Security Community

Who:

• Cleo: Developer of LexiCom, VLTransfer, and Harmony file transfer software, affected by critical vulnerabilities.

• Huntress and Rapid7: Cybersecurity firms tracking and reporting exploitation activity.

• Termite ransomware group: Suspected attackers exploiting a zero-day vulnerability, potentially linked to previous Cl0p operations.

• Victim organizations: Include businesses in consumer products, logistics, shipping, and food supply sectors.

What:

• Vulnerability (CVE-2024-50623): Allows unauthenticated remote code execution via unrestricted file uploads.

• Exploit Activity: Attackers use autorun functionality to drop malicious files and execute commands. Exploitation observed since December 3, with a spike on December 8.

• Ransomware Impact: Termite uses modified Babuk ransomware, encrypting files and adding a ".termite" extension.

Impact:

• At least 10 businesses compromised, with critical sectors affected.

• Exploitation widespread: Highlights risks of unmanaged internet exposure for file transfer tools.

• Termite ransomware may signify an evolution of Cl0p or a new threat group operating with similar tactics.

• Patch pending: Users must urgently apply mitigations and restrict software exposure until Cleo releases a fix.

Read the full article HERE

Who

• FBI: Issued warnings to iPhone and Android users about encrypted messaging apps.

• Tech Giants: Apple, Google, Meta (WhatsApp, Facebook Messenger), and Signal are key players in the encrypted messaging debate.

• Salt Typhoon Hackers: Linked to China’s Ministry of State Security, implicated in cyberattacks on U.S. telecom networks.

What

• FBI's Warning: Urged users to switch to encrypted messaging platforms but criticized the current lack of "responsibly managed" encryption, advocating for tech companies to provide lawful access to encrypted content.

• Security Breaches: Ongoing cyberattacks threaten metadata and message content on major platforms.

• Global Context: Surge in Telegram usage in Korea amid fears of state censorship, highlighting global concerns over messaging app security.

Impact

• U.S. Debate on Encryption: FBI seeks public support for "responsible encryption," balancing privacy with lawful access to prevent criminal misuse.

• Distrust in Tech Giants: Allowing backdoor access to encrypted messages raises fears of privacy erosion and misuse by authoritarian regimes.

• User Security Concerns: Platforms like Telegram face scrutiny for weak encryption practices, emphasizing the need for truly secure alternatives.

Read the full article HERE

Who:

• Starbucks: Impacted by a ransomware attack affecting scheduling and payroll systems.

• Blue Yonder: The third-party cloud service provider targeted in the attack, also serving major grocery stores and corporations like Ford.

• Hackers: Responsible for locking Blue Yonder's systems, demanding a ransom.

• CrowdStrike: Hired by Blue Yonder to help recover from the attack.

What:

• A ransomware attack hit Blue Yonder, disrupting its services, including the software Starbucks uses to manage barista schedules and payroll. This forced Starbucks to pay employees manually.

• The attack also prompted concerns at other large companies, such as Ford, about potential impacts on their operations.

Impact:

• Starbucks had to quickly adapt to manual processes to ensure timely employee payments, highlighting the risk of relying on third-party software.

• The retail and grocery sectors were notably affected, especially during a critical holiday period for sales.

• The incident underscores a broader cybersecurity trend: increased ransomware attacks targeting businesses during vulnerable times like holidays, when companies are under pressure to maintain operations.

Read the full article HERE

Who:

• Entities Involved: Cybercriminals using a variant of Remcos RAT malware in a phishing campaign; Fortinet FortiGuard Labs identified this activity.

What:

• Attack Vector: Phishing emails with purchase order themes lure victims into opening a malicious Excel attachment, which exploits an old Office vulnerability (CVE-2017-0199) to deliver Remcos RAT as a fileless payload.

• Malware Capabilities: Remcos RAT can remotely control infected systems, collecting sensitive data and issuing commands for activities like file harvesting, process manipulation, registry editing, and enabling cameras or microphones.

Impact:

• Security Risks: The fileless nature of Remcos RAT complicates detection, allowing attackers to evade security measures and maintain control over compromised systems. This campaign highlights evolving techniques in malware delivery through commonly used applications, increasing risks for unprotected users.

  
  

Read the full article HERE

Who:

• Entities Involved: Threat actors deploying AndroxGh0st malware in collaboration with Mozi botnet; identified by CloudSEK.

What:

• Attack Method: AndroxGh0st malware is exploiting vulnerabilities across internet-facing applications and using the Mozi botnet to infect IoT and cloud systems. The malware leverages unpatched flaws in various platforms (e.g., Cisco ASA, Dasan GPON, and Oracle EBS) for remote code execution and credential theft, gaining control over targeted devices.

• Botnet Capabilities: Mozi enables DDoS attacks, while AndroxGh0st expands its scope by embedding Mozi’s IoT infection mechanisms, enabling wider IoT device compromise.

Impact:

• Security Risks: The operational alliance between AndroxGh0st and Mozi escalates the threat to IoT and cloud services, expanding potential attack surfaces and allowing for coordinated, large-scale botnet operations. This integration poses a high risk for critical infrastructure, with enhanced capabilities for sustained access and increased infection rates across devices.

  
  

Read the full article HERE