Managed Event Collection

TWiC | Phishing Kits, FBI Shuts Down Credential Site, WordPress Critical Vulnerability, and Cobalt Strike

In this edition of This Week in Cybersecurity, we will discuss how phishers are using Telegram to sell phishing kits and lure in inexperienced phishers. We will also cover the recent seizure of Genesis Market, a major marketplace for stolen credentials, by the FBI and international law enforcement. Additionally, we will discuss the critical vulnerability in the Elementor Pro website builder plugin for WordPress that has been exploited by unknown attackers. Finally, we will take a look at Microsoft’s legal action to seize domains related to criminal activity involving Cobalt Strike, a popular security testing application that is often abused by cybercriminals. Continue reading to learn more about these important topics and how they may impact your organization’s security posture.

Telegram Used to Sell Phishing Kits

There has been a continued growth of the use of Telegram by phishers to offer a variety of phishing services in the past few years. Phishers use Telegram channels to promote their services to anyone willing to pay. These services can range from creating automated phishing bots, generating phishing pages, collecting data and distributing phishing links. Within this black market, free content for aspiring phishers is also offered, along with free phishing kits and users’ personal data. The reason behind these free offers is to recruit an unpaid workforce or bait inexperienced phishers to bite.

In addition, paid offers for phishers on Telegram include access to phishing tools, guides for creating customized phishing pages, and phishing-as-a-service (PhaaS) subscriptions. nGuard’s wide range of security assessments include Social Engineering. It is important for an organization to test their employees with social engineering techniques to identify potential vulnerabilities and educate them on how to recognize and respond to real-world attacks, ultimately improving the overall security posture of the organization.

FBI and International Law Enforcement Shut Down Stolen Credential Site

Genesis Market, a major marketplace for stolen credentials of all types, was seized by law enforcement as part of Operation Cookie Monster. The marketplace was offering both consumer and corporate account identities, and the admins have not been identified or caught yet. Genesis Market was one of the most popular online shops for account credentials, device fingerprints, and cookies, and it provided access to a wide list of services with user accounts from all over the world. The seizure was possible due to international law enforcement and private sector coordination. Although some of the infrastructure has been taken offline, the platform’s site on the dark web is still reachable. The bot deployed would reside on the compromised computer and send the harvested information in real-time to its buyer. The platform provided access to a wide list of services with user accounts from all over the world and the customers of the market turned a pretty penny from using the stolen digital identities.

Users can check if their accounts were compromised and sold on Genesis Market through a portal from the Dutch Police specifically built for this purpose. During nGuard’s external and internal penetration testing we always check databases for known, leaked credentials and attempt to access user’s accounts and infrastructure should we discover any.

WordPress Site Builder Elementor Pro Has Critical Vulnerability Exploited

Unknown attackers are exploiting a recently patched security vulnerability in the Elementor Pro website builder plugin for WordPress. Versions 3.11.6 and earlier are affected, with the flaw described as a case of broken access control. The issue was addressed in version 3.11.7, which was released on March 22. Successful exploitation of the high-severity flaw enables an authenticated attacker to take over a WordPress site with WooCommerce enabled. After doing so, a malicious user can set the default user role to administrator, creating an account that has administrator privileges. The attackers are also likely to redirect the site to a malicious domain or upload a malicious plugin or backdoor to further exploit the site. Users are urged to update to 3.11.7 or 3.12.0.

WordPress is one of the most popular Content Management Systems (CMS) used by millions of websites worldwide. However, it is also one of the most targeted platforms for cyber-attacks. While WordPress is a powerful and flexible platform, it requires careful maintenance and attention to security best practices to keep it secure. nGuard commonly tests WordPress sites during external penetration testing, continuously monitors them with ongoing vulnerability management scans, and collecting logs through our managed event collection and correlation service. Regular penetration testing and vulnerability scanning, and log analysis can help ensure the ongoing security and integrity of a WordPress site, protecting against data breaches, financial losses, and reputational damage.

Microsoft Taking Down Illegal Versions of Cobalt Strike

Microsoft’s Digital Crimes Unit and the Health Information Sharing & Analysis Center have taken legal action to seize domains related to criminal activity involving cracked copies of the security testing application, Cobalt Strike. In January of 2021, nGuard wrote a detailed advisory on what Cobalt Strike is and what it is capable of. The tool is often abused by cybercriminals to carry out attacks ranging from financially motivated cybercrime to high-end state-aligned attacks. The court order names a range of entities and groups the companies allege misuse their technologies, including the LockBit and Conti ransomware groups, as well as a series of cybercrime operations. The legal order targets 16 anonymous “John Doe” actors engaged in a range of criminal behavior, from ransomware activity to malware distribution and development. This action builds on Microsoft’s pioneering use of domain seizure to disrupt the technical infrastructure malicious hackers rely on. It is likely only a first step to challenge illicit use of the hacking tool, as malicious actors will likely be able to retool their infrastructure. To simulate the same attacks executed by these malicious groups, nGuard’s Red Team Testing also uses tools like Cobalt Strike on network and system defenses. Having a Red Team assessment conducted will help enable better security by allowing your security teams to identify vulnerabilities and improve their defenses against potential attacks.

Beware: New Zero-Touch Exploit Targeting Microsoft Outlook Users

Microsoft Outlook users should be aware of a new critical vulnerability that has been discovered by Microsoft Threat Intelligence analysts. CVE-2023-23397 is a privilege elevation/authentication bypass vulnerability that affects all versions of Outlook for Windows. The vulnerability has a 9.8 CVSS rating and is considered a zero-touch exploit, meaning that it requires low complexity to abuse and does not require any user interaction.

According to security researchers, threat actors are exploiting this vulnerability by sending malicious emails, which do not even need to be opened. The vulnerability is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB share on a threat actor-controlled server on an untrusted network.

The attacker remotely sends a malicious calendar invite represented by .msg — the message format that supports reminders in Outlook — to trigger the vulnerable API endpoint PlayReminderSound using “PidLidReminderFileParameter” (the custom alert sound option for reminders).

Once the victim connects to the attacker’s SMB server, the connection to the remote server sends the user’s NTLM negotiation message automatically, which the attacker can use for authentication against other systems that support NTLM authentication. This could result in a NTLM relay attack to gain access to other services or even a full compromise of domains if the compromised users are admins.

It is important to note that all supported versions of Microsoft Outlook for Windows are affected by this vulnerability. Other versions of Microsoft Outlook, such as Android, iOS, Mac, as well as Outlook on the web and other M365 services, are not affected as they do not support NTLM authentication.

Security experts are warning that this vulnerability is trivial to deploy and “will likely be leveraged imminently by actors for espionage purposes or financial gain.” The earliest evidence of exploitation, attributed to Russian military intelligence, dates back to April 2022 against government, logistics, oil/gas, defense, and transportation industries located in Poland, Ukraine, Romania, and Turkey.

To mitigate the risk of exploitation, Microsoft has released a patch as part of their March 2023 Monthly Security Update, and users are advised to apply the patch immediately. Additionally, security administrators can reduce the risk of exploitation by blocking TCP 445/SMB outbound from their network, disabling the WebClient service, adding users to the Protected Users Security Group, and enforcing SMB signing on clients and servers to prevent a relay attack.

If you are concerned about your organization’s security, we recommend running the Microsoft-provided PowerShell script to scan emails, calendar entries, and task items for the “PidLidReminderFileParameter” property. This will help you locate problematic items that have this property and subsequently remove or delete them permanently.

In light of this critical vulnerability, it is important for organizations to take proactive measures to safeguard their systems and data. nGuard offers a range of cybersecurity services that can help organizations stay ahead of emerging threats like CVE-2023-23397. Our Penetration Testing services can help identify vulnerabilities in your systems and provide recommendations for patching and securing them. Our Strategic Assessment services can assist with patch management, ensuring that your systems are up to date with the latest security patches and updates. Don’t wait until it’s too late to protect your organization from cyber threats. Contact nGuard today to learn how we can help you secure your systems and data.

TWiC | U.S. House Data Leak, ICS Attacks, FortiOS Vulnerability, Cyber Insurance

FBI Investigating Data Breach Affecting U.S. House of Representatives Members and Staff

The Federal Bureau of Investigation (FBI) is investigating a data breach affecting members and staff of the U.S. House of Representatives. The breach saw account and sensitive personal information belonging to them and their families stolen from the servers of DC Health Link, which administers their health care plans.

While US House Chief Administrative Officer Catherine L. Szpindor has said, “it was unclear how many people had been affected by the breach.” A sample of the data reportedly posted on a hacking forum showed details of around 170,000 people. The information included names, dates of birth, addresses, email addresses, phone numbers, and Social Security numbers. At least one threat actor has reportedly put the data up for sale.

nGuard’s MECC (Managed Event Collection and Correlation) can help protect against malicious attacks by collecting and analyzing log data from various sources. MECC can then alert security teams to potential threats and provide them with the information they need to investigate and respond to an ongoing or potential attack. Should your organization fall victim to an attack like this, call nGuard to help with our Cyber Security Incident Response services.

New FortiOS and FortiProxy Critical Vulnerabilities

Fortinet has released patches to address 15 security flaws, including one critical vulnerability in FortiOS and FortiProxy that could allow an attacker to take control of affected systems. The buffer underwrite flaw (CVE-2023-25610) is rated 9.3 out of 10 for severity and was discovered by Fortinet’s internal security teams. The vulnerability could enable a remote, unauthenticated attacker to execute arbitrary code on the device or cause a denial-of-service attack. Fortinet has not yet seen any malicious exploitation attempts against the flaw, but users are urged to apply the patches quickly, as prior flaws in software have been actively abused in the wild. Workarounds include disabling the HTTP/HTTPS administrative interface or limiting IP addresses that can reach it. Just last week, nGuard wrote about another Fortinet critical vulnerability that was actively being exploited. As this continues to develop, nGuard has a number of solutions that can help your organization stay ahead of the curve, including internal penetration testing and vulnerability management.

Over 40% of Industrial Control Systems (ICS) Were Attacked in 2022

Over 40% of industrial control systems (ICS) computers globally experienced malicious attacks in 2022, according to Kaspersky research into telemetry statistics. The report highlighted growth in Russia, which saw a 9% increase in malicious activity in 2022, but Ethiopia was the top target overall with 59% of its ICS footprint seeing malicious activity.

Kaspersky noted that blocked malicious scripts and phishing pages targeting ICS were particularly common threats, seeing an 11% rise from 2021. The percentage of ICS computers experiencing malicious activity varied from 40.1% in Africa and Central Asia to 14.2% and 14.3% respectively in Western and Northern Europe. nGuard has been helping protect Industrial control systems, SCADA networks, and critical infrastructure for over 20 years with security assessments, penetration testing, incident response, and managed SIEM services.

Low-coverage Cyber Insurance Plans Help Meet Compliance and Contractual Requirements

As the cyber insurance market experiences a surge in claims for ransomware attacks, insurance carriers and brokers have started imposing tighter rules on the companies that can qualify for coverage, raising prices and reducing the amount of coverage offered per policy. nGuard recently wrote about requirements needed to obtain cyber insurance. Policy coverages have significantly dropped in recent times, with some as low as $5m, and some companies cannot purchase as much insurance as they would like. However, some contracts and compliance regulations require that a company have a cyber insurance policy, which can pose a problem for those that lose coverage. Basic policies are now available for more organizations to obtain affordable coverage, allowing them to avoid a breach of compliance and fulfill contractual obligations.

Attacking FortiNAC Devices: Experts Advise Updating

A serious vulnerability in Fortinet’s FortiNAC network access control suite (CVE-2022-39952) is now being exploited by hackers to add a cron job that starts a reverse shell on vulnerable systems as the root user. This unauthenticated file path modification vulnerability poses a major security risk for enterprises using the FortiNAC solution because it may be used to execute commands remotely.

Fortinet has already released security upgrades to remedy the issue, and has recommended that users update susceptible appliances to the most recent versions. As the corporation hasn’t offered any mitigation advice or workarounds, updating is the only option to prevent attacks. Researchers from cybersecurity firms, including Shadowserver Foundation, GreyNoise, and CronUp, have recently observed attacks on CVE-2022-39952 from a variety of IP addresses. This indicates that attackers have already started focusing on unpatched FortiNAC devices.

Horizon3 security researchers have created proof-of-concept (PoC) exploit code which allows hackers to add a cron task that starts a reverse shell on vulnerable systems. Fortinet had previously issued a warning in December 2022 to customers to patch FortiOS SSL-VPN appliances against an actively exploited security flaw (CVE-2022-42475), which was also used as a zero-day in attacks against targets associated with the government.

In reaction to what it called “sensationalized claims” about recent exploitation attempts aimed at a vulnerability in its FortiNAC network access control product, Fortinet has offered some crucial clarifications. The company emphasized that it is yet unclear how exploiting CVE-2022-39952 will actually affect users. However, FortiNAC users should be aware of the possible hazard, as knowledgeable threat actors have been known to attack Fortinet products.

FortiNAC administrators are highly advised to update their software right away to a version of the software that is not impacted by the CVE-2022-39952 vulnerability. This includes FortiNAC versions 9.4.1 or later, 9.2.6 or later, 9.1.8 or newer, and 7.2.0 or later. Organizations may stop hackers from using this important vulnerability to gain access to their corporate networks by heeding this advice.

At nGuard, we understand the importance of proactive security measures to protect our clients from the evolving threat landscape. That’s why we offer a range of security services designed to help detect vulnerabilities like the FortiNAC vulnerability, including internal penetration testing, vulnerability management, and strategic security assessments. Our team of experts can work with clients to develop and implement policies and procedures to ensure they can quickly identify and address security threats, and stay up-to-date on emerging vulnerabilities through our security advisories. By partnering with nGuard, clients can rest assured that they have access to the latest security technologies and expertise to help them stay one step ahead of the threats.

Are You Prepared for the New Cyber Insurance Requirements?

As cyberattacks increase worldwide, insurance companies are tightening their cyber insurance policy requirements. This is due to the 80% rise in ransomware attacks last year, leading to a large number of claims. Among the new provisions are the requirement for multi-factor authentication (MFA) for all admin access and the protection of all privileged accounts. However, identifying gaps in MFA and privileged account protection within a network can be challenging for organizations. In addition to MFA, there are several other requirements that stipulate detailed attestation when filling out a cyber policy questionnaire. A few of those requirements are:

Security Awareness Training and Testing
This process is designed to educate employees on cyber security threats and risks, and to test their understanding of these issues through interactive simulations and assessments. The goal is to raise awareness, increase knowledge, and promote safe online behavior within an organization. To reduce your risk of phishing attacks, nGuard has been conducting Security Awareness Training and phishing testing though our Social Engineering Assessment for years.
Vulnerability Management
A thorough vulnerability management program will identify, assess, and prioritize vulnerabilities in an organization’s systems and networks, and take action to remediate or mitigate these risks to prevent exploitation. This helps maintain the security and integrity of systems and data by staying on top of vulnerabilities as they are discovered. Conducting monthly or quarterly vulnerability scans on an ongoing basis will not only help meet insurance requirements but also keep your network secure. nGuard’s Vulnerability Management can help you manage your external environment, internal environment, and meet PCI requirements with ASV scanning.
24/7/365 Monitoring
A Security Information and Event Management (SIEM) system collects and aggregates log data from various sources within an organization and uses analytics and threat detection techniques to identify potential security incidents and enable security teams to respond promptly. SIEM provides centralized security visibility and event correlation. nGuard’s managed security team performs both manual and automated daily log analysis that proactively detects suspicious activity in your environment with our managed SIEM service called Managed Event Collection & Correlation. nGuard is adding artificial intelligence and machine learning to detect and respond to security threats in real-time via UEBA (User and Entity Behavior Analytics).
Secured, Encrypted, Offsite Backups
Offsite backups refer to the storage of backup data at a remote location, typically in a secure data center, separate from the primary data storage. This helps ensure that the data can be recovered in case of a disaster or cyberattack and protected against data loss while minimizing downtime. Offsite backups are an important component of a comprehensive disaster recovery plan. A Strategic Security Assessment utilizing the Center for Internet Security (CIS) 18 Critical Security Controls as the foundation can help bring the lack of controls like this and others to light.
Endpoint Detection & Response (EDR)
This real-time security solution will monitor and respond to security threats on endpoint devices such as computers and servers using artificial intelligence and machine learning to detect and isolate security incidents.

As insurance carriers adjust the requirements to obtain and maintain coverage, a thorough assessment can help organizations identify and close security gaps to help meet the new cyber insurance requirements and improve their overall security posture. nGuard has a number of solutions that can help meet and exceed the requirements needed to obtain and maintain cyber insurance.

TWiC | ChatGPT, New CISA and NSA Advisory, Microsoft Blocking Add-ins, New Malware Using Google Ads

The nGuard Security Advisory for this week covers several important topics related to cyber security threats. The Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) have issued warnings that remote desktop tools are being used to breach US federal agencies; ChaptGPT being used to create malicious output; Microsoft is set to block Excel add-ins that have been used for office exploits; and a new malware called “Rhadamanthys” has been discovered that uses Google Ads to redirect users to fake software downloads.

CISA & NSA Warn Remote Desktop Tools Are Being Used to Breach US Federal Agencies

The Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) have issued a joint advisory warning that financially motivated hackers have compromised federal agencies using legitimate remote desktop software. The hackers used phishing emails to lure victims to a malicious site that impersonated high-profile companies, including Microsoft and Amazon, and prompted the victims to call the hackers who then tricked employees into visiting the malicious domain. This led to the download of legitimate remote access software which the hackers then used in a refund scam to steal money from victims’ bank accounts. CISA also warned that the attackers could use legitimate remote access software as a backdoor for maintaining persistent access to government networks.

nGuard often can obtain remote access to victim’s computers using legitimate remote access tools like TeamViewer. nGuard’s Social Engineering assessment could help prevent these types of attacks by testing an organization’s resistance to phishing and other types of social engineering tactics.

ChaptGPT Malicious Prompt Engineering

OpenAI’s ChatGPT, a large-scale AI-based natural language generator, was released in late 2022 and has demonstrated the potential of AI for both good and bad. ChatGPT is a chatbot that is built on top of OpenAI’s GPT-3 family of large language models. It is designed to respond to prompts with accurate and unbiased answers. However, the concept of ‘prompt engineering’ has been used to manipulate the system and force it to respond in a specific manner desired by the user. This has led to the malicious potential of social engineering. A Finnish security firm recently published an extensive and serious evaluation of prompt engineering against ChatGPT, focusing on the generation of phishing, various types of fraud, and misinformation. They found they were able to quickly create convincing phishing emails that were well written and free of typos and grammatical errors. They also were able to create writing styles to match a given input which could lead to ‘deep fakes’ impersonating someone’s writing style. Last, they were able to make requests that forced ChatGPT to transfer their opinion within the response. The idea of prompt engineering is something still not fully understood but certainly has shown the power of a tool like ChatGPT can have.

nGuard’s MECC (Managed Event Collection and Correlation) can help protect against malicious ChatGPT attacks by collecting and analyzing log data from various sources, including chatbot interactions. MECC can then alert security teams to potential threats and provide them with the information they need to investigate and respond to the attack. Additionally, nGuard is adding UEBA (User and Entity Behavior Analytics) to its MECC solution. UEBA leverages AI and Machine Learning to help protect against malicious ChatGPT attacks by analyzing user behavior and identifying anomalies that may indicate a security incident. This can include detecting when a user or bot is attempting to access sensitive information or perform unauthorized actions. UEBA can then alert security teams to potential threats and provide them with the information they need to investigate and respond to the attack. Additionally, UEBA can also help to detect compromised user account and bot impersonation.

Microsoft Set to Block Excel Add-in Used for Office Exploits

Microsoft is set to block XLL files from the internet in a bid to prevent cyber attackers from exploiting the “add-ins” function of Excel to run malicious code on a victim’s computer. An XLL file is an Excel Dynamic Link Library, a type of Microsoft Excel add-in used to extend the functionality of the spreadsheet software. XLL files contain custom functions and macros written in C or C++, and can be used to perform tasks that are not possible with the built-in Excel functions. The feature, set to be released in March, is a response to an increasing use of XLL files by attackers which offer a way to read and write data within spreadsheets, add custom functions and interact with Excel objects across platforms. However, experts have said that the feature may not be effective if users ignore the warning that XLL files could contain malicious code, and attackers are likely to continue to find new ways to compromise systems.

nGuard’s Security Awareness Training services can help with this threat by educating employees on how to identify and avoid phishing attempts, both in the form of emails and websites. The training can cover topics such as how to spot suspicious emails, what to look for in a legitimate and illegitimate website, and how to recognize the signs of a phishing attempt.

Rhadamanthys Malware Using Google Ads to Redirect to Fake Software Downloads

A new malware strain called “Rhadamanthys Stealer” is being spread by redirects from Google Ads that pretend to be download sites for popular remote-workforce software, such as Zoom and AnyDesk. The malware is sold on the dark web as malware-as-a-service and is spread through two methods: carefully crafted phishing sites, and phishing emails with malicious attachments. The malware can steal sensitive data such as browser history and account login credentials, including crypto-wallet information. It is also able to detect if it is running in a controlled environment and will terminate its execution if so. As mentioned earlier in this Advisory, nGuard’s Social Engineering assessment and Security Awareness training can prepare your organization and employees for these types of attacks. Help your organization stay vigilant against the latest attack vectors and keeping up to date by assessing your employees and organization on an annual basis at a minimum.