Hackers Actively Exploiting Zero-day Flaw in Zimbra Server

July 14, 2023

Zimbra is a widely used email client used by many organizations worldwide. The Zimbra Collaboration Suite provides a much more comprehensive package of document storage, Editing, instant messaging, mini calendar, and other ease of access administrative controls.

Recent reports indicate that Zimbra Collaboration Suite 8.8.15 had a vulnerability that exists in the mom veto file on the web server relating to XML interpretation by the web server.

Update on Line number 40

The mom veto file is located in the /opt/zimbra/jetty/webapps/zimbra/m/ folder in which line number 40 was vulnerable since it had a code that does not interpret XML code.

Line number 40: <input name=”st” type=”hidden” value=”${param.st}

The above line does not interpret XML code.

In order to fix this, Zimbra has recommended their users update the code to the below code.

This line interprets XML code and makes the XML characters escape.

Before updating the above code, it is recommended for users to back up the file. Once after updating the code, Zimbra does not require a restart for this update.

This update must be made on all the mailbox nodes to have the highest level of security on Zimbra servers.

Update in July Patch

The fix for this vulnerability is planned to be released along with the July patch, as mentioned by Zimbra Team.

Users of Zimbra are recommended to take appropriate actions to prevent servers from being exploited by threat actors.

Zimbra, owned by Synacor, is the leading open-source message and collaboration tool used by more than 5000 companies with millions of users worldwide.

The company has a revenue of $5.2 million as of 2022, with more than 500 employees all over the world.

The post Hackers Actively Exploiting Zero-day Flaw in Zimbra Server appeared first on Cyber Security News.

Cyber Security News

Mallox Ransomware Attacking MS-SQL Servers to Compromise Victims’ Networks

A new ransomware strain dubbed, Mallox (aka TargetCompany, FARGO, and Tohnichi) is actively targeting and attacking Microsoft SQL (MS-SQL) servers.

Since June 2021, this new ransomware strain has been active, and it’s noteworthy, as it targets the MS-SQL servers that are not secured in an attempt to penetrate and breach the networks of the victims.

Mallox ransomware was recently identified by the security researchers at Unit 42, who noted a significant surge (174% ) in Mallox ransomware using MS-SQL servers for distribution, employing brute force, data exfiltration, and network scanners.

Mallox attack attempts (Source – Unit 42)

Mallox Ransomware

Mallox ransomware adopts double extortion tactics by encrypting files and stealing data, using it as leverage to pressure victims into paying the ransom.

Mallox website on Tor (Source – Unit 42)

With redacted names and logos, the group exhibits leaked data, giving victims private keys for negotiations and payments.

Mallox private chat (Source – Unit 42)

The group behind Mallox ransomware boasts hundreds of victims, but telemetry of Unit 42 reveals dozens worldwide from various industries, including:-

Manufacturing

Professional services

Legal services

Wholesale

Retail

Mallox activities surged throughout 2023, with a staggering 174% rise in attacks compared to late 2022.

The persistent Mallox group employs a consistent strategy for initial access, targeting unsecured MS-SQL servers via dictionary brute force, followed by command line and PowerShell to download the ransomware payload.

SQL server exploitation (Source – Unit 42)

Execution of Mallox

For successful execution, the ransomware payload makes numerous attempts prior to encryption. Here below we have mentioned all the attempts:-

Attempts to stop and remove SQL-related services using sc.exe and net.exe.

Attempts to delete volume shadows, restricting file restoration after encryption.

Attempts to erase logs using Microsoft’s wevtutil command line, evading detection and forensic analysis.

Using takeown.exe, ransomware alters file permissions, blocking access to critical system processes like cmd.exe.

Blocks manual System Image Recovery with bcdedit.exe, limiting the system administrator’s options.

It uses taskkill.exe to terminate security processes and evade security solutions.

By removing the registry key, it tries to defeat Raccine anti-ransomware.
Process tree of the attack (Source – Unit 42)

Ransom Note

In every directory on the drive of the victim, the ransomware drops a ransom note explaining the infection and offering contact details.

Ransom Note (Source – Unit 42)

Although Mallox is a small and closed group, the group seeks growth by recruiting affiliates to expand its illicit operations. With successful affiliate recruitment, Mallox could broaden its scope and target additional organizations.

Unit 42 advises proper configuration and patching for internet-facing applications and systems to minimize the attack surface, limiting attackers’ options.

Stay up-to-date with the latest Cyber Security News; follow us on GoogleNews, Linkedin, Twitter, and Facebook.

The post Mallox Ransomware Attacking MS-SQL Servers to Compromise Victims’ Networks appeared first on Cyber Security News.

Cyber Security News

Korenix JetlO 6550 Vulnerability Lets Attackers Gain Unauthorized Access

[[{“value”:”

Researchers at Hadess have identified a critical vulnerability in the widely-used Korenix JetlO industrial Ethernet switch series.

The flaw tracked as CVE-2024-2371 could allow attackers to gain unauthorized access to sensitive data within critical infrastructure and industrial control systems (ICS).

The vulnerability is rooted in the handling of the Simple Network Management Protocol (SNMP) by the Korenix JetlO switches. Due to insufficient access controls within the SNMP implementation, attackers can exploit this flaw to read sensitive information, such as configuration details and network topology, which are crucial for maintaining the security and integrity of industrial systems.

By sending specially crafted SNMP requests, malicious actors can bypass existing authentication mechanisms, gaining unauthorized access to critical system parameters.

This security gap presents a significant threat, as unauthorized access to these details could lead to operational disruptions, manipulation of system settings, network communication breakdowns, and even equipment malfunctions.

Document

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

The problem of vulnerability fatigue today
Difference between CVSS-specific vulnerability vs risk-based vulnerability
Evaluating vulnerabilities based on the business impact/risk
Automation to reduce alert fatigue and enhance security posture significantly

AcuRisQ, that helps you to quantify risk accurately:

Exploiting CVE-2024-2371

Exploiting CVE-2024-2371 has far-reaching potential impacts. In industrial environments where uptime is critical, such disruptions can result in production losses, safety hazards, and severe environmental damage, according to the Hadess report.

The vulnerability underscores the increasing need for robust cybersecurity measures in the industrial sector, where the convergence of IT and operational technology (OT) systems has exposed critical infrastructure to new risks.

In response to the discovery of CVE-2024-2371, Korenix, and other vendors must promptly release patches or firmware updates to address the vulnerability. Meanwhile, affected system operators must take proactive steps to secure their networks.

This includes implementing stringent access controls, segmenting networks to limit the spread of potential intrusions, and deploying intrusion detection systems to monitor for suspicious activities.

The cybersecurity community is closely monitoring the situation, as the exploitation of such vulnerabilities can have cascading effects on interconnected systems and services.

Organizations using Korenix JetlO switches are advised to review their security protocols, apply necessary updates, and remain vigilant against possible exploitation attempts.

As the digital transformation of industrial systems continues, the discovery of CVE-2024-2371 serves as a stark reminder of the importance of cybersecurity diligence.

Stakeholders across the industry must collaborate to fortify defenses against an ever-evolving threat landscape and ensure the resilience of critical infrastructure worldwide.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

The post Korenix JetlO 6550 Vulnerability Lets Attackers Gain Unauthorized Access appeared first on Cyber Security News.

“}]] Read More

Cyber Security News

Google released first quantum-resilient FIDO2 key implementation

Google has announced the first open-source quantum resilient FIDO2 security key implementation, which uses a unique ECC/Dilithium hybrid signature schema co-created with ETH Zurich. […] Read More

BleepingComputer

Update on Line number 40

Update in July Patch

Related

Related Posts

Mallox Ransomware

Execution of Mallox

Ransom Note

Mitigating Vulnerability & 0-day Threats