| New Threat Detection Added | 2 (UAC-0125 Rogue RDP Cookbox Malware and Citrix Session Recording RCE (CVE-2024-8069)) |
| New Threat Protections | 249 |
Weekly Detected Threats
The following threats were added to Crystal Eye XDR this week:
Threat name: | UAC-0125 Rogue RDP Cookbox Malware | |||||||||||||||||||||||||||
Cookbox is designed to compromise and extract sensitive information from affected systems. It starts with a phishing email which includes attachments containing configuration files for setting up Remote Desktop Protocol (RDP) sessions (".rdp" files). Launching these files initiated an outgoing RDP connection to the attacker's server. However, the configuration of the RDP files allowed access to local resources such as disks, network shares, printers, COM ports, audio devices, and the clipboard during the connection. This setup not only exposed local resources but also potentially enabled the execution of third-party programs or scripts on the victim's computer. | ||||||||||||||||||||||||||||
Threat Protected: | 118 | |||||||||||||||||||||||||||
Rule Set Type: |
| |||||||||||||||||||||||||||
Class Type: | Trojan-activity | |||||||||||||||||||||||||||
Kill Chain: |
| |||||||||||||||||||||||||||
Threat name: | Citrix Session Recording RCE (CVE-2024-8069) | ||||||||||||||||||
A critical privilege escalation vulnerability has been identified in Citrix's Virtual Apps and Desktops solution. This flaw allows authenticated users to gain SYSTEM-level privileges on the server hosting the virtual applications and desktops. Exploiting this vulnerability enables attackers to impersonate any user, including administrators, and monitor or manipulate user activities. The centralised nature of this system amplifies the potential impact, making it imperative for organisations to apply necessary patches and security measures promptly. | |||||||||||||||||||
Threat Protected: | 01 | ||||||||||||||||||
Rule Set Type: |
| ||||||||||||||||||
Class Type: | Attempted-admin | ||||||||||||||||||
Kill Chain: |
| ||||||||||||||||||
Known exploited vulnerabilities (Week 2 - November 2024)
For more information, please visit the Red Piranha Forum:
https://forum.redpiranha.net/t/known-exploited-vulnerabilities-catalog-2nd-week-of-november-2024/525
Updated Malware Signatures (Week 2 - November 2024)
Threat | Description | |
Qakbot | A malware designed to acquire valuable data such as banking credentials and is also capable of stealing FTP credentials and spreading across a network by utilising SMB. | |
Lumma Stealer | A type of malware classified as an information stealer. Its primary purpose is to steal sensitive information from infected systems, including but not limited to credentials, financial information, browser data, and potentially other personal or confidential information. | |
Remcos | Remcos functions as a remote access trojan (RAT), granting unauthorised individuals the ability to issue commands on the compromised host, record keystrokes, engage with the host's webcam, and take snapshots. Typically, this malicious software is distributed through Microsoft Office documents containing macros, which are often attached to malicious emails. |
| Ransomware Report | |
The Red Piranha Team conducts ongoing surveillance of the dark web and other channels to identify global organisations impacted by ransomware attacks. In the past week, our monitoring revealed multiple ransomware incidents across diverse threat groups, underscoring the persistent and widespread nature of these cyber risks. Presented below is a detailed breakdown of ransomware group activities during this period. | |
| Name of Ransomware Group | Overall %age of total attack coverage |
11.76% | |
Bianlian | 5.88% |
Killsec3 | 7.35% |
El Dorado | 1.47% |
Meow | 13.24% |
Lynx | 13.24% |
Eraleign (APT73) | 2.94% |
1.47% | |
Space Bears | 1.47% |
Black Suit | 10.29% |
Hunters | 7.35% |
RA group | 2.94% |
3AM | 1.47% |
Kairos | 8.82% |
Everest | 5.88% |
Embargo | 1.47% |
Hellcat | 1.47% |
Lynx Ransomware Group Report
Based on the latest Analysis on 14-Nov-2024, In the latest analysis conducted by Red Piranha, the Lynx ransomware samples were found to utilise advanced encryption techniques, including AES-128 in CTR mode and Curve25519 Donna algorithms. During the encryption process, all affected files have the `.lynx` extension appended to them, effectively locking users out of their data.
This variant, developed specifically for the Windows platform, is written in C++ to enhance its functionality and effectiveness.
Detailed TTPs
Primary Execution and Privileges:
The Lynx ransomware employs System Services (T1569) and Service Execution (T1569.002) techniques, requiring elevated privileges (Administrator/SYSTEM). The malware leverages Windows Service Control Manager (services.exe) for execution, utilising process ID 6224 (hash: 9a47ab27d50df1faba1dc5777bdcfff576524424bc4a3364d33267bbcf8a3896.exe). Remote execution capabilities are enabled through PsExec and sc.exe utilities.