SonicWall “strongly urges” customers to patch several high-risk security flaws impacting its Secure Mobile Access (SMA) 1000 Series line of products that can let attackers bypass authorization and, potentially, compromise unpatched appliances.
SonicWall SMA 1000 SSLVPN solutions are used by enterprises to simplify end-to-end secure remote access to corporate resources across on-prem, cloud, and hybrid data center environments. While the first flaw (an unauthenticated access control bypass rated as high severity) is now tracked as CVE-2022-22282, the other two (a hard-coded cryptographic key and an open redirect, both rated as medium severity) are still waiting for a CVE ID to be issued.
“SonicWall strongly urges that organizations using the SMA 1000 series products upgrade to the latest patch,” the company says in a security advisory published this week.
SonicWall also pointed out that it found “no evidence that these vulnerabilities are being exploited in the wild.”
It also added that the vulnerabilities do not affect SMA 1000 series running versions earlier than 12.4.0, SMA 100 series products, CMS, and remote access clients.
The security bugs impact the following SMA 1000 Series models: 6200, 6210, 7200, 7210, 8000v (ESX, KVM, Hyper-V, AWS, Azure).
Of the three vulnerabilities, CVE-2022-22282 is the most severe as it allows unauthenticated attackers to bypass access control and gain access to internal resources.
Infrastructure previously belonging to the “REvil” (aka Sodinokibi) ransomware has reportedly been reignited by an unnamed threat group, redirecting visitors to a new data-leak website. While attribution has not been independently confirmed, several factors indicate that REvil members are likely behind this new ransomware operation
While attribution has not been independently confirmed, several factors indicate that REvil members are likely behind this new ransomware operation. The re-emergence of REvil follows the deterioration of Russia-US diplomatic relations, suggesting a potential link between these two events. Given the current geopolitical context, it is realistically possible that the Russian state will use REvil to conduct state-aligned operations and act as a force multiplier in ongoing tensions with other nation-states.
Before the January 2022 takedown, REvil was an aggressive and very active RaaS operation, conducting highly targeted and sophisticated cyber attacks. Some of its most prominent operations include the supply-chain attack on managed service provider Kaseya in July 2021 that impacted up to 1,500 businesses and the compromise of global meat supplier JBS, where REvil demanded an unprecedented USD 11 million ransom. A renewed REvil operation would highly likely have a significant impact on the current ransomware-threat landscape, given this threat group’s demonstrated capabilities and ambitions.
Only time will tell whether this new, likely REvil-linked, ransomware operation is legitimate and constitutes a serious threat to organizations worldwide. Regardless, the timing of REvil’s takedown and supposed re-emergence indicates that the fate of this group is likely tied to the developments of the Russia-Ukraine war. Given that this ransomware operation resumed its activity following the closure of communication channels between Russia and the US on cybersecurity matters, it is realistically possible that the group will now focus its efforts on Western organizations. It is realistically possible that Russia will use REvil to conduct state-aligned operations, granting the Russian state plausible deniability for such attacks, and act as a force multiplier in ongoing geopolitical tensions. However, it is likely that future REvil-linked malicious activity will remain purely financially motivated, and not influenced by the political objectives of the Russian state. Regardless of its provenience, a return by REvil would be consistent with other ransomware groups’ rebranding and reemergence efforts. These attempts have traditionally been short-lived and rarely as successful as the original.
Sources
Digital Shadows
Happy Blog
Bleeping Computer
A new Internet Information Services (IIS) post-exploitation framework has been discovered by the CrowdStrike Falcon OverWatch threat hunting team. Dubbed ‘IceApple’, this framework is primarily being used to facilitate credential harvesting from local/remote registries, credential logging on OWA servers, and data reconnaissance/exfiltration. IceApple has also been seen to only run-in memory and maintain an incredible low forensic footprint making tracking difficult.
CrowdStrike published 18 different observed modules that the IceApple framework utilizes. These support a wide range of capabilities like listing/deleting directories, writing to files, making HTTP requests, executing Active Directory queries, exfiltrating files, and dumping/capturing credentials.
IceApple is a post-exploitation framework, and with the current identified module capabilities does not show native exploitation or lateral movement utilization. As such proactively defending web applications is the best defense against post-exploitation frameworks like IceApple. Up to date patching and proper configuration on any/all web applications is the most important aspect, particularly with Microsoft Exchange – IceApple’s preferred target. Lastly organizations should conduct proactive threat hunting to compare what is “normal” in their environment and what is potentially suspicious/malicious. Threat hunters can use the following chart to aid in their hunts (chart provided by CrowdStrike):
A worm dubbed Raspberry Robin has been observed spreading via external USB drives. This has also been referred to as the “QNAP worm”. It spreads via malicious LNK files and uses msiexec.exe to make Command-and-Control (“C2”) communications with infected QNAP devices. This worm appears to be currently targeting technology and manufacturing sectors.
Systems become compromised once the malicious files on infected USB drives are executed. Once C2 communications are established, threat actors have the capability to execute commands or software on compromised systems. Limited information on post-exploitation activity is available.
Leverage Endpoint Detection & Response (“EDR”) solutions to monitor for connections initiated by msiexec.exe to suspicious IP addresses. Furthermore, consider implementing policies or technical controls to limit to the use of removable media, especially for systems housing sensitive information.
Sources
https://threatpost.com/usb-malware-targets-windows-installer/179521/
https://cyware.com/news/raspberry-robin-worm-found-dropping-malware-3265cac2
An alert from multi-national cyber-intelligence alliance “Five Eyes” states that it has observed an increase in “malicious cyber activity targeting managed service providers (MSPs) and expect this trend to continue” (CISA Alert AA22-131A). The advisory offers guidance to MSPs and their customers for navigating this aspect of the threat landscape.
Malicious actions launched through MSPs are among the most challenging threats businesses have to deal with, because much of the response is outside the business’s sphere of control. Perhaps the most prominent episode of such malicious action is the deployment of ransomware through Kaseya Virtual System Administrator in July 2021, in which Kaseya’s customers found themselves victims of ransomware deployed through their configuration management system. General third-party risk can be high: Consider the recent impact to availability of Kronos payroll services after the company’s ransomware attack in December 2021, which forced Kronos customers to fail over to backup payroll systems.
Because third-party security is outside of a customer’s sphere of control, customers must rely upon detailed contracts which address security concerns. Ideally, businesses thoroughly research potential MSPs before signing a contract. Because many third-party agreements have been in effect for a long time, a thorough review of existing relationships and agreements is an important aspect of a cybersecurity program. Perform such reviews at least annually. Companies should develop an incident response plan which addresses third-party risk. This incident response plan should be tested annually, or more often, through a tabletop exercise.
Sources
Protecting Against Cyber Threats to Managed Service Providers and their Customers | CISA
https://www.scmagazine.com/news/managed-services/msps-customers-targeted-by-malicious-cyber-actors-intelligence-alliance-warns
For strategic clients, your vCISO will add this to your next Office Hours for further discussion. However, if you have an immediate need, concern, or question, please reach out to them directly.
For non-strategic clients, please reach out to your Advisor for further discussion.
800-403-8350Our Computer Incident Response Teams (CIRTs) have responded to hundreds of breaches, intrusions, malware infections, thefts, employee investigations, fraud cases and other incidents. Our highly-certified experts have extensive experience in command, coordination and correction of incidents in nearly every industry throughout North America, from local businesses to Fortune 500 international conglomerates.
800-403-8350