Chaos malware targets windows and linux, exchange zero days remain unpatched, ransomware is
targeting schools, and the giveaway winner announcement!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for October 4 2022 - this is your summary
of the threats to our security, privacy and Internet freedom.
Let’s jump right into the news this week.
A new botnet is currently infecting both Windows and Linux PCs and devices like servers and
home or office routers to launch DDoS attacks and use them for cryptomining.
It spreads by searching for unpatched security vulnerabilities and using stolen SSH keys
to brute force it’s way into targets and begin IP spoofing.
The botnet is called Chaose and is based on Go, Google’s open source programming language.
It could infect a variety of devices, though, spanning from x86 and ARM based products to
PowerPC and MIPS.
Chaos infects a devices, gains persistence, and starts reaching out to it’s command
server for continued commands, eventually initiating cryptomining and using the device
for DDoS attacks.
Security researchers at Lumen’s Black Lotus Labs discovered Chaos.
They analyzed samples found online to give some background on the malware, saying that
it is written in Chinese, using Chinese based C2 infrastructure and hitting several industries,
including gaming, financial, technology, and entertainment industries.
It was first discovered in April but continues to spread.
Black Lotus Labs suspects this is an iteration of Kaiji malware, which was also capable of
similar attacks.
The samples obtained were found to include specific CVEs for Huawei and Zyxel but the
researchers note that the list of CVEs exploited could easily be updated to include more known
vulnerabilities.
The researchers recommend network admins monitor for suspicious connections, use the IOCs available
via Github to track any activity, and block the C2 servers from being able to communicate
with any potentially infected devices.
Since the botnet uses vulnerabilities to spread, keep devices updated and patched as soon as
possible and change any default passwords.
About 3 weeks ago a Vietnamese cybersecurity company disclosed two security flaws to Microsoft
through the Zero Day Initiative program, which impact Microsoft Exchange and are tracked
as CVE-2022-41040 and CVE-2022-41082 and nicknamed ProxyNotShell.
The company, GTSC, publicly disclosed the issues last week.
At the time, Microsoft confirmed the vulnerabilities exist, and awareness of targeted attacks in
the wild, with attackers chaining the flaws together to hit Exchange servers with remote
code execution attacks.
Microsoft also noted that threat actors had already used the two vulnerabilities to breach
servers of around 10 organizations in August 2022.
It could affect up to 220,000 servers around the world.
Microsoft shared mitigations for the two issues, recommending customers disable PowerShell
remote access for non-admins, and blocking the known attack pattern through the IIS Manager.
Alternatively, admins can run the Exchange On Premises Mitigation Tool made by Microsoft,
but this also requires PowerShell 3, with admin privileges, running on IIS 7.5 or higher.
Unfortunately though, the mitigation technique can be bypassed because it only covers known
attacks with a known URL pattern.
Due to the mitigation being so specific in their URL block, experts found this was insufficient
in protecting against the attacks and offered an updated option that can cover a broader
attack surface.
Microsoft hasn’t posted an update at time of recording but the CVEs are listed as high
severity since they can be used for privilege escalation and remote code execution.
Both require authentication as a standard user but that could easily be done with password
spraying.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to my newest patrons including Derrick for joining the alliance on Patreon.com/threatwire.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
Don't forget to like and subscribe to Hak5 as well!
We have a winner for the Wifi Pineapple Enterprise Edition!!!
Out of hundreds of comments on the last ThreatWire episode, our winner is Norman Lyon, who posted
this comment.
Congrats, Norman!
Please check my reply to your comment for directions on how to receive your prize.
You must respond by Oct 10 or a new winner will be chosen.
Thank you for entering and everyone, stick around for future giveaways!
Let’s finish out today’s episode with my last top story, about ransomware targeting
schools!
Earlier this month the Los Angeles Unified School District was hit with a ransomware
attack, and on Friday, stated they would not be paying the ransom as the district could
use the money for education or their students rather, since paying a ransom never guarantees
the data will actually be fully recovered.
The group behind the attack, Vice Society, leaked the data publicly via their data leaking
site including a message to the US Cybersecurity and Infrastructure Agency, saying the feds
wasted their time.
Vice Society had previously told journalists they’d stolen 500 GB of data but didn’t
provide any evidence of this until now.
The leak is concerning.
Some of the data pertains to folders that may be sensitive in nature, such as personally
identifiable data on students, and psychological assessments, legal documents, and business
records.
LAUSD responded by saying they’d notify affected individuals and would offer free
credit monitoring.
The superintendent confirmed the data leak via Twitter, saying they were partnered with
law enforcement and were analyzing the data.
Schools continue to be targeted, with this same ransomware group also targeting at least
8 other school districts and universities.
According to a report by Motherboard, many schools haven’t disclosed how they deal
with attacks, turning down Freedom of Information requests by citing state laws, making it harder
to understand how schools are protecting against ransomware attacks.
Experts recommend schools use cloud hosted systems and system backups for quick restoration
purposes.
Having backups on a second network can also remediate a potential attack.
I'm Shannon Morse, I'll see you on the Internet!