• VulnVerse
  • Posts
  • Security Week Review - VulnVerse #17

Security Week Review - VulnVerse #17

Author

Marko Živanović
November 17, 2024

Welcome back to VulnVerse! It's our 17th weekly dispatch, and we've got another jam-packed edition for you. Let's dive into the latest vulnerabilities, exploits, and cyber threats.

Contents:

Vulnerabilities and Exploits 🔥

Alright, let’s dive into the world of vulnerabilities and exploits. These are the core of cybersecurity, but they can be quite intimidating. Keeping up with them demands persistence, curiosity, and a systematic approach. Here are the latest threats you need to be aware of:

WatchTowr examines an unknown CVE affecting Citrix Virtual Apps and Desktops, a solution enabling remote network access.

NetSecFish reports on a command injection vulnerability in D-Link NAS devices, highlighting the security risks posed by the flaw.

Siemens releases a security advisory about a vulnerability in certain products, urging affected users to patch their systems to prevent exploitation.

Checkmarx outlines security risks in Hugging Face, focusing on vulnerabilities in integrations and third-party models used for AI projects.

Apache CloudStack releases security updates in versions 4.18.2.5 and 4.19.1.3, addressing critical vulnerabilities. Users are urged to update to these new versions to mitigate risks.

Cyble reports on the severe vulnerabilities in Fortinet products, which expose organizations to wide-ranging attacks. With over a million devices at risk.

Cyble covers the increasing exploitation of zero-day vulnerabilities in Microsoft products, provides analysis of current attacks and advises immediate patching to prevent compromise.

Cyble highlights a critical command injection vulnerability in legacy D-Link NAS devices that remains unfixed.

Cyble reports on a path traversal vulnerability in the WPLMS WordPress theme, which can lead to remote code execution (RCE). The flaw exposes websites to serious compromise, urging users to patch immediately.

Schneider Electric releases a security advisory addressing vulnerabilities in its products. The document details the risks and provides guidance on updates and mitigations to ensure systems remain secure.

Icinga announces critical security patches in version 2.14.3 of Icinga 2. These updates address vulnerabilities that could impact monitoring environments, with recommendations for prompt installation to secure systems.

JFrog explores vulnerabilities in machine learning services, focusing on how attackers exploit flaws in ML models and infrastructures, examines the risks posed to ML systems and offers strategies for enhancing security.

Security Online reports on a critical vulnerability in the Laravel PHP framework (CVE-2024-52301) that exposes millions of web applications to remote attacks. Developers are urged to apply patches immediately to secure their systems.

Security Online discusses a novel exploit targeting macOS that bypasses its sandbox protections. The vulnerability allows malicious applications to run outside the sandbox, posing significant security risks.

Security Online alerts admins to new critical vulnerabilities in Kanboard, a project management tool. Attackers can exploit these flaws to gain control of the system.

Security Online reports that SAP has issued patches for multiple vulnerabilities as part of the November 2024 Security Patch Day. These updates address critical security flaws affecting SAP products, requiring immediate attention from affected users.

Socket.dev reveals a malicious npm package exploiting WhatsApp's authentication system, with a built-in remote kill switch. The package was designed to hijack authentication tokens and could remotely disable its malicious behavior once detected.

Unit 42 discusses a new privilege escalation vulnerability in Vertex AI, focusing on how attackers could exfiltrate large language model (LLM) data.

BleepingComputer reports that D-Link will not fix a critical vulnerability in 60,000 end-of-life modems exposed to the internet. Despite the severe risk of remote exploitation, the company has indicated it will not provide patches, leaving users vulnerable.

Palo Alto Networks issues a warning about a critical remote code execution (RCE) zero-day vulnerability actively exploited in attacks. The flaw affects multiple platforms, and Palo Alto urges organizations to apply security updates to mitigate the risk.

ClearSky Security discusses a 0-day vulnerability actively exploited in the wild. How threat actors are leveraging the flaw to gain unauthorized access to systems, highlighting the importance of swift patching and vigilance.

Wordfence reports on a vulnerability in the "Really Simple Security" plugin for WordPress. The flaw allows attackers to bypass security measures and potentially take control of WordPress sites, emphasizing the need for timely updates and proper configuration.

Wordfence highlights a critical vulnerability in the Chartify WordPress plugin that allows unauthenticated local file inclusion (LFI). This vulnerability could let attackers execute arbitrary code and gain access to sensitive files on affected websites.

Cyble highlights critical command injection vulnerabilities in HPE Aruba access points. These flaws allow attackers to take control of devices.

TWCERT issues a security advisory regarding multiple vulnerabilities in D-Link routers, which could allow attackers to execute arbitrary code remotely. The advisory recommends patching devices promptly to mitigate risks such as data theft and network compromise.

Data Breaches 💥

Data breaches, those pesky gremlins that slip through the cracks. They’re not just cautionary tales; they’re wake-up calls. Here, we dissect recent incidents, turning others’ misfortunes into your lessons, so you can fortify your defenses.

AppOmni reports a data exposure issue in Microsoft Power Pages that could have allowed unauthorized access to sensitive data. The vulnerability has been reviewed and fixed by Microsoft.

BleepingComputer reports on Amazon's confirmation of an employee data breach resulting from a third-party vendor hack. The breach exposed sensitive employee information, raising concerns over the security of vendor partnerships.

InfoStealers reports on the largest retail breach in history, where 350 million Hot Topic customer records were exposed due to an information-stealer infection. The breach resulted in the theft of personal and payment data, highlighting the importance of strong cybersecurity practices in retail.

Malwarebytes reports a massive data breach in which 122 million people’s business contact information was exposed by a data broker. The leak includes emails, phone numbers, and other personal data, raising concerns about data privacy and the security of third-party data aggregators.

Malwarebytes covers the disappearance of a DNA testing company that took its customers’ genetic data with it. The company’s sudden closure leaves customers at risk of having their sensitive genetic information exposed or misused.

Troy Hunt takes an in-depth look at the DemandScience by Pure Incubation data breach, which exposed millions of individuals' personal and business contact information. The breach, involving a third-party vendor, highlights the importance of securing data supply chains and conducting rigorous vendor assessments.

The Wall Street Journal reports on a major data breach at T-Mobile, attributed to Chinese hackers. The breach targeted telecom networks and exposed personal data, including sensitive customer information, marking another high-profile attack in the telecom industry.

Malware and Ransomware 🐛

Ah, malware. The ever-adapting nemesis that keeps us on high alert. It’s the digital boogeyman lurking in the shadows, ready to pounce. We’ll explore the cutting-edge developments in malware and equip you with the knowledge to defend against these persistent threats. Buckle up, it’s going to be a wild ride.

Sucuri reports on PHP Reinfeector malware targeting WordPress sites, allowing attackers to inject backdoors and compromise site security.

Qianxin analyzes a new Melofee malware variant with enhanced evasion techniques, targeting high-value organizations with more sophisticated payloads.

Infoblox discusses how cybercriminals hijack DNS domains to reroute traffic and spread malware, highlighting the need for better DNS security.

Dr.Web details recent cyber threats identified by their antivirus lab, covering the latest malware and attack trends. How these threats operate and how to protect against them.

Checkpoint provides a detailed analysis of Wezrat, a sophisticated piece of malware targeting organizations worldwide. How it infiltrates systems and its payload delivery mechanisms.

Securelist reports on the discovery of the Ymir ransomware strain, which has been targeting organizations in Colombia. The post explains its modus operandi and the growing threat it poses to Latin American businesses.

Security Intelligence provides an overview of Strela Stealer, a malware campaign that masquerades as an invoice email to steal sensitive data. The post highlights the evolving tactics of these phishing campaigns.

BleepingComputer reports on a botnet exploiting a GeoVision zero-day vulnerability to install Mirai malware. The malware turns compromised devices into part of a botnet, potentially launching large-scale DDoS attacks.

GenDigital introduces Glove Stealer, a new variant of information-stealer malware. How the malware targets sensitive data, including login credentials and personal information, and provides insight into its spread and methods of operation.

Jamf’s breaks down the anatomy of a cyberattack, providing a detailed overview of how attackers infiltrate systems and the stages of their campaigns. It highlights how organizations can better defend against and mitigate attacks targeting macOS devices.

Rapid7 covers the emergence of the Lodarat malware, analyzing its tactics, techniques, and victim patterns. The malware, primarily used for remote access and data exfiltration, has been targeting specific industries and individuals for cyber espionage.

Cyble analyzes a multi-stage PowerShell campaign that leverages the Chisel tool. Outlines the attack’s structure, from initial exploitation to payload delivery, and offers guidance on detection and defense.

Trend Micro explores the growing threat of SEO malware, where cybercriminals manipulate search engine optimization (SEO) to distribute malicious content. Explains how attackers use

Malwarebytes reports on a new phishing campaign where attackers are sending QR codes in the mail that, when scanned, deliver malware. Warns users to be cautious when scanning QR codes, particularly from unknown or suspicious sources.

Cado Security reports that the Guloader malware is actively targeting European industrial companies. The malware is used for data exfiltration and deploying ransomware, with a focus on critical infrastructure sectors.

Cloud ☁️

The cloud isn’t just a storage locker; it’s a dynamic arena where innovation and threats collide. As more data and services make their way to the cloud, the risks and rewards skyrocket. In this section, we’ll dive into the cutting-edge challenges and breakthrough solutions in cloud security.

Security Intelligence discusses the concept of autonomous security for cloud environments, specifically focusing on AWS. Examines how AI and machine learning are being used to enhance cloud security without human intervention.

Google Cloud expands its CVE program to improve cloud security by identifying vulnerabilities and collaborating with researchers to address them.

Tools 🛠️

In the relentless battlefield of cybersecurity, going in unarmed is not an option. Here, we’re rolling out the heavy artillery cutting-edge tools designed to bolster your defenses, streamline your operations, and maybe even add a touch of ease to your day.

Hunt.io discusses how the Sliver C2 framework, paired with Ligolo-ng, is being used in attacks targeting YC (Y Combinator). The post details the use of this powerful C2 framework in sophisticated intrusions, providing insights into its tactics.

SlashNext warns of a new phishing campaign targeting GitHub users, using the "GoIssue" phishing tool to steal credentials. Provides insights on how the attacks work and offers best practices for protecting GitHub accounts.

Cybersecurity Measures and Recommendations 🔒️

Alright, you’ve seen the threats, but awareness alone won’t cut it. It’s time to take action. Here’s a breakdown of some killer cybersecurity measures and recommendations to keep you secure, sane, and one step ahead of the cyber baddies:

Bitdefender's discusses the evolution of the ShrinkLocker ransomware decryptor, which was once a tool to assist victims but is now being used as a weapon by attackers. The post outlines how it is being repurposed in new cybercriminal campaigns.

Bitdefender continues its series on using the NIST Cybersecurity Framework, focusing on the identification of security gaps. This installment provides guidance on how organizations can leverage NIST’s standards to improve their security posture.

Bitdefender provides a comprehensive cybersecurity checklist for healthcare organizations, emphasizing critical measures to protect sensitive health data from increasing cyber threats.

Jamf discusses endpoint hardening strategies to protect macOS devices from cyber threats. Best practices include enforcing strong authentication, securing system preferences, and reducing the attack surface by disabling unnecessary services and features.

Wiz dives into the difficulties of managing Kubernetes audit logs and offers strategies to overcome them. Explains how Kubernetes users can better secure their environments by effectively capturing and analyzing audit data, improving compliance and threat detection.

Wallarm discusses the long-term business impact of API breaches, beyond immediate financial losses. Euantifies the hidden costs, including reputational damage, regulatory fines, and operational disruptions.

Zimperium discusses "Mishing," a rising mobile attack vector in which attackers use SMS-based phishing (smishing) tactics to target users. Examines how organizations can defend against this growing threat by securing mobile devices and implementing stronger user authentication.

Advanced Persistent Threats (APT) 🕵️

APTs are the ninjas of the cyber realm, stealthy, patient, and deadly. These bad boys don’t just smash and grab; they lurk in the shadows, studying their prey, waiting for the perfect moment to strike. If you want to stand a chance against them, you’ve got to get inside their heads and understand their every move.

Cyble discusses the DoNotS cyberattack targeting maritime defense manufacturing, detailing how the threat actors infiltrated critical sectors. Provides insight into the campaign’s tactics and how to protect against similar attacks.

Unit 42 details a newly identified cluster of activity by fake North Korean IT workers. These actors pose as legitimate workers, offering IT services while engaging in cyber espionage, targeting organizations globally with social engineering and malware delivery.

eSentire continues its analysis of the Lazarus Group’s cyber-espionage campaigns, focusing on the Bored Beavertail, InvisibleFerret, and Yacht Club lures. These attacks use highly sophisticated tactics to target high-value organizations in the financial and technology sectors.

Group-IB examines the stealthy tactics employed by the APT Lazarus group, which is known for its cyber espionage and financially motivated attacks. How Lazarus operates covertly to evade detection while targeting high-value organizations.

Jamf Threat Labs reveals that APT (Advanced Persistent Threat) groups are embedding malware in macOS applications built with the Flutter framework. This tactic targets users by disguising malicious payloads in seemingly legitimate apps.

Recorded Future reports that China-based hacker group TAG-112 has targeted Tibetan websites with a sophisticated cyberattack. The group is suspected of conducting cyber espionage, aiming to gather intelligence on Tibet-related affairs.

SEKOIA analyzes Chinese state-sponsored cyber threats, focusing on their tactics in espionage campaigns targeting geopolitical interests and high-value organizations.

BlackBerry reports APT41 deploying the DeepData framework in a targeted espionage campaign across Southern Asia, emphasizing stealth and persistence.

ClearSky Security reports on IRDreamJob24, a new cyber espionage campaign targeting specific organizations. The campaign uses social engineering and spear-phishing to gain access to sensitive information, with signs pointing to state-sponsored actors.

Imperva discusses BLAS, a cyberattack group that targeted election-related websites on election day. The group launched DDoS attacks to disrupt online services, impacting the availability of crucial electoral information.

Perception Point explores a two-step phishing attack that uses Microsoft Visio files to bypass security measures. Explains how the attack works and provides recommendations for defending against such advanced phishing techniques.

Checkpoint reports on the expansion of a Hamas-affiliated threat actor, highlighting a shift towards more disruptive cyber activities. The threat actor is now leveraging new tactics to attack critical infrastructure and cause operational chaos.

Volexity reveals how the BrazenBamboo threat group is exploiting a vulnerability in FortiClient VPN software to steal credentials. The attack, leveraging the DeepData framework, targets VPN connections and could have serious implications for businesses using Fortinet products.

So there you have it! An electrifying overview of the latest vulnerabilities, exploits, data breaches, malware, ransomware, APTs, software and system issues, and practical cybersecurity measures.

Have any questions, comments, or feedback? Feel free to reply directly, I'd love to hear from you. I’m all ears!

If you find this newsletter helpful and think others would too, please consider forwarding it to them. 🙏

Thanks for reading!

exit(0);

Reply

or to participate.