Internet Storm Center Spotlight


SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Series of wiper campaigns hit Ukraine, globe as conflict escalates

Description: Cisco Talos is aware of a second wave of wiper attacks ongoing inside Ukraine, leveraging a new wiper that has been dubbed "HermeticWiper." Deployment of the destructive malware began on Feb. 23, 2022. HermeticWiper features behavioral characteristics similar to what was observed during the WhisperGate attacks that occurred in January. The malware has two components designed for destruction: one that targets the Master Boot Record (MBR) and another targeting partitions. There are several additional components of this campaign, including HermeticWizard, which allows HermeticWiper to be propagated to and deployed on additional systems within affected environments. There is also IsaacWiper, an additional wiper responsible for the destruction of systems and data and HermeticRansom, a ransomware family that has been observed being deployed at the same time as HermeticWiper as a diversionary tactic.

References: https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html

SNORT® SIDs: 59099 and 59100

ClamAV signatures: Win.RedTrixx.Wiper.tii.Hunt


Title: Wireless routers targeted with Cylops Blink malware

Description: Cisco Talos is aware of the recent reporting around a new modular malware family, Cyclops Blink, that targets small and home office (SOHO) devices, similar to previously observed threats like VPNFilter. This malware is designed to run on Linux systems and is compiled specifically for 32-bit PowerPC architecture. The modular nature of this malware allows it to be used in a variety of ways, including typical reconnaissance and espionage activity. It leverages modules to facilitate various operations such as establishment of C2, file upload/download and information extraction capabilities. Talos discovered compromised MikroTik routers inside of Ukraine being leveraged to conduct brute-force attacks on devices protected by multi-factor authentication. This continues a pattern we have seen since our investigation into VPNFilter involving actors using MikroTik routers. While it may not be Cyclops Blink specifically, it was yet another MikroTik router passing malicious traffic, a vendor widely abused by VPNFilter in the past.

References: https://blog.talosintelligence.com/2022/02/threat-advisory-cyclops-blink.html

SNORT® SIDs: 59095 – 59098

ClamAV signatures: Unix.Backdoor.CyclopsBlink

Internet Storm Center Entries


Cyber attackers across the globe are taking advantage of the current conflict in Ukraine, spreading wipers and other malware, potentially raising the risk of misattribution and escalating threats.

https://blog.talosintelligence.com/2022/03/ukraine-update.html


The Ukrainian invasion has raised questions about how much cyber warfare could become involved in the conflict, or if past cyber attacks set the stage for the invasion.

https://www.vox.com/recode/22950633/cyberattacks-russia-ukraine-us-cyberwar


The U.S. Cybersecurity and Infrastructure Security Agency and the FBI are warning that wiper attacks targeting Ukraine could spill over to targets in other countries.

https://www.bleepingcomputer.com/news/security/cisa-and-fbi-warn-of-potential-data-wiping-attacks-spillover/


Large tech companies are calling on international powers to agree on new restrictions around cyber warfare similar to the Geneva Conventions to try and prevent attacks targeting crucial sectors humans rely on.

https://www.cnn.com/2022/03/01/tech/microsoft-geneva-convention-ukraine/index.html


Many tech and cybersecurity companies have offered to assist Ukraine with cybersecurity, internet and networking needs in the wake of Russia’s attack, many offering free services and software.

https://www.nytimes.com/2022/02/28/us/politics/ukraine-russia-microsoft.html

Recent CVEs


COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.


ID: CVE-2021-43049

Title: Information disclosure vulnerability in TIBCO BusinessConnect Container Edition

Description: The Database component of TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain the usernames and passwords of users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition: versions 1.1.0 and below.

CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


ID: CVE-2022-20708

Title: Code Execution Vulnerability in Cisco Small Business Routers

Description: Cisco RV340 routers are impacted by this vulnerability. An attacker might take advantage of this flaw to execute code in the context of root. Although authentication is necessary to exploit this flaw, the current authentication system can be bypassed. The problem arises from the failure to properly validate a user-supplied string before utilizing it to call a system function.

CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Prevalent Malware Files


COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934

MD5: 93fefc3e88ffb78abb36365fa5cf857c

VirusTotal: https://www.virustotal.com/gui/file/e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934/details

Typical Filename: Wextract

Claimed Product: Internet Explorer

Detection Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg


SHA 256: 792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0

MD5: b46b60327c12290e13b86e75d53114ae

VirusTotal: https://www.virustotal.com/gui/file/792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0/details

Typical Filename: NAPA_HQ_SetW10config.exe

Claimed Product: N/A

Detection Name: W32.File.MalParent


SHA 256: 02f6094b5d14e880a1fb7eef90228dbb34102788b5e513836750f90894dde185

MD5: 1152e84337d5d4c56c66a692676b7422

VirusTotal: https://www.virustotal.com/gui/file/02f6094b5d14e880a1fb7eef90228dbb34102788b5e513836750f90894dde185/details

Typical Filename: WaveSWUpdater.exe

Claimed Product: Wavesor SWUpdater

Detection Name: W32.02F6094B5D.Wavesor.SSO.Talos


SHA 256: 5a8660fdb45a0016725485a8a0e94df5a992953437ac18017850ec6e26d26b4a

MD5: 6c863625fe503e89e916dfff22a1c4e6

VirusTotal: https://www.virustotal.com/gui/file/5a8660fdb45a0016725485a8a0e94df5a992953437ac18017850ec6e26d26b4a/details

Typical Filename: TiWorker.exe

Claimed Product: Microsoft® Windows® Operating System

Detection Name: PUA.Win.Dropper.Miner::tpd


SHA 256: dcbb12bf4dd59d4907cb2c8daad2ba558fb462fdb795159e1b3c1ba8ecba9265

MD5: e253fa52dc43a4db2b73b1ce8db04572

VirusTotal: https://www.virustotal.com/gui/file/dcbb12bf4dd59d4907cb2c8daad2ba558fb462fdb795159e1b3c1ba8ecba9265/details

Typical Filename: KMSAuto_Lite_Portable_v1.2.1.zip

Claimed Product: N/A

Detection Name: PUA.Win.Tool.Hackkms::mash.sr.sbx.vioc