Download our Cyber Threat Intelligence Digest - May 2024: Week 21

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

Veeam Discloses Four Vulnerabilities in Backup Enterprise Manager - Veeam issued patches for several critical vulnerabilities in its Backup Enterprise Manager on May 21, 2024. All these vulnerabilities have been fixed in version 12.1.2.172.

Cisco Updates Patch for CVE-2022-20760 Affecting ASA and FTD Software  – Cisco issued a final update to an advisory initially published on April 27, 2022; this concerns a high-severity vulnerability, tracked as CVE-2022-20760. Cisco has released updates that address the vulnerability and updates should be applied.

GitLab Patches High-Severity Vulnerability in Web IDE - On May 22, 2024, GitLab patched several vulnerabilities affecting GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab recommends users of both Community and Enterprise Editions update their systems to versions 17.0.1, 16.11.3, and 16.10.6 to mitigate potential exploitation.

Potential Threats

CISA Warns of Actively Exploited Apache Flink Vulnerability, CVE-2020-17519 - On May 23, 2024, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2020-17519, a critical vulnerability affecting versions 1.11.0, 1.11.1, and 1.11.2 of Apache Flink, to its Known Exploited Vulnerabilities (KEV) catalogue.

New ShrinkLocker Ransomware Adopts BitLocker to Target Entities in the Government, Healthcare, and Manufacturing Sectors – A new ransomware variant dubbed ShrinkLocker has adopted BitLocker, Microsoft’s legitimate encryption technology, to target corporate systems.

Researchers Discover DNSBomb DDoS Attacks that Manipulate DNS Traffic -  SOCRadar reported a new Distributed Denial of Service (DDoS) attack vector dubbed DNSBomb that targets critical internet infrastructure. Researchers from Tsinghua University found that DNSBomb uses the recursive function of DNS resolvers to amplify traffic, which can reach up to 8.7 Gbps. The analysis showed that DNSBomb could achieve a bandwidth amplification factor of over 20,000 times the original traffic.

General News

Amid funding cuts, backlog of unanalysed vulnerabilities in gov't database is growing - The National Vulnerability Database has been forced to limit its operations due to funding shortages and an influx of vulnerabilities.

Alarm over Russian-directed sabotage operations growing across Europe - Security agencies and governments across Europe are increasingly warning about the threat posed by Russia-directed saboteurs operating on their territories.

UK to propose mandatory reporting for ransomware attacks and licensing regime for all payments - Officials in Britain are set to propose a major overhaul of how the country responds to ransomware attacks by requiring all victims to report incidents to the government, and then obliging those victims to seek a license before making any extortion payments.

 

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group’s severity. These updates can be seen below.

 

● Limited Severity

● Basic Severity

● Moderate Severity

● High Severity

 

Global Trends Powered by Recorded Future

Within each category, we have provided the current top five globally trending items. Each item is linked to how actively trending it is and is marked with a small symbol. 

The spikes in references are calculated over 60 days and are normalised to ensure they aren’t disproportionate when compared to bigger entities that will naturally have more baseline mentions.

▲- Spike – This indicates a large increase in reporting volume and a high diversity in the event descriptions,
▲- Rise – This indicates a small increase in reporting volume with little diversity in the descriptions.

Prominent Information Security Events

Veeam Backup Enterprise Manager Vulnerabilities.

Source: Veeam, Insikt Group | Vulnerability Intelligence from Insikt Group
Intelligence Cards: Intelligence & Reports
CVE-2024-29849 | CVVS Score: 9.8 | Recorded Future Risk Score: High – 79
CVE-2024-29850 | CVVS Score: 8.8 | Recorded Future Risk Score: High - 67
CVE-2024-29851 | CVVS Score: 7.2 | Recorded Future Risk Score: Medium – 31
CVE-2024-29852 | CVVS Score: 2.7 | Recorded Future Risk Score: Medium – 32

Veeam issued patches for several critical vulnerabilities in its Backup Enterprise Manager on May 21, 2024. All these vulnerabilities have been fixed in version 12.1.2.172. According to Veeam, deploying Veeam Backup Enterprise Manager is optional, and environments without it installed are not affected by these flaws.

Details surrounding the four vulnerabilities are as follows:

• CVE-2024-29849 allows unauthenticated threat actors to log in to the web interface as any user and has a CVSS score of 9.8.
• CVE-2024-29850 allows account takeover via NTLM relay.
• CVE-2024-29851 allows a high-privileged user to steal the NTLM hash of the Veeam Backup Enterprise Manager service account if that service account is anything other than the default Local System account.
• CVE-2024-29852 allows high-privileged users to read backup session logs.

Backup Enterprise Manager instances installed on dedicated servers can be updated to version 12.1.2.172 without having to upgrade Veeam Backup & Replication immediately.

If upgrading is not possible, Veeam recommends halting the Backup Enterprise Manager. The software can be installed if not in use.

Trojanised Minesweeper clone.

Source: Insikt Group, CERT-UA | Validated Intelligence Event
Intelligence Cards: Intelligence & Reports

CERT-UA reported that the threat actor “UAC-0188” targeted multiple financial and insurance entities across Europe and the United States between February and March 2024. UAC-0188 used trojanised Minesweeper code, concealing malicious Python scripts and facilitating the unauthorised installation of the SuperOps Remote Monitoring and Management (RMM) software. 

SuperOps RMM, a legitimate tool used by IT service providers, was exploited to gain unauthorised remote access and control over compromised systems.

The victim is sent an email with a link to Dropbox from which an executable (.SCR) file of around 33MB will be downloaded. The said file was created using PyInstaller and contains, among other things, the legitimate Python code of the game "Minesweeper" as well as a 28MB base64-encoded string.

Further, as a result of string concatenation and decoding, a ZIP archive will be obtained, from which, using a statically set password, an MSI file representing a legitimate SuperOps RMM program will be extracted and executed. Running this program on a PC will give third parties unauthorised remote access to the computer.

We have provided a list of. Known IOC’s for this potential attack vector below:

Network:
patient-docs-mail[.]com
support2@patient-docs-mail[.]com
acmaiiykmm@protonmail[.]com
hxxps://anotepad[.]com/notes/2d94hf6q
hxxps://anotepad[.]com/notes/2st44b98
hxxps://anotepad[.]com/notes/4qrjbatw
hxxps://anotepad[.]com/notes/cwknw3qs
hxxps://anotepad[.]com/notes/k55a4dq3
hxxps://anotepad[.]com/notes/txb53br5
hxxps://www[.]dropbox[.]com/scl/fi/s6il9o10zmecnrurvw3m8/document_chasestatement0003241353491[.]scr?rlkey=i3gjtul68q9zeeuyw0esi1vm0&dl=1
hxxps://www[.]dropbox[.]com/scl/fi/w864v8x6a53zuaphg01t3/chaseonlinestatement032445381[.]scr?rlkey=ez6lq3jwgu9trx1meprytyhac&dl=1
yemmyusa[.]com

Host:
C:\Program Files\superopsrmm\conf\assetinfo.conf
C:\Program Files\superopsrmm\conf\serverkey.txt
C:\Program Files\superopsrmm\logs\superops.log

 

Remediation Actions

Following the information provided above, we would recommend that the technologies mentioned above be fully patched and up to date. In particular, we would like to highlight and recommend applying the following patches should they apply: 

• Veeam – Backup Enterprise Manager instances installed on dedicated servers should be updated to version 12.1.2.172
• Gitlab – Both Community and Enterprise Editions should be updated to versions 17.0.1, 16.11.3, and 16.10.6

We would also recommend proactively checking your environment for the software versions mentioned above and hunting for any known IOCs related to them.

If you are currently an Acumen Cyber Vulnerability Management customer, we will be proactively performing these searching and hunting activities within your environment.