Get expert threat analysis weekly. Sign up to receive our Threat Briefing:
Date: 03/15/2023
A group known as Dark Pink (also called Saaiwc) and identified as an advanced persistent threat (APT) has been targeting companies in Southeast Asia using malicious software called KamiKakaBot. This malware enables the execution of any desired commands and offers significant capabilities for exfiltration.
Dark Pink typically uses social engineering attacks to trick targets into downloading ISO image files that contain malicious executables. Once these files are mounted, the group uses multiple Microsoft Windows documents that contain malware to infect the victim’s machines. One of the payloads serves as a dropper, which utilizes DLL side-loading to bypass typical security protections and installs KamiKakaBot. Once installed, KamiKakaBot searches for data stored in web browsers, documents, and keylogged user activity. It then uses Command Prompt (cmd.exe) to exfiltrate this data in various obscure ways. In addition, KamiKakaBot has several persistence methods, such as modifying critical Windows Registry keys.
While the current attacks are presently confined to Southeast Asia, malware as potent as KamiKakaBot is often traded among APT groups and can spread rapidly across the globe. Organizations must focus on disrupting the cyber kill chain to combat these attacks. Disruption can be accomplished through a series of measures.
First, companies should provide employees with regular and advanced security awareness training to help them recognize and avoid social engineering attacks. Second, organizations should employ robust endpoint detection and response (EDR) tools to prevent endpoint compromise. Finally, network detection and response (NDR) tools can be used to identify malicious network traffic and potential exfiltration activity.
For more information, fill out the form below and we will be in touch shortly
Among the 15 vulnerabilities addressed recently by Fortinet is a critical vulnerability, CVE-2023-25610 (CVSS 9.3), impacting FortiOS and FortiProxy that could allow an attacker to compromise affected devices. CVE-2023-25610 is a buffer underwrite vulnerability that affects administrative interfaces.
An unauthenticated, remote attacker could potentially execute arbitrary code and/or perform a DoS on the GUI, via specifically crafted requests. This could also lead to memory corruption that could be weaponized to execute code. Attackers could potentially use this vulnerability for initial access and a foothold for lateral movement and malware deployment. There is not yet evidence of exploitation in the wild, though this may change quickly.
Fixes are available in FortiOS versions 6.2.13, 6.4.12, 7.0.10, 7.2.4, and 7.4.0; FortiOS-6K7K versions 6.2.13, 6.4.12, and 7.0.10; and FortiProxy versions 2.0.12, 7.0.9, and 7.0.9. As a workaround, administrators should disable the administrative HTTP/HTTPS interface or limit which IP addresses are allowed to reach it. It is also recommended to perform regular vulnerability assessments (internal and external) to ensure vulnerabilities are being addressed efficiently.
Sources
https://thehackernews.com/2023/03/new-critical-flaw-in-fortios-and.html
CISA has added CVE-2021-39144 to the catalog of known exploited vulnerabilities. CVE-2021-39144 (CVSS 9.8) is an input serialization flaw in the XStream open-source library used by various VMWare products. An unauthenticated attacker can exploit it with a low level of complexity.
Attackers exploiting this vulnerability will be able to execute remote code in the context of the root user on VMware Cloud Foundation (NSX-V) appliances. This could be one step in a large attack chain aimed at encrypting systems or exfiltrating data.
Security updates to address CVE-2021-39144 are available, including for some end-of-life products. There is a workaround available here: https://kb.vmware.com/s/article/89809. VMware-related vulnerabilities are often targeted, and an effective vulnerability management process is needed to mitigate risk. Internal and external vulnerability assessments are necessary for identifying unpatched critical vulnerabilities.
Sources
As part of an agreement to settle charges filed by the Securities and Exchange Commission (SEC) for failing to “disclose the full impact of a ransomware attack despite its personnel learning that its earlier public statements about the attack were erroneous.”
The SEC press release related to the matter describes the scenario in which Blackbaud suffered a ransomware attack in May 2020 and made public statements asserting that the “ransomware attacker did not access donor bank account information or social security numbers.” The press release goes on to say that the company learned within days of this public statement that attackers did indeed “exfiltrate this sensitive information.”
The SEC charged Blackbaud with failing “to maintain disclosure controls and procedures.” Blackbaud agreed to pay a $3 million penalty to settle the SEC charges without confirming or denying their accuracy.
For donors who lost their information in this attack, the impact will be a greater risk of identity theft. Institutions using Blackbaud at the time of the breach face reputational damage.
Use Blackbaud’s experience as a lesson in incident response handling. A well-crafted incident response plan includes guidance on communication plans and incorporates close coordination with legal counsel. Following such a plan will ensure that disclosure controls and procedures are maintained.
Sources
The article referenced below from Recorded Future details a trend of USB-drive based malware infection in Africa and Southeast Asia. This article brings to mind several warnings from the FBI and CISA in the past year involving the use of USB drives by threat actor groups. As technical controls improve for organizations, threat actors have been recycling old tactics such as sending malware-laden USB drives to personnel as “free gifts” or other such enticements to get staff to plug the drives in.
The impact of USB-based malware is network compromise, often leading to exfiltration and ransomware.
Ensure that your organization’s information security program incorporates technical controls over USB devices, as well as user training, so that rogue or malicious devices do not get plugged into workstations.
Sources
https://therecord.media/hackers-using-USB-sticks?category=&sort=articles_date_desc
For strategic clients, your vCISO will add this to your next Office Hours for further discussion. However, if you have an immediate need, concern, or question, please reach out to them directly.
For non-strategic clients, please reach out to your Advisor for further discussion.
For those not yet clients of GreyCastle Security, please click the “Contact Us” button below and we’ll be glad to provide assistance as well as answer any questions you might have.
Offerings
Industries
Compliance
Copyright © 2023 GreyCastle Security. All Rights Reserved
800-403-8350Copyright © 2022 GreyCastle Security. All Rights Reserved
Ho Chin is Chief Financial Officer at GreyCastle Security. In this role, Ho leads Finance, HR, IT and Professional Development. As part of the executive leadership team, Ho works to establish the company’s overall strategy and ensure proper execution of the supporting initiatives pertaining to the above areas of responsibility.
Prior to joining GreyCastle Security, Ho led finance and administrative functions at multiple private equity and venture-backed portfolio companies across multiple industries. Ho holds a bachelor’s degree in Accounting from Pennsylvania State University in Centre County, Pennsylvania and a master’s degree in Business Administration from the Wharton School of Business at the University of Pennsylvania in Philadelphia, Pennsylvania.
Dan Kalil is Chief Executive Officer (CEO) and Board Chairman at GreyCastle Security. In this role, Dan provides vision, leadership and strategies that drive GreyCastle Security’s position as an industry leader. With an emphasis on customer success, Dan’s profitable growth model leverages a customer-centric business approach that balances employee wellbeing and social responsibility.
Prior to becoming CEO, Dan served as the company’s Chief Strategy Officer, during which he supported multiple acquisitions and helped the organization achieve substantial sales growth. In addition to serving as CEO at GreyCastle Security, Dan continues to hold the position of Chief Commercial Officer (CCO) at Assured information Security (AIS) in Rome, New York, a company he co-founded in 2001.
Over the course of the last 22 years, Dan has been committed to advancing the state of cybersecurity and has played an instrumental role in the identification and development of critical, next-generation cyber capabilities. He has held positions in almost every facet of cybersecurity, beginning as a computer forensic examiner and progressing through the management and executive leadership ranks. In addition to co-founding AIS, Dan has facilitated multiple cybersecurity startups, raised investment capital and has served in various lead and support roles toward the acquisition of five companies in the last eight years.
Dan has a bachelor’s degree in Cybersecurity and a master’s degree in Cybersecurity from Utica College in Utica, New York.
Michael Stamas is an entrepreneur, board member, Vice President and a founder of GreyCastle Security. With more than two decades of experience in the technology sector, Mike pairs his management and business development skills with a deep understanding of cybersecurity. Mike brings a unique brand of risk-based advising to GreyCastle clients and prospects.
Mike holds certifications in numerous security and technology related areas, including the Department of Homeland Security and other security technologies like Symantec, Cisco and Microsoft.
Mike plays an active role in his community and serves as a board member and Vice President of InfraGard Albany as well as an advisory board position with the Capital Region YMCA.
Mike has been recognized for his numerous achievements through various honors including the Albany Business Review’s prestigious 40 Under 40 award.
Dan Maynard serves as GreyCastle Security’s Chief Operating Officer, where he currently leads Sales, Marketing and Legal.
Dan has enjoyed a 30+ year career in the Information Technology and Telecommunications industry, during which time he has held various leadership positions for organizations such as Rochester Tel/RCI, Citizens Communications (Frontier), PAETEC Communications, IntegraOptics, tw telecom/Level3 and Centurylink.
In addition to various voice and data technology platforms, he possesses a strong background in leadership development, sales and marketing leadership, transformational leadership and strategic planning. Dan has a thirst for knowledge and as a committed lifelong learner, he encourages and supports professional development initiatives for his teams and continues his involvement with Vistage International.
Dan holds a bachelor’s degree in Biology from Lafayette College in Easton, Pennsylvania, where he was selected as a member of their Athletic Hall of Fame in 2016.
When not at work, Dan enjoys traveling, golfing, attending Utica Comets hockey games and relaxing in the Adirondacks on beautiful Canada Lake with family and friends.
Dan Didier is the Vice President of Solutions and board member at GreyCastle Security.
Dan has been a cybersecurity practitioner for more than 20 years and uses his knowledge and experience to develop cybersecurity solutions that ensure readiness and preparedness.
Dan received his bachelor’s degree in Telecommunications from SUNY Polytechnic Institute in Utica, New York, and graduated Summa Cum Laude with a master’s degree in Information Assurance from Norwich University in Northfield, Vermont.
Our Computer Incident Response Teams (CIRTs) have responded to hundreds of breaches, intrusions, malware infections, thefts, employee investigations, fraud cases and other incidents. Our highly-certified experts have extensive experience in command, coordination and correction of incidents in nearly every industry throughout North America, from local businesses to Fortune 500 international conglomerates.
800-403-8350Francesca LoPorto-Brandow is Director of Culture at GreyCastle Security. In this role, Francesca leads all social responsibility efforts and partnerships and develops effective strategies that promote organizational-wide behaviors and attitudes consistent with a culture of safety, inclusion, teamwork, motivation and high-performance.
Prior to this role, Francesca was Director of People & Culture at GreyCastle and with her leadership, the company’s culture has been recognized by Inc. Magazine as a Nationally recognized Best Workplace, Albany Business Review Best Places to Work and Albany Times Union Top Workplaces.
Before joining GreyCastle Security, Francesca worked as an OD consultant and focused on strategic culture change at The Kaleel Jamison Consulting Group, Inc. for more than six years. There, she facilitated client education sessions, coached leaders and teams, developed and executed consulting interventions and served as strategy project leader on various client engagements. Her work has taken her into Fortune 100 companies and across borders including Panama, Singapore and beyond.
Francesca is a Lean Six Sigma–certified Green Belt, a proud YWCA-GCR board member and in 2013, she coordinated and emceed the inaugural TEDx Troy—a livestream of TEDCity 2.0. Since 2012, she has coordinated and emceed the Troy 100 Forum, a biannual forum for government, religious and community leaders to discuss issues vital to the future of Troy, New York.
Bilingual in English and Italian, Francesca holds a bachelor’s degree in Management and Technology from the Rensselaer Polytechnic Institute’s Lally School of Management & Technology. She was awarded Cybersecurity Recruiter of the year North America in 2017 by the Cybersecurity Excellence Awards.
Jamie Aiello is Senior Vice President of Services and Product Management at GreyCastle Security. In this position, Jamie is responsible for leading a high performing and well-balanced team that is ultimately responsible for the identification, selection, execution and successful performance of our company’s diverse portfolio of cybersecurity offerings.
Prior to joining GreyCastle Security, Jamie has held leadership positions with Annese and Associates, ConvergeOne and BlueSky IT Partners with a focus on delivering cost effective information technology solutions for companies across multiple verticals.
Jamie holds a bachelor’s degree in Political Science from Le Moyne College in Syracuse, New York, a master’s degree in Business Administration from Gardner-Webb University in Boiling Springs, North Carolina and a master’s degree in Computer Information Systems from University of Phoenix in Phoenix, Arizona.
