Blog

Cybersecurity news

• Aruba Networks published a security advisory to inform customers about six critical-severity vulnerabilities impacting multiple versions of ArubaOS, its proprietary network operating system. The flaws impact Aruba Mobility Conductor, Aruba Mobility Controllers, and Aruba-managed WLAN Gateways and SD-WAN Gateways.
• Cybersecurity researchers Bitdefender have released a new decryptor for the MortalKombat ransomware which can help save precious files, free of charge.
• A stealthy Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus has become the first publicly known malware capable of bypassing Secure Boot defenses, making it a potent threat in the cyber landscape.
• The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added CVE-2022-36537 to its “Known Exploited Vulnerabilities Catalog” after threat actors began actively exploiting the remote code execution flaw in attacks.
• Hackers are actively exploiting two critical-severity vulnerabilities in the Houzez theme and plugin for WordPress, two premium add-ons used primarily in real estate websites. Houzez is a high-quality WordPress theme that is available for purchase on ThemeForest, a popular marketplace for digital products.
• In-the-wild exploitation of a Fortinet FortiNAC vulnerability tracked as CVE-2022-39952 was seen just days after a patch was announced, and on the same day a proof-of-concept (PoC) exploit was made public.

More

For the purposes of building the effective Cyber Intelligence process relevance and completeness of the received data plays the crucial role. In most of the cases the work with the Threat Intelligence (TI) data starts with the adding of open source feeds. Regarding the 2021 SANS Cyber Threat Intelligence (CTI) Survey 66.3 % of the companies use open sources for the collecting of indicators of compromise (IoC) data and they strive to work with multiple sources in parallel.

On one hand using several sources seems the most simple and obvious way to start collecting data quickly but on the flipside there is a big issue in numerous detections when you upload these indicators to the security tools. And it makes the process of the data processing by the analyst almost impossible. We’d like to note also that if you want to create block lists for security tools from IoCs or a collection for search queries on the side of EDR solutions there will be a limitation by the number of entities. This means that anyway there has to be the manual work to prepare such collection of IoCs. Besides you have to keep in mind that only indicators itselves are useless.

More

Cybersecurity news

• Security researchers have discovered a new backdoor called WhiskerSpy used in a campaign from a relatively new advanced threat actor tracked as Earth Kitsune, known for targeting individuals showing an interest in North Korea.
• A new Mirai botnet variant tracked as ‘V3G4’ targets 13 vulnerabilities in Linux-based servers and IoT devices to use in DDoS (distributed denial of service) attacks. The malware spreads by brute-forcing weak or default telnet/SSH credentials and exploiting hardcoded flaws to perform remote code execution on the target devices. Once a device is breached, the malware infects the device and recruits it into its botnet swarm.
• A new stealthy malware named ‘Beep’ was discovered, featuring many features to evade analysis and detection by security software. Although Beep is still in development and missing several key features, it currently allows threat actors to download and execute further payloads on compromised devices remotely.
• A recently identified financially motivated threat actor is targeting companies in the United States and Germany with custom malware, including a screenlogger it uses for reconnaissance.
• New ESXiArgs ransomware attacks are now encrypting more extensive amounts of data, making it much harder, if not impossible, to recover encrypted VMware ESXi virtual machines.

More

Challenge

It was very difficult to locate a host when something wrong occurred within the network.

Typically, cybersecurity specialists would call a large number of colleagues from different regions before collecting all the necessary data.

In addition, different systems installed within the infrastructure provided different equipment statistics.

Results

Following the PoC process, there was a comprehensive implementation of the Defensys ACP solution that helped.

• Consolidate all inventory information into one location: equipment technical properties, locations, time zones, equipment personnel.
• Consolidate vulnerability data across infrastructure through automatic prioritization which has contributed to a much more efficient vulnerability management process.
• Aggregate data from more than 1,000 distributed antivirus solution management servers.

Defensys ACP does a healthcheck of the AV system giving the up-to-date reports weekly.

As a result, the Defensys ACP has become a source of reference for assets, not only for cybersecurity personnel, but also for other departments.

Some IT systems use the ACP’s API to enrich the required data with asset information.

The system’s metrics are distributed on the Cyber Security Office video wall where the Operations Center is located.

More

Cybersecurity news

• Fortra has released an emergency patch to address an actively exploited zero-day vulnerability in the GoAnywhere MFT secure file transfer tool. The vulnerability allows attackers to gain remote code execution on vulnerable GoAnywhere MFT instances whose administrative console is exposed online.
• Taiwanese company QNAP has released updates to remediate a critical security flaw affecting its network-attached storage devices that could lead to arbitrary code injection. Tracked as CVE-2022-27596, the vulnerability is rated 9.8 out of a maximum of 10 on the CVSS scoring scale. It affects QTS 5.0.1 and QuTS hero h5.0.1.
• The development team behind the open-source password management software KeePass is disputing what is described as a newly found vulnerability that allows attackers to stealthily export the entire database in plain text. To secure these local databases, users can encrypt them using a master password so that malware or a threat actor can’t just steal the database and automatically gain access to the passwords stored within it.
• Tokyo police and over 100 technology firms commenced a drill to counter ransomware cyberattacks ahead of the Group of Seven summit, set to be held in May in the western Japan city of Hiroshima.

More