Volume 21 – Number 14

Internet Storm Center Spotlight

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Exchange Server critical vulnerabilities included in Patch Tuesday

Description: Microsoft released its monthly security update Tuesday, disclosing 108 vulnerabilities across its suite of products, the most in any month so far this year. Four new remote code execution vulnerabilities in Microsoft Exchange Server are included in Tuesday’s security update. Microsoft disclosed multiple zero-day vulnerabilities in Exchange Server earlier this year that attackers were exploiting in the wild. The new vulnerabilities Microsoft disclosed are identified as CVE-2021-28480, CVE-2021-28481, CVE-2021-28482 and CVE-2021-28483 — all of which are critical, and the highest of which has a CVSS severity score of 9.8 out of 10. There are 20 critical vulnerabilities as part of this release and one considered of “moderate” severity. The remainder are all “important.” Twelve of the critical vulnerabilities exist in the remote procedure call runtime.

References: https://blog.talosintelligence.com/2021/04/microsoft-patch-tuesday-for-april-2021.html

Snort SIDs: 57403, 57404, 57411, 57414

Title: Attackers infiltrate collaboration app servers to spread spam, malware

Description: As telework has become the norm throughout the COVID-19 pandemic, attackers are modifying their tactics to take advantage of the changes to employee workflows. Attackers are leveraging collaboration platforms, such as Discord and Slack, to stay under the radar and evade organizational defenses. Collaboration platforms enable adversaries to conduct campaigns using legitimate infrastructure that may not be blocked in many network environments. RATs, information stealers, internet-of-things malware and other threats are leveraging collaboration platforms for delivery, component retrieval and command and control communications.

Reference: https://blog.talosintelligence.com/2021/04/collab-app-abuse.html

ClamAV signatures: Win.Trojan.AgentTesla-9846789-0, Js.Trojan.Downloader-9846867-0, Win.Dropper.Agent-9847178-0, Win.Trojan.Vebzenpak-9847193-0, Win.Trojan.Bulz-9847194-1, Win.Malware.Predator-9850360-1, Win.Trojan.Taskun-9850631-0, Win.Packed.Trojanx-9850692-0

Internet Storm Center Entries

Iran claimed a state-sponsored actor was likely behind a recent attack that shut down its Natanz uranium enrichment facility.

https://www.nytimes.com/2021/04/11/world/middleeast/iran-nuclear-natanz.html

The U.S. has denied involvement in the attack, which caused an explosion.

https://www.axios.com/biden-administration-explosion-natanz-nuclear-site-8f2b71ae-54c4-438f-be12-68c6f3e3c676.html

A Telegram bot could be exploited to disclose the phone number attached to many Facebook pages; this is separate from the leaked database of 500 million Facebook users’ records that was in the news last week.

https://www.vice.com/en/article/qj8dj5/facebook-phone-number-data-breach-telegram-bot

A threat actor leaked information belonging to a rival hacking group after breaching a credit card fraud dark web forum.

https://www.group-ib.com/media/swarmshop-breach/

Q Link Wireless, a low-cost mobile phone carrier, exposed sensitive personal information to anyone who knew a valid phone number and could provide it through the carrier’s app.

https://arstechnica.com/information-technology/2021/04/no-password-required-mobile-carrier-exposes-data-for-millions-of-accounts/

U.S. President Joe Biden filled two key cybersecurity roles in his administration, nominating former National Security Agency officials to head the Cybersecurity and Infrastructure Security Agency and to become the country’s first national cyber director.

https://www.politico.com/news/2021/04/12/biden-nominates-former-nsa-officials-480945

Vulnerabilities in four TCP/IP stacks affect millions of Internet of Things devices that can be exploited to allow remote code execution or cause denial-of-service conditions.

https://www.zdnet.com/article/these-new-vulnerabilities-millions-of-iot-devives-at-risk-so-patch-now/

The Sysrv botnet is adding new exploits and capabilities as it steps up its targeting of Windows and Linux machines to delivery cryptocurrency miners.

https://arstechnica.com/gadgets/2021/04/windows-and-linux-devices-are-under-attack-by-a-new-cryptomining-worm/

Several ransomware actors are still exploiting unpatched Microsoft Exchange Servers a month after the company disclosed several zero-day vulnerabilities.

https://www.darkreading.com/attacks-breaches/inside-the-ransomware-campaigns-targeting-exchange-servers/d/d-id/1340582

Recent CVEs

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2021-30177

Title: SQL Injection Vulnerability in PHPNuke

Vendor: PHPNuke

Description: There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE.