Oktacron - Cyber Security RSS Feeds History

Follina (CVE-2022-30190): a vulnerability in MSDT | Kaspersky official blog

kaspersky May 31, 2022 Business

Researchers have discovered another serious vulnerability in Microsoft products that potentially allows attackers to execute arbitrary code. MITRE designated this vulnerability as CVE-2022-30190, while researchers somewhat poetically named it Follina. The most disturbing thing is that there is no fix for this bug yet. show more ...

Whats even worse, the vulnerability is already being actively exploited by cybercriminals. While the update is under development, all Windows users and administrators are advised to use temporary workarounds. What is CVE-2022-30190 and what products does it affect The CVE-2022-30190 vulnerability is contained in the Microsoft Windows Support Diagnostic Tool (MSDT) which doesnt sound like a big deal. Unfortunately, due to the implementation of this tool, the vulnerability can be exploited via a malicious office document. MSDT is an application that is used to automatically collect diagnostic information and send it to Microsoft when something is going wrong with Windows. The tool can be called from another applications (Microsoft Word being the most popular example) through the special MSDT URL protocol. If the vulnerability is successfully exploited, an attacker is able to run arbitrary code with the privileges of the application that called the MSDT — that is, in this case, with the rights of the user who opened the malicious file. Vulnerability CVE-2022-30190 can be exploited in all operating systems of the Windows family, both desktop and server. How attackers exploit CVE-2022-30190 As a demonstration of the attack, the researchers describe the following scenario. Attackers create a malicious office document and slip it to the victim. The most common way to do this is to send an e-mail with a malicious attachment, spiced up with some classic social engineering ploy to convince the recipient to open the file. Something like Urgently check the contract, signing tomorrow morning can easily do the trick. The infected file contains a link to an HTML file that contains JavaScript code that executes malicious code in the command line via MSDT. As a result of successful exploitation, the attackers can install programs, view, modify or destroy data, as well as create new accounts — that is, do everything that is possible with the victims privileges in the system. How to stay safe As mentioned at the beginning, there is no patch yet. To counteract, Microsoft recommends disabling the MSDT URL protocol. To do this, you need to run a command prompt with administrator rights and execute the command reg delete HKEY_CLASSES_ROOTms-msdt /f. Before doing this, it would be useful to back up the registry by executing reg export HKEY_CLASSES_ROOTms-msdt filename. This way you can quickly restore the registry with the reg import filename command as soon as this workaround is no longer needed, Of course, this is only a temporary measure and you should install an update that closes the Follina vulnerability as soon as it becomes available. The described methods of exploiting this vulnerability involve the use of e-mails with malicious attachments and social engineering methods. Therefore we recommend to be even more careful than usual with e-mails from unknown senders, especially with attached MS Office documents. For companies it makes sense to regularly raise employee awareness about most relevant hackers tricks. In addition, all devices with an Internet access should be equipped with robust security solutions. Even when someone is exploiting an unknown vulnerability, such solutions can prevent malicious code from running on a users machine.

Costa Rica May Be Pawn in Conti Ransomware Group’s Bid to Rebrand, Evade Sanctions

krebsonsecurity May 31, 2022 A Little Sunshine

Costa Rica’s national health service was hacked sometime earlier this morning by a Russian ransomware group known as Hive. The intrusion comes just weeks after Costa Rican President Rodrigo Chaves declared a state of emergency in response to a data ransom attack from a different Russian ransomware gang — show more ...

Conti. Ransomware experts say there is good reason to believe the same cybercriminals are behind both attacks, and that Hive has been helping Conti rebrand and evade international sanctions targeting extortion payouts to cybercriminals operating in Russia. The Costa Rican publication CRprensa.com reports that affected systems at the Costa Rican Social Security Fund (CCSS) were taken offline on the morning of May 31, but that the extent of the breach was still unclear. The CCSS is responsible for Costa Rica’s public health sector, and worker and employer contributions are mandated by law. The fallout from this latest attack is not yet clear, but it is likely to be disruptive: A hand-written sign posted outside a public health center in Costa Rica today explained that all systems are down until further notice (thanks to @Xyb3rb3nd3r for sharing this photo). A hand-written notice posted outside a public health clinic today in Costa Rica warned of system outages due to a cyberattack on the nation’s healthcare systems. The message reads: “Dear Users: We would like to inform you that due a problem related to the information systems of the institution, we are unable to expend any medicine prescriptions today until further notice. Thank you for your understanding- The pharmacy.” Esteban Jimenez, founder of the Costa Rican cybersecurity consultancy ATTI Cyber, told KrebsOnSecurity the CCSS suffered a cyber attack that compromised the Unique Digital Medical File (EDUS) and the National Prescriptions System for the public pharmacies, and as a result medical centers have turned to paper forms and manual contingencies. “Many smaller health centers located in rural areas have been forced to close due to not having the required equipment or communication with their respective central health areas and the National Retirement Fund (IVM) was completely blocked,” Jimenez said. “Taking into account that salaries of around fifty thousand employees and deposits for retired citizens were due today, so now the payments are in danger.” Jimenez said the head of the CCSS has addressed the local media, confirming that the Hive ransomware was deployed on at least 30 out of 1,500 government servers, and that any estimation of time to recovery remains unknown. He added that many printers within the government agency this morning began churning out copies of the Hive ransom note. Printers at the Costa Rican government health ministry went crazy this morning after the Hive ransomware group attacked. Image: Esteban Jimenez. “HIVE has not yet released their ransom fee but attacks are expected to follow, other organizations are trying to get a hold on the emergency declaration to obtain additional funds to purchase new pieces of infrastructure, improve their backup structure amongst others,” Jimenez said. A copy of the ransom note left behind by the intruders and subsequently uploaded to Virustotal.com indicates the CCSS intrusion was the work of Hive, which typically demands payment for a digital key needed to unlock files and servers compromised by the group’s ransomware. A HIVE ransomware chat page for a specific victim (redacted). On May 8, President Chaves used his first day in office to declare a national state of emergency after the Conti ransomware group threatened to publish gigabytes of sensitive data stolen from Costa Rica’s Ministry of Finance and other government agencies. Conti initially demanded $10 million, and later doubled the amount when Costa Rica refused to pay. On May 20, Conti leaked more than 670 gigabytes of data taken from Costa Rican government servers. As CyberScoop reported on May 17, Chaves told local media he believed that collaborators within Costa Rica were helping Conti extort the government. Chaves offered no information to support this claim, but the timeline of Conti’s descent on Costa Rica is worth examining. Most of Conti’s public communications about the Costa Rica attack have very clearly assigned credit for the intrusion to an individual or group calling itself “unc1756.” In March 2022, a new user by the same name registered on the Russian language crime forum Exploit. A message Conti posted to its dark web blog on May 20. On the evening of April 18, Costa Rica’s Ministry of Finance disclosed the Conti intrusion via Twitter. Earlier that same day, the user unc1756 posted a help wanted ad on Exploit saying they were looking to buy access to “special networks” in Costa Rica. “By special networks I mean something like Haciendas,” unc1756 wrote on Exploit. Costa Rica’s Ministry of Finance is known in Spanish as the “Ministerio Hacienda de Costa Rica.” Unc1756 said they would pay $USD 500 or more for such access, and would work only with Russian-speaking people. THE NAME GAME DISTRACTION Experts say there are clues to suggest Conti and Hive are working together in their attacks on Costa Rica, and that the intrusions are tied to a rebranding effort by Conti. Shortly after Russia invaded Ukraine at the end of February, Conti declared its full support, aligning itself directly with Russia and against anyone who would stand against the motherland. Conti’s threatening message this week regarding international interference in Ukraine. Conti quickly deleted the declaration from its website, but the damage had already been done, and any favor or esteem that Conti had earned among the Ukrainian cybercriminal underground effectively evaporated overnight. Shortly thereafter, a Ukrainian security expert leaked many months worth of internal chat records between Conti personnel as they plotted and executed attacks against hundreds of victim organizations. Those candid messages exposed what it’s like to work for Conti, how they undermined the security of their targets, as well as how the group’s leaders strategized for the upper hand in ransom negotiations. But Conti’s declaration of solidarity with the Kremlin also made it increasingly ineffective as an instrument of financial extortion. According to cyber intelligence firm ADVIntel, Conti’s alliance with the Russian state soon left it largely unable to receive ransom payments because victim companies are being advised that paying a Conti ransom demand could mean violating U.S. economic sanctions on Russia. “Conti as a brand became associated with the Russian state — a state that is currently undergoing extreme sanctions,” ADVIntel wrote in a lengthy analysis (PDF). “In the eyes of the state, each ransom payment going to Conti may have potentially gone to an individual under sanction, turning simple data extortion into a violation of OFAC regulation and sanction policies against Russia.” Conti is by far the most aggressive and profitable ransomware group in operation today. Image: Chainalysis ADVIntel says it first learned of Conti’s intrusion into Costa Rican government systems on April 14, and that it has seen internal Conti communications indicating that getting paid in the Costa Rica attack was not the goal. Rather, ADVIntel argues, Conti was simply using it as a way to appear publicly that it was still operating as the world’s most lucrative ransomware collective, when in reality the core Conti leadership was busy dismantling the crime group and folding themselves and top affiliates into other ransomware groups that are already on friendly terms with Conti. “The only goal Conti had wanted to meet with this final attack was to use the platform as a tool of publicity, performing their own death and subsequent rebirth in the most plausible way it could have been conceived,” ADVIntel concluded. ADVIntel says Conti’s leaders and core affiliates are dispersing to several Conti-loyal crime collectives that use either ransomware lockers or strictly engage in data theft for ransom, including AlphV/BlackCat, AvosLocker, BlackByte, HelloKitty, Hive, and Karakurt. Still, Hive appears to be perhaps the biggest beneficiary of any attrition from Conti: Twice over the past week, both Conti and Hive and claimed responsibility for hacking the same companies. When the discrepancy was called out on Twitter, Hive updated its website to claim it was not affiliated with Conti. Conti and Hive’s Costa Rican exploits mark the latest in a string of recent cyberattacks against government targets across Latin America. Around the same time it hacked Costa Rica in April, Conti announced it had hacked Peru’s National Directorate of Intelligence, threatening to publish sensitive stolen data if the government did not pay a ransom. But Conti and Hive are not alone in targeting Latin American victims of late. According to data gathered from the victim shaming blogs maintained by multiple ransomware groups, over the past 90 days ransom actors have hacked and sought to extort 15 government agencies in Brazil, nine in Argentina, six in Colombia, four in Ecuador and three in Chile. A recent report (PDF) by the Inter-American Development Bank suggests many Latin American countries lack the technical expertise or cybercrime laws to deal with today’s threats and threat actors. “This study shows that the Latin American and Caribbean (LAC) region is not sufficiently prepared to handle cyberattacks,” the IADB document explains. “Only 7 of the 32 countries studied have a critical infrastructure protection plan, while 20 have established cybersecurity incident response teams, often called CERTs or CSIRTs. This limits their ability to identify and respond to attacks.”

SideWinder Hackers Launched Over a 1,000 Cyber Attacks Over the Past 2 Years

cyware May 31, 2022 Threat Actors

Kaspersky's APT trends report for Q1 2022 published late last month revealed that the threat actor is actively expanding the geography of its targets beyond its victim profile to other countries and regions, including Singapore.

Turkey's Pegasus Airlines Exposes Flight and Crew Information in 6.5TB Leak

cyware May 31, 2022 Breaches and Incidents

Aside from the potential privacy implications for crew members, SafetyDetectives speculated that the leak may have given malicious actors access to highly sensitive information.

REvil prosecutions reach a 'dead end,' Russian media reports

cyware May 31, 2022 Incident Response, Learnings

The Russian government’s prosecution of the REvil suspects arrested in January has stalled due to a lack of U.S. cooperation, a lawyer for one of the suspects told a Russian media outlet Friday.

Microsoft shares mitigation for Office zero-day exploited in attacks

cyware May 31, 2022 Threat Intel & Info Sharing

Microsoft has shared mitigation measures to block attacks exploiting a newly discovered Microsoft Office zero-day flaw abused in the wild to execute malicious code remotely.

57% of all digital crimes in 2021 were scams

cyware May 31, 2022 Trends, Reports, Analysis

Scammers are now attracting specific groups of victims to increase conversion rates. Social media are more often becoming the first point of contact between scammers and their potential victims.

Australian digital driver's licenses hackable in minutes

cyware May 31, 2022 Malware and Vulnerabilities

An Australian digital driver's license (DDL) implementation that officials claimed is more secure than a physical license has been shown to easily defaced, but authorities insist the credential remains secure.

Global tech industry objects to India’s new infosec regime

cyware May 31, 2022 Laws, Policy, Regulations

Eleven significant tech-aligned industry associations from around the world have reportedly written to CERT-In to call for revision of the nation’s new infosec reporting and data retention rules.

Australia's National Disability Insurance Scheme Hit by Breach at Case Management System Provider

cyware May 31, 2022 Breaches and Incidents

CTARS, a Sydney-based software and analytics provider for the disability and care sectors, this week revealed an unauthorized third-party had gained access to its systems on May 15.

Microsoft is rolling out these security settings to protect millions of accounts

cyware May 31, 2022 Security Products & Services

Microsoft began rolling out security defaults to customers who created a new Azure AD tenant after October 2019, but didn't enable the defaults for customers that created Azure AD tenants prior to October 2019.

Hoxhunt Raises $40M in Series B Funding

cyware May 31, 2022 Companies to Watch

Hoxhunt, a Helsinki, Finland–based cybersecurity training platform provider, raised $40 million in Series B funding. The round was led by Level Equity Management, with participation from existing investor Icebreaker.vc.

Experts warn of ransomware attacks against government organizations of small states

cyware May 31, 2022 Trends, Reports, Analysis

The experts at Cyber Research Labs warn of ransomware attacks against government organizations. They observed a total of 48 government organizations from 21 countries that were hit by 13 ransomware attacks in 2022.

Singapore ups investment in quantum computing to stay ahead of security threats

cyware May 31, 2022 Innovation and Research

The Singapore government on Tuesday announced plans to set aside SG$23.5 million (US$17.09 million) to support three national platforms, parked under its Quantum Engineering Programme (QEP), for up to 3.5 years.

Anonymous Claims Attacks Against Belarus for Involvement in Russian Invasion of Ukraine

cyware May 31, 2022 Breaches and Incidents

Anonymous-affiliated collective Spid3r claims to have attacked Belarus’ government websites in retaliation for the country’s alleged support of Russia’s invasion of Ukraine.

Three Nigerian men arrested in INTERPOL Operation Killer Bee

cyware May 31, 2022 Incident Response, Learnings

The operation Killer Bee involved INTERPOL’s General Secretariat headquarters and National Central Bureaus (NCBs) and law enforcement agencies from 11 countries across Southeast Asia.

Italy warns organizations to brace for incoming DDoS attacks

cyware May 31, 2022 Threat Intel & Info Sharing

The type of cyberattack the Italian organization refers to is DDoS (distributed denial-of-service), which may not be catastrophic but can still cause damage, financial or otherwise, due to service outages and disruptions.

New XLoader Botnet Uses Probability Theory to Hide its Servers

cyware May 31, 2022 Malware and Vulnerabilities

Threat analysts have spotted a new version of the XLoader botnet malware that uses probability theory to hide its command and control servers, making it difficult to disrupt the malware's operation.

Malware Volumes Decline as Trojan Distribution Surges

cyware May 31, 2022 Trends, Reports, Analysis

Trojan families that affected users the most included Mobtes (44.35%), Piom (32.61%), and Boogr (14.32%). Iran at 35.25% stands as the most impacted country by mobile malware.

Key Trends in The Verizon Data Breach Investigation Report 2022

cyware May 31, 2022 Trends, Reports, Analysis

According to the report, ransomware attacks continue to mount pressure on organizations worldwide as researchers recorded a 13% increase in such attacks. While 40% of ransomware incidents were executed via desktop sharing software, 35% involved the use of email.

The Underground Company That Hacks iPhones For Ordinary Consumers

packetstormsecurity May 31, 2022 headline,hacker,phone,flaw,apple

Australian Digital Driving Licenses Can Be Defaced In Minutes

packetstormsecurity May 31, 2022 headline,government,australia,flaw,ident

Russia Nixes US Charges Against REvil As Cooperation Fizzles

packetstormsecurity May 31, 2022 headline,hacker,government,malware,usa,r

Guardian Launches Tor Onion Service

packetstormsecurity May 31, 2022 headline,privacy,cryptography

Germany Issues Fresh Warning To Banks Of Cyber Attacks Due To Ukraine War

packetstormsecurity May 31, 2022 headline,hacker,bank,russia,cyberwar,ger