Category Archives: Advisories

Advisories

SEABORGIUM APT Group Targets NATO Members and European Countries

Read Time:1 Minute, 57 Second

FortiGuard Labs is aware of a report published by Microsoft of a threat actor named “SEABORGIUM”, which the vendor attributed to Russia, that targeted organizations in NATO member countries as well as in Northern and Eastern Europe for espionage. Also referred as Callisto, TA446 and COLDRIVER, the threat actor has been active since 2015 and reportedly used a spyware developed by infamous HackingTeam in their earlier campaigns.Why is this Significant?This is significant because the “SEABORGIUM” threat actor has been active since 2015 and reportedly targeted various industries including defense contractors, think tanks, Non-Governmental Organizations (NGOs) and Intergovernmental Organizations (IGOs) in NATO member countries as well as other European countries for espionage.What is SEABORGIUM APT Group?SEABORGIUM is a threat actor that has reportedly targeted organizations that are associated with foreign and security policy making in Europe for at least seven years. Countries of interest include NATO partner nations as well as countries in Northern, Southern and Eastern Europe. The Microsoft blog indicates that the APT group targeted Ukraine’s public sector prior to the ongoing Russo-Ukrainian war.The SEABORGIUM APT threat actor is also known as Callisto Group (Callisto), COLDRIVER, TA446, and is potentially related to Gamaredon Group.Infection tactics of SEABORGIUM include credential phishing attacks, sending a Word doc attachment with malware embedded or malicious macros, and sending emails with themes that the target is likely interested in; also establishing relationships on Social Networking Service (SNS), all presumably for email credential theft. The stolen credentials allow the threat actor to gain access to the victim’s mailbox and exfiltrate information. The attacker also is believed to set up email rules in the victim’s mailboxes that automatically forward incoming messages to the attacker’s email address for data gathering.In earlier campaigns, the SEABORGIUM APT group is believed to have used the Scout implant from Galileo, one of the Remote Control Systems (RCS) developed by the infamous Italy based HackingTeam. The Scout agent sends victim’s machine information and screen captures to the attacker’s infrastructure.What is the Status of Coverage?FortiGuard Labs provides the following AV coverage for the samples believed to be related with the SEABORGIUM APT group:W32/Agent.AAAI!trW32/Agent.AACX!trW32/Trojan.I!trPDF/Agent.A9BA!trVBA/Agent.ADO!trAll network IOCs associated with this attack are blocked by the WebFiltering client.

Read More

Advisories

Joint CyberSecurity Advisory on Vulnerabilities in Zimbra Collaboration (CISA-MS-ISAC)

Read Time:2 Minute, 54 Second

On August 16th, a joint cybersecurity advisory was issued by the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC) on vulnerabilities in Zimbra Collaboration that is actively leveraged in the field by threat actors. The advisory covers five CVEs: CVE-2022-24682, CVE-2022-27924, CVE-2022-27925, CVE-2022-37042, and CVE-2022-30333.Why is this Significant?This is significant because the vulnerabilities in Zimbra Collaboration Suite called out in the advisory (CVE-2022-24682, CVE-2022-27924, CVE-2022-27925, CVE-2022-37042, and CVE-2022-30333) are leveraged in real attacks by threat actors, and as such relevant patches should be applied as soon as possible.Zimbra Collaboration, formerly known as Zimbra Collaboration Suite, is a cloud-based email, calendaring, and groupware solution developed by Synacor and is widely used worldwide. According to its Web site, Zimbra is used in more than 140 countries and over 1,000 government and financial institutions.How Widespread are the Attacks Leveraging the Vulnerabilities?While there is no information available as to how widespread the attacks are, wide adoption of Zimbra Collaboration is a high exploitation target for any threat actor.What are the Vulnerabilities Exploited in the Field?The advisory states a total of five vulnerabilities are exploited in the wild.CVE-2022-24682CVE-2022-24682 is a cross-site scripting (XSS) vulnerability in Zimbra Webmail. The vulnerability affects all versions of Zimbra 8.8.15 and was exploited as a zero-day. Remote attackers can leverage the vulnerability to run an arbitrary web script within the session of the connected Zimbra user.CVE-2022-27924CVE-2022-27924 is a memcache command injection vulnerability that impacts Zimbra Collaboration 8.8.15 and 9.0. Successful exploitation allows a remote attacker to steal email login credentials in plain text from Zimbra Collaboration without any user interaction.CVE-2022-27925CVE-2022-27925 is an arbitrary file upload vulnerability that affects Zimbra Collaboration 8.8.15 and 9.0. By leveraging the vulnerability, an authenticated remote attacker can upload arbitrary files to an arbitrary location on the vulnerable system. The advisory states that CVE-2022-27925 was observed to have been exploited in conjunction with CVE-2022-37042.CVE-2022-37042CVE-2022-37042 is an authentication bypass vulnerability that impacts Zimbra Collaboration 8.8.15 and 9.0. Successful exploitation allows an unauthenticated attacker to upload arbitrary files to an arbitrary location on the vulnerable system and leads to remote code execution. The advisory states that CVE-2022-37042 was observed to have been exploited in conjunction with CVE-2022-27925.CVE-2022-30333CVE-2022-30333 is a path traversal vulnerability that affects Linux and Unix versions of RARLAB UnRAR before version 6.12. Successfully exploiting the vulnerability allows an attacker to drop files to an arbitrary location on a vulnerable system during the unpacking operation.Has the Vendor Released a Patch?Yes. A patch is available for all vulnerabilities. For more details, see the Appendix for a link to “Zimbra Collaboration – Security Vulnerability Advisories” and “RARLAB”.What is the Status of Coverage?FortiGuard Labs has the following IPS coverage in place against the exploitation of the vulnerabilities:Zimbra.Collaboration.Calendar.Reflected.XSS (CVE-2022-24682)Zimbra.Collaboration.Mboximport.Unrestricted.File.Upload (CVE-2022-27925 and CVE-2022-37042)FortiGuard Labs is investigating coverage for CVE-2022-27924 and CVE-2022-30333, and will update this threat signal once any relevant updates are available.

Read More

Advisories

Joint Cybersecurity Advisory on Zeppelin Ransomware (AA22-223A)

Read Time:1 Minute, 39 Second

On August 11, 2022, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) released a joint advisory on Zeppelin ransomware. The alert provides insight into the tactics, techniques, and procedures (TTPs) along with indicators of compromise used by Zeppelin threat actors. Zeppelin has been operating since 2019 and has targeted organizations across multiple industries as well as critical infrastructure sectors.What is Zeppelin ransomware?Zeppelin is a Delphi-based ransomware and is run as a Ransomware-as-a-Service (RaaS). First reports of Zeppelin ransomware goes back as far as December 2019. Some reports suggest that Zeppelin ransomware originates from the Vegaslocker and Buran strains.According to the CISA advisory, Zeppelin ransomware’s infection vectors include RDP exploitation, leveraging vulnerabilities in popular FireWall products and phishing emails. Once a threat actor compromises the victim’s network, it steals sensitive information from the victim before starting the file encryption process. Zeppelin ransomware typically adds a “.zeppelin” file extension to the affected files, however other files extensions used were observed. After files are encrypted, the victim is presented with a ransom note that is typically named “!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT” containing attacker’s contact information (email, Jabber, ICQ or Telegram) as well as a ransom message. Zeppelin victims are threatened that encrypted files will not be recovered, and stolen information will be released to the public if the ransom is not paid.Ransom note from a recent Zeppelin ransomware sampleThe advisory also states that threat actors ran Zeppelin ransomware more than once on the compromised network in some cases, which resulted in multiple decryption keys being required for file decryption.What is the Status of Coverage?FortiGuard Labs provides the following AV coverage against known Zeppelin ransomware variants:W32/Zeppelin.FBFD!tr.ransomW32/Buran.H!tr.ransomW32/Agent.H!tr.ransomW32/Filecoder_Buran.J!tr.ransomW32/Kryptik.GOGY!trW32/Kryptik.HIMG!trW32/Kryptik.HJEK!trW32/Generic.AC.171!trW64/Agent.EQ!trW32/Neshta.EW32/CoinMiner.NBX!trW32/PossibleThreatRiskware/Application

Read More

Advisories

CVE-2020-27792

Read Time:14 Second

A heap-based buffer over write vulnerability was found in GhostScript’s lp8000_print_page() function in gdevlp8k.c file. An attacker could trick a user to open a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service.

Read More