CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES February 24-MARCH 3, 2022
TOP VULNERABILITY THIS WEEK: Wiper Campaigns Hit Ukraine

NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Series of wiper campaigns hit Ukraine, globe as conflict escalates
Description: Cisco Talos is aware of a second wave of wiper attacks ongoing inside Ukraine, leveraging a new wiper that has been dubbed “HermeticWiper.” Deployment of the destructive malware began on Feb. 23, 2022. HermeticWiper features behavioral characteristics similar to what was observed during the WhisperGate attacks that occurred in January. The malware has two components designed for destruction: one that targets the Master Boot Record (MBR) and another targeting partitions. There are several additional components of this campaign, including HermeticWizard, which allows HermeticWiper to be propagated to and deployed on additional systems within affected environments. There is also IsaacWiper, an additional wiper responsible for the destruction of systems and data and HermeticRansom, a ransomware family that has been observed being deployed at the same time as HermeticWiper as a diversionary tactic.
References: https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
SNORT® SIDs: 59099 and 59100
ClamAV signatures: Win.RedTrixx.Wiper.tii.Hunt

Title: Wireless routers targeted with Cylops Blink malware
Description: Cisco Talos is aware of the recent reporting around a new modular malware family, Cyclops Blink, that targets small and home office (SOHO) devices, similar to previously observed threats like VPNFilter. This malware is designed to run on Linux systems and is compiled specifically for 32-bit PowerPC architecture. The modular nature of this malware allows it to be used in a variety of ways, including typical reconnaissance and espionage activity. It leverages modules to facilitate various operations such as establishment of C2, file upload/download and information extraction capabilities. Talos discovered compromised MikroTik routers inside of Ukraine being leveraged to conduct brute-force attacks on devices protected by multi-factor authentication. This continues a pattern we have seen since our investigation into VPNFilter involving actors using MikroTik routers. While it may not be Cyclops Blink specifically, it was yet another MikroTik router passing malicious traffic, a vendor widely abused by VPNFilter in the past.
References: https://blog.talosintelligence.com/2022/02/threat-advisory-cyclops-blink.html
SNORT® SIDs: 59095 – 59098
ClamAV signatures: Unix.Backdoor.CyclopsBlink

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Cyber attackers across the globe are taking advantage of the current conflict in Ukraine, spreading wipers and other malware, potentially raising the risk of misattribution and escalating threats.
https://blog.talosintelligence.com/2022/03/ukraine-update.html

The Ukrainian invasion has raised questions about how much cyber warfare could become involved in the conflict, or if past cyber attacks set the stage for the invasion.
https://www.vox.com/recode/22950633/cyberattacks-russia-ukraine-us-cyberwar

The U.S. Cybersecurity and Infrastructure Security Agency and the FBI are warning that wiper attacks targeting Ukraine could spill over to targets in other countries.
https://www.bleepingcomputer.com/news/security/cisa-and-fbi-warn-of-potential-data-wiping-attacks-spillover/

Large tech companies are calling on international powers to agree on new restrictions around cyber warfare similar to the Geneva Conventions to try and prevent attacks targeting crucial sectors humans rely on.
https://www.cnn.com/2022/03/01/tech/microsoft-geneva-convention-ukraine/index.html

Many tech and cybersecurity companies have offered to assist Ukraine with cybersecurity, internet and networking needs in the wake of Russia’s attack, many offering free services and software.
https://www.nytimes.com/2022/02/28/us/politics/ukraine-russia-microsoft.html

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2021-43049 |
Title: Information disclosure vulnerability in TIBCO BusinessConnect Container Edition
Description: The Database component of TIBCO Software Inc.’s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain the usernames and passwords of users of the affected system. Affected releases are TIBCO Software Inc.’s TIBCO BusinessConnect Container Edition: versions 1.1.0 and below.
CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

ID: CVE-2022-20708 |
Title: Code Execution Vulnerability in Cisco Small Business Routers
Description: Cisco RV340 routers are impacted by this vulnerability. An attacker might take advantage of this flaw to execute code in the context of root. Although authentication is necessary to exploit this flaw, the current authentication system can be bypassed. The problem arises from the failure to properly validate a user-supplied string before utilizing it to call a system function.
CVSS v3.1 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

MOST PREVALENT MALWARE FILES February 24-March 3, 2022
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934
MD5: 93fefc3e88ffb78abb36365fa5cf857c
VirusTotal: https://www.virustotal.com/gui/file/e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934/details
Typical Filename: Wextract
Claimed Product: Internet Explorer
Detection Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg

SHA 256: 792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0
MD5: b46b60327c12290e13b86e75d53114ae
VirusTotal: https://www.virustotal.com/gui/file/792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0/details
Typical Filename: NAPA_HQ_SetW10config.exe
Claimed Product: N/A
Detection Name: W32.File.MalParent

SHA 256: 02f6094b5d14e880a1fb7eef90228dbb34102788b5e513836750f90894dde185
MD5: 1152e84337d5d4c56c66a692676b7422
VirusTotal: https://www.virustotal.com/gui/file/02f6094b5d14e880a1fb7eef90228dbb34102788b5e513836750f90894dde185/details Typical Filename: WaveSWUpdater.exe
Claimed Product: Wavesor SWUpdater
Detection Name: W32.02F6094B5D.Wavesor.SSO.Talos

SHA 256: 5a8660fdb45a0016725485a8a0e94df5a992953437ac18017850ec6e26d26b4a
MD5: 6c863625fe503e89e916dfff22a1c4e6
VirusTotal: https://www.virustotal.com/gui/file/5a8660fdb45a0016725485a8a0e94df5a992953437ac18017850ec6e26d26b4a/details
Typical Filename: TiWorker.exe
Claimed Product: Microsoft® Windows® Operating System
Detection Name: PUA.Win.Dropper.Miner::tpd

SHA 256: dcbb12bf4dd59d4907cb2c8daad2ba558fb462fdb795159e1b3c1ba8ecba9265
MD5: e253fa52dc43a4db2b73b1ce8db04572
VirusTotal: https://www.virustotal.com/gui/file/dcbb12bf4dd59d4907cb2c8daad2ba558fb462fdb795159e1b3c1ba8ecba9265/details
Typical Filename: KMSAuto_Lite_Portable_v1.2.1.zip
Claimed Product: N/A
Detection Name: PUA.Win.Tool.Hackkms::mash.sr.sbx.vioc