Threat Intelligence Report - November 4-10 2019

Trends

• The top attacker country was China with 2594 unique attackers (36%).
• The top Exploit event was Authentication with 37% of occurrences.
• The top Trojan C&C server detected was Heodo with 26 instances detected.
• The most prevalent malware detected was Bitcoin Miner xme64-2141.exe, first seen 10th March 2019.

Top Attacker by Country

Threat Geolocation

Top Attacking Hosts

Top Network Attackers

Top Events Nids and Exploits

Top Alarms

Comparison from last week 

Remote Access Trojan C&C Servers Found

Common Malware

CVEs For Which Public Exploits Have Been Detected

ID:        CVE-2019-2114
Title:    NFC Beaming Android Security Control Bypass Vulnerability
Vendor:    Google
Description: NFC beaming of applications between devices using Android OS bypasses some security controls (the "install unknown application" prompt). This could lead to local escalation of privilege by installing an application with no additional execution privileges needed. This means, that an Android phone that has NFC and Android Beam enabled, then touching a malicious phone or a malicious NFC payment terminal to the device may allow malware to be installed by bypassing the "install unknown apps" prompt.
CVSS v2 Base Score:    4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)

ID:        CVE-2019-11932
Title:    Whatsapp Remote Code Execution Vulnerability
Vendor:    Whatsapp
Description: A double free vulnerability exists in the DDGifSlurp function in decoding.c in libpl_droidsonroids_gif as used in WhatsApp for Android before 2.19.244. Successful exploitation allows remote attackers to execute arbitrary code or cause a denial of service.
CVSS v2 Base Score:    7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

ID:        CVE-2019-11043
Title:    PHP 7 Remote Code Execution Vulnerability
Vendor:    Multi-Vendor
Description: A vulnerability exists in PHP where insufficient validation in the path handling code of FPM module could result in the execution of arbitrary code and to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. This vulnerability could be exploited to gain partial access to sensitive information. Malicious users could also use this vulnerability to change partial contents or configuration on the system.
CVSS v2 Base Score:    7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

ID:        CVE-2019-16662
Title:    rConfig Remote Code Execution Vulnerability
Vendor:    Multi-Vendor
Description: An issue was discovered in rConfig where an attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution
CVSS v2 Base Score:    10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID:        CVE-2019-1414
Title:    Visual Studio Code Elevation of Privilege Vulnerability
Vendor:    Microsoft
Description: An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer. A local attacker who successfully exploited the vulnerability could inject arbitrary code to run in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system.
CVSS v2 Base Score:    6.3 (AV:L/AC:M/Au:N/C:C/I:C/A:N)

ID:        CVE-2019-2888
Title:    Oracle WebLogic Server EJBTaglibDescriptor XXE Vulnerability
Vendor:    Oracle
Description: A vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data.
CVSS v2 Base Score:    5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)