Category Archives: Advisories

Advisories

RansomBoggs Ransomware Targeted Multiple Ukrainian Organizations

Read Time:53 Second

FortiGuard Labs is aware of a report that a new ransomware strain named “RansomBoggs” was deployed to multiple unnamed organizations in Ukraine. The ransomware encrypts files on compromised machines and provides attacker’s contact information for victims to talk with the attacker for file recovery.Why is this Significant?This is significant because RansomBoggs is the latest ransomware that targets Ukrainian organizations. Based on the tactics, techniques, and procedures (TTPs) used in the attack, security vendor ESET attributed RansomBoggs to the Sandworm APT group who is believed to be associated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation.What is RansomBoggs Ransomware?RansomBoggs ransomware encrypts files on compromised machines and adds a “.chsch” file extension to the affected files. It drops a ransom note requesting victims to get in touch with the attacker for file recovery.Currently, there is no indication that RansomBoggs ransomware has wiper functionality.What is the Status of Coverage?FortiGuard Labs provides the following AV signature for RansomBoggs ransomware:MSIL/Filecoder.A!tr.ransom

Read More

Advisories

Aurora Infostealer Sold on Darknet and Telegram

Read Time:1 Minute, 2 Second

FortiGuard Labs is aware of a report that a new infostealer named “Aurora” is being offered for sale on the darkweb and Telegram. The infostealer was allegedly developed by a threat actor who previously developed the Aurora botnet. Aurora infostealer is capable of stealing data from compromised machines as well as downloading and executing remote files.Why is this Significant?This is significant because Aurora is a new Malware-as-a-Service (MaaS) infostealer reportedly advertised in darknet and telegram sites. Aurora not only steals information from compromised machines but also deploys additional malware. According to outside reports, several active threat actors are using Aurora infostealer. What is Aurora Infostealer?Aurora is a Go-based infostealer that targets web browsers, cryptocurrency related browser extensions, cryptocurrency wallets in compromised machines for data exfiltration. Aurora is also capable of downloading and executing remote files, which can be used for deployment of additional malware.The reported infection vector is luring users to install fake software promoted in bogus cryptocurrency and free software web sites. What is the Status of Protection?FortiGuard Labs provide the following AV signatures against known Aurora infostealer samples:W32/Agent.IE!trW32/PossibleThreatReported network IOCs associated with Aurora infostealer are blocked by the Webfiltering client.

Read More

Advisories

CVE-2019-18265

Read Time:18 Second

Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected content is stored in logs and rendered when viewed in the web application.

Read More

Advisories

USN-5752-1: Linux kernel (Azure CVM) vulnerabilities

Read Time:1 Minute, 21 Second

David Bouman and Billy Jheng Bing Jhong discovered that a race condition
existed in the io_uring subsystem in the Linux kernel, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2022-2602)

Sönke Huster discovered that an integer overflow vulnerability existed in
the WiFi driver stack in the Linux kernel, leading to a buffer overflow. A
physically proximate attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2022-41674)

Sönke Huster discovered that a use-after-free vulnerability existed in the
WiFi driver stack in the Linux kernel. A physically proximate attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2022-42719)

Sönke Huster discovered that the WiFi driver stack in the Linux kernel did
not properly perform reference counting in some situations, leading to a
use-after-free vulnerability. A physically proximate attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2022-42720)

Sönke Huster discovered that the WiFi driver stack in the Linux kernel did
not properly handle BSSID/SSID lists in some situations. A physically
proximate attacker could use this to cause a denial of service (infinite
loop). (CVE-2022-42721)

Sönke Huster discovered that the WiFi driver stack in the Linux kernel
contained a NULL pointer dereference vulnerability in certain situations. A
physically proximate attacker could use this to cause a denial of service
(system crash). (CVE-2022-42722)

Read More