NormCyber Threat Bulletin - 24th July 2024

The set of 13 vulnerabilities included 8 which were deemed Critical in severity according to the CVSS scoring assigned to them, carrying scores from 9.6 – 10. The rest of the vulnerabilities were still of concern, carrying a severity rating of High, with the scores ranging from 7.6 to 8.3. The 8 Critical flaws can be seen below:

CVE-2024-23472 – SolarWinds ARM Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability
CVE-2024-28074 – SolarWinds ARM Internal Deserialization Remote Code Execution Vulnerability
CVE-2024-23469 – Solarwinds ARM Exposed Dangerous Method Remote Code Execution Vulnerability
CVE-2024-23475 – Solarwinds ARM Traversal and Information Disclosure Vulnerability
CVE-2024-23467 – Solarwinds ARM Traversal Remote Code Execution Vulnerability
CVE-2024-23466 – Solarwinds ARM Directory Traversal Remote Code Execution Vulnerability
CVE-2024-23470 – Solarwinds ARM UserScriptHumster Exposed Dangerous Method Remote Command Execution Vulnerability
CVE-2024-23471 – Solarwinds ARM CreateFile Directory Traversal Remote Code Execution Vulnerability

If a threat actor can successfully exploit these vulnerabilities, they will be able to read and delete files, and execute arbitrary code with elevated permissions. These vulnerabilities have been addressed in Version 2024.3 on 17^th July 2024 following a responsible disclosure from the Trend Micro Zero Day Initiative (ZDI).

This development comes shortly after CISA added a high-severity path traversal flaw in SolarWinds Serv-U Path to it’s Known Exploited Vulnerabilities list. This vulnerability was tracked as CVE-2024-28995 and was given a CVSS Score of 8.6. This was added due to reports of active exploitation in the wild.

By utilising Norm’s Vulnerability Patch Management module, customers can ensure they are protected against vulnerabilities disclosed via vendor bug bounty programs.

References:

SolarWinds Patches 8 Critical Flaws in Access Rights Manager Software (thehackernews.com)
Security Resources | SolarWinds Trust Center Security Advisories (solarwinds.com)
Cisco Warns of Critical Flaw Affecting On-Prem Smart Software Manager (thehackernews.com)

How Crowdstrike Made Global Industry Freeze

On the 19th of July 2024, a software update was released by Crowdstrike. It has subsequently caused global disruption and is now being coined the largest IT outage in history.

So what happened?

Crowdstrike is an American cyber security company, providing cyber attack response services, threat intelligence and end-point security. They released a sensor configuration update to Windows systems at 04:09 UTC on the 19th of July. This update triggered a logic error and caused a system crash and the Blue Screen of Death (BSOD) on affected systems.

Configuration files, also known as channel files, are routinely updated in response to new and emerging tactics. Within Windows systems they are found within the directory:

C:\Windows\System32\drivers\CrowdStrike\. On this occasion, the relevant channel file is 291. This file is responsible for controlling how the Falcon sensor evaluates named pipe execution on Windows systems.

A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. Named pipes can be used to provide communication between processes on the same computer or between processes on different computers across a network.

It is estimated that this outage has affected around 8.5 million Windows devices. The outage has greatly affected airports, rail networks, hospitals, the retail sectors, to name a few. However, the damage doesn’t stop there. An increase in phishing attempts has been observed due to the outage. The CEO of Crowdstrike, George Kurtz, and Government cyber security agencies across the world have warned individuals and businesses of the rise in malicious actors purporting to be Crowdstrike employees and technology specialists, offering services like recovery assistance.

References:

Helping our customers through the CrowdStrike outage – The Official Microsoft Blog
Technical Details: Falcon Update for Windows Hosts | CrowdStrike
CrowdStrike outage: Phishing jumps as scam artists exploit event | Fortune
From trains to retail, how CrowdStrike outage caused havoc across industries | Microsoft IT outage | The Guardian

New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns

MuddyWater, an Iranian threat group linked to the Ministry of Intelligence and Security (MOIS), has intensified its activities in Israel since the start of the Israel-Hamas war in October 2023. The group also targets organisations in Saudi Arabia, Turkey, Azerbaijan, India, and Portugal.

MuddyWater employs phishing campaigns using compromised email accounts, leading to the deployment of legitimate Remote Management Tools (RMM) like Atera Agent and Screen Connect.

Recently, they introduced a new, previously undocumented custom backdoor called BugSleep, specifically for targeting Israeli organisations.

BugSleep allows threat actors to execute commands and transfer files between compromised machines and the command-and-control (C&C) server.

The backdoor is still in development, with continuous improvements and bug fixes by the threat actors.

BugSleep Technical Analysis:

Delivery Mechanism:

MuddyWater primarily uses phishing campaigns to deliver BugSleep. They compromise legitimate email accounts and send malicious attachments or links to unsuspecting victims.
The malware is often disguised as legitimate files (e.g., PDFs, Word documents) or embedded within malicious URLs.

Infection Process:

When a victim opens the malicious attachment or clicks on the link, BugSleep is executed.
It establishes persistence by creating registry keys or scheduled tasks.
The malware also attempts to evade detection by using anti-analysis techniques (e.g., sandbox detection, anti-debugging).

Command-and-Control (C&C) Communication:

BugSleep communicates with its C&C server to receive commands and exfiltrate data.
It uses various protocols (HTTP, DNS, or custom protocols) to avoid detection.
Encrypted communication ensures stealthiness.

Capabilities:

BugSleep allows remote command execution on the compromised system.
It can upload/download files, execute shell commands, and manipulate processes.
The threat actors adapt its functionality based on their objectives.

Indicators of Compromise (IoCs):

Researchers have identified specific domains, IP addresses, and file hashes associated with BugSleep.
Organisations can use these IoCs to detect and block the malware.

Attribution:

MuddyWater’s motivation remains geopolitical, targeting organisations in Israel and other countries.
Attribution is challenging due to the group’s use of obfuscation techniques and infrastructure diversification.

References:

NEW BUGSLEEP BACKDOOR DEPLOYED IN RECENT MUDDYWATER CAMPAIGNS (research.checkpoint.com)
New BugSleep malware implant deployed in MuddyWater attacks (bleepingcomputer.com)
MuddyWater threat group deploys new malware ‘BugSleep’ (izoologic.com)