| New Threat Detection Added | 2 (Ivanti CSA Zero-Day Exploitation and BugSleep Remote Access Tool (RAT)) |
| New Threat Protections | 137 |
Weekly Detected Threats
The following threats were added to Crystal Eye XDR this week:
Threat name: | Ivanti CSA Zero-Day Exploitation | ||||||||||||||||||
Advanced threat actors have exploited multiple zero-day vulnerabilities in Ivanti's Cloud Services Appliance (CSA), including CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380. These vulnerabilities allow attackers to perform unauthorised actions such as path traversal and command injection, leading to potential system compromise. The exploitation of these flaws underscores the importance of timely patching and robust security measures. | |||||||||||||||||||
Threat Protected: | 01 | ||||||||||||||||||
Rule Set Type: |
| ||||||||||||||||||
Class Type: | Attempted-admin | ||||||||||||||||||
Kill Chain: |
| ||||||||||||||||||
Threat name: | BugSleep Remote Access Tool (RAT) | ||||||||||||||||||||||||
BugSleep is a sophisticated Remote Access Tool (RAT) that provides attackers with reverse shell capabilities and file input/output operations on compromised endpoints. It employs a custom Command-and-Control (C2) protocol over plain TCP sockets, utilizing a pseudo-Type Length Value (TLV) structure for communication. The malware encrypts payloads by subtracting a static value from each byte, enhancing its stealth. BugSleep's functionalities include reverse shell access, file manipulation, and persistence mechanisms, posing significant risks to affected systems. | |||||||||||||||||||||||||
Threat Protected: | 02 | ||||||||||||||||||||||||
Rule Set Type: |
| ||||||||||||||||||||||||
Class Type: | Attempted-admin | ||||||||||||||||||||||||
Kill Chain: |
| ||||||||||||||||||||||||
Known exploited vulnerabilities (Week 5 - October 2024)
Threat | CVSS | Description | |
CVE-2024-51567 | 10.0 (Critical) | CyberPanel pre-auth remote code execution vulnerability |
For more information, please visit the Red Piranha Forum:
https://forum.redpiranha.net/t/known-exploited-vulnerabilities-catalog-5th-week-of-october-2024/519
Updated Malware Signatures (Week 5 - October 2024)
Threat | Description | |
Zeus | Also known as Zbot, this malware is primarily designed to steal banking credentials. | |
Lumma Stealer | A type of malware classified as an information stealer. Its primary purpose is to steal sensitive information from infected systems, including but not limited to credentials, financial information, browser data, and potentially other personal or confidential information. | |
Vidar | A stealer designed to collect sensitive data from infected machines. It usually targets Windows-based machines and is spread through email attachments or downloads from compromised websites. |
| Ransomware Report | |
The Red Piranha Team actively monitors the dark web and other sources to identify organisations globally affected by ransomware attacks. In the past week, we uncovered numerous ransomware incidents across various groups, highlighting the ongoing and pervasive nature of these cyber threats. Below is the breakdown of ransomware group activities for this period. | |
| Name of Ransomware Group | Percentage of new Victims last week |
12.26% | |
BlackSuit | 3.77% |
Meow | 3.77% |
Interlock | 1.89% |
Donut Leaks | 1.89% |
Bianlian | 1.89% |
RA Group | 1.89% |
12.26% | |
Brain Cipher | 3.77% |
Killsec | 9.43% |
RansomHouse | 2.83% |
El Dorado | 2.83% |
Playboy | 2.83% |
5.66% | |
Lynx | 0.94% |
Handala | 1.89% |
Arcus | 0.94% |
Abyss-data | 0.94% |
Eraleign (APT73) | 2.83% |
Sarcoma | 2.83% |
Cactus | 0.94% |
3AM | 5.66% |
Qilin | 10.38% |
Everest | 5.66% |
Play Ransomware Analysis
Play ransomware, emerging as one of the most active threat actors with 12.26% of total attacks in our recent analysis, has gained significant attention due to its collaboration with North Korean state-sponsored actors. This partnership marks a concerning evolution in ransomware operations, blending cybercrime with state-sponsored capabilities.
Play Ransomware: North Korean State Actor Connections
Key Connection Points
- Infrastructure Overlap
- Shared Command-and-Control (C2) infrastructure with North Korean APT groups
- Common IP addresses used in attacks (68.235.184[.]54)
- Identical server configurations and malware deployment patterns
- Technical Similarities
- Use of Tactics, Techniques, and Procedures (TTPs) similar to UNC4899
- Deployment of DPRK-linked malware alongside Play ransomware
- Common exploitation of vulnerabilities like ProxyNotShell and OWASSRF
- Attack Pattern Correlations
- Coordinated targeting healthcare organisations
- Similar victim selection methodology
- Synchronised timing of attacks
Detailed TTPs for Play Ransomware with North Korean Connection
- Initial Access and Exploitation:
- Exploits Microsoft Exchange vulnerabilities (ProxyNotShell and OWASSRF)
- Exploits specifically CVE-2022-41082 and CVE-2022-41040
- Targets healthcare sector organisations predominantly
- Deploys web shells for persistent access
- Infrastructure and Operations:
- Shares C2 infrastructure with IP address 68.235.184[.]54
- Connects with UNC4899 operations
- Maintains common Command-and-Control servers
- Deploys shared malware infrastructure
- Post-Exploitation Activities:
- Deploys Cobalt Strike beacons for network control
- Executes PowerShell commands for system manipulation
- Implements BitLocker encryption for data impact
- Performs Volume Shadow Copy Deletion
- Lateral Movement and Persistence:
- Modifies Windows Registry for persistence
- Creates scheduled tasks for maintained access
- Installs malicious services
- Abuses admin shares for movement
- Data Impact and Encryption:
- Uses BitLocker Drive Encryption for file encryption
- Targets system backups systematically
- Deletes volume shadow copies
- Implements secure data destruction methods
- Tool Deployment and Usage:
- Deploys custom web shells for access
- Uses sophisticated PowerShell scripts
- Implements Remote Administration Tools
- Employs shared North Korean malware variants
- Strategic Operations:
- Coordinates synchronised attack timing
- Shares attack infrastructure with DPRK actors
- Focuses on the healthcare sector targeting
- Implements common exploitation techniques
- Command-and-Control:
- Uses shared hosting providers
- Maintains overlapping C2 servers with DPRK operations
- Implements sophisticated proxy mechanisms
- Deploys coordinated control infrastructure