Category Archives: Advisories

Advisories

Newly Identified Green Stone Malware Leveraging Malicious Macros in Global Campaign

Read Time:2 Minute, 37 Second

FortiGuard Labs is aware of a campaign targeting Iranian interests, specifically in the energy sector. Dubbed Green Stone, this malware is delivered through Microsoft Excel spreadsheets containing malicious macros. The Green Stone malware is obfuscated in Base64, where the macro code contains instructions to unpack Green Stone into a temporary directory where it is then executed.What is Green Stone?Green Stone is classified as an infostealer, is persistent and will steal information from the affected machine. It will look for specific registry entries in MicrosoftInternet ExplorerTypedURLs to look for websites that the targeted machine recently visited. Besides containing basic infostealer functionality, Green Stone also connects to Telegram to send C2 traffic through, which is likely a way to evade detection.The threat has the ability to collect information about the victim machine, take screenshots and send it to a predetermined URI. Green Stone can do the following:Scan directory hierarchiesDelete files and folders Run commandsLocate filesRename files and directoriesCopy filesand UnzipBased on our data, connections to the C2 server reveal the United States accounts for 30 percent, Brazil 15 percent and Argentina, Korea and Germany accounting for less than 2 percent of connections to the 185.162.235[.]184 IP address of the attacker. Who is Behind Green Stone?There is not enough information at this time to determine attribution.Any Other Suggested Mitigation?As it has been observed that Green Stone threat actors have used malicious Microsoft Office files, likely through social engineering and phishing techniques, it is recommended to never enable macro based documents, especially from a sender that is not recognized.Due to the ease of disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine risk.Also – organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spear phishing attacks. They also need to encourage employees to never open attachments from someone they don’t know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spear phishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations’ internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.What is the Status of Coverage?Fortinet customers running the latest definitions are protected by the following (AV) signatures:WM/Agent!tr (Malicious Macro)W32/Agent.665F!tr (Green Stone)All network IOC’s are blocked by the WebFiltering Client.

Read More

Advisories

CVE-2020-1754

Read Time:12 Second

In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the ‘access all groups’ capability were not restricted to viewing grades of users within their own groups.

Read More

Advisories

CVE-2021-27798

Read Time:19 Second

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability in Brocade Fabric OS versions v7.4.1b and v7.3.1d could allow local users to conduct privileged directory transversal. Brocade Fabric OS versions v7.4.1.x and v7.3.x have reached end of life. Brocade Fabric OS Users should upgrade to supported versions as described in the Product End-of-Life Publish report.

Read More

Advisories

rubygem-rails-html-sanitizer-1.4.3-1.fc37

Read Time:27 Second

FEDORA-2022-9cd3e3a570

Packages in this update:

rubygem-rails-html-sanitizer-1.4.3-1.fc37

Update description:

Automatic update for rubygem-rails-html-sanitizer-1.4.3-1.fc37.

Changelog

* Fri Aug 5 2022 Vít Ondruch <vondruch@redhat.com> – 1.4.3-1
– Update to rails-html-sanitizer 1.4.3.
Resolves: rhbz#2095592
Resolves: rhbz#2101883
Resolves: rhbz#2113699
* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> – 1.4.2-3
– Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild

Read More