Anomali Cyber Watch: ProxyShell Being Exploited to Install Webshells and Ransomware, Neurevt Trojan Targeting Mexican Users, Secret Terrorist Watchlist Exposed, and More

<p>The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics:<b> APT37 (InkySquid), BlueLight, Ransomware, T-Mobile Data Breach, Critical Vulnerabilities, IoT, Kalay, Neurevt, </b> and <b>ProxyShell</b>. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.</p> <p><img src="https://cdn.filestackcontent.com/YkAvwTflT8uKhittTjHo"/></p> <p><em>Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed. Current Anomali ThreatStream users can query these indicators under the <a href="https://ui.threatstream.com/search?q=(status%20%3D%20%22active%22)%20and%20(created_ts%20%3E%3D%202021-08-18T04:00:00)%20and%20(created_ts%20%3C%3D%202021-08-25T03:59:59)%20and%20(tags%20%3D%20%22anomali%20cyber%20watch%22)">“anomali cyber watch”</a> tag.</em></p> <h2>Trending Cyber News and Threat Intelligence</h2> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit" target="_blank">Microsoft Exchange Servers Still Vulnerable to ProxyShell Exploit</a></h3> <p>(published: August 23, 2021)</p> <p>Despite patches a collection of vulnerabilities (ProxyShell) discovered in Microsoft Exchange being available in the July 2021 update, researchers discovered nearly 2,000 of these vulnerabilities have recently been compromised to host webshells. These webshells allow for attackers to retain backdoor access to compromised servers for further exploitation and lateral movement into the affected organizations. Researchers believe that these attacks may be related to the recent LockFile ransomware attacks.<br/> <b>Analyst Comment:</b> Organizations running Microsoft Exchange are strongly encouraged to prioritize updates to prevent ongoing exploitation of these vulnerabilities. In addition, a thorough investigation to discover and remove planted webshells should be undertaken as the patches will not remove planted webshells in their environments. A threat intelligence platform (TIP) such as Anomali Threatstream can be a valuable tool to assist organizations ingesting current indicators of compromise (IOCs) and determine whether their Exchange instances have been compromised.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947244" target="_blank">[MITRE ATT&CK] Exploitation for Client Execution - T1203</a> | <a href="https://ui.threatstream.com/ttp/947247" target="_blank">[MITRE ATT&CK] Web Shell - T1100</a> | <a href="https://ui.threatstream.com/ttp/947268" target="_blank">[MITRE ATT&CK] Hidden Files and Directories - T1158</a> | <a href="https://ui.threatstream.com/ttp/947146" target="_blank">[MITRE ATT&CK] Source - T1153</a><br/> <b>Tags:</b> CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, Exchange, ProxyShell, backdoor</p> </div> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows" target="_blank">LockFile: Ransomware Uses PetitPotam Exploit to Compromise Windows Domain Controllers</a></h3> <p>(published: August 20, 2021)</p> <p>A new ransomware family, named Lockfile by Symantec researchers, has been observed on the network of a US financial organization. The first known instance of this ransomware was July 20, 2021, and activity is ongoing. This ransomware has been seen largely targeting organizations in a wide range of industries across the US and Asia. The initial access vector remains unknown at this time, but the ransomware leverages the incompletely patched PetitPotam vulnerability (CVE-2021-36942) in Microsoft's Exchange Server to pivot to Domain Controllers (DCs) which are then leveraged to deploy ransomware tools to devices that connect to the DC. The attackers appear to remain resident on the network for several days before deploying the ransomware. This new ransomware has similarities to both LockBit and Conti.<br/> <b>Analyst Comment:</b> Ransomware continues to be one of the most common and disruptive forms of cyber attacks in 2021, resulting in millions of dollars in financial losses and significant disruptions across education, energy, and manufacturing sectors. Having a TIP such as Anomali ThreatStream is increasingly recognized as a vital component of a defense-in-depth program. The capability to easily ingest and correlate threat intelligence as it is disseminated and correlate it against an organization's infrastructure (as provided by Anomali Match) can greatly ease the burden of finding and remediating both vulnerabilities and attacks.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947287" target="_blank">[MITRE ATT&CK] PowerShell - T1086</a> | <a href="https://ui.threatstream.com/ttp/947187" target="_blank">[MITRE ATT&CK] System Network Configuration Discovery - T1016</a><br/> <b>Tags:</b> Asia, CVE-2021-36942, LockBit, Ransomware, LockFile, Conti, North America, PetitPotam, Banking and Finance</p> </div> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://www.zdnet.com/article/t-mobile-said-information-of-more-than-8-million-customers-leaked-in-breach/#ftag=RSSbaffb68" target="_blank">T-Mobile Says Information of More Than 48 Million Customers Leaked in Breach</a></h3> <p>(published: August 18, 2021)</p> <p>A threat actor is selling what they claim to be 30 million T-Mobile customers' Social Security and driver license numbers on an underground forum. T-Mobile confirmed the breach and eliminated the actor's access to the systems, and now claims that the data contains information from approximately eight million current customers (including 800,000 prepaid accounts) and assesses the total number of records stolen to be 40 million, contrasting with the 100 million records claimed by the actor. These records include personally identifiable information (PII), including social security numbers, addresses, International Mobile Equipment Identity (IMEI) numbers and more.<br/> <b>Analyst Comment:</b> The loss of control of customer PII is a large problem, both from a public relations (PR) and legal standpoint, as breached companies scramble to meet reporting requirements and inform the public of the risks associated with such breaches. It is vital for organizations that collect PII to have coordinated defense-in-depth programs. A product such as Anomali Match can be invaluable to rapidly detecting and remediating breaches by correlating, for example, data loss prevention (DLP) information with up-to-date threat intelligence.<br/> <b>Tags:</b> data breach, PII, telco</p> </div> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://blog.talosintelligence.com/2021/08/neurevt-trojan-takes-aim-at-mexican.html" target="_blank">Neurevt Trojan Takes Aim at Mexican Users</a></h3> <p>(published: August 17, 2021)</p> <p>Cisco Talos researchers discovered a campaign using the Neurevt trojan to target customers of Mexican banks. This campaign combines backdoors and information stealers with the Neurevt trojan, allowing for persistent access to victim information systems as well as the capability to capture screenshots, keystrokes, mouse activity and more. Additionally, there are a number of anti-analysis and evasion techniques leveraged by the malware.<br/> <b>Analyst Comment:</b> Neither the Neurevt trojan nor the associated tools used in this campaign were new, meaning that organizations with intelligence-driven security programs that combine network traffic with intelligence about threat actors and their tactics, tools, and procedures (TTPs) would likely be able to rapidly identify and neutralize this activity. Tools like Anomali Threatstream and Anomali Match, which correlate information from security research across the globe with data from sources such as email gateways, endpoint detection and response (EDR) systems, and Security Information and Event Management (SIEM) enable rapid detection aof nd response to new threats while speeding up the search for previously undetected attacks.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947281" target="_blank">[MITRE ATT&CK] Launch Daemon - T1160</a> | <a href="https://ui.threatstream.com/ttp/3905071" target="_blank">[MITRE ATT&CK] Application Layer Protocol - T1071</a> | <a href="https://ui.threatstream.com/ttp/3904527" target="_blank">[MITRE ATT&CK] Ingress Tool Transfer - T1105</a> | <a href="https://ui.threatstream.com/ttp/947125" target="_blank">[MITRE ATT&CK] System Information Discovery - T1082</a> | <a href="https://ui.threatstream.com/ttp/947142" target="_blank">[MITRE ATT&CK] Process Injection - T1055</a> | <a href="https://ui.threatstream.com/ttp/947207" target="_blank">[MITRE ATT&CK] Process Discovery - T1057</a> | <a href="https://ui.threatstream.com/ttp/947243" target="_blank">[MITRE ATT&CK] Input Capture - T1056</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947166" target="_blank">[MITRE ATT&CK] Modify Registry - T1112</a> | <a href="https://ui.threatstream.com/ttp/947252" target="_blank">[MITRE ATT&CK] Query Registry - T1012</a> | <a href="https://ui.threatstream.com/ttp/947115" target="_blank">[MITRE ATT&CK] Disabling Security Tools - T1089</a> | <a href="https://ui.threatstream.com/ttp/947109" target="_blank">[MITRE ATT&CK] Security Software Discovery - T1063</a> | <a href="https://ui.threatstream.com/ttp/947195" target="_blank">[MITRE ATT&CK] File and Directory Discovery - T1083</a> | <a href="https://ui.threatstream.com/ttp/947287" target="_blank">[MITRE ATT&CK] PowerShell - T1086</a> | <a href="https://ui.threatstream.com/ttp/947082" target="_blank">[MITRE ATT&CK] System Owner/User Discovery - T1033</a> | <a href="https://ui.threatstream.com/ttp/947215" target="_blank">[MITRE ATT&CK] Accessibility Features - T1015</a> | <a href="https://ui.threatstream.com/ttp/947141" target="_blank">[MITRE ATT&CK] Masquerading - T1036</a> | <a href="https://ui.threatstream.com/ttp/947124" target="_blank">[MITRE ATT&CK] Peripheral Device Discovery - T1120</a> | <a href="https://ui.threatstream.com/ttp/3297596" target="_blank">[MITRE ATT&CK] Software Discovery - T1518</a> | <a href="https://ui.threatstream.com/ttp/2402543" target="_blank">[MITRE ATT&CK] Virtualization/Sandbox Evasion - T1497</a> | <a href="https://ui.threatstream.com/ttp/947079" target="_blank">[MITRE ATT&CK] Screen Capture - T1113</a> | <a href="https://ui.threatstream.com/ttp/947164" target="_blank">[MITRE ATT&CK] File Deletion - T1107</a> | <a href="https://ui.threatstream.com/ttp/3905348" target="_blank">[MITRE ATT&CK] OS Credential Dumping - T1003</a><br/> <b>Tags:</b> Neurevt, Banking and Finance, Russia, Trojan, Mexico</p> </div> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-devices.html" target="_blank">Mandiant Discloses Critical Vulnerability Affecting Millions of IoT Devices</a></h3> <p>(published: August 17, 2021)</p> <p>A critical vulnerability (CVE-2021-28372) has been identified in ThroughTek's Kalay P2P software development kit (SDK) that could impact at least 83 million Internet of Things (IoT) devices. The Kalay platform allows registered devices to connect to a mobile or desktop application. The vulnerability could allow for an attacker to remotely compromise connected devices.<br/> <b>Analyst Comment:</b> Organizations using the Kalay SDK should upgrade to at least version 3.1.10. The proliferation of IoT devices, combined with their commodity nature and general lack of built-in security continue to plague this space and allow for undiscovered vulnerabilities to be exploited by actors. Both due to the sensitive nature of these devices (e.g. internet connected cameras) and the ability to pivot from a vulnerable IoT system to a broader network means that accurate inventory of IoT devices should be correlated with threat intelligence to allow for rapid detection and patching when vulnerabilities are discovered.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947124" target="_blank">[MITRE ATT&CK] Peripheral Device Discovery - T1120</a> | <a href="https://ui.threatstream.com/ttp/3904527" target="_blank">[MITRE ATT&CK] Ingress Tool Transfer - T1105</a> | <a href="https://ui.threatstream.com/ttp/947093" target="_blank">[MITRE ATT&CK] Audio Capture - T1123</a><br/> <b>Tags:</b> CVE-2021-28372, IoT, Kalay</p> </div> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://us-cert.cisa.gov/ncas/alerts/aa21-229a" target="_blank">BadAlloc Vulnerability Affecting BlackBerry QNX RTOS</a></h3> <p>(published: August 17, 2021)</p> <p>The Cybersecurity & Infrastructure Security Agency (CISA) has warned that the IoT and Operational Technology (OT) vulnerabilities collectively known as BadAlloc (CVE-2021-22156) in Blackberry's QNX RTOS affects over 195 million devices worldwide. The affected devices include critical infrastructure, automobiles, and medical devices. CISA is urgently recommending that organizations with affected systems patch their devices.<br/> <b>Analyst Comment:</b> A combination of asset inventory and patch management, along with limiting the ports exposed by these devices to only used ports, are important mitigation measures for vulnerabilities like this. These policies and programs are especially important for organizations involved in critical infrastructure and the medical industry. Organizations that have the tools to connect external threat intelligence, network traffic (endpoint, SIEM, etc.) with their Configuration Management Database (CMDB) and Crown Jewels Assessment (CJA) are in the best position to discover events like this and take appropriate action immediately.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947286" target="_blank">[MITRE ATT&CK] Service Execution - T1035</a> | <a href="https://ui.threatstream.com/ttp/947125" target="_blank">[MITRE ATT&CK] System Information Discovery - T1082</a><br/> <b>Tags:</b> CVE-2021-22156, BadAlloc, IoT, Blackberry QNX</p> </div> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/" target="_blank">North Korean APT InkySquid Infects Victims Using Browser Exploits</a></h3> <p>(published: August 17, 2021)</p> <p>A recent strategic web compromise (SWC) of a South Korean online newspaper that primarily focuses on North Korea has been attributed with moderate confidence to North Korean group APT37 (aka InkySquid, ScarCruft). The attackers used an known exploit of Internet Explorer (CVE-2020-1380) to inject malicious JavaScript and later deliver a custom malware known as Bluelight which leveraged the Microsoft Graph API for C2 operations. This activity was observed from at least early March 2021 through June 2021.<br/> <b>Analyst Comment:</b> Exploitation of known vulnerabilities in web browsers is not a new technique, which serves as a reminder that the majority of cyber threats are known and can be prevented or rapidly detected and mitigated when organizations have intelligence integrated into their security operations. Technologies such as Anomali ThreatStream and Anomali Match enable organizations to connect all available external data, information, and intelligence with all internal network traffic to alert network defenders of malicious activity in near-real time.<br/> <b>MITRE ATT&CK: </b> <a href="https://ui.threatstream.com/ttp/947269" target="_blank">[MITRE ATT&CK] Access Token Manipulation - T1134</a> | <a href="https://ui.threatstream.com/ttp/947136" target="_blank">[MITRE ATT&CK] Deobfuscate/Decode Files or Information - T1140</a> | <a href="https://ui.threatstream.com/ttp/947203" target="_blank">[MITRE ATT&CK] Web Service - T1102</a> | <a href="https://ui.threatstream.com/ttp/947201" target="_blank">[MITRE ATT&CK] Scripting - T1064</a> | <a href="https://ui.threatstream.com/ttp/947235" target="_blank">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a><br/> <b>Tags:</b> APT, APT37, Bluelight, CVE-2020-1380, CVE-2021-26411, North Korea, Strategic Web Compromise</p> </div> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://www.helpnetsecurity.com/2021/08/16/realtek-rtl819xd-vulnerability/" target="_blank">65 Vendors Affected by Severe Vulnerabilities in Realtek Chips</a></h3> <p>(published: August 16, 2021)</p> <p>A dozen vulnerabilities have been identified in the Realtek RTL819xD module. These vulnerabilities could allow attackers to gain complete access to the device, installed operating systems and other network devices. While this generally requires an attacker to be on the same Wi-Fi network as the device, misconfigurations can expose these devices directly to the Internet. The chips supplied by Realtek are used by almost all well-known manufacturers and can be found in Voice over Internet Protocol (VoIP) devices, wireless routers, IP cameras, IoT devices, and more. The list of affected hardware manufacturers includes AsusTEK, Belkin, D-Link, Edimax, Hama, Netgear.<br/> <b>Analyst Comment:</b> The proliferation of IoT devices both in corporate spaces and home offices makes it imperative that organizations and home users routinely check for and apply updates. These devices can be exploited and used by malicious actors to pivot to other devices on the network. IoT devices should be included in device inventories for visibility.<br/> <b>Tags:</b> CVE-2021-35393, CVE-2021-35392, CVE-2021-35395, CVE-2021-35394, IoT, Realtek</p> </div> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://www.bleepingcomputer.com/news/security/secret-terrorist-watchlist-with-2-million-records-exposed-online/" target="_blank">Secret Terrorist Watchlist with 2 Million Records Exposed Online</a></h3> <p>(published: August 16, 2021)</p> <p>A trove of JSON records, which appear to be 1.9M records from the FBI's Terrorist Screening Center (TSC), were discovered in July on a password-less Elasticsearch cluster. These records are utilized by a number of federal agencies as a "no-fly list" consisting of sensitive personal information of suspected terrorists and associates. This data was confirmed to have been indexed by at least two search engines, indicating that this information may have been accessed by others aside from the researcher who reported it. The records include names, citizenry information, and passport IDs, among other data. Interestingly, this data was discovered hosted on a Bahrain IP address, not one based in the US.<br/> <b>Analyst Comment:</b> Aside from the embarrassment this discovery will certainly cause the FBI, the people whose information was exposed could be in danger from vigilantes seeking to do harm to them. Additionally, as these lists can include inaccuracies, or could be manipulated and redistributed, this kind of breach could threaten the careers and reputations of innocent people. Secure development techniques for platforms hosting sensitive information should include validation that such information should not be exposed to the Internet unless absolutely necessary, and then should be properly secured, even for development or staging instances. Security scans, backed by asset inventory and incorporated into a TIP, can help to quickly identify and fix these issues before they are discovered by an external entity.<br/> <b>Tags:</b> Government, Military, North America, Middle East</p> </div>