Healthcare firm HealthEquity disclosed a data breach caused by a partner’s compromised account that exposed protected health information.

Healthcare fintech firm HealthEquity disclosed a data breach after a partner’s compromised account was used to access its systems. The intruders have stolen protected health information from the company systems. The company discovered an anomalous behavior from the partner’s personal device and immediately launched an investigation that led to the discovery of the security breach.

“The investigation concluded that the Partner’s user account had been compromised by an unauthorized third party, who used that account to access information. The accessed information included some personally identifiable information, which in some cases is considered protected health information, pertaining to certain of our members. The investigation further concluded that some information was subsequently transferred off the Partner’s systems.” reads the FORM 8-K filed with SEC. “The Company has taken steps to strengthen its security environment, including with respect to the compromised Partner account and the recommended actions of its incident response firm. The investigation did not find placement of malicious code on any Company systems. There has been no interruption to the Company’s systems, services, or business operations.”

HealthEquity is a leading financial technology company that specializes in administering health savings accounts (HSAs) and other consumer-directed benefits. Some key facts about HealthEquity:

As of July 2022, HealthEquity managed 7.5 million HSA accounts with $20.5 billion in assets, plus an additional 7 million other consumer-directed benefit accounts for a total of 14.5 million accounts.

The company is notifying its partners and clients, as well as identifying and notifying impacted individual members.

HealthEquity will offer complimentary credit monitoring and identity restoration services. The investigation is still ongoing and the healthcare fintech firm has yet to determine the fill impact of the incident.

“The Company does not currently believe the incident will have a material adverse effect on its business, operations, or financial results.” continues the Form 8-K.

“The Company believes it holds adequate cybersecurity insurance for this incident and will also be seeking recourse from the Partner.”

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, healthcare)

Brazil’s data protection authority temporarily banned Meta from using data originating in the country to train its artificial intelligence.

Brazil’s data protection authority, Autoridade Nacional de Proteção de Dados (ANPD), has imposed a temporary ban on Meta from processing users’ personal data for training its artificial intelligence (AI) models.

“The National Data Protection Authority (ANPD) issued today a Preventive Measure determining the immediate suspension, in Brazil, of the validity of the new privacy policy of the company Meta , which authorized the use of personal data published on its platforms for the purpose of training artificial intelligence (AI) systems.” reads the announcement published by ANPD. 

ANPD also announced a daily fine of R$50,000 for non-compliance.

The Board of Directors issued a Preventive Measure due to the “use of an inadequate legal basis for data processing, insufficient disclosure of clear and accessible information about privacy policy changes and data processing, excessive limitations on the exercise of data subjects’ rights, and processing of children’s and adolescents’ personal data without proper safeguards.”

Meta’s updated privacy policy allows the social media giant to use public posts for its AI systems.

Meta expressed disappointment with the decision, claiming its practices comply with Brazilian privacy laws.

“This is a step backwards for innovation, competition in AI development and further delays bringing the benefits of AI to people in Brazil,” the spokesperson said.

Human Rights Watch recently published a report revealing that LAION-5B, a major image-text dataset used for training AI models, includes identifiable photos of Brazilian children. These models can be used by tools employed to create malicious deepfakes that put even more children at risk of exploitation,

In June, Meta announced it is delaying the training of its large language models (LLMs) using public content shared by adults on Facebook and Instagram following the Irish Data Protection Commission (DPC) request.

Meta added it is disappointed by request from the Irish Data Protection Commission (DPC), the social network giant pointed out that this is a step “backwards for European innovation, competition in AI development and further delays bringing the benefits of AI to people in Europe.”

“We’re disappointed by the request from the Irish Data Protection Commission (DPC), our lead regulator, on behalf of the European DPAs, to delay training our large language models (LLMs) using public content shared by adults on Facebook and Instagram  — particularly since we incorporated regulatory feedback and the European DPAs have been informed since March.” reads the statement from Meta. “This is a step backwards for European innovation, competition in AI development and further delays bringing the benefits of AI to people in Europe.”

The company explained that its AI, including Llama LLM, is already available in other parts of the world. Meta explained that to provide a better service to its European communities, it needs to train the models on relevant information that reflects the diverse languages, geography and cultural references of the people in Europe. For this reason, the company initially planned to train its large language models using the content that its European users in the EU have publicly stated on its products and services.

Meta added that the delay will allow it to address requests from the U.K. Information Commissioner’s Office (ICO) before starting the training.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, Meta)

Microsoft has revealed two security flaws in Rockwell Automation PanelView Plus that could be weaponized by remote, unauthenticated attackers to execute arbitrary code and trigger a denial-of-service (DoS) condition. "The [remote code execution] vulnerability in PanelView Plus involves two custom classes that can be abused to upload and load a malicious DLL into the device," security researcher

Technology company Splunk released security updates to address 16 vulnerabilities in Splunk Enterprise and Cloud Platform.

Technology company Splunk addressed 16 vulnerabilities in Splunk Enterprise and Cloud Platform, including four high-severity flaws.

The vulnerability CVE-2024-36985 is a Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise.

“In Splunk Enterprise versions below 9.0.10, 9.1.5, and 9.2.2, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could cause a Remote Code Execution through an external lookup that likely references the “splunk_archiver“ application.” reads the advisory. “The “splunk_archiver“ application likely contains a script called “copybuckets.py“ that itself references a file called “erp_launcher.py“, which would likely execute a script called “sudobash. The “sudobash“ script does not perform any input checking. Therefore it runs a bash shell with arguments supplied by the “erp_launcher.py“ file. This can lead to an RCE.”

Splunk Enterprise versions 9.2.2, 9.1.5, and 9.0.10, or higher address the issue, the company also recommends disabling the “splunk_archiver“ application to temporarily mitigate the issue.

The company addressed another high-serverity bug, tracked as CVE-2024-36984, which is a Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows.

“In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.” reads the advisory. “The exploit requires the use of the collect SPL command which writes a file within the Splunk Enterprise installation. The attacker could then use this file to submit a serialized payload that could result in execution of code within the payload.”

Splunk Enterprise versions 9.2.2, 9.1.5, and 9.0.10, or higher address the issue.

If users do not log in to Splunk Web on indexers in a distributed environment, disabling Splunk Web on those indexers can mitigate the issue.

Below is the list of the addressed flaws:

SVD	Date	Title	Severity	CVE
SVD-2024-0718	2024-07-01	Third-Party Package Updates in Splunk Enterprise – July 2024	High
SVD-2024-0717	2024-07-01	Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint	Medium	CVE-2024-36997
SVD-2024-0716	2024-07-01	Information Disclosure of user names	Medium	CVE-2024-36996
SVD-2024-0715	2024-07-01	Low-privileged user could create experimental items	Medium	CVE-2024-36995
SVD-2024-0714	2024-07-01	Persistent Cross-site Scripting (XSS) in Dashboard Elements	Medium	CVE-2024-36994
SVD-2024-0713	2024-07-01	Persistent Cross-site Scripting (XSS) in Web Bulletin	Medium	CVE-2024-36993
SVD-2024-0712	2024-07-01	Persistent Cross-site Scripting (XSS) in Dashboard Elements	Medium	CVE-2024-36992
SVD-2024-0711	2024-07-01	Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows	High	CVE-2024-36991
SVD-2024-0710	2024-07-01	Denial of Service (DoS) on the datamodel/web REST endpoint	Medium	CVE-2024-36990
SVD-2024-0709	2024-07-01	Low-privileged user could create notifications in Splunk Web Bulletin Messages	Medium	CVE-2024-36989
SVD-2024-0708	2024-07-01	OpenSSL crypto library (libcrypto.so) incorrectly compiled with stack execution bit set in Splunk Enterprise and Universal Forwarder on certain operating systems	Informational
SVD-2024-0707	2024-07-01	Insecure File Upload in the indexing/preview REST endpoint	Medium	CVE-2024-36987
SVD-2024-0706	2024-07-01	Risky command safeguards bypass through Search ID query in Analytics Workspace	Medium	CVE-2024-36986
SVD-2024-0705	2024-07-01	Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise	High	CVE-2024-36985
SVD-2024-0704	2024-07-01	Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows	High	CVE-2024-36984
SVD-2024-0703	2024-07-01	Command Injection using External Lookups	High	CVE-2024-36983
SVD-2024-0702	2024-07-01	Denial of Service through null pointer reference in “cluster/config” REST endpoint	High	CVE-2024-36982
SVD-2024-0701	2024-07-01	Remote Code Execution through dashboard PDF generation component	High

The company did not reveal if one of these vulnerabilities was actively exploited in the wild.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, RCE)

Twilio states that threat actors have identified the phone numbers of users of its two-factor authentication app, Authy, TechCrunch reported.

Last week, the notorious hacker ShinyHunters claimed to have stolen 33 million phone numbers from Twilio. This week the messaging firm told TechCrunch that “threat actors” identified data of Authy users, a two-factor authentication app owned by Twilio, including their phone numbers.

Twilio is an American firm that provides programmable communication tools for making and receiving phone calls, sending and receiving text messages, and performing other communication functions using its web service APIs.

The company has more than 5,000 employees in 17 countries, and its revenues in 2021 are US$2.84 billion.

A company spokesperson told TechCrunch that the hackers obtained the data from an unauthenticated endpoint. The company confirmed it has already secured the vulnerable endpoint.

Twilio stated there is no evidence that the threat actors accessed its systems or other sensitive data. As a precaution, the company is urging all Authy users to update their Android and iOS apps and remain vigilant against phishing and smishing attacks.

“Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests.” reads a security update published by the company. “We have seen no evidence that the threat actors obtained access to Twilio’s systems or other sensitive data. As a precaution, we are requesting that all Authy users update to the latest Android and iOS apps for the latest security updates. While Authy accounts are not compromised, threat actors may try to use the phone number associated with Authy accounts for phishing and smishing attacks; we encourage all Authy users to stay diligent and have heightened awareness around the texts they are receiving.”

In August 2022, Twilio disclosed a data breach, threat actors had access to the data of some of its customers. The attackers accessed company systems using employee credentials obtained through a sophisticated SMS phishing attack.

“On August 4, 2022, Twilio became aware of unauthorized access to information related to a limited number of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials. This broad based attack against our employee base succeeded in fooling some employees into providing their credentials. The attackers then used the stolen credentials to gain access to some of our internal systems, where they were able to access certain customer data.” Twilio said over the weekend.” reads the incident report published by Twilio.

The company did not disclose the number of affected employees and customers.

In October 2022, the Communications company announced that it suffered another “brief security incident” on June 29, 2022, the attack was conducted by the same threat actor that in August compromised the company and gained access to customers’ and employees’ information.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, ShinyHunters)

Brazil's data protection authority, Autoridade Nacional de Proteção de Dados (ANPD), has temporarily banned Meta from processing users' personal data to train the company's artificial intelligence (AI) algorithms. The ANPD said it found "evidence of processing of personal data based on inadequate legal hypothesis, lack of transparency, limitation of the rights of data subjects, and risks to

A coordinated law enforcement operation codenamed MORPHEUS has felled close to 600 servers that were used by cybercriminal groups and were part of an attack infrastructure associated with the Cobalt Strike.  The crackdown targeted older, unlicensed versions of the Cobalt Strike red teaming framework between June 24 and 28, according to Europol. Of the 690 IP addresses that were flagged to

Cloud communications provider Twilio has revealed that unidentified threat actors took advantage of an unauthenticated endpoint in Authy to identify data associated with Authy accounts, including users' cell phone numbers. The company said it took steps to secure the endpoint to no longer accept unauthenticated requests. The development comes days after an online persona named ShinyHunters

An international law enforcement operation code-named Operation Morpheus led to the takedown of 593 Cobalt Strike servers used by crooks.

An international law enforcement operation, code-named Operation Morpheus, aimed at combatting the criminal abuse of an older, unlicensed version of the Cobalt Strike red teaming tool.

The Cobalt Strike platform was developed for Adversary Simulations and Red Team Operations, currently provided by the cybersecurity software company Fortra. It has also become popular among threat actors over the past years, including APT29, FIN7, RYUK, Trickbot and Conti.

It is quite easy to find pirated versions of the software that were used by attackers in the wild.

Operation MORPHEUS, led by the UK National Crime Agency, included law enforcement authorities from Australia, Canada, Germany, the Netherlands, Poland, and the United States. This disruptive action, which concluded a complex investigation, began in 2021.

The operation took place between June 24 and 28 and was coordinated by Europol, which also collaborated with private partners, including BAE Systems Digital Intelligence, Trellix, Spamhaus, abuse.ch, and The Shadowserver Foundation. These partners used enhanced scanning, telemetry, and analytical capabilities to identify malicious activities and cybercriminal use.

The law enforcement experts identified 690 IP addresses and various domain names associated with criminal activities. The operation led to the takedown of 593 of these IP addresses across 27 countries.

“Fortra has taken significant steps to prevent the abuse of its software and has partnered with law enforcement throughout this investigation to protect the legitimate use of its tools. However, in rare circumstances, criminals have stolen older versions of Cobalt Strike, creating cracked copies to gain backdoor access to machines and deploy malware. Such unlicensed versions of the tool have been connected to multiple malware and ransomware investigations, including those into RYUK, Trickbot and Conti.” reads the press release published by Europol.

“Law enforcement used a platform, known as the Malware Information Sharing Platform, to allow the private sector to share real-time threat intelligence with law enforcement. Over the span of the whole investigation, over 730 pieces of threat intelligence were shared containing almost 1.2 million indicators of compromise.” concludes the press release. “Europol’s EC3 organised over 40 coordination meetings between the law enforcement agencies and the private partners. During the week of action, Europol set up a virtual command post to coordinate law enforcement action across the globe.”

In April 2023, Microsoft Digital Crimes Unit (DCU) announced that had collaborated with Fortra, the company that develops and maintains the tool, and Health Information Sharing and Analysis Center (Health-ISAC) to curb the abuse of Cobalt Strike by cybercriminals.

The Microsoft DCU secured a court order in the U.S. to remove cracked versions of Cobalt Strike (“refer to stolen, unlicensed, or otherwise unauthorized versions or copies of the tool”) so they can no longer be used by cybercriminals.

Threat actors, including ransomware groups and nation-state actors, use Cobalt Strike after obtaining initial access to a target network. The tool is used to conduct multiple malicious activities, including escalating privileges, lateral movements, and deploying additional malicious payloads.

“More specifically, cracked versions of Cobalt Strike allow Defendants to gain control of their victim’s machine and move laterally through the connected network to find other victims and install malware. This includes installing ransomware like Conti, LockBit, Quantum Locker, Royal, Cuba, BlackBasta, BlackCat and PlayCrypt, to arrest access to the systems. In essence, Defendants are able to leverage cracked versions of Cobalt Strike to brutally force their way into victim machines and deploy malware.” reads the court order. “Additionally, once the Defendants deploy the malware or ransomware onto computers running Microsoft’s Window operating system, Defendants are able to execute a series of actions involving abuse of Microsoft’s copyrighted declaring code.”

Example of an attack flow by threat actor DEV-0243.

Microsoft observed more than 68 ransomware attacks, involving the use of cracked copies of Cobalt Strike, against healthcare organizations in more than 19 countries around the world.

The attacks caused huge financial damages to the attacked hospitals in recovery and repair costs, plus interruptions to critical patient care services.

Microsoft also observed nation-state actors, including APT groups from Russia, China, Vietnam, and Iran, using cracked copies of Cobalt Strike.

“Microsoft, Fortra and Health-ISAC remain relentless in our efforts to improve the security of the ecosystem, and we are collaborating with the FBI Cyber Division, National Cyber Investigative Joint Task Force (NCIJTF) and Europol’s European Cybercrime Centre (EC3) on this case. While this action will impact the criminals’ immediate operations, we fully anticipate they will attempt to revive their efforts. Our action is therefore not one and done.” concludes the report.

In November 2022, Google Cloud researchers announced the discovery of 34 different Cobalt Strike hacked release versions with a total of 275 unique JAR files across these versions.

Google Cloud Threat Intelligence (GCTI) researchers developed a set of YARA rules to detect hacked variants in the wild with a high degree of accuracy. The researchers noticed that each Cobalt Strike version contains approximately 10 to 100 attack template binaries

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, newsletter)

Most accomplished cybercriminals go out of their way to separate their real names from their hacker handles. But among certain old-school Russian hackers it is not uncommon to find major players who have done little to prevent people from figuring out who they are in real life. A case study in this phenomenon is “x999xx,” the nickname chosen by a venerated Russian hacker who specializes in providing the initial network access to various ransomware groups.

x999xx is a well-known “access broker” who frequently sells access to hacked corporate networks — usually in the form of remote access credentials — as well as compromised databases containing large amounts of personal and financial data.

In an analysis published in February 2019, cyber intelligence firm Flashpoint called x999xx one of the most senior and prolific members of the top-tier Russian-language cybercrime forum Exploit, where x999xx could be seen frequently advertising the sale of stolen databases and network credentials.

In August 2023, x999xx sold access to a company that develops software for the real estate industry. In July 2023, x999xx advertised the sale of Social Security numbers, names, and birthdays for the citizenry of an entire U.S. state (unnamed in the auction).

A month earlier, x999xx posted a sales thread for 80 databases taken from Australia’s largest retail company. “You may use this data to demand a ransom or do something different with it,” x999xx wrote on Exploit. “Unfortunately, the flaw was patched fast. [+] no one has used the data yet [+] the data hasn’t been used to send spam [+] the data is waiting for its time.”

In October 2022, x999xx sold administrative access to a U.S. healthcare provider.

ALIAS: MAXNM

The oldest account by the name x999xx appeared in 2009 on the Russian language cybercrime forum Verified, under the email address [email protected]. Ozersk is a city in the Chelyabinsk region of west-central Russia.

According to the breach tracking service Constella Intelligence, the address [email protected] was used more than a decade ago to create an account at Vktontakte (the Russian answer to Facebook) under the name Maxim Kirtsov from Ozersk. Mr. Kirtsov’s profile — “maxnm” — says his birthday is September 5, 1991.

The user x999xx registered on the Russian language cybercrime community Zloy in 2014 using the email address [email protected]. Constella says this email address was used in 2022 at the Russian shipping service cdek.ru by a Maksim Georgievich Kirtsov from Ozersk.

Additional searches on these contact details reveal that prior to 2009, x999xx favored the handle Maxnm on Russian cybercrime forums. Cyber intelligence company Intel 471 finds the user Maxnm registered on Zloy in 2006 from an Internet address in Chelyabinsk, using the email address [email protected].

That same email address was used to create Maxnm accounts on several other crime forums, including Spamdot and Exploit in 2005 (also from Chelyabinsk), and Damagelab in 2006.

A search in Constella for the Russian version of Kirtsov’s full name — Кирцов Максим Георгиевич — brings up multiple accounts registered to [email protected].

A review of the digital footprint for [email protected] at osint.industries reveals this address was used a decade ago to register a still-active account at imageshack.com under the name x999xx. That account features numerous screenshots of financial statements from various banks, chat logs with other hackers, and even hacked websites.

Some of the photos in that Imageshack account also appear on Kirtsov’s Vkontakte page, including images of vehicles he owns, as well as pictures of potted marijuana plants. Kirtsov’s Vkontakte profile says that in 2012 he was a faculty member of the Ozersk Technological Institute National Research Nuclear University.

The Vkontakte page lists Kirtsov’s occupation as a website called ozersk[.]today, which on the surface appears to be a blog about life in Ozersk. However, in 2019 the security firm Recorded Future published a blog post which found this domain was being used to host a malicious Cobalt Strike server.

Cobalt Strike is a commercial network penetration testing and reconnaissance tool that is sold only to vetted partners. But stolen or ill-gotten Cobalt Strike licenses are frequently abused by cybercriminal gangs to help lay the groundwork for the installation of ransomware on a victim network.

In August 2023, x999xx posted a message on Exploit saying he was interested in buying a licensed version of Cobalt Strike. A month earlier, x999xx filed a complaint on Exploit against another forum member named Cobaltforce, an apparent onetime partner whose sudden and prolonged disappearance from the community left x999xx and others in the lurch. Cobaltforce recruited people experienced in using Cobalt Strike for ransomware operations, and offered to monetize access to hacked networks for a share of the profits.

DomainTools.com finds ozersk[.]today was registered to the email address [email protected], which also was used to register roughly two dozen other domains, including x999xx[.]biz. Virtually all of those domains were registered to Maxim Kirtsov from Ozersk. Below is a mind map used to track the identities mentioned in this story.

x999xx is a prolific member of the Russian webmaster forum “Gofuckbiz,” with more than 2,000 posts over nearly a decade, according to Intel 471. In one post from 2016, x999xx asked whether anyone knew where he could buy a heat lamp that simulates sunlight, explaining that one his pet rabbits had recently perished for lack of adequate light and heat. Mr. Kirtsov’s Vkontakte page includes several pictures of caged rabbits from 2015 and earlier.

CONFIRMATION

Reached via email, Mr. Kirtsov acknowledged that he is x999xx. Kirtsov said he and his team are also regular readers of KrebsOnSecurity.

“We’re glad to hear and read you,” Kirtsov replied.

Asked whether he was concerned about the legal and moral implications of his work, Kirtsov downplayed his role in ransomware intrusions, saying he was more focused on harvesting data.

“I consider myself as committed to ethical practices as you are,” Kirtsov wrote. “I have also embarked on research and am currently mentoring students. You may have noticed my activities on a forum, which I assume you know of through information gathered from public sources, possibly using the new tool you reviewed.”

“Regarding my posts about selling access, I must honestly admit, upon reviewing my own actions, I recall such mentions but believe they were never actualized,” he continued. “Many use the forum for self-serving purposes, which explains why listings of targets for sale have dwindled — they simply ceased being viable.”

Kirtsov asserted that he is not interested in harming healthcare institutions, just in stealing their data.

“As for health-related matters, I was once acquainted with affluent webmasters who would pay up to $50 for every 1000 health-themed emails,” Kirtsov said. “Therefore, I had no interest in the more sensitive data from medical institutions like X-rays, insurance numbers, or even names; I focused solely on emails. I am proficient in SQL, hence my ease with handling data like IDs and emails. And i never doing spam or something like this.”

On the Russian crime forums, x999xx said he never targets anything or anyone in Russia, and that he has little to fear from domestic law enforcement agencies provided he remains focused on foreign adversaries.

x999xx’s lackadaisical approach to personal security mirrors that of Wazawaka, another top Russian access broker who sold access to countless organizations and even operated his own ransomware affiliate programs.

“Don’t shit where you live, travel local, and don’t go abroad,” Wazawaka said of his own personal mantra. “Mother Russia will help you. Love your country, and you will always get away with everything.”

In January 2022, KrebsOnSecurity followed clues left behind by Wazawaka to identify him as 32-year-old Mikhail Matveev from Khakassia, Russia. In May 2023, the U.S. Department of Justice indicted Matveev as a key figure in several ransomware groups that collectively extorted hundreds of millions of dollars from victim organizations. The U.S. State Department is offering a $10 million reward for information leading to the capture and/or prosecution of Matveev.

Perhaps in recognition that many top ransomware criminals are largely untouchable so long as they remain in Russia, western law enforcement agencies have begun focusing more on getting inside the heads of those individuals. These so-called “psyops” are aimed at infiltrating ransomware-as-a-service operations, disrupting major cybercrime services, and decreasing trust within cybercriminal communities.

When authorities in the U.S. and U.K. announced in February 2024 that they’d infiltrated and seized the infrastructure used by the infamous LockBit ransomware gang, they borrowed the existing design of LockBit’s victim shaming website to link instead to press releases about the takedown, and included a countdown timer that was eventually replaced with the personal details of LockBit’s alleged leader.

In May 2024, law enforcement agencies in the United States and Europe announced Operation Endgame, a coordinated action against some of the most popular cybercrime platforms for delivering ransomware and data-stealing malware. The Operation Endgame website also included a countdown timer, which served to tease the release of several animated videos that mimic the same sort of flashy, short advertisements that established cybercriminals often produce to promote their services online.

The LockBit ransomware group breached another hospital in the United States, the victim is the Fairfield Memorial Hospital in Illinois.

It has happened again, another US healthcare organization suffered a security breach, this time the victim is the Fairfield Memorial Hospital in Illinois.

Fairfield Memorial Hospital is a not-for-profit critical access hospital located in Fairfield, Illinois. It has 25 acute-care beds and a workforce of over 400 employees.

It offers a wide range of medical services, including Emergency Services, General Surgical Services, Intensive Care Unit (ICU), Medical Surgical Unit, Orthopedic Surgical Services, and Urgent Care.

The hospital is fully accredited and has been recognized for its quality of care, with high patient experience and medical/surgical ICU ratings.

The Lockbit ransomware gang claimed the hack of the healthcare structure and added it to its Tor leak site.

The extortion group claimed the theft of data and announced it would leak it on July 17, 2024.

LockBit breached another United States hospital this time in Fairfield, Illinois.

Fairfield Memorial Hospital

https://t.co/yQDgJEjmdZ pic.twitter.com/HdEKdf7P2a

— Dominic Alvieri (@AlvieriD) July 2, 2024

Unfortunately, the ransomware group claimed the hack of other hospitals as reported by researchers at Hack Manack. The extortion group also claimed the hack of the Merryman House Domestic Crisis Center, and the Florida Department of Health.

“Today, cybercriminals have hit rock bottom, claiming to have attacked Fairfield Memorial Hospital, Merryman House Domestic Crisis Center, and the Florida Department of Health. What makes the situation critical is not only the highly sensitive data being stolen but also the repercussions that a ransomware attack can have on critical infrastructures, such as hospitals, which put people’s lives at risk. Hackers targeting these infrastructures are no longer just money-hungry “nerds”; they are becoming murderers.” wrote the experts.

#CyberAttack #Healthcare

#USA: Today, cybercriminals have hit rock bottom, claiming to have attacked Fairfield Memorial Hospital, Merryman House Domestic Crisis Center, and the Florida Department of Health.

What makes the situation critical is not only the highly… pic.twitter.com/kGN7Y1mbMQ

— HackManac (@H4ckManac) July 2, 2024

This week Wayne Memorial Hospital in Pennsylvania was the victim of a cyber attack, Monti gang claimed to have hacked the healthcare infrastructure.

Healthcare infrastructure in the US continues to be under attack, in February the Lurie Children’s Hospital in Chicago took IT systems offline after a cyberattack. The security incident severely impacted normal operations also causing the delay of medical care.

Lurie Children’s Hospital is one of the top pediatric hospitals in the United States.

In early November 2023, the Cogdell Memorial Hospital (Scurry County Hospital District) announced it was experiencing a computer network incident that prevented the hospital from accessing some of its systems and severely limiting the operability of its phone system. The hospital immediately removed network connectivity and continued to provide most routine services.

The facility operates as a Critical Access Hospital and a Rural Health Clinic serving rural West Texas.

In November 2023, the Lorenz extortion group leaked the data stolen from the Texas-based Cogdell Memorial Hospital.

Cyber attacks against hospitals are very dangerous, and despite major ransomware gangs imposing restrictions on their affiliates to avoid targeting them, many incidents have recently made headlines.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, Fairfield Memorial Hospital)

Recently the Office of the Director of National Intelligence (ODNI) unveiled a new strategy for open-source intelligence (OSINT) and referred to OSINT as the “INT of first resort”. Public and private sector organizations are realizing the value that the discipline can provide but are also finding that the exponential growth of digital data in recent years has overwhelmed many traditional OSINT

The American credit union Patelco Credit Union shut down several of its banking systems to contain a ransomware attack.

Patelco Credit Union is a member-owned, not-for-profit credit union that serves Northern California, particularly the San Francisco Bay Area. Founded in 1936, it is one of the oldest and largest credit unions in the country. With more than $9 billion in assets, it is the 22nd largest credit union in the country.

In a service update provided by the company, Patelco disclosed it had suffered a ransomware attack on June 29, 2024.

“On June 29, 2024, Patelco Credit Union experienced a ransomware attack.” reads the update.

The company is working with leading third-party cybersecurity experts to investigate and contain the attack, it also reported the incident to regulators and law enforcement.

According to the “Services Updates” page the following services are still unavailable:

Available	Limited Functionality	Unavailable
Check and Cash Deposits	Patelco Branches	Online Banking
ATM Withdrawals	Call Center	Mobile App
External ACH1	Live Chat	Outgoing Wire Transfers
ACH for Bills2	Debit Card Transactions	Monthly Statements
In-Branch Loan Payments	Credit Card Transactions	Zelle
–	Direct Deposit	Balance Inquiries
–	–	Online Bill Pay

Customers can perform cash withdrawals and deposits using Patelco ATMs and over 30,000 shared branch ATMs in the U.S.

The company did not reveal the family of ransomware that infected its systems and at the time of this writing, no ransomware groups have claimed responsibility for the security breach.

It’s unclear if threat actors have stolen data from the impacted systems.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, Patelco Credit Union)

Unknown threat actors have been observed exploiting a now-patched security flaw in Microsoft MSHTML to deliver a surveillance tool called MerkSpy as part of a campaign primarily targeting users in Canada, India, Poland, and the U.S. "MerkSpy is designed to clandestinely monitor user activities, capture sensitive information, and establish persistence on compromised systems," Fortinet FortiGuard

The Polish government is investigating a potential connection between Russia and a cyberattack on the country’s state news agency.

The Polish government is investigating a suspected link between Russia and the cyberattack on the country’s state news agency Polish Press Agency (PAP).

“The Polish Press Agency (PAP) has been hit by a cyberattack; all pertinent information regarding this critical incident is currently being provided to the relevant authorities,” PAP’s liquidator Marek Blonski and PAP’s editor-in-chief Wojciech Tumidalski wrote in a joint statement. “We are working to strengthen the security of all our systems and services,” Blonski and Tumidalski added. 

The attack on the Polish Press Agency (PAP) occurred in May and aimed at spreading disinformation and destabilizing the country.

Authorities believe that a fake news report on Poland’s national news agency, claiming that Prime Minister Donald Tusk was mobilizing 200,000 men starting on July 1, was likely created by Russia-sponsored hackers. The attack appeared to be an attempt to interfere with the upcoming European Parliament election.

“Everything indicates that we are dealing with a cyberattack directed from the Russian side,” said Krzysztof Gawkowski, a deputy prime minister who also holds the digital affairs portfolio. “The goal is disinformation ahead of (European Parliament) elections and a paralysis of the society.”

Two fabricated reports about a partial mobilization in Poland starting on July 1, 2024, were released on the PAP service on a Friday afternoon. PAP clarified that they were not the source of these reports, and promptly annulled and withdrawn them.

Polish authorities suspect that Russia carried out the attack. 

PAP CEO Marek Błoński condemned the attack.

“We are committed to clarifying the issue in collaboration with the appropriate state services”, Błoński said.

Polish media outlets, including Polskie Radio, have reported frequent targeting by Russian hackers, with Polish companies experiencing over 1,400 attacks weekly.

The Russian embassy in Warsaw told Reuters it had no knowledge of the incident and declined further comment.

In May, CERT Polska and CSIRT MON teams issued a warning about a large-scale malware campaign targeting Polish government institutions, allegedly orchestrated by the Russia-linked APT28 group.

The attribution of the attacks to the Russian APT is based on similarities with TTPs employed by APT28 in attacks against Ukrainian entities.

“the CERT Polska (CSIRT NASK) and CSIRT MON teams observed a large-scale malware campaign targeting Polish government institutions.” reads the alert. “Based on technical indicators and similarity to attacks described in the past (e.g. on Ukrainian entities), the campaign can be associated with the APT28 activity set, which is associated with Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).”

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, Polish government)

The loader-as-a-service (LaaS) known as FakeBat has become one of the most widespread loader malware families distributed using the drive-by download technique this year, findings from Sekoia reveal. "FakeBat primarily aims to download and execute the next-stage payload, such as IcedID, Lumma, RedLine, SmokeLoader, SectopRAT, and Ursnif," the company said in a Tuesday analysis. Drive-by attacks

Cybersecurity researchers have discovered an attack campaign that targets various Israeli entities with publicly-available frameworks like Donut and Sliver. The campaign, believed to be highly targeted in nature, "leverage target-specific infrastructure and custom WordPress websites as a payload delivery mechanism, but affect a variety of entities across unrelated verticals, and rely on

An unnamed South Korean enterprise resource planning (ERP) vendor's product update server has been found to be compromised to deliver a Go-based backdoor dubbed Xctdoor. The AhnLab Security Intelligence Center (ASEC), which identified the attack in May 2024, did not attribute it to a known threat actor or group, but noted that the tactics overlap with that of Andariel, a sub-cluster within the

Fintech firms Wise and Affirm confirmed they were both impacted by the recent data breach suffered by Evolve Bank.

Fintech companies Wise and Affirm have confirmed that they were both affected by the recent data breach at Evolve Bank.

At the end of June, the LockBit gang announced that it had breached the systems of the Federal Reserve of the United States and exfiltrated 33 TB of sensitive data, including “Americans’ banking secrets.”

Despite the announcement, data leaked data from the group belongs to the Arkansas-based financial organization Evolve Bank & Trust.

The analysis of the data leaked by the LockBit group on its Tor leak site on June 26 confirmed the documents belong to the Evolve Bank & Trust.

Evolve Bank & Trust published a notice on its website to confirm the security breach and announced it has launched an investigation into the incident. The financial organization confirmed that certain personal information may have been compromised. The financial organization refused to pay the ransom and the gang leaked the stolen data.

“Evolve Bank & Trust is making retail bank customers and financial technology partners’ customers (end users) aware of a cybersecurity incident that may involve certain personal information, as well as the actions we have taken in response, and additional steps individuals may take.” reads the notice of Cybersecurity Incident. “Evolve is currently investigating a cybersecurity incident involving a known cybercriminal organization that appears to have illegally obtained and released on the dark web the data and personal information of some Evolve retail bank customers and financial technology partners’ customers (end users). We take this matter extremely seriously and are working diligently to address the situation.”

Evolve has reported the incident to law enforcement, it also added that the incident has been completely contained.

An update published on June 26, 2024 12:00pm confirmed that the company’s retail banking customers’ debit cards, online, and digital banking credentials do not appear to be impacted.

Evolve will directly contact impacted customers and financial technology partners.

The fintech firm Wise announced that the Evolve data breach impacted some of its customers. Despote Wise is no longer collaborating with Evolve, the bank was still storing some Wise data. 

Wise was sharing data with Evolve Bank & Trust to receive USD account details from the bank, including name, address, date of birth, contact details, SSN or EIN for US customers, or another identity document number for non-US customers. Evolve has not yet reveal which Wise data has been compromised by the security incident.

Wise pointed out that the data breach has not impacted their systems.

“For Evolve Bank & Trust to provide USD account details to Wise customers, they were required to hold identifying information. The information that we shared with Evolve Bank & Trust to provide USD account details included name, address, date of birth, contact details, SSN or EIN for US customers, or another identity document number for non-US customers. Evolve has not yet confirmed to us what data has been impacted.” reads the statement published by Wise. “We no longer work with Evolve Bank & Trust, and USD account details are provided by a different bank.” 

The fintech firm will contact customers whose data may have been compromised.

Affirm, a fintech firm with a buy now, pay later service for online and in-store shopping, also confirmed that Evolve Bank data breach impacted some of its customers.

“On June 25, 2024, Evolve Bank & Trust (“Evolve”), the third-party issuer of the Affirm Card, notified the Company that Evolve had experienced a cybersecurity incident whereby a third party gained unauthorized access to personal information and financial information (“Personal Information”) of Evolve retail banking customers and the customers of its financial technology partners.” reads the FORM 8-K filed by with SEC. “Because the Company shares the Personal Information of Affirm Card users with Evolve to facilitate the issuance and servicing of Affirm Cards, the Company believes that the Personal Information of Affirm Card users was compromised as part of Evolve’s cybersecurity incident.”

The company added that its information systems were not compromised.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, data breach)

The cybersecurity threat landscape has witnessed a dramatic and alarming rise in the average ransomware payment, an increase exceeding 500%. Sophos, a global leader in cybersecurity, revealed in its annual "State of Ransomware 2024" report that the average ransom payment has increased 500% in the last year with organizations that paid a ransom reporting an average payment of $2 million, up from

Prudential Financial confirmed that more than 2.5 million individuals were affected by the data breach it suffered in February 2024.

The insurance company Prudential Financial confirmed that the data breach it suffered in February 2024 affected over 2.5 million individuals. The incident occurred on February 4, 2024, and was discovered on February 5, 2024.

The company did not share details of the cyber attack, however, the Alphv/BlackCat ransomware gang claimed responsibility for the security breach.

The company initially announced in March that the security incident had impacted more than 36,000 individuals. The compromised data included names, addresses, driver’s license numbers, and non-driver identification card numbers.

In an update provided by Prudential Financial, the company revealed that the incident impacted 2,556,210 individuals.

The company is offering two years of free credit monitoring services to the affected individuals.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, data breach)

Modern CPUs from Intel, including Raptor Lake and Alder Lake, have been found vulnerable to a new side-channel attack that could be exploited to leak sensitive information from the processors. The attack, codenamed Indirector by security researchers Luyi Li, Hosein Yavarzadeh, and Dean Tullsen, leverages shortcomings identified in Indirect Branch Predictor (IBP) and the Branch Target Buffer (BTB

An Australian man has been charged with carrying out ‘Evil Twin’ Wi-Fi attack during a domestic flight to steal user credentials and data.

An Evil Twin Wi-Fi attack is a type of cyberattack where a threat actor sets up a rogue wireless access point that mimics a legitimate one. The goal is to trick users into connecting to the fake access point, thereby allowing the attacker to intercept, capture, and manipulate data transmitted by the victim.

The AFP charged an Australian man (42) with operating a fake Wi-Fi access point on a domestic flight to steal user credentials and data.

“The AFP has charged a West Australian man who allegedly established fake free WiFi access points, which mimicked legitimate networks, to capture personal data from unsuspecting victims who mistakenly connected to them.” reads the press release published by AFP. “The man, 42, is expected to appear in Perth Magistrates Court today (28 June, 2024) to face nine charges for alleged cybercrime offences.”

The defendant faces charges of three counts of unauthorized impairment of electronic communication and three counts of possession or control of data to commit a serious offense.

The man is also charged with unauthorized access or modification of restricted data, dishonestly obtaining or dealing in personal financial information, and possession of identification information. If convicted, he faces a maximum sentence of 23 years in prison.

The analysis of the seized data and devices from the Australian man revealed dozens of personal credentials and fraudulent WiFi pages. The man was charged in May 2024 following an investigation launched in April 2024 after an airline reported a suspicious WiFi network during a domestic flight. The investigators found a portable wireless access device, a laptop, and a mobile phone in the man’s luggage at Perth Airport. The Australian police also searched the man’s home in Palmyra. A second search warrant on May 8, 2024, led to his arrest and charges. Police allege he created ‘evil twin’ WiFi networks to lure users into entering their credentials on fake webpages, which he then stored. These harvested cfedentials could be used to access victims’ personal information and bank details.

AFP cybercrime investigators collected evidence that indicates the use of fraudulent WiFi pages at airports in Perth, Melbourne, and Adelaide, on domestic flights, and at locations associated with the man’s previous employment.

“To connect to a free WiFi network, you shouldn’t have to enter any personal details– such as logging in through an email or social media account,”

“If you do want to use public WiFi hotspots, install a reputable virtual private network (VPN) on your devices to encrypt and secure your data when using the internet.” AFP Western Command Cybercrime Detective Inspector Andrea Coleman said.

“When using a public network, disable file sharing, don’t do anything sensitive – such as banking -while connected to it and once you finish using it, change your device settings to ‘forget network’.

“We also recommend turning off the WiFi on your phone or other electronic devices before going out in public, to prevent your device from automatically connecting to a hotspot.” 

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, Evil Twin Wi-Fi attack)

Cisco fixed an actively exploited NX-OS zero-day, the flaw was exploited to install previously unknown malware as root on vulnerable switches.

Cisco addressed an NX-OS zero-day, tracked as CVE-2024-20399 (CVSS score of 6.0), that the China-linked group Velvet Ant exploited to deploy previously unknown malware as root on vulnerable switches.

The flaw resides in the CLI of Cisco NX-OS Software, an authenticated, local attacker can exploit the flaw to execute arbitrary commands as root on the underlying operating system of an affected device.

“This vulnerability is due to insufficient validation of arguments that are passed to specific configuration CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected configuration CLI command.” reads the advisory published by Cisco. “A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root.”

The IT giant pointed out that only attackers with Administrator credentials can successfully exploit this vulnerability on a Cisco NX-OS device.

In April 2024, researchers reported to the Cisco Product Security Incident Response Team (PSIRT) that the issue was actively exploited in the wild.

Cybersecurity firm Sygnia observed the attacks on April 2024 and reported them to Cisco.

“Sygnia identified that CVE-2024-20399 was exploited in the wild by a China-nexus threat group as a ‘zero-day’ and shared the details of the vulnerability with Cisco. By exploiting this vulnerability, a threat group – dubbed ‘Velvet Ant’ – successfully executed commands on the underlying operating system of Cisco Nexus devices.” reads the report published by Sygnia. “This exploitation led to the execution of a previously unknown custom malware that allowed the threat group to remotely connect to compromised Cisco Nexus devices, upload additional files, and execute code on the devices.“

The vulnerability impacts the following devices:

• MDS 9000 Series Multilayer Switches (CSCwj97007)
• Nexus 3000 Series Switches (CSCwj97009)
• Nexus 5500 Platform Switches (CSCwj97011)
• Nexus 5600 Platform Switches (CSCwj97011)
• Nexus 6000 Series Switches (CSCwj97011)
• Nexus 7000 Series Switches (CSCwj94682) *
• Nexus 9000 Series Switches in standalone NX-OS mode (CSCwj97009)

Cisco recommends customers monitor the use of credentials for the administrative users network-admin and vdc-admin.

Cisco provides the Cisco Software Checker to help customers determine if their devices are vulnerable to this flaw.

In late 2023, Sygnia researchers responded to an incident suffered by a large organization that they attributed to the same China-linked threat actor ‘Velvet Ant.’

The cyberspies deployed custom malware on F5 BIG-IP appliances to gain persistent access to the internal network of the target organization and steal sensitive data.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, NX-OS)

Meta's decision to offer an ad-free subscription in the European Union (E.U.) has faced a new setback after regulators accused the social media behemoth of breaching the bloc's competition rules by forcing users to choose between seeing ads or paying to avoid them. The European Commission said the company's "pay or consent" advertising model is in contravention of the Digital Markets Act (DMA).

A China-nexus cyber espionage group named Velvet Ant has been observed exploiting a zero-day flaw in Cisco NX-OS Software used in its switches to deliver malware. The vulnerability, tracked as CVE-2024-20399 (CVSS score: 6.0), concerns a case of command injection that allows an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected

An Australian man has been charged with running a fake Wi-Fi access point during a domestic flight with an aim to steal user credentials and data. The unnamed 42-year-old "allegedly established fake free Wi-Fi access points, which mimicked legitimate networks, to capture personal data from unsuspecting victims who mistakenly connected to them," the Australian Federal Police (AFP) said in a press

Last Week in Security is a summary of the interesting cybersecurity news, techniques, tools and exploits from the past week. This post covers 2024-06-24 to 2024-07-01.

News

• regreSSHion (CVE-2024-6387)

  • regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems (CVE-2024-6387) - The Qualys team drops an unauthenticated remote code execution vulerability in OpenSSH, possibly the most audited software project ever. It's a race condition that takes ~10,000 attempts on x86 to exploit, so any type of fail2ban, SSHGuard, or similar protection will likely mitigate the vulnerability, but everyone should update ASAP. This one will have a long tail of exposure - SSH is everywhere. The OpenSSH project recently announced support for built in rate limiting: PerSourcePenalties and PerSourcePenaltyExemptList and the dates line up 🤔.
  • Notes on regreSSHion on musl - "OpenSSH sshd on musl-based systems is not vulnerable to RCE via CVE-2024-6387 (regreSSHion)." However, it could still deadlock the sshd process.
  • cve-2024-6387-poc - UNVERIFIED! Do your own code review and testing. 32-bit PoC for CVE-2024-6387 — mirror of the original 7etsuo/cve-2024-6387-poc (Deleted).

• Polyfill supply chain attack hits 100K+ sites - Polyfill[.]io was bought by a Chinese company ~6 months ago, but this attack looks more widespread: Polyfill.io, BootCDN, Bootcss, Staticfile attack traced to 1 operator. Cloudflare stepped in and autoamtically replaced polyfill.io links with Cloudflare's mirror for a safer Internet.

• PortSwigger, the company behind the Burp Suite of security testing tools, swallows $112M - What does this mean against the Caido vs BurpSuite Pro debate? Congrats to PortSwigger nonetheless.

• TeamViewer's corporate network was breached in alleged APT hack - A very popular remote monitoring and management tool vendor breached. You can follow the security update here. Ouch.

• Sustaining Digital Certificate Security - Entrust Certificate Distrust - Google Chrome will stop trusting Entrust root certificates in October. Why? See for yourself: Entrust on Bugzilla. The process to trust certificate authorites is one of those critical processes that underpins the entire system but almost no one acknowledges or understands (it's the Federal Reserve of cybersecurity).

• Introducing the Microsoft Entra PowerShell module - Time to update your Azure/Entra tooling!

Techniques and Write-ups

• Evading Event Tracing for Windows (ETW)-Based Detections - This post explores Event Tracing for Windows (ETW), its components, and various techniques to evade ETW-based detections, including tampering with ETW trace sessions, hijacking sessions, and patching ETW functions to bypass endpoint detection and response systems. Good read!
• Commonly Abused Linux Initial Access Techniques and Detection Strategies - Bring back linux tradecraft!
• Attack of the clones: Getting RCE in Chrome's renderer with duplicate object properties - Browsers are some of the most complex yet security critical peices of software available today. This post shows the details of an exploit that had to be re-worked due to code hardening, but still led to RCE from a single page visit.
• Exploiting Steam: Usual and Unusual Ways in the CEF Framework - Sometimes instead of attacking the browser itself, it's easier to attack the plumbing that connects it to the rest of the system.
• Why nested deserialization is harmful: Magento XXE (CVE-2024-34102) - Another high impact CVE against Magento discovered by Assetnote.
• Creating an Emux Environment With Ludus - Great walkthrough for those looking to get started with embedded hacking!
• The State of Data Breaches - Troy Hunt, owner of haveibeenpwned writes about what he's seeing across the industry.
• Putting the C2 in C2loudflare - How to bring up an entire C2 infrastructure with all your tooling and their corresponding redirectors using Azure Snapshots, Cloudflare and Tmux Resurrect.
• Github Actions Exploitation: Introduction - A basic introduction into Github action exploitation. Note: Github has an enterprise offering that can be hosted on-prem by large customers. Look for it on your next red team.
• The Windows Registry Adventure #3: Learning resources - If you ever read a write-up and think "how in the world did they figure this out?" perhaps the answer is lots and lots of research. This post is a good example of how exploitation usually involves knowing a system better than most of its authors.
• Inside Xerox WorkCentre: Two Unauthenticated RCEs - 2x RCEs and an LPE against a big Xerox multifunction machine.
• Auth. Bypass In (Un)Limited Scenarios - Progress MOVEit Transfer (CVE-2024-5806) - "Editors note: This blog post is everything - a beautiful vulnerability and a masterclass in fun exploitation chains." Agree.

Tools and Exploits

• ApexLdr - ApexLdr is a DLL Payload Loader written in C.
• RemoteKrbRelay - Remote Kerberos Relay made easy! Advanced Kerberos Relay Framework.
• SharpIncrease - A Tool that aims to evade av with binary padding.
• CVE-2024-30088 - A Windows LPE that stems from a Time-of-Check to Time-of-Use (TOCTOU) vulnerability within the function NtQueryInformationToken, particularly in the handling of the AuthzBasepCopyoutInternalSecurityAttributes function.
• CVE-2023-24871 - POCs & exploit for CVE-2023-24871 (Windows RCE + LPE).

New to Me and Miscellaneous

This section is for news, techniques, write-ups, tools, and off-topic items that weren't released last week but are new to me. Perhaps you missed them too!

• parseusbs - Parses USB connection artifacts from offline Registry hives.
• Becoming a Red Teamer - Recent changes in red team tooling has sparked a debate. Here is a quick take on the topic of what it takes to become a red teamer.
• The BIRT Project - "Our goal is to support incident responders by providing them with effective tools that exceed their needs. As a 100% bootstrapped project, we are motivated by our extensive experience in cybersecurity and a deep understanding of the challenges faced in incident response. We recognize the need for quick and accurate responses in the face of today's changing threats. "
• Why I attack - An perspective on why to do research and make your research public. Controversial topic but always good to stay informed and have these conversations.
• winutil - Chris Titus Tech's Windows Utility - Install Programs, Tweaks, Fixes, and Updates.
• Win11Debloat - A simple, easy to use powershell script to remove bloatware apps from windows, disable telemetry, bing in windows search aswell as perform various other changes to declutter and improve your windows experience. This script works for both windows 10 and windows 11.
• poc-cve-2024-38396 - PoC for iTerm2 CVEs CVE-2024-38396 and CVE-2024-38395 which allow code execution.
• themida-unmutate - Static deobfuscator for Themida/WinLicense/Code Virtualizer's mutation-based obfuscation.
• Queueing - An interactive study of queueing strategies - Neat interactive site to learn about queueing strategies.

Techniques, tools, and exploits linked in this post are not reviewed for quality or safety. Do your own research and testing.

A trio of security flaws has been uncovered in the CocoaPods dependency manager for Swift and Objective-C Cocoa projects that could be exploited to stage software supply chain attacks, putting downstream customers at severe risks. The vulnerabilities allow "any malicious actor to claim ownership over thousands of unclaimed pods and insert malicious code into many of the most popular iOS and

A critical flaw in the OpenSSH server can be exploited to achieve unauthenticated remote code execution with root privileges in glibc-based Linux systems.

OpenSSH maintainers addressed a critical vulnerability, tracked as CVE-2024-6387, that can lead to unauthenticated remote code execution with root privileges in glibc-based Linux systems.

OpenSSH maintained have addressed the vulnerability with the release of version 9.8 on July 01, 2024.

“A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with ASLR. Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept. Exploitation on 64-bit systems is believed to be possible but has not been demonstrated at this time. It’s likely that these attacks will be improved upon.” reads the advisory. “Exploitation on non-glibc systems is conceivable but has not been examined. Systems that lack ASLR or users of downstream Linux distributions that have modified OpenSSH to disable per-connection ASLR re-randomisation (yes – this is a thing, no – we don’t understand why) may potentially have an easier path to exploitation.”

The Qualys Threat Research Unit (TRU) has discovered the Remote Unauthenticated Code Execution (RCE) vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems.

The issue is due to a signal handler race condition, Qualys researchers state that the flaw poses a considerable risk because it affects sshd in its default configuration.

“The vulnerability, which is a signal handler race condition in OpenSSH’s server (sshd), allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems; that presents a significant security risk. This race condition affects sshd in its default configuration.” reported Qualys.

Searches using Censys and Shodan have revealed over 14 million potentially vulnerable OpenSSH server instances exposed to the Internet. Data from Qualys CSAM 3.0 shows that around 700,000 of these are external internet-facing instances, representing 31% of all such instances in their global customer base. Notably, over 0.14% of these vulnerable instances are running an End-Of-Life/End-Of-Support version of OpenSSH.

The flaw was introduced with the fix for another vulnerability, tracked as CVE-2006-5051. This is a case of regression of a previously patched flaw, which means that a previously fixed bug has resurfaced in a later software release, often due to updates that unintentionally reintroduce the issue. The regression was introduced in October 2020 with the release of OpenSSH 8.5p1.

Maintainers pointed out that OpenBSD systems are not impacted by this vulnerability. The latest release also addressed a Logic error in ssh(1) ObscureKeystrokeTiming. The flaw was discovered by Philippos Giavridis and also independently by Jacky Wei En Kung, Daniel Hugenroth and Alastair Beresford of the
University of Cambridge Computer Lab.

“In OpenSSH version 9.5 through 9.7 (inclusive), when connected to an OpenSSH server version 9.5 or later, a logic error in the ssh(1) ObscureKeystrokeTiming feature (on by default) rendered this feature
ineffective – a passive observer could still detect which network packets contained real keystrokes when the countermeasure was active because both fake and real keystroke packets were being sent unconditionally.” states the advisory.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, OpenSSH server)