Category Archives: Advisories

Advisories

Alert (AA23-040A) #StopRansomware: Ransomware Activities Related to DPRK

Read Time:2 Minute, 27 Second

FortiGuard Labs is aware of a joint advisory on ransomware activities against organizations in healthcare and critical infrastructure performed by threat actors related to the Democratic People’s Republic of Korea (DPRK). The advisory was issued by multiple agencies in the United States and the Republic of Korea (ROK) and contains information that helps organizations fortify their cyber defense for known tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs).Why is this Significant?This is significant because the advisory is part of the #StopRansomware effort and provides tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) that belong to ransomware activities related to threat actors associated with DPRK. The information in the advisory helps organizations review and strengthen cyber defenses.The advisory was issued by the United States National Security Agency (NSA), the U.S. Federal Bureau of Investigation (FBI), the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Department of Health and Human Services (HHS), the Republic of Korea (ROK) National Intelligence Service (NIS), and the ROK Defense Security Agency (DSA).What are the TTPs Covered in the Advisory?Threat actors were observed to have leveraged the following vulnerabilities to gain access to the victims’ network:CVE 2021-44228 (Apache log4j remote code execution vulnerability)CVE-2021-20038 (SonicWall SMA100 buffer overflow vulnerability)CVE-2022-24990 (TerraMaster OS unauthenticated remote command execution vulnerability)Threat actors also hide malware in the X-Popup instant messenger app as initial infection vector.Ransomware used by DPRK threat actors include Maui, H0lyGh0st, BitLocker, Deadbolt, ech0raix, GonnaCry, Hidden Tear, Jigsaw, LockBit 2.0, My Little Ransomware, NxRansomware, Ryuk, and YourRansom.What is Mitigation?The advisory provides mitigation methods. For details, see the Appendix for a link to “Alert (AA23-040A): #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities”.What is the Status of Protection?FortiGuard Labs has the following AV signatures in place for the available samples referenced in the IOC section in the advisory:Java/Webshell.V!trPHP/Webshell.NIJ!trPHP/Webshell.NOK!trVBA/Agent.BSL!trW32/Agent.C5C2!trW32/Agent.FD!trW32/Agent.GT!trW32/Agent.QCD!tr.spyW32/Agent.SRR!trW32/DTrack!tr.bdrW32/Filecoder.AX!trW32/Filecoder.OLY!trW32/KeyLogger.RKT!trW32/MagicRAT.B!trW32/MagicRAT.C!trW32/MagicRAT.D!trW32/MagicRAT.E!trW32/MAUICRYPT.YACC5!tr.ransomW32/MulDrop19.28718!trW32/NukeSped.HD!trW32/NukeSped.JF!trW32/PossibleThreatW32/Scar.JEV!trW64/Agent.ACBX!trW64/Filecoder.788A!tr.ransomW64/GenKryptik.FTAR!trW64/NukeSped.HA!trW64/NukeSped.HD!trW64/NukeSped.IF!trW64/NukeSped.LC!trW64/NukeSped.LE!trW64/NukeSped.LT!trRiskware/XpopupMalicious_Behavior.SBW32/Malicious_Behavior.VEXPossibleThreat.PALLASHFortiGuard Labs has the following IPS signatures in place for the exploited vulnerabilities in the advisory:Apache.Log4j.Error.Log.Remote.Code.Execution (CVE-2021-44228)SonicWall.SMA100.mod_cgi.Buffer.Overflow (CVE-2021-20038)FortiGuard Labs is currently investigating IPS protection for CVE-2022-24990. The Threat Signal will be updated when new information becomes available.

Read More

Advisories

Potentially Destructive Medusa Malware Targets Linux Devices

Read Time:1 Minute, 22 Second

FortiGuard Labs is aware of a report that a new Medusa malware variant that is targeting Linux-based devices. The Medusa malware is reportedly based on the infamous Mirai malware and is not only capable of launching Distributed Denial of Service (DDoS) attacks and exfiltrating information from compromised devices, but also encrypting files and deleting all files in the system drives.Why is this Significant?This is significant because Medusa botnet supports ransomware functionality and is capable of encrypting files on compromised Linux devices. It also deletes files on the hard disk 24 hours after file encryption is finished, which bricks the affected devices.What is Medusa Malware?Medusa is a Mirai variant that connects to Command-and-Control (C2) servers, and perform various activities upon receiving commands from C2s. Capabilities include – launching DDoS attacks and exfiltrating information from compromised devices. It can also encrypt files on compromised devices and delete all files in the system drives 24 hours after file encryption is completed, which would make the affected devices unusable.While infection chain of Medusa botnet has not been identified, exploiting vulnerabilities is the likely infection vector since Medusa ransomware is reportedly based on the infamous Mirai malware. Bruteforcing is another potential attack vector as Linux devices often have weak username passwords combination by default and users tend not to change default passwords.What is the Status of Protection?FortiGuard Labs has the following AV signatures in place for this attack:Linux/Redis.TSU!trPython/Stealer.DEDC!tr.ransomBAT/Agent.P!tr.dldrFortiGuard Labs has the following IPS signature in place to block download of Medusa malware:Embedded.Linux.Malicious.Script

Read More

Advisories

python-fastapi-0.92.0-1.fc39 python-starlette-0.25.0-1.fc39

Read Time:33 Second

FEDORA-2023-6c030b3c71

Packages in this update:

python-fastapi-0.92.0-1.fc39
python-starlette-0.25.0-1.fc39

Update description:

python-starlette 0.25.0

Fixed

Limit the number of fields and files when parsing multipart/form-data on the MultipartParser

python-fastapi 0.92.0

🚨 This is a security fix. Please upgrade as soon as possible.

Upgrades

⬆ Upgrade Starlette to 0.25.0.
This solves a vulnerability that could allow denial of service attacks by using many small multipart fields/files (parts), consuming high CPU and memory.
Only applications using forms (e.g. file uploads) could be affected.
For most cases, upgrading won’t have any breaking changes.

Read More