US and South Korea accuse North Korea of using hospital ransoms to fund more hacking
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-20038 | Unauthenticated Stack Buffer Overflow in SonicWall SMA 100 Appliances SonicWall SMA 100 series secure remote-access appliances contain an unauthenticated stack-based buffer overflow (CWE-121) in the appliance's network-facing interface, triggered by crafted requests sent to the device without any credentials. A remote attacker who triggers the overflow can execute arbitrary code on the appliance with the privileges of the affected service, gaining a foothold on an internet-facing VPN gateway that typically sits at the network edge. Any organization running an SMA 100 series appliance is affected, and because these appliances provide remote access to corporate networks, compromise can expose entire internal environments. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2022-01-28 with known ransomware use, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is catalogued in the provided data, but the KEV listing and EPSS score indicate active attacker interest. Do: Upgrade SMA 100 series appliances to firmware 10.0.7.2 or later per SonicWall's instructions, as required by the CISA KEV listing. Until patched, restrict internet exposure of the SMA portal and management interface to trusted sources where feasible. Because ransomware operators are known to exploit this flaw, review appliance logs for signs of compromise and monitor for unexpected account creation or traffic after patching. | 9.8 | 100% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed SMA 100 appliances (order of magnitude ~10,000-50,000 devices), plus a larger installed base used internally | |
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Inventory all Java applications and dependencies for Apache Log4j2 and apply the vendor's patched updates, or remove affected assets from the network, as required by CISA's KEV catalog. Where updates are not yet available, use the temporary mitigations in CISA's ED-22-02 recommended-mitigation guidance, such as disabling message lookups, only until patches are applied. Prioritize internet-facing and business-critical systems and hunt for exploitation activity given known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×9 |
| masshundreds of millions of Java applications/devices, with hundreds of thousands of internet-exposed services | |
| CVE-2022-24990 | Unauthenticated RCE via Admin Password Leak in TerraMaster TOS 4.2.29 and earlier TerraMaster TOS (TerraMaster OS) versions 4.2.29 and earlier do not require authentication (CWE-306) on the mobile API endpoint module/api.php?mobile/webNasIPS, and a request presenting the User-Agent "TNAS" returns system information that includes the administrative account's password in the PWD field. An unauthenticated attacker with network access to the NAS web interface can send this request and read the response, obtaining full administrative credentials. With those credentials an attacker controls the NAS, and public proof-of-concept exploits chain this flaw with a PHP object-instantiation bug to achieve unauthenticated remote command execution. Any TerraMaster NAS running TOS 4.2.29 or earlier is affected, with internet-exposed devices at the greatest risk. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities Catalog (added 2023-02-10) with known ransomware use, carries an EPSS of roughly 84%, and CISA and press reports describe active attacks, including North Korean ransomware activity against healthcare and critical infrastructure. Do: Upgrade TerraMaster TOS to a release newer than 4.2.29 per the vendor's instructions, as required by the CISA KEV entry. If patching must wait, restrict the TOS web interface to trusted networks so unauthenticated users cannot reach module/api.php?mobile/webNasIPS. Check device logs for requests to the webNasIPS endpoint with a TNAS User-Agent and look for signs of post-compromise activity, since ransomware use of this flaw is known. | 7.5 | 84% | KEV ransomware PoC ×3 |
| largeon the order of tens of thousands of internet-exposed TerraMaster NAS devices (estimate, not a verified count) |
Full article615 words · extracted from therecord.media · click to collapse
North Korean state hackers are using a variety of ransomware strains to attack healthcare organizations and other targets globally, with the goal of pulling in money to fund other operations, the U.S. and South Korea said Thursday. The two allies said “an unspecified amount of revenue from these cryptocurrency operations supports [North Korean] national-level priorities and objectives, including cyber operations targeting the United States and South Korea governments.” Specific targets for those cyber operations include U.S. defense information networks and military contractors, according to joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the NSA and several South Korean defense and intelligence agencies. North Korean hackers have used both internally developed ransomware like Maui and H0lyGh0st, the agencies said, as well as other extortion malware attained by other means — such as Deadbolt, ech0raix, GonnaCry, Hidden Tear, Jigsaw, LockBit 2.0, My Little Ransomware, NxRansomware, Ryuk, and YourRansom. The advisory provides an update on one released by the same law enforcement agencies in July 2022 – in which North Korean hackers were accused of using the Maui ransomware in attacks on healthcare organizations. It marks the first time agencies have tied a specific actor to the use of Deadbolt and ech0raix, two ransomware strains used to target customers of data-storage hardware vendor QNAP. The agencies also said North Korean hackers have attempted to portray themselves as members of other ransomware groups like the now-shuttered REvil. They have generated multiple web domains, personas and accounts to obscure their actions, according to the agencies, which noted that the hackers are able to “procure infrastructure, IP addresses, and domains with cryptocurrency generated through illicit cybercrime, such as ransomware and cryptocurrency theft.” They also use VPNs to make it appear attacks are coming from more innocuous locations outside of North Korea. The hackers use a range of exploits for common vulnerabilities like Log4Shell and others. The agencies named three specific vulnerabilities – CVE-2021-44228, CVE-2021-20038 and CVE-2022-24990 – as ones typically used by North Korean actors. In addition to ransomware, the hackers use other customized malware to exfiltrate data, perform reconnaissance operations and steal files. “DPRK cyber actors have been observed setting ransoms in bitcoin. Actors are known to communicate with victims via Proton Mail email accounts,” the advisory said. “For private companies in the healthcare sector, actors may threaten to expose a company’s proprietary data to competitors if ransoms are not paid.” The advisory highlights a startling trend across the world as nation-states have begun deploying ransomware for a variety of reasons and purposes. The governments of countries like Costa Rica, Albania, Bosnia and Herzegovina and Montenegro have each dealt with ransomware attacks that were allegedly launched by rivals or adversaries like Russia and Iran. Several other parliaments around the world have faced off against ransomware gangs and hackers in recent years. Allan Liska, a ransomware expert at cybersecurity company Recorded Future, said more than 50 national governments or national government agencies have been hit by ransomware in 2022. The Record is an editorially independent unit of Recorded Future. “We’ve seen what appear to be government-backed ransomware attacks from Russia, China, Iran and North Korea. Now, North Korea has always used ransomware attacks, dating back to 2017, but they seem to have really stepped up their attacks this year, making them even more dangerous as an adversary,” he said.
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/north-korea-hackers-funding-us-south-korea-advisory