Threat Intelligence Report December 7th - December 13th 2020

 
   Trends

• The top attacker country was China with 127557 unique attackers (33.39%).
• The top Trojan C&C server detected was Lokibot with 10 instances detected.
• The top phishing campaign detected was against Facebook accounts with 44 instances detected.
  
  FORTINET

  Over 500 Australian Fortinet customers including Government agencies and internal departments as well as
  iconic organisations within the Australian finance and banking sector, have had their FortiGate IPs and other sensitive credentials leaked on a prominent hacker forum. An unknown hacker posted a list of one-line exploits
  for CVE-2019-13379 to steal VPN credentials from vulnerable target devices.  

  These remote command execution vulnerabilities affect over 1.5 million devices globally, and with no automatic update mechanism included within Fortinet's appliance, many affected systems will remain unpatched for the foreseeable future. Additionally, even if the affected Fortinet VPNs are later patched, those passwords can be reused by anyone with access to the leaked data and potentially regain control to the VPNs.  

  Critical summary of CVE-2019-13379: 

  An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to
  6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 under SSL VPN web portal allows an unauthenticated attacker to
  download system files via special crafted HTTP resource requests.   

  This vulnerability has been chained with improper permissions set on the SSL VPN session file which can be accessed through path traversal from the Webroot in a publicly disclosedPoC exploit released 11/08/2019. 
  
  COVID-19 DOCUMENTATION HACK

  The European Medicines Agency (EMA) which controls the use of medicines across the European Union, has been a target of a cyberattack. With the attack focusing on documentation relating to the regulatory submission for Pfizer and BioNtech's COVID-19 vaccine candidate BNT162b2.  

  The Agency has launched a full investigation with close cooperation with law enforcement and other relevant entities. No additional information concerning the cyberattack has been released.  
  
  

  GOOGLE PLAY CORE LIBRARY

  A security flaw has been located within Google Play Core Library, placing hundreds of millions of Android users at risk. The CVE-2020-8913 is a local-code-execution vulnerabilitywhich resides within the SplitCompat.install endpoint in Android's Play Core Library. Thissecurity flaw provides cybercriminals with the opportunity to gain code execution inside popular applications located within the Google Play Store, allowing them to have the same data access as those vulnerable applications.  
  ​​​​​​

   Top Attackers By Country

   Top Attackers By Country

   Threat Geo-location

   Top Attacking Hosts

Top Attackers

   Top Network Attackers

   Remote Access Trojan C&C Servers Found

Trojan C&C Servers Detected

AgentTesla  Amadey  Anubis  Azorult  BlackNet  CobaltStrike  DiamondFox  Heodo  Keitaro  Kpot  Loader  Lokibot  Oski  Pony  Predator  Redirected  Trickbot  TriumphLoader  Zloader

   Common Malware

   Top Phishing Campaigns

   CVEs with Recently Discovered Exploits

     This is a list of recent vulnerabilities for which exploits are available.