Threat Intelligence Report - September 23-29, 2019

Trends

• The top attacker country was China with 874 unique attackers (33%)
• The top Exploit event was Miscellaneous with 65% of occurrences.
• The top Trojan C&C server detected was TrickBot with 36 instances detected.

Top Attacker by Country

Threat Geo-location

Top Attacking Hosts

Top Network Attackers

Top Event NIDS and Exploits

Top Alarms

Comparison from last week 

Remote Access Trojan C&C Servers Found

Common Malware

CVEs For Which Public Exploits Have Been Detected

Title:    Microsoft SharePoint Persistent Cross-Site Scripting Vulnerability
Vendor:    Microsoft
Description: A cross-site-scripting vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.
CVSS v2 Base Score:    3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)

ID:        CVE-2019-1579
Title:    HPE Intelligent Management Center Information Disclosure Vulnerability
Vendor:    HPE
Description: An information disclosure vulnerability exists in HPE Intelligent Management Center due to improper validation of user-supplied data. An unauthenticated, remote attacker can exploit this to allow unauthenticated access.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

ID:        CVE-2019-16531
Title:    LayerBB Cross-Site Request Forgery Vulnerability
Vendor:    LayerBB
Description: LayerBB has multiple Cross site request forgery issues such as editing user profiles and forums. These can be demonstrated by changing the System Settings via admin/general.php.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

ID:        CVE-2019-16399
Title:    Western Digital My Book World II NAS Authentication Bypass Vulnerability
Vendor:    Western Digital
Description: An Authentication Bypass Vulnerability exists in Western Digital WD My Book World, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/system_advanced.php?lang=en and login with the default root password welc0me.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Title: Microsoft Windows AppXSvc Elevation of Privilege Vulnerability
Vendor: Microsoft
Description: An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'.
Note: This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.
CVSS v2 Base Score:    7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)