TrueBot infections were observed in Clop ransomware attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-31199 | Unauthenticated Deserialization RCE in Netwrix Auditor Video Recording Component CVE-2022-31199 is an insecure object deserialization flaw (CWE-502; CISA also tags CWE-122) in the User Activity Video Recording component of Netwrix Auditor. An unauthenticated remote attacker who can reach the component's TCP port 9004 can trigger the flaw; this port is commonly blocked by standard enterprise firewalling, which limits how many environments are directly reachable. Successful exploitation yields arbitrary code execution running as NT AUTHORITY\SYSTEM, giving the attacker full local privileges on the affected host and a strong foothold for follow-on activity such as ransomware. Any organization running Netwrix Auditor with the User Activity Video Recording component deployed is affected, with the available data providing no specific affected version ranges. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-07-11 with known ransomware use, and EPSS assigns a 36% probability of exploitation within 30 days (98th percentile), though no public proof-of-concept is known. Do: Apply updates per vendor instructions immediately, or discontinue use of the affected component if updates are unavailable, per CISA's required action. Inventory whether the User Activity Video Recording component is installed and whether TCP port 9004 is reachable from user networks, VPNs, or the internet, and restrict that port to trusted hosts as a stopgap. Prioritize remediation given the KEV listing and known ransomware use. | 9.8 | 36% | KEV ransomware PoC |
| large≈10,000–100,000 installations (estimated) |
Full article442 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 12, 2022
Researchers reported an increase in TrueBot infections, attackers have shifted from using malicious emails as their primary delivery method to other techniques.
Cisco Talos researchers reported an increase in TrueBot infections, threat actors have shifted from using malicious emails as their primary attack vector to other techniques.
Truebot has been active since 2017 and some researchers linked it to the Silence Group, while a recent investigation linked it to threat actor TA505 (aka Evil Corp).
The Talos experts identified two different Truebot botnets, one is distributed worldwide, with a particular focus on Mexico, Pakistan, and Brazil, and the second one is focused on the US.
The delivery methods used in recent attacks include the exploitation of a now-patched vulnerability (CVE-2022-31199) in Netwrix Auditor, an IT asset management tool, and the Raspberry Robin worm.
The experts highlighted that the attacks took place only a few weeks after the vulnerability was publicly disclosed, a circumstance that suggests threat actors quickly test new attack vectors.
The researchers believe with moderate confidence that during November, the threat actors started using yet another distribution technique.
“Recently, the attackers have shifted from using malicious emails as their primary delivery method to other techniques. In August, we saw a small number of attacks that exploited a recent remote code execution vulnerability in Netwrix auditor. In October, a larger number of infections leveraged Raspberry Robin, a recent malware spread through USB drives, as a delivery vector.” reads the analysis published by Talos. “Post-compromise activity included data theft and the execution of Clop ransomware.”
Truebot is a downloader malware, it is used to infect systems, collect information on the targets, and deploy additional malicious payloads. Gathered data are sent back to the attacker’s command and control (C2).
The researchers noticed a set of commands to exfiltrate stolen data through a previously unknown custom tool dubbed Teleport.
The analysis of the commands issued via Teleport reveals that the tool is used by the attackers to collect files from OneDrive and Downloads folders, and from the victim’s Outlook email messages.
Talos telemetry reported multiple occurrences of Raspberry Robin delivering Truebot.
The researchers investigated an attack leveraging Truebt to deliver the Clop ransomware.
“The attackers, however, appear to have switched to an unknown TrueBot distribution mechanism starting in November, with the vector succeeding in co-opting over 500 internet-facing Windows servers located in the U.S., Canada, and Brazil into a botnet.” concludes the report that also includes Indicators of Compromise (IoCs).
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, TrueBot)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/139527/malware/truebot-infections-clop-ransomware-attacks.html