Category Archives: Advisories

Advisories

postgresql-jdbc-42.2.25-1.fc35

Read Time:9 Second

FEDORA-2022-1151f65e9a

Packages in this update:

postgresql-jdbc-42.2.25-1.fc35

Update description:

Rebase on upstream version 42.2.25. This rebase fixes CVE-2022-21724.

Read More

Advisories

APT10 (Cicada) Campaign Expands on Further Global Interests

Read Time:2 Minute, 6 Second

FortiGuard Labs is aware of a new campaign from the APT10/Cicada threat actors. Reported by researchers at Symantec, this latest campaign highlights the various tools and custom malware used by Cicada to perform espionage activity, which we covered in our blog post from 2019, which used different TTPs. APT 10 is also referred to as:CicadaCVNXHOGFISH menuPassPOTASSIUM Stone Panda Red Apollo This group focuses specifically on the following verticals:GovernmentLegalPharmaceuticalReligiousTelecomNon-Governmental Organizations (NGOs)and targets multiple countries around the world, including in Europe, Asia, and North America. First seen attacking Japanese interests, Cicada has been observed targeting various managed service providers globally as well. Campaigns have been attributed to the government of China.As part of our membership with the Cyber Threat Alliance, all indicators of compromise (IOCs) were provided to us in advance before publication to ensure Fortinet protections were in place during the time of announcement.What are the Technical Details of Cicada?Cicada has been observed to use a custom loader and malware to perform their attacks. Various activities observed included attacks on Microsoft Exchange Servers. The report suggested that potential zero day exploits were likely used to gain access. Once inside, the attackers would deploy a loader and a custom backdoor known as Sodamaster.Sodamaster is fileless and evades sandbox detection, and enumerates various operating system parameters such as username, hostname, and OS of the targeted systems. It can also download and execute additional payloads. According to the report, the TTPs (Tactics, Techniques and Procedures) used by Cicada were in operation since 2020.Various tools used by Cicada are Mimikatz, rar archiving (file compression), system/network discovery (to determine what systems and services are running) , WMIExec (cmd line to execute commands remotely), and NBTscan (open source for network reconnaissance) tools. Other observations were the usage of VLCplayer that was exploited to act as a custom loader, and WinVnc for remote control of compromised machines.How Widespread is this?This is limited to targeted attacks.Who is Behind this Attack?This has been attributed to APT10 and is state sponsored. For further details on APT10, please refer to “Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information” in the APPENDIX.What Operating Systems are Affected?Windows Operating Systems.What is the Status of Coverage?FortiGuard Labs has coverage in place for publicly available samples as:Riskware/MimikatzW64/HUILOADER.ZYJB!trW64/Ecipekac.M!trAll network IOCs are blocked by the WebFiltering client.

Read More

Advisories

Borat RAT: New RAT with Ransomware Capability

Read Time:55 Second

FortiGuard Labs is aware of a report that a new Remote Access Trojan (RAT) called “Borat” is sold in underground forums. The RAT provides not only typical RAT capabilities such as keylogging, audio and webcam recording, and browser credential stealing to cybercriminals, but also offers file encryption and decryption capability as well as creating a ransom note on the victim’s machine.Why is this Significant?This is significant because Borat RAT not only enables cybercriminals to perform typical RAT activities but also provides ransomware capabilities as well.What Functionalities Does Borat RAT Provide?Borat RAT allows an attacker to perform the following activities:KeyloggingRansomware activities such as encrypting and decrypting files as well as creating a ransom note on the victim’s machineDistributed Denial of Service (DDoS)Audio and webcam recordingRemote desktopReverse proxySteals device infoProcess hollowingCredential stealingDiscord token stealingPlay audioSwap mouse buttonsHold mouseShow and hide the Desktop and the taskbarEnable and disable webcam lightHang systemTurn off the monitorDisplay blank screen What is the Status of Coverage?FortiGuard Labs provides the following AV coverage for Borat RAT:MSIL/Agent.CFQ!trMSIL/Keylogger.DUS!trMalicious_Behavior.SB

Read More

Advisories

CVE-2020-19229

Read Time:12 Second

Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerability, an attacker could exploit the vulnerability to execute arbitrary commands via the rememberMe parameter.

Read More

Advisories

CVE-2020-23349

Read Time:10 Second

An intent redirection issue was doscovered in Sina Weibo Android SDK 4.2.7 (com.sina.weibo.sdk.share.WbShareTransActivity), any unexported Activities could be started by the com.sina.weibo.sdk.share.WbShareTransActivity.

Read More