CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES October 1 - 8, 2020
TOP VULNERABILITY THIS WEEK: Attackers being PoetRAT keep targeting Azerbaijan public and private sectors

NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: PoetRAT malware evolves to be slimmer, faster and harder to detect
Description: Cisco Talos is tracking the behavior of the attackers behind the PoetRAT threat, who continue to target public and private entities in Azerbaijan. They observed multiple new campaigns indicating a change in the actor’s capabilities and showing their maturity toward better operational security. This actor continues to use spear-phishing attacks to lure a user to download a malicious document from temporary hosting providers. The malware comes from malicious URLs included in the email, resulting in the user clicking and downloading a malicious document. Previous versions of PoetRAT deployed a Python interpreter to execute the included source code which resulted in a much larger file size compared to the latest version’s switch to Lua script.
References: https://blog.talosintelligence.com/2020/10/poetrat-update.html
Snort SIDs: 53689 - 53691

Title: Emotet now using poltiically charged emails
Description: The infamous Emotet botnet is now using lure documents that disguise themselves as being from the Democratic National Committee. Attackers sent emails to numerous American organizations last week with the title “Team Blue Take Action.” If the user opens the attachment, it asks them to enable macros. Once enabled, the file then downloads Emotet and a few other malicious tools. Emotet went quiet in early 2020, but has since reemerged and changed up its tactics since the summer.
References: https://www.darkreading.com/threat-intelligence/emotet-spoofs-dnc-in-new-attack-campaign/d/d-id/1339075
Snort SIDs: 55870 - 55874

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

The U.S. Cybersecurity and Infrastructure Security Agency released an alert last week that it expects distributed denial-of-service attacks to disrupt websites that post election results, but will not affect voting.
https://www.ic3.gov/media/2020/200930.aspx

A group of American citizens living outside the U.S. are suing election officials in seven states, arguing that they should have the ability to return their absentee ballots electronically.
https://www.theguardian.com/us-news/2020/oct/02/us-voting-electronic-lawsuit-voters-living-abroad

Visa says networks belonging to two American hospitality merchants were attacked in May and June with point-of-sale malware that attempted to skim credit card information.
https://www.zdnet.com/article/two-north-american-hospitality-merchants-hacked-in-may-and-june/

A British service that helps organizations raise money says a data breach may have led to the theft of donors’ bank account information and passwords for the site.
https://www.bbc.com/news/technology-54370568

Facebook says it shut down several accounts that Chinese threat actors hijacked to host malicious ads, spending $4 million of victims’ money on ads for diet pills, fake designer handbags and more.
https://wired.com/story/facebook-shut-down-malware-that-hijacked-accounts-to-run-ads/

Hospital chain Universal Health Services says it’s made “substantial progress” in restoring its services after an apparent cyber attack last week.
https://www.bizjournals.com/philadelphia/news/2020/10/05/uhs-king-of-prussia-cyberattack-hospital-it.html

The United Nations’ agency for international shipping had to curtail some of its services following a cyberattack late last week.
https://www.infosecurity-magazine.com/news/un-shipping-agency-offline/

A cellular service provider’s website has reportedly has become infected with credit card-skimming malware that sends data back to a server controlled by the criminals.
https://arstechnica.com/information-technology/2020/10/boom-hacked-page-on-mobile-phone-website-is-stealing-customers-card-data/

GitHub released new code-scanning functionality that allows developers to detect potential vulnerabilities in their projects before making them public.
https://venturebeat.com/2020/09/30/github-launches-code-scanning-to-unearth-vulnerabilities-early/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2020-1350
Title: Microsoft Windows DNS Server Remote Code Execution Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account. Windows servers that are configured as DNS servers are at risk from this vulnerability.
CVSS v3 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

ID: CVE-2020-1472
Title: Microsoft Netlogon Elevation of Privilege Vulnerability
Vendor: Microsoft
Description: An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
CVSS v3 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

ID: CVE-2020-0688
Title: Microsoft Exchange Validation Key Remote Code Execution Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in Microsoft Exchange Server when the server fails to properly create unique keys at install time. Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web application, which runs as SYSTEM.
CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

ID: CVE-2020-3566
Title: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities
Vendor: Cisco
Description: A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes.
CVSS v3 Base Score: 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

ID: CVE-2020-0618
Title: Microsoft SQL Server Remote Code Execution Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests. An attacker who successfully exploited this vulnerability could execute code in the context of the Report Server service account.
To exploit the vulnerability, an authenticated attacker would need to submit a specially crafted page request to an affected Reporting Services instance.
CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

ID: CVE-2020-15675
Title: Mozilla Firefox User-After-Free Vulnerability
Vendor: Mozilla
Description: A user-after-free vulnerability exists in WebCGL in Mozilla Firefox. When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash.
CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

ID: CVE-2020-8243
Title: Pulse Connect Secure Arbitrary Code Execution Vulnerability
Vendor: PulseSecure
Description: A vulnerability exists in the Pulse Connect Secure admin web interface that could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
CVSS v3 Base Score: 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

MOST PREVALENT MALWARE FILES October 1 - 8, 2020
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 1eef72aa566ba6c76b33f9d430d7233e358392382bfb3db81ca4f28d74f415a5
MD5: 01a607b4d69c549629e6f0dfd3983956
VirusTotal: https://www.virustotal.com/gui/file/1eef72aa566ba6c76b33f9d430d7233e358392382bfb3db81ca4f28d74f415a5/details
Typical Filename: wupxarch.exe
Claimed Product: N/A
Detection Name: W32.Auto:1eef72aa56.in03.Talos

SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5: 8c80dd97c37525927c1e549cb59bcbf3
VirusTotal: https://www.virustotal.com/gui/file/85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5/details
Typical Filename: Eter.exe
Claimed Product: N/A
Detection Name: Win.Exploit.Shadowbrokers::5A5226262.auto.talos

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: https://www.virustotal.com/gui/file/15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b/details
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: Win.Downloader.Generic::1201

SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: https://www.virustotal.com/gui/file/c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f/details
Typical Filename: Tempmf582901854.exe
Claimed Product: N/A
Detection Name: Win.Dropper.Agentwdcr::1201

SHA 256: 1a8a17b615799f504d1e801b7b7f15476ee94d242affc103a4359c4eb5d9ad7f
MD5: 88781be104a4dcb13846189a2b1ea055
VirusTotal: https://www.virustotal.com/gui/file/1a8a17b615799f504d1e801b7b7f15476ee94d242affc103a4359c4eb5d9ad7f/details
Typical Filename: UltraSearchApp
Claimed Product: N/A
Detection Name: Win.Trojan.Generic::sso.talos