchers have found animators in North Korea creating artwork for major Hollywood studios. A misconfigured North Korea cloud server, discovered at the end of last year, contained thousands of animation files, notes, and working documents for productions of shows that stream on Amazon Prime Video and Max. The companies likely didn’t know workers from the Hermit Kingdom were creating the artwork, but it’s another example of how North Korea is using skilled workers to circumvent sanctions and make the regime money.

Meanwhile, Cisco revealed this week that some of its devices, called Adaptive Security Appliances, have been targeted by state-sponsored hackers who exploited two zero-day vulnerabilities in the systems. The attack, dubbed ArcaneDoor, is believed to have had an espionage focus and sources suspect China’s state-backed hackers may be the culprits.

The November presidential elections may still be months away, but the next US president will have increased surveillance capabilities. This week Joe Biden signed a controversial bill extending and enhancing Section 702 of the Foreign Intelligence Surveillance Act. FISA allows spy agencies to collect Americans’ calls, emails, and more when pursuing foreign intelligence. Critics say the changes are “a gift to any president who may wish to spy on political enemies.”

That’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**School Principal Framed Using AI Voice Deepfake**

In January, an Instagram account in Baltimore, Maryland, posted an alleged audio recording of local school principal Eric Eiswert making racist and antisemitic comments. Baltimore County Public Schools quickly opened an investigation into the incident. However, this week, a former athletic director at Pikesville High School was arrested after police said he used artificial intelligence software to create the fake audio clip of Eiswert. The audio included comments about “ungrateful Black kids” and disparaging remarks about the Jewish community.

Dazhon Darien, the former staff member, was arrested after being stopped in possession of a gun at an airport when officials saw there was an outstanding arrest warrant, the _Baltimore Banner_ reported. The media organization reports that Darien was charged with disrupting school activities and stalking. The fake clip was allegedly made in retaliation for the principal investigating Darien over irregular payments to his roommate.

Police reports, the _Banner_ says, indicate that the audio clip had a “profound” impact on the school principal. “It not only led to Eiswert’s temporary removal from the school but also triggered a wave of hate-filled messages on social media and numerous calls to the school,” police reports said.

Voice-cloning technology, which can fall under the broader banner of deepfake technology, has rapidly improved within the last year. Cloning tools can recreate someone’s voice to a relatively realistic level using just a few seconds of real audio. The systems have increasingly been used to impersonate politicians and scam people over the phone.

**General Motors Stops Driving Surveillance, Following Privacy Complaints**

Your car knows a lot about you—from where and how you drive, to your weight and how you sit. This week, following a series of revelations from _New York Times_ reporter Kashmir Hill, General Motors announced it will end its “Smart Driver” program and unenroll all customers. Until the reports from the _Times_, GM was sharing data with data brokers LexisNexis and Verisk, which shared it with insurers and led to high payments for some people. The OnStar Smart Driver program had been designed to promote safer driving, GM said. However, many people were not aware they had been enrolled in the system. Ten lawsuits have been filed so far about the Smart Driver program and how it shared data.

**Google Delays Killing Cookies—Again**

In January 2020, Google said it would remove third-party cookies from Chrome within two years—following Safari, Brave, Firefox, and other browsers in eradicating the tracking technology. It’s now April 2024 and the company has delayed the change for a third time, saying it’ll happen in 2025. Google’s proposed cookie replacement has faced scrutiny from competition and privacy regulators in the UK, with critics saying cookies are just being replaced by another form of tracking and suggesting the changes could further benefit Google’s ad business.

**Samourai Wallet Founders Arrested Over $2 Billion Unlawful Transactions**

Keonne Rodriguez and William Lonergan Hill, the founders of crypto-mixing service Samourai Wallet, were charged by US prosecutors this week for running an unlicensed money transfer business and conspiracy to commit money laundering. The company processed $2 billion in “unlawful transactions” and “facilitated more than $100 million in money laundering,” according to Damian Williams, the United States Attorney for the Southern District of New York, and other investigators. The charges can carry a maximum of 20 years each. The move comes as US prosecutors try to clampdown on crypto mixing services that may be used to hide funds or allow illicit behavior. Mixers Bitcoin Fog, Helix, and Tornado Cash have all faced action in recent years.

**Chinese Keyboard Vulnerabilities Could Reveal Typing**

New research from the University of Toronto’s Citizen Lab this week revealed vulnerabilities in eight Chinese keyboard apps that, if exploited, could allow everything typed to be intercepted. Up to a billion people may be impacted, the researchers say. They tested apps from major technology companies and phone makers, including Baidu, Honor, Huawei, Samsung and Tencent. “Most of the vulnerable apps can be exploited by an entirely passive network eavesdropper,” they researchers write, adding that most of the impacted companies fixed the vulnerabilities when they were reported.

School Employee Allegedly Framed a Principal With Racist Deepfake Rant

By Deeba Ahmed
Hackers are dusting off old tricks! A recent attack exploited vulnerabilities in systems running outdates Microsoft Office to deliver Cobalt Strike malware. Learn how to protect yourself!
This is a post from HackRead.com Read the original post: 7-Year-Old 0-Day in Microsoft Office Exploited to Drop Cobalt Strike

Cybersecurity firm Deep Instinct has discovered that attackers are using the Cobalt Strike loader to deploy old zero-day exploits, a relatively new trend. Let’s delve deeper into this.

Deep Instinct Threat Lab has discovered a targeted operation against Ukraine in which hackers are using an old zero-day vulnerability, CVE-2017-8570, as the initial vector and a custom loader for Cobalt Strike Beacon, a professional pen-testing tool designed for evaluating computer security by red teams. However, in this attack, hackers have used a cracked version with no legitimate user. 

They’ve exploited CVE-2017-8570, an old Microsoft Office vulnerability identified in 2017, to launch the Cobalt Strike Beacon, targeting Ukraine’s systems. They used a malicious PPSX (PowerPoint Slideshow) file disguised as an old US Army instruction manual for mine-clearing tank blades, bypassing traditional security measures and allowing them to hide the payload and complicate analysis. The file used a “script:” prefix before the HTTPS URL to hide the payload and complicate analysis. 

> _“The lure contained military-related content, suggesting it was targeting military personnel. But the domain names weavesilk(.)space and petapixel(.)fun are disguised as an obscure generative art site (weavesilk(.)com) and a popular photography site (petapixel(.)com). These are unrelated, and it’s a bit puzzling why an attacker would use these specifically to fool military personnel.”_
> 
> Deep Instinct

The use of the Cobalt Strike loader, a malicious, versatile toolset commonly employed in targeted attacks, suggests a sophisticated approach by the attackers. Cobalt Strike allows adversaries to deploy malware, steal data, and maintain persistence on compromised systems. In the context of Ukraine, it is used as a delivery mechanism for these zero-day exploits, maximizing their impact.

Deep Instinct’s research indicates that attackers are actively leveraging zero-day exploits, which are vulnerabilities unknown to security software vendors. This makes them particularly dangerous as traditional defences may not be able to detect and block them.

Researchers couldn’t attribute the attacks to any known threat actor or rule out the possibility of a red team exercise. Evidence indicates the sample was uploaded from Ukraine, the second stage was hosted under a Russian VPS provider, and the Cobalt beacon C&C was registered in Warsaw, Poland.

_“_Given the n-day exploitation trends against > 12-month-old edge device and email server CVEs we’ve seen over the past 4 years, seeing a threat actor exploit a Wine vulnerability from 2017 is weirdly refreshing,_“_ stated Casey Ellis, Founder and Chief Strategy Officer at Bugcrowd

_“_The use of undocumented low-level WinAPI calls is unusual as well. I can understand why threat analysts are having difficulty with attribution, it’s an esoteric and somewhat nerdy kill chain._“_ Casey explained.

“Aside from the technical pieces, the fact that it’s not Russia is noteworthy, and the TTPs suggest a previously unknown player. Cobalt Strike usage as a C2 is fairly commonplace and the key takeaway here is that old vulnerabilities in easily forgotten software still matter._“_

**How to Stay Safe?**

Deep Instinct’s research suggests that traditional security solutions may not be enough for zero-day exploits. Organizations should adopt advanced threat detection through behavioural analysis and machine learning. Vigilance is also crucial, especially for cyber threats targeting Ukraine, and a proactive defence strategy combining firewalls and antivirus software.

1.  APTs Exploiting WinRAR 0day Flaw Despite Patch Availability
2.  5 year old vulnerability used for Monero mining on Linux servers
3.  Protestware Uses npm Packages to Call for Peace in Gaza, Ukraine
4.  12-Year-Old vulnerability in Windows Defender risked 1 billion devices
5.  17-year-old “wormable” SigRed vulnerability found in Windows servers

7-Year-Old 0-Day in Microsoft Office Exploited to Drop Cobalt Strike

The targeted operation utilized CVE-2017-8570 as the initial vector and employed a notable custom loader for Cobalt Strike, yet attribution to any known threat actor remains elusive.

Source: Yuriy Tuchkov via Alamy Stock Photo

An unknown threat actor targeted government entities in Ukraine toward the end of 2023 using an old Microsoft Office remote code execution (RCE) exploit from 2017 (CVE-2017-8570) as the initial vector and military vehicles as the lure.

The threat actor initiated the attack using a malicious PowerPoint file (.PPSX) sent as an attachment through a message on secure messaging platform Signal. This file, which masqueraded as an old instruction manual by the US Army for mine-clearing blades for tanks, had in fact a remote relationship to an external script hosted on a Russian virtual private server (VPS) provider domain protected by Cloudflare.

The script executed the CVE-2017-8570 exploit to achieve RCE, according to a Deep Instinct blog post on the attack this week, in an effort to steal information.

**Underneath the Hood of a Tricky Cyberattack**

In terms of the technical nitty-gritty, the obfuscated script masqueraded as Cisco AnyConnect APN configuration and was responsible for setting persistency, decoding, and saving the embedded payload to disk, which happened in several stages to evade detection.

The payload includes a loader/packer dynamic link library (DLL) named "vpn.sessings" that loads a Cobalt Strike Beacon into memory and awaits instructions from the command-and-control (C2)  server of the attacker.

Mark Vaitzman, threat lab team leader at Deep Instinct, notes that the penetration testing tool Cobalt Strike is very commonly used among threat actors, but this particular beacon makes use of a custom loader that relies on several techniques that slow down analysis.

"It is continuously updated to provide attackers with a simple way to move laterally once the initial footprint is set," he says. "\[And\] it was implemented in several anti-analysis and unique evasion techniques."

Vaitzman notes that in 2022, a severe CVE allowing RCE was found in Cobalt Strike — and many researchers predicted that threat actors would alter the tool to create open source alternatives.

"Several cracked versions can be found on underground hacking forums," he says.

Beyond the tweaked version of Cobalt Strike, he says, the campaign is also notable for the lengths to which the threat actors continuously attempt to masquerade their files and activity as a legitimate, routine OS and common applications operations, to remain hidden and maintain the control of infected machines as long as possible. In this campaign, he says, the attackers took this "living off the land" strategy further.

"This attack campaign shows several masquerading techniques and a smart way of persistence that has not been documented yet," he explains, without divulging details.

**Cyberthreat Group Has Unknown Make & Model**

Ukraine has been targeted by multiple threat actors on multiple occasions during its war with Russia, with the Sandworm Group serving as the aggressor's primary cyberattack unit.

But unlike in most attack campaigns during the war, the threat lab team couldn’t link this effort to any known threat group, which may indicate that this is the work of a new group or representative of a fully upgraded tool set of a known threat actor.

Mayuresh Dani, manager of security research at Qualys Threat Research Unit, points out the use of geographically disparate sources to help the threat actors dispel attribution also make it difficult for security teams to provide targeted protection based on geographical locations.

"The sample was uploaded from Ukraine, the second stage was hosted and registered under a Russian VPS provider, and the Cobalt beacon \[C2\] was registered in Warsaw, Poland," he explains.

He says that what he found most interesting about the chain of attack was that the initial compromise was accomplished via the secure Signal app.

"The Signal messenger has been largely used by security-focused personnel or those who are involved in sharing clandestine information, such as journalists," he notes.

**Beef Up Cyber Armor With Security Awareness, Patch Management**

Vaitzman says that because most of cyberattacks start with phishing or link-luring via emails or messages, broader employee cyber awareness plays an important role in mitigating such attack attempts.

And for security teams, "We also recommend scanning for the provided IoCs in the network, as well as making sure that Office is patched to the latest version," Vaitzman says.

Callie Guenther, senior manager of cyber threat research at Critical Start, says that from a defense perspective, the reliance on older exploits also stresses the importance of robust patch management systems.

"Additionally, the sophistication of the attack underscores the need for advanced detection mechanisms that go beyond signature-based cyber-defense approaches," she says, "incorporating behavior and anomaly detection to identify modified malicious software."

**About the Author(s)**

Nathan Eddy is a freelance journalist and award-winning documentary filmmaker specializing in IT security, autonomous vehicle technology, customer experience technology, and architecture and urban planning. A graduate of Northwestern University’s Medill School of Journalism, Nathan currently lives in Berlin, Germany.

Military Tank Manual, 2017 Zero-Day Anchor Latest Ukraine Cyberattack

Cyberattacks on logistics are becoming increasingly common, and the potential impact is enormous.

Chahak Mittal, Cybersecurity GRC Manager, Universal Logistics Holdings, Inc.

April 25, 2024

5 Min Read

Source: Rawf8 via Alamy Stock Photo

COMMENTARY

Imagine you're standing in a bustling city, surrounded by the symphony of commerce. The exchange of goods and the flow of transportation are all around you. This is the heartbeat of our global economy. But what would happen if this heartbeat were to be disrupted? If the very lifeblood of our interconnected world were to falter — or worse, come to a grinding halt?

The consequences would be catastrophic. Imagine empty shelves in grocery stores, gas stations running out of fuel, and hospitals unable to get the supplies they need. Imagine widespread panic and social unrest.

This is not just a hypothetical scenario. It's a real threat we need to take seriously. Cyberattacks on logistics are becoming increasingly common, and the potential impact is enormous. Logistics is the backbone of our global economy. It's the process that keeps the world's shelves stocked and the wheels of commerce turning.

**Cyberattacks on Logistics May Have Severe Ramifications**

Let's first discuss why cyberattacks on logistics are so concerning.

Remember back to the haunting early days of the pandemic. Lockdown measures paralyzed entire nations, factories fell silent, and transportation came to a grinding halt. The repercussions were profound, as essential goods faced severe delays, and shortages left many in dire straits. The fabric of our interconnected world was put to the test, and the challenges were immense.

Four years later, we see news headlines about cyberattacks on Ukraine's logistics and its global impact. Think for a moment about the unimaginable consequences if a cyberattack were to disrupt logistics on a larger scale than COVID-19 or even exceed its impact.

It is unsettling that a nation could be brought to its knees not by an army or weapons but by code on a computer. This prospect cannot be ignored, especially given that the transport and logistics industry is undergoing a digital transformation.

Companies are increasingly using digitalization tools to streamline all processes, from warehouse inventory management to vehicle tracking. This is a good thing, of course. Digitalization can help to improve efficiency, reduce costs, and improve customer service. But there is a dark side to digitalization. The more digitized a company is, the more vulnerable it is to cyberattacks.

**An Expanded Battlefield**

Let's now delve into the second part of our journey: understanding how cyberattacks on logistics can be weaponized. Throughout history, proper logistics have always been the secret weapon behind any victorious endeavor, whether in war or other ventures. From the days of the Civil War, where horses, mules, and wagons provided armies the food, equipment, and ammunition they needed, to the modern era with colossal military operations with intricate supply chains, logistics have always been the beating heart of success.

Now the battlefield has expanded into the digital realm. The logistics that have propelled economies and nations forward are now vulnerable to a new kind of adversary –— one that wields not swords and shields, but lines of code and malicious intent.

But let's go even deeper. What if these cyberattacks on logistics were not just the work of lone hackers seeking chaos? What if they were orchestrated by state actors with strategic intent? The Russia-Ukraine conflict has demonstrated the potential of such scenarios. The cyber offensive aimed at Ukraine reached far beyond its borders, affecting global supply chains and sending shockwaves through economies. 

In this ever-evolving digital landscape, a new kind of arsenal is being amassed in the shadows: stockpiled zero-day vulnerabilities. Just as nations once accumulated weapons to safeguard their sovereignty, they now amass vulnerabilities as digital ammunition. These zero-day vulnerabilities, arcane exploits unknown even to software creators, have become potent tools of cyber warfare.

Imagine the power of a nation armed with a stockpile of these vulnerabilities. It can strike silently, crippling logistical infrastructures without firing a single shot. This reality becomes more tangible as each day passes. The Russia-Ukraine conflict showcases this new arsenal's alarming potential, serving as a reminder that our reliance on interconnected logistics is both a strength and a vulnerability.

**Fortifying Our Defenses**

So, where do we go from here? How can we fortify our logistical arteries against these emerging threats? Just as the strength of a nation's military once depended on its ability to ensure a steady flow of supplies to the frontlines, today's battles are won by safeguarding the flow of data, goods, and services.

The lessons of history remain relevant — a robust logistics network is not only essential for prosperity, but it is also a fundamental pillar of security. We must invest in cyber-defense strategies that mirror the importance we place on physical defense. Collaboration between governments, industries, and international partners is paramount. The private sector, too, holds a pivotal role.

As we embrace digitalization, we must do so with cybersecurity at the forefront. Companies must not only prioritize efficiency but also fortify their digital infrastructure against potential attacks. 

Strong alliances, collaborative diplomacy, and international cooperation are essential to our defense strategy. Just as alliances between nations bolster our military might, alliances between industries and governments can fortify cybersecurity. By harnessing the power of cyber and soft power in harmony, we can navigate the intricate dance of modern warfare.

The time to act is now. We stand at a crossroads where the path of progress intersects with the shadows of uncertainty. The interconnectedness that has fueled our global economy is also its Achilles' heel. Cyberattacks on logistics are not a distant possibility; they are a sobering reality.

The disruption of our supply chains, the paralysis of our economies — these are the stakes we face. But history has shown us that challenges can become catalysts for innovation. We can forge a new paradigm, one where technology and diplomacy converge to safeguard our way of life.

It is a future where alliances are not just forged on battlefields, but in virtual boardrooms and digital summits, and where the strength of a nation's cybersecurity is as integral to its defense strategy as its military might.

**About the Author(s)**

Cybersecurity GRC Manager, Universal Logistics Holdings, Inc.

Chahak Mittal is a Certified Information Systems Security Professional (CISSP) and Cybersecurity Governance, Risk, and Compliance Manager at Universal Logistics. She is a cybersecurity leader deeply committed to knowledge sharing and community engagement. Through her roles as a Judge at Globee Awards, Major League Hacking (MLH) Hackathons, and as a dedicated cybersecurity instructor volunteer in the Microsoft TEALS Program, she has actively contributed to the cybersecurity ecosystem. Chahak's active involvement in organizations such as the Information Systems Security Association and SecureWorld's Detroit Advisory Council has been instrumental in her pursuit of staying at the forefront of industry trends and challenges. Furthermore, she has channeled her insights into thought-provoking cybersecurity articles, published on SecureWorld.io, ISC2, and CyberDefense Magazine, making a meaningful contribution to the field's intellectual discourse.

Digital Blitzkrieg: Unveiling Cyber-Logistics Warfare

Attacks by a previously unknown threat actor leveraged two bugs in firewall devices to install custom backdoors on several government networks globally.

Source: Znakki via Shutterstock

A state-sponsored threat actor has exploited two Cisco zero-day vulnerabilities in firewall devices to target the perimeter of government networks with two custom-built backdoors, in a global cyber-espionage campaign.

Dubbed "ArcaneDoor," the campaign by the previously unknown actor — which researchers from Cisco Talos track as UAT4356 — has targeted Cisco Adaptive Security Appliance (ASA) firewall devices of several Cisco customers since at least December 2023, Cisco Talos researchers revealed in a blog post.

While the actor's initial access vector remains unknown, once it occurs, UAT4356 used a "sophisticated attack chain" involving exploit of the two vulnerabilities — a denial-of-service flaw tracked as CVE-2024-20353 and a persistent local execution flaw tracked as CVE-2024-20359 that have since been patched — to implant malware and execute commands across a small set of Cisco customers. Cisco Talos also flagged a third flaw in ASA, CVE-2024-20358, that was not used in the ArcaneDoor campaign.

The researchers also found evidence that the actor has interest in and potentially will attack devices from Microsoft and other vendors, making it crucial that organizations ensure that all perimeter devices "are properly patched, logging to a central, secure location, and configured to have strong multifactor authentication (MFA)," Cisco Talos wrote in the post.

**Custom Backdoor Malware for Global Governments**

The first sign of suspicious activity in the campaign came in early 2024 when a customer reached out to Cisco's Product Security Incident Response Team (PSIRT) and Cisco Talos about security concerns with its ASA firewall devices.

A subsequent several-months-long investigation conducted by Cisco and intelligence partners uncovered threat actor-controlled infrastructure dating back to early November 2023. Most of the attacks — all of which targeted government networks globally —occurred between December and early January. There is also evidence that the actor — which Microsoft also is now tracking as STORM-1849 — was testing and developing its capability as early as last July.

The primary payloads of the campaign are two custom backdoors— "Line Dancer" and "Line Runner" — which were used together by UAT4356 to conduct malicious activities on the network, such as configuration and modification; reconnaissance; network traffic capture/exfiltration; and potentially lateral movement.  

Line Dancer is a memory-resident shellcode interpreter that enables adversaries to upload and execute arbitrary shellcode payloads. In the campaign, Cisco Talos observed the malware being used to execute various commands on an ASA device, including: disabling the syslog; running and exfiltrating the command show configuration; creating and exfiltrating packet captures; and executing commands present in the shellcode, among other activities.

Line Runner meanwhile is a persistence mechanism deployed on the ASA device using functionality related to a legacy capability that allowed for the pre-loading of VPN clients and plugins on the device during booting that can be exploited as CVE-2024-20359, according to Cisco Talos. In at least one case, the threat actor also abused CVE-2024-20353 to facilitate this process.

"The attackers were able to leverage this vulnerability to cause the target ASA device to reboot, triggering the unzipping and installing" of Line Runner, according to the researchers.

**Protect the Perimeter From Cyberattackers**

Perimeter devices, which sit at the edge between an organization's internal network and the Internet, "are the perfect intrusion point for espionage-focused campaigns," providing threat actors a way to gain a foothold to "directly pivot into an organization, reroute or modify traffic, and monitor network communications into the secure network, according to Cisco Talos.

Zero-days on these devices are an especially attractive attack surface on these devices, notes Andrew Costis, chapter lead of the Adversary Research Team at MITRE ATT&CK testing firm AttackIQ.

"We've seen time and time again critical zero and n-day vulnerabilities being exploited with all of the mainstream security appliances and software," he says, noting previous attacks on bugs in devices from Ivanti, Palo Alto Networks, and others.

The threat to these devices highlights the need for organizations to "routinely and promptly" patch them using up-to-date hardware and software versions and configurations, as well as maintain close security monitoring of them, according to Cisco Talos.

Organizations also should focus on post-compromise TTPs of threat actors and test known adversary behaviors as part of "a layered approach" to defensive network operations, Costis says.

**Detecting ArcaneDoor Cyberattack Activity**

Indicators of compromise (IoCs) that customers can look for if they suspect they may have been targeted by ArcaneDoor include any flows to/from ASA devices to any of the IP addresses present in the IOC list included in the blog.

Organizations also can issue the command "show memory region | include lina" to identify another IOC. "If the output indicates more than one executable memory region … especially if one of these memory sections is exactly 0x1000 bytes, then this is a sign of potential tampering," Cisco Talos wrote.  

And, Cisco provided two sets of steps that network administrators can take to identify and remove the ArcaneDoor persistence backdoor Line Runner on an ASA device once the patch is applied. The first is to conduct a review of the contents of disk0; if a new file (e.g., "client\_bundle\_install.zip" or any other unusual .zip file) appears on the disk, it means that Line Runner had been present but is no longer active due to the update.

Administrators also can follow a series of commands provided that will create an innocuous file with a .zip extension that will be read by the ASA at reboot. If it appears on disk0, it means that Line Runner likely was present on the device in question. Administrators can then delete the "client\_bundle\_install.zip" file to remove the backdoor.

If administrators find a newly created .zip file on their ASA devices, they should copy that file off the device and email \[email protected\] using a reference to CVE-2024-20359 and including the outputs of the "dir disk0:" and "show version" commands from the device, as well as the .zip file that they extracted.

**About the Author(s)**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

Cisco Zero-Days Anchor 'ArcaneDoor' Cyber-Espionage Campaign

By Uzair Amir
The role of Network Detection and Response (NDR) in cybersecurity. Learn how NDR tools empower organizations to tackle evolving threats effectively.
This is a post from HackRead.com Read the original post: NDR in the Modern Cybersecurity Landscape

In today’s information age, businesses are increasingly reliant on interconnected networks and cloud infrastructures, and **protecting digital assets against cyber threats** has become a paramount concern.

Network Detection and Response (NDR) is a critical component in the arsenal of cybersecurity tools, offering advanced capabilities to monitor, analyze, and respond to threats traversing network environments.

As organizations confront the complexities of modern cyber threats, understanding the role and significance of NDR is essential for bolstering their cybersecurity posture.

****Understanding NDR in Cybersecurity****

Modern cybersecurity uses the concept of Network Detection and Response (NDR) as an active approach to fortifying network defences against threats. But what exactly is NDR in cybersecurity, and how does it function within the broader security landscape?

**What is NDR in cyber security?** NDR, also known as network detection and response, covers a set of cybersecurity techniques designed to monitor and analyze network traffic for potential security threats.

Unlike traditional security measures that focus primarily on endpoint protection or perimeter defence, NDR operates within the network infrastructure, using advanced detection techniques such as artificial intelligence and machine learning to identify anomalous behaviour and potential indicators of compromise (IOCs).

NDR serves as an active defence mechanism, providing organizations with real-time visibility into their network traffic and enabling rapid response to threats. By continuously monitoring network activity and analyzing patterns, NDR solutions empower security teams to detect and neutralize potential threats before they can cause huge harm or compromise sensitive data.

****The Purpose of NDR****

The primary objective of NDR is to enhance network visibility and security by providing organizations with the means to detect and respond to security incidents in a timely and effective manner. But what specific purposes does NDR serve within cybersecurity, and how does it contribute to threat mitigation?

****Early Threat Detection****

By optimizing network visibility, NDR enables organizations to identify malicious activity and **indicators of compromise (IOCs)** at an early stage. Through the analysis of network traffic data, security teams can detect unauthorized activity, unusual communication patterns, and anomalous behaviours, allowing them to take proactive measures to neutralize threats before they escalate.

****Rapid Incident Response****

Enhanced network visibility facilitated by NDR enables real-time monitoring and analysis of network traffic, empowering organizations to respond swiftly to security incidents as they occur. By tracking the source, extent, and impact of an event, security teams can implement prompt remediation measures to mitigate its effects and minimize potential damage.

****Comprehensive Threat Analysis****

Increased network visibility provided by NDR facilitates in-depth examination of network data, enabling organizations to gain insights into potential threat proliferation. By analyzing network communication patterns, traffic flows, and data transfers, security teams can identify malicious behaviour, detect malware infections, and uncover hidden threats, thereby enhancing their understanding of attacker tactics, techniques, and procedures (TTPs).

For organizations seeking to strengthen their defences against emerging threats, selecting the right NDR solution is important. While several vendors offer NDR capabilities, a few stand out for their innovative features and comprehensive security offerings.

****Arctic Wolf****

As a managed NDR provider, Arctic Wolf offers a suite of security solutions aimed at identifying, tracking, and mitigating cyber threats. With its Security Operations Center-as-a-Service (SOC-as-a-Service), Arctic Wolf helps organizations detect security flaws, proactively mitigate risks, and prioritize remediation efforts.

****Attivo Networks****

Leveraging deception methods, Attivo Networks’ threat defence platform detects and neutralizes post-compromise threats, including in-network threat activity and lateral movement by attackers. Through its ThreatDirect and BOTsink components, Attivo Networks extends network deception tactics to cloud, remote distributed, and micro-segmented systems, providing organizations with enhanced threat detection capabilities.

****Stellar Cyber** **

Stellar Cyber is an NDR solution that enables organizations to safeguard their data and maximize the effectiveness of their security investments. By aggregating and analyzing log data, it helps organizations prioritize security alerts for investigation, providing knowledge to enhance their security posture.

****Darktrace****

Built on self-learning cyber-AI, Darktrace’s Enterprise Immune System employs advanced AI and machine-learning techniques to detect attacks and insider threats. Without relying on rules or signatures, Darktrace identifies subtle indicators of sophisticated attacks, providing organizations with comprehensive threat detection capabilities.

****Emerging Trends in NDR****

Several new trends are shaping the future of network detection and response. These trends reflect the nature of cyber threats and the need for innovative approaches to combating them effectively.

****AI-Powered Threat Detection****

As cyber threats become more sophisticated and difficult to detect, NDR solutions are increasingly using artificial intelligence (AI) and machine learning (ML) algorithms to enhance threat detection capabilities. By analyzing vast amounts of network data and identifying patterns indicative of malicious activity, AI-powered NDR solutions can detect and respond to threats in real-time, even as attackers evolve their tactics.

****Behavioral Analytics****

Traditional signature-based detection methods are often ineffective against zero-day attacks. To address this challenge, NDR solutions are incorporating behavioural analytics techniques to identify anomalous behaviour and deviations from normal network patterns. By establishing baselines of “normal” network behaviour, NDR solutions can detect and alert suspicious activities that may indicate a security threat.

****Cloud-Native NDR****

With the widespread adoption of cloud computing and hybrid infrastructures, NDR solutions are evolving to provide native support for cloud environments. Cloud-native NDR solutions offer easy integration with cloud platforms, enabling organizations to monitor and protect their cloud-based assets effectively. By extending visibility and threat detection capabilities to the cloud, these solutions help organizations maintain a consistent security posture across their entire infrastructure.

****Threat Intelligence Integration****

Integrating threat intelligence feeds into NDR solutions enhances their ability to identify and respond to threats. By using up-to-date threat intelligence data from reputable sources, NDR solutions can prioritize alerts and provide insights to security teams. This approach enables organizations to stay ahead of new threats and mitigate potential risks before they escalate.

****Automation and Orchestration****

The growing cyber threats and limited security resources, as well as automation and orchestration, are becoming essential components of NDR solutions. By automating repetitive tasks and orchestrating incident response processes, NDR solutions enable security teams to streamline operations and respond to threats more effectively. This allows organizations to maximize the efficiency of their security operations and focus their resources on high-priority tasks.

****Market Dynamics and Future Trends****

The network detection and response market continues to change rapidly, driven by new technologies and new threats. Reports from Quadrant Knowledge Solutions offer insights into market dynamics and future trends, enabling organizations to scale through the NDR security landscape and select the most suitable platform for their needs.

By harnessing the insights and capabilities offered by NDR solutions, organizations can strengthen their cybersecurity posture and ensure protection for their digital assets. Integrating NDR into their security stack empowers organizations to detect, analyze, and respond to threats effectively, mitigating potential risks and safeguarding against cyber attacks.

****Conclusion****

Network Detection and Response (NDR) plays a vital role in the modern cybersecurity space, offering organizations the ability to actively identify, analyze, and mitigate security threats in real-time. By providing enhanced network visibility and threat detection capabilities, NDR solutions empower security teams to detect and respond to the latest threats swiftly and effectively.

As organizations continue to confront the complexities of modern cyber threats, understanding the need for NDR and selecting the right solution is **essential for boosting their cybersecurity defences**. By using the insights and capabilities offered by NDR solutions, organizations can enhance their resilience against cyber attacks and safeguard their digital assets.

NDR in the Modern Cybersecurity Landscape

By Waqas
Using Google Chrome? Update your browser to the latest version right now!
This is a post from HackRead.com Read the original post: Google Patches Critical Chrome Vulnerability and Additional Flaws

Google Chrome users beware! A critical vulnerability (CVE-2024-4058) has been patched in the latest update (version 124). This flaw could allow attackers to take control of your system.

Google addressed a critical vulnerability (CVE-2024-4058) in its Chrome web browser on Wednesday, April 24th, 2024. This flaw resides within the ANGLE graphics layer engine and carries a “critical” severity rating, indicating its potential for severe exploitation.

While the critical CVE-2024-4058 garnered the most attention, Google’s Chrome update (version 124) also patched two additional high-severity vulnerabilities:

*   **CVE-2024-4059:** This vulnerability is classified as an out-of-bounds read within the V8 JavaScript engine. An out-of-bounds read allows attackers to access memory locations they shouldn’t, potentially revealing sensitive information.
*   **CVE-2024-4060:** This vulnerability is a use-after-free issue in the Dawn component. Use-after-free vulnerabilities can lead to crashes or potentially code execution depending on how they are exploited.

****The Importance of Updating****

While the specific details and exploitability of CVE-2024-4059 and CVE-2024-4060 are not yet fully public, it’s important to update Chrome regardless. A high-severity rating suggests these vulnerabilities could also be weaponized by attackers, so patching promptly remains the best course of action.

Jason Soroko, Senior Vice President of Product at Sectigo commented on the update stating, _“_CVE-2024-4058, a Type Confusion in ANGLE, is a vulnerability categorized as critical because it could allow remote code execution (RCE), enabling attackers to put malware onto the victim’s device. This latest vulnerability is a bad one for sure, and therefore it would be critical to patch this immediately._”_

****How to Protect Yourself****

The safest course of action is to update your Google Chrome browser immediately. Google has released Chrome version 124 which addresses this vulnerability alongside other security fixes. Here’s how to update Chrome:

*   **Windows & Mac:** Open Chrome, click the three vertical dots in the top right corner, go to “Help” and then “About Chrome.” Chrome will automatically check for updates and install them if available.
*   **Linux:** The update process for Linux may vary depending on your distribution. Consult your distribution’s documentation for specific update instructions.

Updating to Chrome version 124 protects you from these critical, high-severity, and potentially dangerous vulnerabilities. For additional technical details and a full list of changes in this build visit the Log section.

1.  Critical Chrome Update Counters Spyware Vendor’s Exploits
2.  Google Chrome to Mask User IP Addresses to Protect Privacy
3.  Fake Chrome Browser Update Installs NetSupport Manager RAT
4.  CISA Warns of Chrome and Excel Parsing LibraryExploitable Flaws
5.  Fantom Foundation Suffers Wallet Hack Via Google Chrome 0-Day

Google Patches Critical Chrome Vulnerability and Additional Flaws

By Deeba Ahmed
Popular File Transfer Software Hit by Zero-Day Exploit: Millions Potentially Exposed - Install Patches Right Now!
This is a post from HackRead.com Read the original post: Popular File Transfer Software CrushFTP Hit by Zero-Day Exploit

A critical zero-day vulnerability in CrushFTP, a popular file transfer software, allows attackers to download sensitive system files. This puts millions of users at risk! Learn how to protect yourself from this exploit and secure your file transfers.

Attention file transfer users! A recently discovered zero-day exploit in CrushFTP, a popular enterprise file transfer software solution, has sent security researchers scrambling. This critical vulnerability could allow attackers to download sensitive system files, potentially compromising the security of millions of users worldwide.

****What is CrushFTP and Why Should You Care?****

CrushFTP is a widely used software program that enables secure file transfers between computers and servers, offering functionalities like FTP, SFTP, FTPS, WebDAV, and more. However, the recent discovery of a zero-day exploit raises concerns about the potential for unauthorized access and data breaches, making businesses/organizations using it for data exchanges vulnerable.

****How Does the Exploit Work?****

The vulnerability (CVE-2024-4040), identified by Simon Garrelou of Airbus CERT, allows attackers to bypass the software’s virtual file system (VFS) restrictions and download system files that are typically off-limits. This unauthorized access could lead to the theft of sensitive data, the installation of malicious software, and disruption of file transfer operations or server inoperability.

****Who is Affected?****

The exact number of affected users is unknown, but CrushFTP boasts a significant user base across various industries. Organizations of all sizes, from small businesses to large enterprises, could be at risk if they haven’t applied the latest security patch, details of which can be found in CrushFTP’s advisory.

“CrushFTP v11 versions below 11.1 have a vulnerability where users can escape their VFS and download system files. This has been patched in v11.1.0,” the advisory read.

It must be noted that customers operating CrushFTP instances within a demilitarized zone (DMZ) are safe from the attacks. The flaw is yet to receive a CVE identifier.

Cybersecurity firm CrowdStrike reported an exploit for the CrushFTP Zero-Day flaw targeting U.S. entities in what it believes is a politically motivated intelligence-gathering activity.

However, CrushFTP’s founder, Ben Spink, claims the company hasn’t received any user complaints as yet whereas the vulnerability was patched within hours of identification.

To update CrushFTP to the latest version v11.1.0, log in to the dashboard, click the About tab, and click Update> Update Now. Wait 5 minutes for files to download, unzip, and copy, then auto-restart CrushFTP.

1.  WinRAR users update software as 0-day vulnerability is found
2.  WeTransfer phishing attack spoofs file-sharing to steal credential
3.  APT Winter Vivern Exploits Roundcube 0-Day against European Entities

Tag

#zero_day