By security practitioners, for security practitioners novacoast federal | Pillr | novacoast | about innovate
By security practitioners, for security practitioners

Weekly Top 10 – 10.23.2023- Critical Vulnerability in Cisco IOS XE Leads to Over 30k Compromised Devices, Threat Actors Abuse Google Ads to Deliver Malware, QR Codes Used to Spread Malware and Steal Passwords, Coordinated Law Enforcement Effort Takes Down RagnarLocker Ransomware Gang


Our Threat Operations and Intelligence team compiles a daily digest of the most recent online cybersecurity risks. The following top 10 stories were selected from the 40+ original ones we determined to be most significant during the course of the week, ranking by highest risk and using multiple sources when available:

  1. Critical Vulnerability in Cisco IOS XE Leads to Over 30k Compromised Devices
    Cisco released a security advisory detailing an authentication bypass vulnerability in IOS XE devices, which include switches, routers, access points, etc. The vulnerability (CVE-2023-20198, with a CVSS score of 10) resides in the Web UI and allows for attackers to create new administrative users. Two days after the announcement by Cisco, over 30,000 devices with public-facing access to the Web UI have been compromised.
  2. Vulnerability in Synology DSM Allows for Admin Account Takeover

    In June, Synology, the producer of many celebrated Network Attached Storage (NAS) items, brought to light a security flaw in their Disk Station Manager (DSM) programming. Presently, the security warning still says that rectification is ‘continuing’. This vulnerability (CVE-2023-2729, with a CVSS score of 7.5) permits aggressors to reassemble the arbitrary seed utilized to make the administrator secret phrase when the gadget was set up, giving the assailant the capacity to decode the secret phrase itself and access the executive account.
  3. Threat Actors Abuse Google Ads to Deliver Malware

    MalwareBytes recently wrote about a method that bad people use called “malvertizing.” In this method, they pay Google Ads to show up as the first search result for popular, safe software like Notepad++. Despite having misleading titles, these URLs lead to sites with malicious downloads. Should an unsuspecting user click through, they may be exposed to a variety of malware types, ranging from spyware to info-stealers and command & control.
  4. QR Codes Used to Spread Malware and Steal Passwords

    As QR codes become more popular, threat actors are using them to spread malware (Quishing) and steal credentials (QRLJacking). Malicious QR codes escape anti-phishing training since users don’t see the URL before visiting the website. Users must be taught to check the destination URL after clicking a link or scanning a QR code to verify the page.
  5. Coordinated Law Enforcement Effort Takes Down RagnarLocker Ransomware Gang

    Early on October 19th, Europol seized the dark web negotiation and leak site for the RagnarLocker Ransomware group. It now displays the emblems of multiple law enforcement agencies and a message stating “This service has been seized as part of a coordinated international law enforcement action against the RagnarLocker group.”
  6. Fake Browser Update Malware Employs Blockchain for Defense Evasion

    Randy McEoin discovered a malware campaign using fake browser updates called ClearFake. This campaign compromises WordPress websites and injects JavaScript code that states the user needs to update their browser to use the website. The user then downloads a malicious executable posing as an updater. However, to prevent their malware from being taken down, attackers have begun hosting this malware on the Binance Smart Chain, a decentralized blockchain platform created to run applications or smart contracts. Due to the unchangeable state of blockchain, the malware cannot be removed and a permanent download location is created.
  7. Ukrainian Cyber Alliance Destroys the Infrastructure of Trigona Ransomware Group

    The Ukrainian Cyber Alliance infiltrated the Trigona ransomware network, completely replacing their dark web site with the UCA logo. Additionally, they state they have taken out three complete server backups, crypto wallets, source code, and data from various programs such as Rocket Chat, Confluence, and Jira. Moreover, they eradicated all the data, forcing the ransomware gang to reconstruct their whole system from the beginning. There is an opportunity that the exfiltrated data includes victim decryption keys.
  8. ShellBot Linux Malware Uses New Methods to Avoid Detection

    Threat actors exploited a vulnerability in the HTTP/2 protocol to perform the largest ever DDoS attack to date. Google recorded 398 million requests per second, which is seven and a half times more than the previous record-holder, Cloudflare, who recorded 46 million requests per second. The target companies mostly mitigated these attacks, which did not appear to result in any service outages.
  9. Hackers Use Scripts to Deliver Several Types of Malware at Once

    The FBI released an advisory this year about scripts used by attackers to download different types of malware at the same time. The scripts are called “multi-tooling” and allow the attackers to make money while gathering data for further compromise or to sell. Kaspersky has stated that they see multi-tooling scripts being used often.
  10. Attackers Continue to Exploit Critical WinRAR Vulnerability

    In August, a critical vulnerability was found in WinRAR. This allows for remote code execution when users try to view a file in a zip archive. Patches have been available, but Google’s TAG (Threat Analysis Group) says that Russian state-sponsored APTs still use this vulnerability. Make sure the latest WinRAR patches are applied to prevent exploitation.
    Previous Post

    Current Dependency Vulnerabilities Giving Us PTSD

    Next Post

    Weekly Top 10 – 10.30.2023- Critical Vulnerabilities in SolarWinds Access Rights Manager, Zero-Day in Roundcube Exploited by Nation State Actors, VMWare VCenter Security Flaw Patched in End-of-Life Products, Vulnerabilities in Google Chrome Lead to Remote Code Execution

    Innovate uses cookies to give you the best online experience. If you continue to use this site, you agree to the use of cookies. Please see our privacy policy for details.