Note: This is a breaking news event. All information and updates related to this event will be updated once relevant information is available. FortiGuard Labs is aware of reports that an unpatched Microsoft Exchange vulnerability is being exploited in the wild. It is a Remote Command Execution (RCE) vulnerability, as such successful exploitation could allow an attacker to execute remote commands on affected Microsoft Exchange servers. At the time of this writing, patches and CVE assignments are not available. Also, Microsoft has not commented or confirmed that this is a zero day vulnerability.Why is this Significant?This is significant because this is likely a new unpatched Remote Command Execution (RCE vulnerability). Successful exploitation could allow an attacker to execute remote commands on affected Microsoft Exchange servers. Microsoft Exchange is widely used in Enterprise and an unpatched vulnerability poses a serious threat to many organizations worldwide.When was the Vulnerability Discovered?On September 28, 2022, GTSC (security vendor) published a blog on an unpatched Microsoft Exchange vulnerability which was leveraged in an attack against an unnamed critical infrastructure. Has Microsoft Released a Patch for the Vulnerability?At the time of this writing (September 29, 2022), Microsoft has not released a patch for the vulnerability.Has the Vendor Released an Advisory for the Vulnerability?No, Microsoft has not released an advisory at the time of this writing (September 29, 2022). Microsoft has yet to confirm that this is a new zero-day or vulnerability.What is the Status of Coverage?FortiGuard Labs is closely monitoring the situation and will update this Threat Signal once protections are available. All network IOCs on the GTSC blog are blocked by the WebFiltering client.What Mitigation Steps are Available?GTSC provided potential detection and mitigation information in their blog. Note that those detection and mitigation have not been verified by FortiGuard Labs. For additional information, see the Appendix for a link to “WARNING: NEW ATTACK CAMPAIGN UTILIZED A NEW 0-DAY RCE VULNERABILITY ON MICROSOFT EXCHANGE SERVER”.
FortiGuard Labs is aware of a new variant of modular malware “Kaiji” targeting Windows and Linux machines and devices belonging to both consumers and enterprises in Europe. Dubbed “Chaos”, the malware connects to command and control (C2) servers and performs various activities including launching Distributed Denial of Service (DDoS) attacks and mining crypto currencies.Why is this Significant?This is significant because the Chaos malware targets both consumers and enterprises in Europe by exploiting various vulnerabilities. Infected machines will join a botnet which are then used for malicious activities such as DDoS attacks and cryptocurrency mining.What is Chaos Malware?Chaos is a Go-based modular malware for Windows and Linux and is allegedly an updated version of Kaiji malware. Chaos malware connects to C2 servers and receives remote commands as well as modules for additional functionality. According to security vendor Black Lotus Labs, Chaos is primarily used for DDoS attacks and cryptocurrency mining. It is also designed to spread to other systems through SSH and exploitation of various vulnerabilities.It is important to note that ransomware with a similar name exists (Chaos ransomware), but they are completely unrelated.What Vulnerabilities Does Chaos Exploit for Propagation?The following vulnerabilities were exploited by Chaos malware according to Black Lotus Labs:Command Execution vulnerability in Huawei HG532 Router (CVE-2017-17215)Command Injection Vulnerability in Zyxel firewalls (CVE-2022-30525)Note – that since Chaos is a modular malware and receives remote commands, it may exploit other vulnerabilities including Authentication Bypass Vulnerability in F5 BIG-IP (CVE-2022-1388).Have Vendors Released Patches for CVE-2017-17215, CVE-2022-30525 and CVE-2022-1388?Patches are available for CVE-2022-30525 and CVE-2022-1388. We are currently unaware of any vendor supplied patches for CVE-2017-17215.What is the Status of Protection?FortiGuard Labs will detect Chaos DDoS malware with the following AV signatures:Linux/Kaiji.C!trW32/Ransom_Foreign.R002C0WG222W32/PossibleThreatFortiGuard Labs provides the following IPS signatures for the vulnerabilities exploited by Chaos malware:Huawei.HG532.Remote.Code.Execution (CVE-2017-17215)ZyXEL.Firewall.ZTP.Command.Injection (CVE-2022-30525)F5.BIG-IP.iControl.REST.Authentication.Bypass (CVE-2022-1388)
