CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
MOST PREVALENT MALWARE FILES MARCH 3-10, 2022
TOP VULNERABILITY THIS WEEK: Ukraine continues to be targeted by attacks, potential to spread to other countries

NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Cybersecurity continues to be major factor in Ukraine-Russia conflict
Description: Cisco Talos is observing a variety of threats targeting Ukraine, including disinformation, defacements, DDoS, wiper malware, and potential BGP manipulation. Additionally, there has been increased participation from cyber vigilantes and other actors launching attacks on both sides of the conflict. This has raised serious concerns about both the risks associated with this behavior, as unsophisticated attackers may unintentionally disable key pieces of Ukrainian infrastructure, unintended targets — both within Ukraine and elsewhere — may become collateral damage, and as the possibility arises for these activities to further escalate the threat environment. There have also been serious implications in the crimeware landscape, with the well-known ransomware cartel Conti suffering significant fallout after publicly declaring their support for Russia.
References:

• https://blog.talosintelligence.com/2022/03/ukraine-update.html
• https://blog.talosintelligence.com/2022/02/current-executive-guidance-for-ongoing.html
• https://blogs.cisco.com/news/cisco-stands-on-guard-with-our-customers-in-ukraine

ClamAV signatures: Win.RedTrixx.Wiper.tii.Hunt

Title: Microsoft Patch Tuesday for March 2022
Description: Microsoft released another relatively light security update Tuesday, disclosing 71 vulnerabilities, including fixes for issues in Azure and the Office suite of products. March’s Patch Tuesday only included two critical vulnerabilities, which is notable considering there weren’t any critical issues in February’s security update. This month’s patch batch does not include any threats that Microsoft says have been exploited in the wild, and none of the vulnerabilities disclosed has a severity score higher than 8.8 out of 10. The most serious issue is CVE-2022-23277, a remote code execution vulnerability in Microsoft Exchange Server. An adversary could exploit this vulnerability to target the Exchange Server accounts with arbitrary or remote code execution, according to Microsoft. If the user is authenticated, they could trigger malicious code in the context of the Server account through a network call.
References: https://blog.talosintelligence.com/2022/03/microsoft-patch-tuesday-for-march-2022.html
SNORT® SIDs: 59210 - 59217, 59220 and 59221

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

ICANN has declined Ukraine’s request to revoke Russian domains.
https://arstechnica.com/tech-policy/2022/03/icann-wont-revoke-russian-internet-domains-says-effect-would-be-devastating/

Ukrainian leaders say critical systems like electrical grids and nuclear power plants are more susceptible to physical attacks than cyber threats.
https://www.washingtonpost.com/national-security/2022/03/04/ukraine-nuclear-cyberattack/

Google purchased cybersecurity company Mandiant for roughly $5.4 million with plans to fold the firm into Google Cloud to create an “end-to-end security operations suite.”
https://www.theverge.com/2022/3/8/22966907/google-buying-mandiant-cybersecurity-outfit-5-4-billion

Code signing certificates stolen from Nvidia are being used to sign malware.
https://www.bleepingcomputer.com/news/security/malware-now-using-nvidias-stolen-code-signing-certificates/

A European-focused banking trojan disguised as a legitimate app in the Google Play store was downloaded more than 10,000 times.
https://techcrunch.com/2022/03/03/teabot-data-steal-google-play/

Personal data involved in a massive data breach of T-Mobile in 2021 is widely available and traded on the dark web.
https://www.cyberscoop.com/t-mobile-breach-dark-web-warning-attorneys-general/

MOST PREVALENT MALWARE FILES March 3-10, 2022
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934
MD5: 93fefc3e88ffb78abb36365fa5cf857c
VirusTotal: https://www.virustotal.com/gui/file/e4973db44081591e9bff5117946defbef6041397e56164f485cf8ec57b1d8934/details
Typical Filename: Wextract
Claimed Product: Internet Explorer
Detection Name: PUA.Win.Trojan.Generic::85.lp.ret.sbx.tg

SHA 256: 792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0
MD5: b46b60327c12290e13b86e75d53114ae
VirusTotal: https://www.virustotal.com/gui/file/792bc2254ce371be35fcba29b88a228d0c6e892f9a525c330bcbc4862b9765d0/details
Typical Filename: NAPA_HQ_SetW10config.exe
Claimed Product: N/A
Detection Name: W32.File.MalParent

SHA 256: 02f6094b5d14e880a1fb7eef90228dbb34102788b5e513836750f90894dde185
MD5: 1152e84337d5d4c56c66a692676b7422
VirusTotal: https://www.virustotal.com/gui/file/02f6094b5d14e880a1fb7eef90228dbb34102788b5e513836750f90894dde185/details
Typical Filename: WaveSWUpdater.exe
Claimed Product: Wavesor SWUpdater
Detection Name: W32.02F6094B5D.Wavesor.SSO.Talos

SHA 256: 5a8660fdb45a0016725485a8a0e94df5a992953437ac18017850ec6e26d26b4a
MD5: 6c863625fe503e89e916dfff22a1c4e6
VirusTotal: https://www.virustotal.com/gui/file/5a8660fdb45a0016725485a8a0e94df5a992953437ac18017850ec6e26d26b4a/details
Typical Filename: TiWorker.exe
Claimed Product: Microsoft® Windows® Operating System
Detection Name: PUA.Win.Dropper.Miner::tpd

SHA 256: dcbb12bf4dd59d4907cb2c8daad2ba558fb462fdb795159e1b3c1ba8ecba9265
MD5: e253fa52dc43a4db2b73b1ce8db04572
VirusTotal: https://www.virustotal.com/gui/file/dcbb12bf4dd59d4907cb2c8daad2ba558fb462fdb795159e1b3c1ba8ecba9265/details
Typical Filename: KMSAuto_Lite_Portable_v1.2.1.zip
Claimed Product: N/A
Detection Name: PUA.Win.Tool.Hackkms::mash.sr.sbx.vioc