Anomali Cyber Watch: GitLab Vulnerability Exploited In The Wild, Mekotio Banking Trojan Returns, Microsoft Exchange Vulnerabilities Exploited Again and More
The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: Babuk, Braktooth, Linux, Gamaredon, Magecart and Vulnerabilities. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.
Figure 1 – IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.
Trending Cyber News and Threat Intelligence
BrakTooth Bluetooth Bugs Bite: Exploit Code, PoC Released
(published: November 5, 2021)
A proof-of-concept (PoC) tool to test for the recently revealed BrakTooth flaws in Bluetooth devices, and the researchers who discovered them have released both the test kit and full exploit code for the bugs. On Thursday, CISA urged manufacturers, vendors and developers to patch or employ workarounds. On Monday, the University of Singapore researchers updated their table of affected devices, after the chipset vendors Airoha, Mediatek and Samsung reported that some of their devices are vulnerable.
Analyst Comment: Users are urged to patch or employ workarounds as soon as possible.
Tags: Bluetooth, BrakTooth, Exploit, Vulnerability
CVE-2021-43267: Remote Linux Kernel Heap Overflow | TIPC Module Allows Arbitrary Code Execution
(published: November 4, 2021)
Researchers at SentinelOne have identified a vulnerability in the TIPC Module, part of the Linux Kernel. The Transparent Inter-Process Communication (TIPC) module is a protocol that is used for cluster-wide operation and is packaged as part of most major Linux distributions. The vulnerability, designated as “CVE-2021-43267”, is a heap overflow vulnerability that could be exploited to execute code within the kernel.
Analyst Comment: TIPC users should ensure their Linux kernel version is not between 5.10-rc1 and 5.15.
Tags: Linux, TIPC, Vulnerabiltity
Ukraine Links Members Of Gamaredon Hacker Group To Russian FSB
(published: November 4, 2021)
The Ukrainian Secret Service claims to have identified five members of the threat group, Gamaredon. The group, who Ukraine are claiming to be operated by the Russian Federal Security Service (FSB), are believed to be behind over 5,000 attacks against Ukraine. These attacks usually consist of malicious documents and using a template injection vulnerability, the group has targeted government, public and private entities.
Analyst Comment: Users should be careful that a file is sent via a known and trusted sender, that individual should be contacted to verify the authenticity of the attachment prior to opening. Thus, any such file attachment sent by unknown senders should be viewed with the utmost scrutiny, and the attachments should be avoided and properly reported to appropriate personnel. Users should be careful when viewing documents that ask for macros to be enabled.
MITRE ATT&CK: [MITRE ATT&CK] User Execution – T1204
Tags: Gamaredon, Malicious Documents, Russia, Ukraine, Template Injection
Credit Card Skimmer Evades Virtual Machines
(published: November 3, 2021)
Researchers at Malwarebytes have released research detailing the evolution of credit card skimmers to evade virtual machines. The skimmer, Magecart, uses WebGL, a JavaScript API to gather user system information. If there is no virtual machine detected, the skimmer will continue to scrape the victim’s data, which will include credit card information.
Analyst Comment: The financial information that was disclosed seems to be very comprehensive (credit card numbers, bank accounts, etc), and victims could have their identity stolen and financial transactions made in their name. Users that believe they have been impacted by this data breach should monitor their credit cards and bank accounts for unusual activity, and, in addition, freeze their credit reports.
MITRE ATT&CK: [MITRE ATT&CK] System Information Discovery – T1082 | [MITRE ATT&CK] Virtualization/Sandbox Evasion – T1497
Tags: Anti-VM, Credit Card, Magecart, Skimmer
Microsoft Exchange Vulnerabilities Exploited Once Again For Ransomware, This Time With Babuk
(published: November 3, 2021)
Cisco Talos researchers have identified a campaign spreading Babuk ransomware, attributed to the recent threat group Tortilla. The campaign appears to have primarily targeted US users, but with infections also occurring in other countries including Brazil, Finland, Germany, Honduras, Thailand, and the United Kingdom. Vulnerable Microsoft Exchange servers are targeted in an attempt to exploit the ProxyShell vulnerability to deliver Babuk ransomware.
Analyst Comment: Ransomware can potentially be blocked by using endpoint protection solutions (HIDS). Always keep your important files backed up following the 3-2-1 rule: have at least 3 different copies, on 2 different mediums, with 1 off-site. In the case of ransomware infection, the affected system must be wiped and reformatted. Other devices on the network should be checked for similar infections. Always check for a decryptor before considering payment; avoid payment at all costs. Ransomware should be reported to law enforcement agencies who are doing their best to track these actors and prevent ransom from being a profitable business for cyber criminals.
MITRE ATT&CK: [MITRE ATT&CK] Data Encrypted for Impact – T1486
Tags: Babuk, ChinaChopper, Microsoft Exchange Server, Vulnerability
Mekotio Banker Returns with Improved Stealth and Ancient Encryption
(published: November 3, 2021)
A new variant of the “Mekotio” banking trojan that has previously been targeting Latin American countries, according to Check Point researchers. The malware is being distributed via phishing emails that contain a link to a zip archive or a zip file as an attachment. The phishing email contains a link that contains a malicious attachment that is intended to trick the recipient into opening the attachment. If the attachment is opened, the malware will download a PowerShell script that runs directly in memory, allowing the malware to be undetected by most anti-virus products. The new infection vector contains these unprecedented elements: a stealthier batch file with at least two layers of obfuscation, a new fileless PowerShell script, and use of Themida v3 for packing the payload.
Analyst Comment: Threat actors deliver malware in numerous ways and will consistently update their TTPs to make analysis and discovery more difficult. Educate your employees on the methods actors use to distribute malware: compromised websites, malicious files, phishing, spearphishing, and vulnerability exploitation, among others.
MITRE ATT&CK: [MITRE ATT&CK] User Execution – T1204 | [MITRE ATT&CK] Command and Scripting Interpreter – T1059 | [MITRE ATT&CK] Phishing – T1566 | [MITRE ATT&CK] Process Injection – T1055
Tags: Mekotio, Powershell, Encryption, Latin America, Phishing
Trojan Source Attack Method Can Hide Bugs In Source Code
(published: November 1, 2021)
Researchers from the University of Cambridge have identified a method of attack that can be used to inject malicious code into source code. The method, named “Trojan Source”, manipulates the source code at the encoding level by embedding control characters that are then used to reorder the source code. The method has been demonstrated to work on multiple languages including C, C++, C#, Java, JavaScript, Go, Python, and Rust.
Analyst Comment: One way to defend against Trojan Source is to reject the use of control characters for text directionality in language specifications and in compilers that implement the languages. It is also possible to scan your source code including third-party libraries to check if these control characters were abused.
Tags: C, C++, C#, Java, Javascript, Trojan Source, Vulnerability, Exploit
GitLab Unauthenticated Remote Code Execution CVE-2021-22205 Exploited in the Wild
(published: November 1, 2021)
The vulnerability, “CVE-2021-22205”, a GitLab Remote Code Execution (RCE) vulnerability has changed to a 10 CVSSv3 score after changing from an authenticated to an unauthenticated issue. The vulnerability was first identified in April 2021, and could allow a remote actor to exploit a vulnerability in ExifTool to execute commands as a git user. There have been multiple reports of the vulnerability being exploited in the wild. While a patch has been released, many GitLab instances will still be vulnerable.
Analyst Comment: Users to update to the latest version of GitLab as soon as possible, and where possible should not be internet facing.
Tags: GitLab, RCE, Vulnerability
