A Chinese cyberespionage group tracked as UNC3886 has been observed exploiting a VMware ESXi zero-day vulnerability to escalate privileges on guest virtual machines, Mandiant warns.

Initially detailed in September 2022, UNC3886 has been using malicious vSphere Installation Bundles (VIBs) – packages that are typically used to maintain systems and deploy updates – to install backdoors on ESXi hypervisors and gain command execution, file manipulation, and reverse shell capabilities.

The group’s malicious actions would impact VMware ESXi hosts, vCenter servers, and Windows virtual machines (VM).

In recent attacks, the cyberspies were seen harvesting credentials from vCenter Server for all connected ESXi hosts, deploying backdoors using VMCI sockets for lateral movement and persistence, and modifying and disabling logging services on compromised systems.

Additionally, the group has been exploiting a zero-day vulnerability in VMware Tools to bypass authentication and execute privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.

Tracked as CVE-2023-20867, the vulnerability has a ‘low severity’ rating, because its exploitation requires that the attacker has root access to the ESXi server.

“A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine,” VMware explains in an advisory. VMware Tools version 12.2.5 resolves the flaw.

According to Mandiant, UNC3886 was seen using scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database, enumerating all ESXi hosts and their guest VMs, and modifying lists of allowed IPs across all connected ESXi hosts.

The cyberspies also used installation scripts to deploy malicious VIBs to hosts, and exploited CVE-2023-20867 to execute commands and transfer files from the compromised ESXi host to and from guest VMs, without authentication and without a trace.

“Additionally, the use of CVE-2023-20867 does not generate an authentication log event on the guest VM when commands are executed from the ESXi host,” Mandiant explains.

The cybersecurity firm also observed the group deploying two backdoors (VirtualPita and VirtualGate) using VMCI sockets for lateral movement and continued persistence.

The malware provides the attackers with a new level of persistence (access to the infected ESXi host is regained by accessing a VM) that also allows for network segmentation bypass and evasion of security reviews for open listening ports.

In conjunction with CVE-2023-20867, the regained access to the ESXi host allows the attackers to perform “unauthenticated actions with the highest privileged accounts across any virtual machine running underneath that ESXi host,” Mandiant notes.

“If a vCenter exists as a virtual machine underneath the ESXi host, the attacker can proceed to harvest all connected vpxuser credentials for all ESXi hosts connected to the vCenter and continue to laterally pivot across the environment,” Mandiant adds.

UNC3886 is known for exploiting zero-day bugs in firewall and virtualization solutions in attacks targeting defense, technology, and telecommunication organizations in the US and in the Asia-Pacific region.

Related: Exploitation of Recent Fortinet Zero-Day Linked to Chinese Cyberspies

Related: Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks

Related: New MOVEit Vulnerabilities Found as More Zero-Day Attack Victims Come Forward

https://www.securityweek.com/chinese-cyberspies-caught-exploiting-vmware-esxi-zero-day/

Today we find ourselves using cloud native technologies to increase flexibility, scaling and cost savings in many respects. The modern cloud stack using IaaS, abstracts the hardware maintenance component away and you are left with everything above such as the operating system and software.

Golden images have been a simple concept used in practice for a long time. It reminds me a bit of the AOL marketing campaign that everyone saw and knew. The concept was that each year a new CD appeared in the mail with a version number, and people installed the software from the CD onto their PC. (Amazing to imagine how far we have come) The idea was that we know there is a known good version that has been approved and tested, pre-bundled, so no downloads were needed from external sources, especially over slow dial-up internet connections.

There is a lot of debate around the best way to create golden images and how to maintain them, as well as the software involved such as AWS image builder, Terraform or Packer. One idea is to keep them as simple as possible such that they have broad compatibility and can be configured by downstream systems. The other side is to configure them as much as possible beforehand to speed up builds and remove downloaded dependencies. Here is a typical workflow you might have in your image building and deployment process.

For simplicity, I’m going to focus on the first build step as defined in the image above. The 1st build is foundational and sets the stage for all of your other applications. Pick a reputable and official image that will be supported for a long time. You want to ensure your runtime is installed correctly and the image is hardened to your needs. In addition, you will download, sign and version your image to reduce reliance on third party hosted servers and minimize source hijacking threads. Also, consider including these three areas to help empower your images from the start and to minimize configuration drift.

Logging agent configuration – Logs are extremely important to monitor processes, crashes and anything else that you want turned on by default.

Telemetry agent – Organizations need visibility into the health of clusters, so it’s imperative that you are collecting reliable telemetry and sending the data somewhere for processing. This is paramount for both security and troubleshooting down the road.

Security agent – Depending on how your environment is set up, you may want to consider a security agent at this level to ensure every endpoint is monitored. Consideration here is key.

Images can run rampant within an organization, often having various flavors based on the needs of each team. When it comes to security, change management is a key part of NIST 800-53 as well as other system frameworks. In order to be successful with your golden builds, you will need to ensure you have coverage of the following:

• Approved baseline configurations accepted by the organization
• Default rule to use built-in software as a first option
• Expectation of regular of security and feature upgrades
• Process to upgrade pipelines to the latest build
• Retire old images and promote new images on a standard timeline

Part of securing the supply chain means that companies need to know how to fix issues when they discover them. Having a SBOM or other inventory list is a great place to start, but being able to take action when a vulnerability is found is the second part. By having a golden image, or set of known golden images, you will put a process in place that allows you to quickly fix and deploy within your organization.

Related: The SBOM Bombshell

Related: SBOMs – Software Supply Chain Security’s Future or Fantasy?

https://www.securityweek.com/software-supply-chain-the-golden-container-ship/

Progress Software has released another round of patches for its MOVEit products after researchers discovered new vulnerabilities while analyzing the recent zero-day. The news comes just as more organizations hit by the zero-day attack have come forward.

The zero-day affecting the MOVEit Transfer and Cloud managed file transfer (MFT) software, tracked as CVE-2023-34362 and described as an SQL injection issue, has been exploited to steal data from organizations that have been using the product. The flaw started being widely exploited in late May, but new evidence suggests that cybercriminals have been testing it since as early as 2021. 

The attacks were conducted by a cybercrime group known for the Cl0p ransomware operation. The hackers claim to have hit hundreds of organizations, giving them until June 14 to get in touch in order to prevent data stolen from their systems from getting leaked. 

In a new advisory published on Friday, Progress informed customers that it has released patches for new vulnerabilities discovered by cybersecurity firm Huntress, whose researchers have been monitoring attacks involving exploitation of CVE-2023-34362.

The vendor said the new flaws “could potentially be used by a bad actor to stage an exploit”, but noted that currently there is no evidence that they have been exploited in the wild. Both MOVEit Transfer and MOVEit Cloud products are again impacted.  

Huntress has described its findings as “further attack vectors” discovered during its analysis.

CVE-2023-35036 has been assigned to the new vulnerabilities, which have also been described as SQL injection bugs that can be exploited by an unauthenticated attacker to access MOVEit databases.   

At least 100 organizations have been reportedly hit by attacks exploiting the MOVEit zero-day, but the number of victims could be much higher considering that there are as many as 3,000 internet-exposed systems. 

One of the first victims to come forward was UK-based payroll and HR company Zellis. Several major companies using Zellis services were hit, including the airlines British Airways and Aer Lingus, the BBC, and pharmacy chain Boots. 

The Canadian province of Nova Scotia was also among the first to announce that personal information has been breached as a result of the MOVEit hack. The University of Rochester also disclosed a breach in early June.

The latest victims to come forward are government organizations: the Illinois Department of Innovation & Technology (DoIT) and the Minnesota Department of Education (MDE).

Both organizations became aware of the attacks on May 31 and they both took immediate action to secure their servers. 

“DoIT’s investigation is ongoing and the full extent of this incident is still being determined, but DoIT believes a large number of individuals could be impacted,” DoIT said. 

The Minnesota Education Department has determined that 24 files were accessed by hackers. These files contained the information of roughly 95,000 students placed in foster care, including names, dates of birth and county of placement. 

Dozens of other students also had information exposed, including name, date of birth, address, parent name, high school and college transcript information, and the last four digits of the their social security number. 

“To date there have been no ransom demands nor is MDE aware that the data has been shared or posted online. Additionally, no virus or other malware was uploaded to MDE’s hardware systems,” the organization said. 

The Cl0p ransomware operators claim on their website that they will not attempt to extort money from impacted government organizations, including cities and law enforcement agencies. 

“We erased all your data. You do not need to contact us. We have no interest to expose such information,” the hackers wrote. 

American networking solutions provider Extreme Networks also announced being impacted by the MOVEit attack last week. The company is in the process of determining whether customer information has been compromised.

Related: Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery

https://www.securityweek.com/new-moveit-vulnerabilities-found-as-more-zero-day-attack-victims-come-forward/

Fortinet has patched a critical FortiGate vulnerability that can be exploited by an unauthenticated attacker for remote code execution, according to the researchers who reported the flaw to the vendor. 

The vulnerability is tracked as CVE-2023-27997 and it was discovered by researchers at French offensive IT security firm Lexfo. 

Charles Fol, one of the researchers, said on Twitter that the vulnerability affects every SSL VPN appliance and it can be exploited for remote code execution without authentication. 

Fortinet has yet to publish an advisory for the flaw, but French cybersecurity company Olympe Cyberdefense reported that an advisory is expected to become public on June 13. 

The company said the security hole impacts the SSL VPN functionality of FortiGate firewalls, allowing an attacker to “interfere via the VPN”. 

FortiOS 7.0.12, 7.2.5, 6.4.13 and 6.2.15 reportedly contain the patch. 

Vulnerabilities affecting Fortinet products are often exploited by threat actors — both cyberspies and profit-driven cybercriminals — in many cases before a patch has been released.

CISA’s Known Exploited Vulnerabilities Catalog currently lists 10 Fortinet product vulnerabilities that have been leveraged by malicious actors in their attacks since 2018.

Related: Fortinet Patches Critical Vulnerability in Data Analytics Solution

Related: Chinese Hackers Exploited Fortinet VPN Vulnerability as Zero-Day

Related: Fortinet Finds Zero-Day Exploit in Government Attacks After Devices Detect Integrity Breach

Related: Fortinet Patches Critical Unauthenticated RCE Vulnerability in FortiOS

https://www.securityweek.com/fortinet-patches-critical-fortigate-ssl-vpn-vulnerability/

Newly uncovered evidence suggests that cybercriminals have known about the recently patched MOVEit Transfer zero-day vulnerability since mid-2021.

The zero-day affecting the managed file transfer (MFT) software, tracked as CVE-2023-34362, started being widely exploited on or around May 27. The product’s developer, Progress Software, alerted customers on May 31, but at least 100 organizations have reportedly been compromised as part of the malicious campaign.

Shortly after the attacks came to light, threat intelligence company GreyNoise reported seeing scanning activity possibly related to CVE-2023-34362 in early March.

However, security researchers at risk and financial advisory services firm Kroll have found evidence suggesting that exploitation — or at least testing of the vulnerability — may have started much earlier.

Kroll has looked at the Microsoft IIS logs of customers impacted by the recent attacks and discovered similar activity occurring in other client environments in April 2022 and July 2021. 

“Kroll observed activity consistent with MOVEit Transfer exploitation that collectively occurred on April 27, 2022; May 15–16, 2023; and May 22, 2023, indicating that actors were testing access to organizations via likely automated means and pulling back information from the MOVEit Transfer servers to identify which organization they were accessing,” the company said. 

In the attacks from July 2021, it appeared that the attackers were conducting manual testing, based on how long the activity lasted. The attackers seemed to switch to automated tools in subsequent activity, which lasted minutes and even seconds.

An analysis of the IP addresses involved in the older attacks pointed to the Cl0p ransomware group. Microsoft attributed the recent MOVEit exploitation to Cl0p and the threat actor took credit for the attacks shortly after.

In a message posted on its website, the ransomware gang claimed to have exploited the MOVEit zero-day to steal files from “hundreds of companies”, instructing victims to get in touch by June 14 to avoid their data getting leaked. The hackers claim they are not targeting government organizations.

Victims have started coming forward. The list includes the Nova Scotia government and UK payroll company Zellis, through which the hackers gained access to data belonging to some of its customers, including British Airways and BBC.

This is not the first time Cl0p has exploited a zero-day vulnerability in an MFT product to hit multiple organizations in a short time interval. Earlier this year, the cybercriminals exploited a GoAnywhere flaw to exfiltrate data from companies that had been using the product. 

“From Kroll’s analysis, it appears that the Clop threat actors had the MOVEit Transfer exploit completed at the time of the GoAnywhere event and chose to execute the attacks sequentially instead of in parallel. These findings highlight the significant planning and preparation that likely precede mass exploitation events,” Kroll said.

Related: Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery

https://www.securityweek.com/evidence-suggests-ransomware-group-knew-about-moveit-zero-day-since-2021/

A researcher has disclosed the details of serious vulnerabilities discovered in a Honda ecommerce platform used for equipment sales. Exploitation of the flaws could have allowed an attacker to gain access to customer and dealer information.

The security holes and the data exposure were discovered earlier this year by US-based researcher Eaton Zveare, who notified Honda about his findings in mid-March. The vendor immediately took steps to address the issues and thanked the white hat hacker for his work, but did not reward him as it does not have a bug bounty program. Honda said it did not find any evidence of malicious exploitation. 

While Honda is best known for its cars, the ecommerce platform analyzed by Zveare is designed for the sales of Honda power equipment (generators, pumps, lawn mowers), and boat engines and accessories. 

The platform powers Honda Dealer Sites, a service that dealers can use to create websites where they sell Honda products. Dealers need to create an account and are then provided all the tools they need to create a website, promote it, and handle product orders. 

The researcher discovered a password reset API vulnerability in an admin dashboard that allowed him to reset the password of a test account set up by Honda. While that only gave him access to the test account, he discovered an insecure direct object references (IDOR) vulnerability that gave him access to every dealer’s data simply by changing the value of an ID in the admin panel’s URL.

From the dealer admin dashboard he was also able to elevate privileges to administrator of the entire platform — functionality reserved for Honda employees — using a specially crafted request. This administration panel provided an overview of the dealer network, including the amount of money earned in subscription fees. 

Zveare said he had gained access to more than 21,000 customer orders ranging from 2016 to 2023, including name, address, phone number and information on the ordered items. The vulnerabilities also exposed 1,500 dealer sites that could have been modified by the attacker.

In addition, the researcher found more than 3,500 dealer accounts for which he could have changed the password, roughly 1,000 dealer email addresses, and 11,000 customer emails addresses.  He believes it may have also been possible to obtain the private keys provided by some dealers for payment services such as PayPal, Stripe and Authorize.net.

“With access to more than 21k customer orders, highly targeted phishing campaigns could be created to trick customers into providing even more valuable data, or to try and install malware on their devices. Another possibility would have been to check for new Honda orders every day and send phishing emails to customers disguised as ‘Register your new Honda product’ or ‘You mistyped your credit card number, click here to correct it’,” the researcher wrote in a blog post regarding potential impact.

He added, “The most significant issue I can think of is the access to the dealer sites. There are more than 1k active sites that could have been covertly updated to add malicious code such as cryptominers and credit card skimmers. Of course, it’s possible some astute dealers may discover such website changes, but they might chalk it up to themselves being hacked and change their dealer account password. Unfortunately, there is nothing any dealer could have done to protect their store from this attack.”

Earlier this year, Zveare reported finding a vulnerability in a Toyota customer relationship management (CRM) platform, which could have been exploited to access the personal information of customers in Mexico.

Related: Toyota Discloses New Data Breach Involving Vehicle, Customer Information

Related: Honda Admits Hackers Could Unlock Car Doors, Start Engines

Related: Toyota: Data on More Than 2 Million Vehicles in Japan Were at Risk in Decade-Long Breach

https://www.securityweek.com/vulnerabilities-in-honda-ecommerce-platform-exposed-customer-dealer-data/

Cisco on Wednesday announced patches for a critical vulnerability in its Expressway series and TelePresence Video Communication Server (VCS) enterprise collaboration and video communication solutions.

Tracked as CVE-2023-20105 (CVSS score of 9.6), the vulnerability allows an administrator with ‘read-only’ rights to elevate their privileges to ‘read-write’.

The issue exists because password change requests are not handled properly, allowing an attacker authenticated as a ‘read-only’ administrator to send a crafted request to change the password for any user account on the system, including that of a ‘read-write’ administrator, and then impersonate them.

Cisco Expressway series and TelePresence VCS deployments that have granted CLI access to a read-only administrator are also vulnerable to CVE-2023-20192, a high-severity vulnerability also leading to escalation of privilege. According to Cisco, CLI access is disabled by default for read-only users.

“This vulnerability is due to incorrect implementation of user role permissions. An attacker could exploit this vulnerability by authenticating to the application as a read-only CLI administrator and issuing commands normally reserved for administrators with read-write capabilities,” Cisco explains in an advisory.

An attacker could exploit this flaw to execute commands they would not normally have access to, including modifying system configuration parameters.

Expressway series and TelePresence VCS version 14.2.1 contains patches for CVE-2023-20105, while version 14.3.0 addresses CVE-2023-20192.

This week, Cisco also announced patches for high-severity denial-of-service (DoS) bugs in the Unified Communications Manager IM & Presence service and Firepower 2100 series appliances, as well as a high-severity code execution flaw in AnyConnect Secure Mobility Client and Secure Client software for Windows.

Cisco also released fixes for two medium-severity vulnerabilities, namely a DoS bug in Unified Communications Manager and Unified Communications Manager Session Management Edition and an escalation of privilege issue in Secure Workload.

Additionally, the company warned that no patches will be released for a medium-severity cross-site scripting (XSS) flaw in Small Business 200, 300, and 500 series switches, which reached end-of-life (EoL) in or before 2019.

The tech giant says it is not aware of any of these vulnerabilities being exploited in malicious attacks. Additional information on the vulnerabilities can be found on Cisco’s product security page.

Related: Cisco Says PoC Exploits Available for Newly Patched Enterprise Switch Vulnerabilities

Related: Cisco Warns of Critical Vulnerability in EoL Phone Adapters

Related: Cisco Patches Critical Vulnerabilities in Industrial Network Director, Modeling Labs

https://www.securityweek.com/cisco-patches-critical-vulnerability-in-enterprise-collaboration-solutions/

Open source password manager KeePass was updated over the weekend to patch a vulnerability allowing attackers to retrieve the cleartext master password from a memory dump.

Tracked as CVE-2023-32784 and impacting KeePass 2.x versions, the issue is related to the custom-developed textbox used for password entry, which creates a leftover string in memory for each character that the user types.

An attacker can use a KeePass process dump, a hibernation file, a swap file, or even a RAM dump of the entire system to retrieve the strings and reconstruct the typed password. Because the strings are ordered in memory, even multiple typed-in passwords can be retrieved.

Several weeks ago, a security researcher published a proof-of-concept (PoC) tool that can exploit the vulnerability to retrieve passwords from memory dumps.

The researcher also pointed out that the risks associated with the flaw were minimal, as remote exploitation was not possible. Unless a system was already infected with malware, there was no reason to assume password compromise due to this issue.

At the time, KeePass announced that a patch for the bug had been included in the test version of KeePass 2.54, with the stable release scheduled for July.

The update, however, was released several weeks earlier, improving process memory protections to prevent the creation of managed strings and prevent password recovery. The application also creates dummy fragments in memory now, and mixes them with the correct fragments.

The software update brings several other changes as well, including user interface and integration enhancements, new features, and other improvements and bug fixes, the KeePass 2.54 changelog shows.

Related: Gigabyte Rolls Out BIOS Updates to Remove Backdoor From Motherboards

Related: GitLab Security Update Patches Critical Vulnerability

Related: Google Patches Third Chrome Zero-Day of 2023

https://www.securityweek.com/keepass-update-patches-vulnerability-exposing-master-password/

Google on Monday released a Chrome 114 security update that patches the third zero-day vulnerability found in the web browser in 2023.

Google said the latest version of Chrome patches two flaws, including CVE-2023-3079, a type confusion issue affecting the V8 JavaScript engine. 

The internet giant noted that the vulnerability, discovered on June 1, has been exploited in the wild, but has not shared any information on the attacks.

However, the fact that the security hole and its exploitation were discovered by Clement Lecigne of Google’s Threat Analysis Group suggests that CVE-2023-3079 has likely been exploited by a commercial spyware vendor.

Google regularly publishes blog posts describing the exploits used by various spyware vendors, which typically advertise their products for lawful surveillance by government agencies. However, their solutions have often been abused by totalitarian regimes to spy on critics. 

In many cases, spyware vendors integrate Chrome vulnerabilities into complex exploit chains that are designed to target Android devices. 

Google announced recently that it’s temporarily offering up to $180,000 through its bug bounty program for a full chain exploit that leads to a sandbox escape in Chrome. 

In 2022, the company patched nine Chrome zero-days, including five discovered by its Threat Analysis Group.  

Related: Google Warns of New Chrome Zero-Day Attack

Related: Android Security Update Patches Kernel Vulnerability Exploited by Spyware Vendor

Related: Details Emerge on Israeli Spyware Vendor QuaDream and Its iOS Malware

https://www.securityweek.com/google-patches-third-chrome-zero-day-of-2023/

Taiwan-based networking device manufacturer Zyxel is urging customers to update the firmware of ATP, USG Flex, VPN, and ZyWALL/USG firewall devices, to prevent the exploitation of recently patched vulnerabilities.

Tracked as CVE-2023-28771, CVE-2023-33009 and CVE-2023-33010, the issues can lead to OS command execution, remote code execution (RCE), and denial-of-service (DoS).

The first of the issues came to light in late April, when Zyxel released patches for it, warning that it can be exploited remotely without authentication by sending specially crafted packets to a vulnerable device.

In mid-May, after security researchers reproduced the exploit targeting CVE-2023-28771, Rapid7 warned that the vulnerability would likely be mass-exploited in the wild, considering that there were tens of thousands of Zyxel device web interfaces accessible from the internet.

Shortly after, a Mirai variant was seen exploiting the bug to ensnare unpatched devices in a DDoS-capable botnet. Around the same time, Zyxel released patches for CVE-2023-33009 and CVE-2023-33010.

Now, Zyxel once again raises the alarm on the ongoing attacks, urging customers to install the available patches as soon as possible, to prevent exploitation.

The manufacturer notes that it previously alerted customers of the available patches through multiple channels, including security advisory newsletter, push notifications via web GUIs, and scheduled firmware upgrades for cloud-based devices.

The company also advises customers to disable HTTP/HTTPS services from the WAN if unused, enable policy control and only allow access from trusted IPs, enable geoIP filtering, and disable UDP ports 500 and 4500 if unused.

To identify potential malware infections, customers should look for symptoms such as unresponsive devices, unreachable web GUIs or SSH management interfaces, network interruptions, and disconnecting VPN connections.

Additional information on the addressed vulnerabilities can be found on Zyxel’s security advisories page.

Related: Zyxel Patches Critical Vulnerability in NAS Firmware

Related: Technical Details Released for Recently Patched Zyxel Firewall Vulnerabilities

Related: Zyxel Firewall Vulnerability Exploitation Attempts Seen One Day After Disclosure

https://www.securityweek.com/zyxel-urges-customers-to-patch-firewalls-against-exploited-vulnerabilities/