Internet Storm Center Spotlight


SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Cybersecurity continues to be major factor in Ukraine-Russia conflict

Description: Cisco Talos is observing a variety of threats targeting Ukraine, including disinformation, defacements, DDoS, wiper malware, and potential BGP manipulation. Additionally, there has been increased participation from cyber vigilantes and other actors launching attacks on both sides of the conflict. This has raised serious concerns about both the risks associated with this behavior, as unsophisticated attackers may unintentionally disable key pieces of Ukrainian infrastructure, unintended targets — both within Ukraine and elsewhere — may become collateral damage, and as the possibility arises for these activities to further escalate the threat environment. There have also been serious implications in the crimeware landscape, with the well-known ransomware cartel Conti suffering significant fallout after publicly declaring their support for Russia.

References:

- https://blog.talosintelligence.com/2022/03/ukraine-update.html

- https://blog.talosintelligence.com/2022/02/current-executive-guidance-for-ongoing.html

- https://blogs.cisco.com/news/cisco-stands-on-guard-with-our-customers-in-ukraine

ClamAV signatures: Win.RedTrixx.Wiper.tii.Hunt


Title: Microsoft Patch Tuesday for March 2022

Description: Microsoft released another relatively light security update Tuesday, disclosing 71 vulnerabilities, including fixes for issues in Azure and the Office suite of products. March’s Patch Tuesday only included two critical vulnerabilities, which is notable considering there weren’t any critical issues in February’s security update. This month’s patch batch does not include any threats that Microsoft says have been exploited in the wild, and none of the vulnerabilities disclosed has a severity score higher than 8.8 out of 10. The most serious issue is CVE-2022-23277, a remote code execution vulnerability in Microsoft Exchange Server. An adversary could exploit this vulnerability to target the Exchange Server accounts with arbitrary or remote code execution, according to Microsoft. If the user is authenticated, they could trigger malicious code in the context of the Server account through a network call.

References: https://blog.talosintelligence.com/2022/03/microsoft-patch-tuesday-for-march-2022.html

SNORT® SIDs: 59210 - 59217, 59220 and 59221

Internet Storm Center Entries


ICANN has declined Ukraine's request to revoke Russian domains.

https://arstechnica.com/tech-policy/2022/03/icann-wont-revoke-russian-internet-domains-says-effect-would-be-devastating/


Ukrainian leaders say critical systems like electrical grids and nuclear power plants are more susceptible to physical attacks than cyber threats.

https://www.washingtonpost.com/national-security/2022/03/04/ukraine-nuclear-cyberattack/


Google purchased cybersecurity company Mandiant for roughly $5.4 million with plans to fold the firm into Google Cloud to create an “end-to-end security operations suite.”

https://www.theverge.com/2022/3/8/22966907/google-buying-mandiant-cybersecurity-outfit-5-4-billion


Code signing certificates stolen from Nvidia are being used to sign malware.

https://www.bleepingcomputer.com/news/security/malware-now-using-nvidias-stolen-code-signing-certificates/


A European-focused banking trojan disguised as a legitimate app in the Google Play store was downloaded more than 10,000 times.

https://techcrunch.com/2022/03/03/teabot-data-steal-google-play/


Personal data involved in a massive data breach of T-Mobile in 2021 is widely available and traded on the dark web.

https://www.cyberscoop.com/t-mobile-breach-dark-web-warning-attorneys-general/

Recent CVEs


COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.


ID: CVE-2020-12775

Title: Command injection vulnerability in Hicos Citizen Certificate

Description: Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attacker can exploit this vulnerability to perform a command injection attack to execute an arbitrary system command, disrupt the system, or terminate service.

CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


ID: CVE-2022-0841

Title: OS Command injection in npm-lockfile

Description: npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability.

CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


ID: CVE-2022-0845

Title: Code Injection in PyTorch Lightning

Description: PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. There is currently a patch available, anticipated to be part of the 1.6.0 release.

CVSS v3.1 Base Score: 9.8 (V:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


ID: CVE-2022-0848

Title: OS Command Injection in GitHub repository part-db/part-db

Description: OS command injection (also known as shell injection) is a web security vulnerability that allows an attacker to execute an arbitrary OS command on the server that is running an application, and typically fully compromise the application and all its data.

CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Prevalent Malware Files


COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934

MD5: 93fefc3e88ffb78abb36365fa5cf857c

VirusTotal: https://www.virustotal.com/gui/file/e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934/details

Typical Filename: Wextract

Claimed Product: Internet Explorer

Detection Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg


SHA 256: 792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0

MD5: b46b60327c12290e13b86e75d53114ae

VirusTotal: https://www.virustotal.com/gui/file/792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0/details

Typical Filename: NAPA_HQ_SetW10config.exe

Claimed Product: N/A

Detection Name: W32.File.MalParent


SHA 256: 02f6094b5d14e880a1fb7eef90228dbb34102788b5e513836750f90894dde185

MD5: 1152e84337d5d4c56c66a692676b7422

VirusTotal: https://www.virustotal.com/gui/file/02f6094b5d14e880a1fb7eef90228dbb34102788b5e513836750f90894dde185/details

Typical Filename: WaveSWUpdater.exe

Claimed Product: Wavesor SWUpdater

Detection Name: W32.02F6094B5D.Wavesor.SSO.Talos


SHA 256: 5a8660fdb45a0016725485a8a0e94df5a992953437ac18017850ec6e26d26b4a

MD5: 6c863625fe503e89e916dfff22a1c4e6

VirusTotal: https://www.virustotal.com/gui/file/5a8660fdb45a0016725485a8a0e94df5a992953437ac18017850ec6e26d26b4a/details

Typical Filename: TiWorker.exe

Claimed Product: Microsoft® Windows® Operating System

Detection Name: PUA.Win.Dropper.Miner::tpd


SHA 256: dcbb12bf4dd59d4907cb2c8daad2ba558fb462fdb795159e1b3c1ba8ecba9265

MD5: e253fa52dc43a4db2b73b1ce8db04572

VirusTotal: https://www.virustotal.com/gui/file/dcbb12bf4dd59d4907cb2c8daad2ba558fb462fdb795159e1b3c1ba8ecba9265/details

Typical Filename: KMSAuto_Lite_Portable_v1.2.1.zip

Claimed Product: N/A

Detection Name: PUA.Win.Tool.Hackkms::mash.sr.sbx.vioc