Media Coverage

In late September 2022, a new 0-day exploit method (ProxyNotShell) was found for on-premises Exchange Server, for which Microsoft released several URL rewrite rules at once in October 2022 as interim protection. Microsoft then released a security update in November 2022 to close the vulnerabilities. Microsoft Exchange servers that are not up to the new patch level are at risk of attackers abusing the ProxyNotShell vulnerabilities CVE-2022-41040 and CVE-2022-41082 as an entry vector to Microsoft Exchange Server. Before Christmas, I had reported about a suspected new attack vector used by the Play Ransomware group for successful attacks via the ProxyNotShell vulnerabilities. FIN7 is a Russian advanced persistent threat (APT) group that has increasingly targeted the U.S. retail, restaurant and hospitality sectors since mid-2015. And then another tweet came to my attention from Shadowserver, who are scanning the Internet for Microsoft Exchange servers vulnerable to the ProxyNotShell vulnerability CVE-2022-4108 (the report can be found here). The result of these scans is that nearly 70,000 Exchange servers worldwide were found to have arguably not received patches to close the ProxyNotShell vulnerability CVE-2022-4108. While there is some uncertainty because only certain version information was queried. Current data of vulnerable Exchange servers can be viewed in the Shadowserver dashboard. 

As part of our Exploit Intelligence service, VulnCheck tracks vulnerabilities exploited in the wild. Prioritizing known exploited vulnerabilities for remediation is a smart strategy to minimize vulnerability risk. However, that strategy breaks down when some exploited vulnerabilities are overlooked. For CVE published in 2022, VulnCheck is tracking 37 more exploited vulnerabilities than the CISA KEV Catalog. One vulnerability that we’re tracking and KEV isn’t is CVE-2022-35914, a trivial unauthenticated and remote command execution vulnerability affecting GLPI. GLPI is open source software that can serve as a helpdesk, asset manager, administrator, and more. Exposing critical IT management software to the internet is a mistake the security industry sees often. Censys can find approximately 15,000 internet-facing GLPI instances. Shodan doesn’t see half as many instances as Censys, but it is able to create an interesting historical graph of internet-facing GLPI services. Shadowserver tweeted about active exploitation in the middle of October. A couple of months have passed since GLPI and Shadowserver shared their observations regarding active exploitation of CVE-2022-35914. We think it’s useful to know if the vulnerability is still under active exploitation. There are two sources that can help us quickly answer that question. First, Shadowserver maintains a useful honeypot dashboard that lists all the vulnerabilities they’ve seen exploited recently. The other source we can turn to is GreyNoise. Prioritizing the remediation of vulnerabilities exploited in the wild is a solid vulnerability management strategy. But relying on a single source of information with an incomplete dataset could result in disaster.

Recorded Future’s Insikt Group® conducted a study of malicious command-and-control (C2) infrastructure identified using proactive scanning and collection methods throughout 2022. All data was sourced from the Recorded Future® Platform and is current as of September 1, 2022. Recorded Future tracks the creation and modification of new malicious infrastructure for a multitude of post-exploitation toolkits, custom malware, and open-source remote access trojans (RATs). Since 2017, we have created detections for 108 families including RATs, advanced persistent threat (APT) malware, botnet families, and other commodity tools. We observed over 17,000 unique command-and-control (C2) servers during 2022, which is up 30% from last year. Much like 2021, our collection in 2022 was dominated by Cobalt Strike team servers, botnet families including IcedID and QakBot, and popular RATs such as PlugX. In June of 2022, ShadowServer detailed their methodology for scanning the IPv6 internet space. We predict that more organizations, including Recorded Future, will increase IPv6 scanning with resulting findings of more IPv6 C2 detections. While not widely reported on, malware that communicates over a IPv6 connection does exist, such as VirtualPie as reported on by Mandiant.

Understanding Kubernetes architecture helps you with day-to-day Kubernetes implementation and operations. When implementing a production-level cluster setup, having the right knowledge of Kubernetes components will help you run and troubleshoot applications. To reduce the cluster attack surface, it is crucial to secure the API server. The Shadowserver Foundation has conducted an experiment that discovered 380 000 publicly accessible Kubernetes API servers.

Researchers at Cyble have observed initial access brokers (IABs) selling access to enterprise networks likely compromised via a recently patched critical flaw, tracked as CVE-2022-40684, in Fortinet products. In October, the Shadowserver Foundation reported that more than 17K Fortinet devices exposed online were vulnerable to attacks exploiting the CVE-2022-40684 flaw, most of them in Germany and in the US. Now Cyble researchers reported more than 100,000 FortiGate firewalls accessible from the internet that may be targeted by threat actors if not patched yet.

SecurityAffairs — Researchers at Cyble are aware of an Initial Access Broker (IAB ) are likely to be selling access to corporate networks. In early October, Fortinet addressed the authentication bypass vulnerability CVE-2022-40684 affecting the FortiGate Firewall/FortiProxy Web Proxy. An attacker who successfully exploited this vulnerability could log into a vulnerable device, Fortinet said. As of this October, the Shadowserver Foundation has announced that over 17K Fortinet devices exposed online are vulnerable to attacks exploiting the vulnerability CVE-2022-40684, the majority of which are located in Germany and the United States. Now , Cyble researchers report that more than 100,000 Internet-accessible FortiGate firewalls, if still unpatched, could be targeted by threat actors.

Azure Firewall IDPS includes over fifty categories that can be assigned to individual signatures. The following table is a list of definitions for each category. Botcc (command and control bot) This category is for signatures that are automatically generated from various sources of known and confirmed active botnets and other command and control (C2) hosts. This category is updated daily. The primary data source for the category is Shadowserver.org.

A worldwide operation aimed at curtailing fraud has led to the arrest of 975 suspects and the seizure of nearly $130 million, as Interpol expands its efforts and brings new tools to its investigations. Interpol’s National Central Bureaus (NCBs) collaborated with local authorities to pursue arrests. Interpol announced that the linked investigations, dubbed Operation Haechi III, tracked cyber-enabled financial crimes and money laundering in 30 countries. The investigations, which took place between June 28 and Nov. 23, intercepted money transfers and virtual assets, leading to the arrest of 975 suspects in the last five months. Interpol, along with Afripol, also announced an Africa-centric effort — the Africa Cyber Surge Operation — involving 27 countries collaborating over the past four months. The efforts resulted in the takedown of a dark market in Eritrea, investigations into cryptocurrency scams in Cameroon, and the arrest of the operators of malicious cyber infrastructure used for botnets, phishing campaigns, and online extortion. In addition to national government, Interpol credited private-sector partners with helping out, including British Telecom, the Cyber Defense Institute, Fortinet’s FortiGuard Labs, Group-IB, Kaspersky, Palo Alto Networks’ Unit 42 team, Shadowserver, and Trend Micro.

Interpol on Friday announced the arrest of ten individuals suspected of participation in $800,000 scam and fraud operations with global impact. The arrests were made as part of a four-month effort (July to November 2022) called ‘Africa Cyber Surge Operation’ and focused on countering cybercrime across Africa. According to Interpol, law enforcement from 27 countries joined the operation. Law enforcement agencies took action against over 200,000 pieces of malicious cyber infrastructure facilitating cybercrime across the continent, including botnets, phishing, spam, and online extortion activities. The operation received support from multiple private cybersecurity firms, including British Telecom, Cyber Defense Institute, Fortinet, Group-IB, Kaspersky, Palo Alto Networks, Shadowserver, and Trend Micro.

Police in Africa have arrested 10 people connected to global fraud worth an estimated $800,000, after a four-month operation, Interpol has revealed. The global policing organization said that 27 countries joined the Africa Cyber Surge Operation, which ran from July to November. Coordinated from the Interpol Command Centre in Kigali, Rwanda, the operation focused on tackling the enablers of cybercrime, Interpol said. As such, police took action against 200,000 pieces of “malicious cyber infrastructure” across the region, including botnet-linked technology used to run mass phishing, spam and online extortion campaigns. Collaboration was key to the success of the Africa Cyber Surge Operation. Interpol worked with its local equivalent Afripol; private sector security vendors including Trend Micro, Fortinet, Group-IB and Kaspersky; local ISPs and Computer Emergency Response Teams (CERTs); hosting providers; and other players like the non-profit Shadowserver Foundation. Eighteen of the participating countries have CERTs and, crucially, police have now put in place agreements to formalize response work for the future, according to Interpol. Many countries were participating for the first time in such an operation. The operation was sandwiched between a two-week training course in Kigali, in which participants learned about cryptocurrency and cybercrime investigations, and a debrief in Mauritius in November. “The Cyber Surge activities have also led to newly introduced legislative protocols and the establishment of a series of cybercrime departments in member countries, which will further contribute to reducing the impact of cybercrime and protecting communities in the region,” Interpol explained.