The all in one place for non-profit security aid.
Security vendor consolidation is picking up steam with good reason. Everyone wants to improve security efficiency and effectiveness while paying for less.
The post Keep it, Tweak it, Trash it – What to do with Aging Tech in an Era of Consolidation appeared first on SecurityWeek.
SecurityWeek RSS Feed
Hackers compromised the Roundcube Email Servers of Ukrainian organizations
APT28 (aka BlueDelta, Fancy Bear, Sednit, and Sofacy), a threat group connected to Russia’s GRU, hacked the Roundcube email servers of over 40 Ukrainian organizations, including government bodies.
The cyber-espionage group used news about the Russia-Ukraine conflict to trick people into opening harmful emails. These emails exploited vulnerabilities in Roundcube Webmail to hack into unsecured servers.
With the help of a malicious script, Russian military hackers redirect the individuals’ incoming emails to an email address controlled by the attackers after gaining unauthorized access to the email servers.
Moreover, this script is also used to:-
Gather intelligence information
Steal victims’ Roundcube address book
Steal session cookies
Steal other Roundcube database data
The investigation by Ukraine’s CERT-UA and Recorded Future’s Insikt Group revealed that the campaign’s objective was to collect and steal military intelligence for Russia’s invasion of Ukraine.
Since November 2021, it is believed that the APT28 military hackers have been using the same infrastructure for these cyberespionage attacks and other illicit activities.
In addition, this GRU-linked group has also faced allegations of exploiting the previously unknown zero-day vulnerabilities in Microsoft Outlook.
An email titled “News of Ukraine” was detected during the thorough investigation of the mailbox contents of the computer user.
Here Below, we have mentioned all the key details regarding this email:-
Email received on 12.05.2023
Email received from ukraine_news@meta[.]ua
The email contained a bait article from an “NV” (nv.ua) publication.
The email contained an exploit for the vulnerability in Roundcube CVE-2020-35730 (XSS)
The email contained JavaScript code for running “q.js” and “e.js” files.
An exploit for the Roundcube vulnerability that is tracked as “CVE-2021-44026” (SQLi) is present within the “q.js” file. While this exploit is primarily used to extract information from the database of Roundcube.
Moreover, the identification of the “c.js” code revealed that it carries an exploit for the CVE-2020-12641 vulnerability. This exploit allows for the execution of commands on the mail server.
Recommendations
Here below we have mentioned all the recommendations provided by the cybersecurity analysts:-
Within email attachments, the organizations should disable HTML and/or JavaScript.
Use anti-spoofing and authentication mechanisms to filter incoming email traffic.
Keep your security tools and systems up-to-date with the latest patches and updates.
Make sure to not open any attachments received from an unknown sender.
Manage and secure Your Endpoints Efficiently – Free Download
The post Hackers compromised the Roundcube Email Servers of Ukrainian organizations appeared first on Cyber Security News.
Cyber Security News
BianLian Ransomware Leveraging RDP Credentials To Gain Initial Access
BianLian emerged in 2022, and after its emergence rapidly, it became one of the three most active ransomware groups.
They started their operations by exploiting RDP, ProxyShell, and SonicWall VPN vulnerabilities.
The cybersecurity researchers at Juniper affirmed that the operators of this ransomware group do so for the initial access using customized Go malware and living off-the-land techniques.
In early 2023, after Avast released a decryptor, this shifted from encryption or double extortion to simply stealing and extorting.
By May 2023, victim postings had peaked before declining due to improved defenses and law enforcement attention.
Are you from SOC/DFIR Teams? – Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files
But early 2024 witnessed a resurgence with more than ninety new victims, demonstrating BianLian’s resilience and adaptability in the ransomware landscape.
BianLian’s 2024 strategy was based on selecting high-value industries with legal services (23.7%) and healthcare placed at the forefront because of their vulnerability to such data.
In mid-January, BianLian experienced a sharp rise in threat actors involved in its C2 infrastructure, as they deployed more than fifteen new servers within twenty-four hours.
This trend in C2 infrastructure activities occurred alongside an increase in victim postings, which coincided with hackers’ hacking of TeamCity servers and the subsequent development of a PowerShell-based backdoor toolkit by the group.
The ransomware campaigns of this operator highlighted its ability to adapt to different sectors’ victims and the strategic timing of infrastructure expansion.
BianLian’s C2 infrastructure in 2023-2024 reveals strategic variety. Mostly, they use 443 ports (18.59%) and 8443 (9.94%) for HTTPS traffic, followed by 46.47% that apply divergent other ports to avoid detection.
In mid-January, BianLian experienced a sharp rise in threat actors involved in its C2 infrastructure, as they deployed more than fifteen new servers within twenty-four hours.
This trend in C2 infrastructure activities occurred alongside an increase in victim postings, which coincided with hackers’ hacking of TeamCity servers and the subsequent development of a PowerShell-based backdoor toolkit by the group.
The ransomware campaigns of this operator highlighted its ability to adapt to different sectors’ victims and the strategic timing of infrastructure expansion.
BianLian’s C2 infrastructure in 2023-2024 reveals strategic variety. Mostly, they use 443 ports (18.59%) and 8443 (9.94%) for HTTPS traffic, followed by 46.47% that apply divergent other ports to avoid detection.
The Go-based backdoor using modules mimux and soso operates as a loader with a hardcoded c2 address. Recent versions switched from log.Print to a Logger function in 2024 for more flexible logging.
This infrastructure design illustrates BianLian’s attempt to merge with lawful traffic, diversify hosting, and strengthen its malware so it may be used in prolonged manageable attack instances.
Besides this, a Linux variant has been discovered, which is part of the Go-based tools used by BianLian to launch attacks on different operating systems.
The group concentrates on engineering, healthcare, and legal services that prop high-value targets.
They have continued to evolve by switching from encryption to pure data theft and extortion. They are even building new backdoor versions with improved logging functions.
This growth and a simultaneous strategic diversification of their infrastructural set-up support constant vigilance and cross-platform defense against this advanced threat actor.
3b309c076c26f27f42dbab8c89f05df51c414e87529251dc2d9946e7bc694f29
72d91293ff1a91587af3997081f65eac819d2ff73655837dc68a447d371ca2f1
f9421165e4a62c7a1941b7b3fa73ac6f2149e7ffab3a6a622406baabf1933a2e
834ab96263cca7b01b3ae6549a9811b56204e714402215ce37fb602732b981d1
B12be86af46b0267d86fcacef0a58bad0d157a7a044f89a453082b32503bd3c0
ec2-13-215-228-73[.]ap-southeast-1[.]compute[.]amazonaws[.]com
104[.]238[.]61[.]20
45[.]56[.]165[.]131
146[.]59[.]102[.]74
45[.]56[.]165[.]131
“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo
The post BianLian Ransomware Leveraging RDP Credentials To Gain Initial Access appeared first on Cyber Security News.
Adobe Security Update for Premiere Pro, InDesign & Bridge
Adobe has released crucial security updates for its widely-used software products: Premiere Pro, InDesign, and Bridge.
The updates, identified as APSB24-46, APSB24-48, and APSB24-51, respectively, were initially posted and last updated on July 9, 2024.
These updates aim to address several vulnerabilities that could potentially be exploited by malicious actors, posing significant risks to users’ data and system integrity.
The Product Security Incident Response Team (PSIRT) at Adobe has been instrumental in driving the company’s vulnerability disclosure program.
PSIRT provides a centralized point of contact for customers, partners, pen-testers, and security researchers to report security vulnerabilities in Adobe products and services.
Join our free webinar to learn about combating slow DDoS attacks, a major threat today.
By encouraging the external security community to disclose security issues privately, PSIRT minimizes risks to customers, Adobe’s infrastructure, and the brand.
This collaborative approach underscores Adobe’s commitment to maintaining the highest security standards for its users.
Adobe Premiere Pro, InDesign, and Bridge users are strongly advised to install these updates immediately to safeguard their systems.
The security patches address vulnerabilities that, if left unpatched, could be exploited to execute arbitrary code, leading to potential data breaches or system compromises.
Adobe’s latest product security updates provide detailed information and guidance on the reported security issues, ensuring users can take the necessary steps to protect their software and data.
Users can visit the official Adobe security page for more information on the latest security updates and to notify Adobe of any security issues.
Staying informed and proactive about software updates is crucial in today’s digital landscape, where security threats constantly evolve.
“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo
The post Adobe Security Update for Premiere Pro, InDesign & Bridge appeared first on Cyber Security News.