| New Threat Detection Added | 2 (Ivanti Cloud Services Appliance CVE-2024-8190 and Lumma Stealer) |
| New Threat Protections | 84 |
Weekly Detected Threats
The following threats were added to Crystal Eye XDR this week:
Threat name: | Ivanti Cloud Services Appliance CVE-2024-8190 | |||||||||||||||||||||
Nation-state adversaries exploited zero-day vulnerabilities in Ivanti Cloud Services Appliance (CSA), chaining multiple exploits. A publicly unknown path traversal vulnerability on the resource /client/index.php (CVE-2024-8963, disclosed September 19) allowed unauthorised access to other resources like users.php and reports.php. Additionally, a command injection vulnerability on reports.php (CVE-2024-9380, disclosed October 8) enabled remote command execution. These vulnerabilities allowed attackers to bypass security, gaining control of compromised systems. | ||||||||||||||||||||||
Threat Protected: | 01 | |||||||||||||||||||||
Rule Set Type: |
| |||||||||||||||||||||
Class Type: | Attempted-admin | |||||||||||||||||||||
Kill Chain: |
| |||||||||||||||||||||
Threat name: | Lumma Stealer | |||||||||||||||||||||
Lumma Stealer is a sophisticated malware that exploits fake CAPTCHA pages to distribute itself, targeting Windows users. The malware is distributed via phishing sites that trick victims into executing malicious PowerShell commands. Lumma Stealer steals sensitive data like credentials, financial information, and personal files. It leverages various CDN platforms for delivery and evades detection using base64 encoding and clipboard manipulation. This malware is dangerous due to its stealth tactics and the growing trend of fake CAPTCHA attacks. | ||||||||||||||||||||||
Threat Protected: | 48 | |||||||||||||||||||||
Rule Set Type: |
| |||||||||||||||||||||
Class Type: | Trojan-activity | |||||||||||||||||||||
Kill Chain: |
| |||||||||||||||||||||
Known exploited vulnerabilities (Week 3 - October 2024)
Threat | CVSS | Description | |
CVE-2024-28987 | 9.1 (Critical) | SolarWinds Web Help Desk Hardcoded Credential Vulnerability | |
CVE-2024-9680 | 9.8 (Critical) | Mozilla Firefox Use-After-Free Vulnerability | |
CVE-2024-30088 | 7.0 (High) | Microsoft Windows Kernel TOCTOU Race Condition Vulnerability | |
CVE-2024-40711 | 9.8 (Critical) | Veeam Backup and Replication Deserialization Vulnerability |
For more information, please visit the Red Piranha Forum:
https://forum.redpiranha.net/t/known-exploited-vulnerabilities-catalog-3rd-week-of-october-2024/513
Updated Malware Signatures (Week 3 - October 2024)
Threat | Description | |
Zeus | Also known as Zbot, this malware is primarily designed to steal banking credentials. | |
Lumma Stealer | A type of malware classified as an information stealer. Its primary purpose is to steal sensitive information from infected systems, including but not limited to credentials, financial information, browser data, and potentially other personal or confidential information. | |
Vidar | A stealer designed to collect sensitive data from infected machines. It usually targets Windows-based machines and is spread through email attachments or downloads from compromised websites. |
| Ransomware Report | |
The Red Piranha Team actively and closely monitors the dark web and other sources to track ransomware activities globally. In the past week alone, we have uncovered new ransomware victims and updates on existing cases across 19 industries and 11 countries. This surge underscores the pervasive and growing reach of ransomware, affecting organisations of all sizes and sectors, from healthcare to manufacturing. These findings highlight the evolving nature of ransomware, posing significant operational and financial risks to businesses in diverse regions globally. | |
| Name of Ransomware Group | Percentage of new Victims last week |
33.33% | |
Cicada3301 | 12.82% |
Meow | 7.69% |
7.69% | |
Cactus | 7.69% |
Sarcoma | 5.13% |
Hunters | 5.13% |
Killsec | 5.13% |
Black suit | 2.56% |
Interlock | 2.56% |
Lynx | 2.56% |
Rhysida | 2.56% |
2.56% | |
Everest | 2.56% |
Killsec Ransomware
Killsec ransomware, first identified in October 2023, has quickly gained notoriety for targeting critical industries such as government, finance, and manufacturing. Employing a hybrid extortion model, Killsec not only encrypts data but also defaces websites to further pressure victims. Its ransom demands typically range from €1,500 to $25,000. The ransomware group is notorious for leveraging phishing, exploiting Remote Desktop Protocol (RDP) weaknesses, and utilising double extortion to steal sensitive data before encryption.
Killsec’s rise demonstrates the ever-evolving nature of ransomware, emphasising the need for comprehensive cybersecurity strategies, including patch management, regular security audits, and training to identify phishing attacks. By combining traditional encryption-based extortion with new methods such as website defacement, Killsec presents a formidable challenge to modern organisations.
Detailed TTPs:
- Command-and-Control (C2): Killsec uses encrypted communication channels to maintain stealth. They often communicate via command-and-control servers, which coordinate attacks and issue commands to deploy malware within victims' systems.
- Lateral Movement: Once they gain access through RDP exploitation, Killsec deploys tools such as PowerShell scripts to move laterally across the network, enabling them to compromise additional systems and escalate privileges.
- Credential Dumping: Post-compromise, Killsec frequently engages in credential dumping to harvest login credentials, gaining higher-level access to more critical systems.
- Process Injection: To evade detection, Killsec often injects malicious code into legitimate system processes. This tactic helps them avoid endpoint detection systems while maintaining persistence on the network.
- Advanced Encryption: Killsec leverages robust encryption techniques, making decryption nearly impossible without their private key. The ransomware uses sophisticated algorithms, locking out victims from accessing crucial data unless they pay the ransom.
Data Leak Site: Killsec ransomware operates a data leak site on the dark web where they expose victims who refuse to meet ransom demands. This site lists compromised organisations, leveraging public shaming as an additional extortion tactic. By making sensitive data public, Killsec increases the pressure on victims to pay the ransom to avoid further reputational damage and data exposure. This aggressive approach mirrors the tactics of other ransomware groups, emphasising Killsec’s commitment to exploiting both the financial and reputational vulnerabilities of its victims.