| New Threat Detection Added | 2 - FortiWLM Unauthenticated SQL Injection (CVE-2023-34991) and Operation Crimson Palace - XiebroC2 CnC |
| New Threat Protections | 178 |
Weekly Detected Threats
The following threats were added to Crystal Eye XDR this week:
Threat name: | FortiWLM Unauthenticated SQL Injection (CVE-2023-34991) | ||||||||||||||||||
Fortinet's Wireless LAN Manager (FortiWLM) has been found to contain several critical security vulnerabilities that could allow remote attackers to compromise the system fully. These vulnerabilities include unauthenticated command injection (CVE-2023-34993), unauthenticated SQL injection (CVE-2023-34991), and unauthenticated arbitrary file read (CVE-2023-42783). Exploiting these flaws could lead to unauthorised command execution, database manipulation, and access to sensitive files, respectively. FortiWLM is commonly deployed in large enterprise environments, making these vulnerabilities particularly concerning. Fortinet has released patches to address these issues, and it is strongly recommended that affected organisations apply these updates promptly. | |||||||||||||||||||
Threat Protected: | 1 | ||||||||||||||||||
Rule Set Type: |
| ||||||||||||||||||
Class Type: | Attempted-admin | ||||||||||||||||||
Kill Chain: |
| ||||||||||||||||||
Threat name: | Operation Crimson Palace - XiebroC2 CnC | ||||||||||||||||||
Operation Crimson Palace is a sophisticated cyberespionage campaign attributed to Chinese state-sponsored actors, targeting government agencies and public service organisations in Southeast Asia. The campaign employs advanced tactics, including DLL sideloading, to deploy custom malware such as "TattleTale," a previously undocumented keylogger. The attackers have demonstrated adaptability by shifting to open-source tools and varying their command-and-control (C2) channels to evade detection. Notably, compromised infrastructure within the same verticals has been leveraged to stage malware and relay C2 communications, indicating a strategic approach to blending into the targeted environments. | |||||||||||||||||||
Threat Protected: | 5 | ||||||||||||||||||
Rule Set Type: |
| ||||||||||||||||||
Class Type: | Trojan-activity | ||||||||||||||||||
Kill Chain: |
| ||||||||||||||||||
Known exploited vulnerabilities (Week 3 - December 2024)
For more information, please visit the Red Piranha Forum:
https://forum.redpiranha.net/t/known-exploited-vulnerabilities-catalog-3rd-week-of-december-2024/533
Vulnerability | CVSS | Description | |
CVE-2024-35250 | 7.8 (High) | Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability | |
CVE-2024-20767 | 7.4 (High) | Adobe ColdFusion Improper Access Control Vulnerability | |
CVE-2024-55956 | 9.8 (Critical) | Cleo Multiple Products Unauthenticated File Upload Vulnerability | |
CVE-2021-40407 | 9.8 (Critical) | Reolink RLC-410W IP Camera OS Command Injection Vulnerability | |
CVE-2019-11001 | 7.2 (High) | Reolink Multiple IP Cameras OS Command Injection Vulnerability | |
CVE-2022-23227 | 9.8 (Critical) | NUUO NVRmini 2 Devices Missing Authentication Vulnerability | |
CVE-2018-14933 | 9.8 (Critical) | NUUO NVRmini Devices OS Command Injection Vulnerability | |
CVE-2024-12356 | 9.8 (Critical) | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability |
Updated Malware Signatures (Week 3 - December 2024)
Threat | Description | |
Lumma Stealer | A type of malware classified as an information stealer. Its primary purpose is to steal sensitive information from infected systems, including but not limited to credentials, financial information, browser data, and potentially other personal or confidential information. | |
Remcos | Remcos functions as a remote access trojan (RAT), granting unauthorised individuals the ability to issue commands on the compromised host, record keystrokes, engage with the host's webcam, and take snapshots. Typically, this malicious software is distributed through Microsoft Office documents containing macros, which are often attached to malicious emails. |
| Ransomware Report | |
The Red Piranha Team conducts ongoing surveillance of the dark web and other channels to identify global organisations impacted by ransomware attacks. In the past week, our monitoring revealed multiple ransomware incidents across diverse threat groups, underscoring the persistent and widespread nature of these cyber risks. Presented below is a detailed breakdown of ransomware group activities during this period. | |
| Name of Ransomware Group | Overall %age of total attack coverage |
Funksec | 14.47% |
Bianlian | 3.14% |
8.81% | |
El Dorado | 3.77% |
Killsec3 | 4.4% |
Cicada3301 | 1.26% |
Handala | 0.63% |
Akira | 9.43% |
Team Underground | 0.63% |
7.55% | |
Eraleign (APT73) | 1.89% |
Argonauts Group | 0.63% |
Dragonforce | 2.52% |
Leaked Data | 1.26% |
Lynx | 1.89% |
Qilin | 3.77% |
Kairos | 1.26% |
4.4% | |
Stormous | 0.63% |
Everest | 3.77% |
Interlock | 1.89% |
Hunters | 3.77% |
Nitrogen | 1.89% |
3AM | 0.63% |
Brain Cipher | 1.26% |
Bluebox | 1.89% |
0.63% | |
Cactus | 0.63% |
Nullbulge | 0.63% |
Blackbasta | 3.14% |
1.26% | |
Money Message | 0.63% |
2.52% | |
Cloak | 1.26% |
Abyss-data | 0.63% |
0.63% | |
Space Bears | 0.63% |
Fog Ransomware Group
Fog Ransomware emerged in April 2024, targeting both Windows and Linux endpoints. It operates as a multi-pronged extortion operation, utilising a TOR-based Data Leak Site (DLS) to publicly list victims and host exfiltrated data from those who refuse to meet ransom demands.
This ransomware is part of the modern ransomware-as-a-service (RaaS) ecosystem, with customisable payloads tailored to disrupt operations in targeted environments.
Detailed TTPs
Initial Access and Foothold Establishment:
- Primary Initial Access Methods:
- Exploitation of known vulnerabilities in public-facing systems.
- Use of compromised credentials purchased from Initial Access Brokers (IABs).
- Post-Access Lateral Movement: Systematic traversal across network endpoints using valid credentials.
Cross-Platform Payloads:
- Windows Variant: Focuses on shadow copy deletion, service termination, and extensive configuration capabilities.
- Linux Variant: Targets virtual environments (e.g., VMSD and VMDK files) and employs tailored commands for environment disruption.
Fog Ransomware supports multiple command-line parameters. These include:
Parameter Description
--help Display all available syntax
--offvm Force termination of VM-related processes
--size Specify file encryption percentage (e.g., 70%)
--target Define specific paths or directories for encryption
--id Provide ID/password for execution (required)
--fork Run without terminal, daemon mode
--log (file) Enable logging (to terminal by default)
--nomutex Skip checks for existing running processes
--showtalkid Display campaign ID without encryption
--processallfiles Encrypt all files, ignoring default extensions
--thread Specify the number of threads for encryption
File Encryption Behavior:
File Extensions: .fog, .Fog, .FLOCKED
Windows Shadow Copy Deletion Command:
vssadmin.exe delete shadows /all /quiet
Windows Configuration: JSON-based configuration enabling:
- Custom encrypted file extensions.
- Ransom note filename configuration.
- Service and process termination lists.
- RSA public key embedding for encryption operations.
Readme.txt