LockBit Remains Most Prolific Ransomware in Q3
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens. | 7.8 | 100% | KEV ransomware PoC ×10 |
| masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown) | |
| CVE-2018-0798 +1 in the same advisory: …0802 | Memory Corruption RCE in Microsoft Office Equation Editor (CVE-2018-0798) CVE-2018-0798 is a memory corruption flaw (out-of-bounds write, CWE-787) in the Microsoft Equation Editor component of Microsoft Office 2007, 2010, 2013, and 2016 that allows remote code execution when the component mishandles objects in memory. A remote attacker triggers it by persuading a user to open a specially crafted document containing a maliciously embedded equation; user interaction is required and no privileges are needed (CVSS vector AV:N/AC:L/PR:N/UI:R). Successful exploitation lets the attacker run arbitrary code in the context of the current user, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.8). Any organization running the affected legacy Office versions — including deployments using the Office Compatibility Pack — is exposed, with government, military, and transportation organizations named in related reporting on Office-document attack campaigns. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and its EPSS score of 95.1% (100th percentile) indicates a very high probability of active exploitation, with related headlines highlighting APT activity (notably the Bitter group's campaigns against military targets in South Asia) around Office document threats. Do: Apply Microsoft's security updates for this vulnerability across Office 2007, 2010, 2013, 2016 and the Office Compatibility Pack, per vendor instructions as required by CISA KEV, and upgrade off legacy Office 2007/2010 to a still-supported release since those versions no longer receive regular fixes. Enforce caution with untrusted Office documents (don't open unsolicited attachments or embedded equations from unknown sources) and consider stripping or blocking embedded OLE equation objects from external files. Prioritize patching for government, military, and transportation-sector environments given active APT targeting of those sectors via Office documents. | 8.8 group max | 95% | KEV |
| masshundreds of millions of Office users/endpoints worldwide |
Full article353 words · extracted from infosecurity-magazine.com · click to collapse
The infamous LockBit ransomware variant remained the most widespread in the third quarter of 2022, accounting for over a fifth (22%) of detections, according to a new report from Trellix.
The threat intelligence vendor analyzed proprietary data from its sensor network, open source intelligence and investigations by the Trellix Advanced Research Center to compile The Threat Report: Fall 2022.
It revealed that Lockbit and Phobos were the most common ransomware families during Q3 2022. Lockbit was recently assessed by Deep Instinct to be the most prolific variant of 2022 so far.
“At the end of Q3 their ‘builder’ was released, and allegedly various groups are already establishing their own RaaS with it,” the report said of LockBit.
“Phobos ransomware continues to be active and accounts for 10% of our telemetry hits. Their tactic of selling a complete ransomware kit and avoiding large organizations allows them to stay under the radar.”
Germany recorded the highest detections of APT-related activity (29%) and the highest volume of ransomware (27%), while telecoms was the sector most impacted by ransomware, followed by transportation and shipping.
The latter accounted for more APT detections than any other vertical and witnessed a 100% increase in ransomware in the US, the report claimed.
The most active advanced threat groups during the quarter were the China-linked Mustang Panda, Russia’s APT29 and Pakistan-linked APT36.
Red team software Cobalt Strike remained a popular tool for threat actors, seen in a third (33%) of observed global ransomware activity and 18% of APT detections in Q3.
There was also a reminder in the report of the need for risk-based patch management programs. Trellix observed Microsoft Equation Editor vulnerabilities from several years ago – CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802 – as the most frequently exploited among malicious emails received by customers in the quarter.
“We continue to see unremitting activity out of Russia and other state-sponsored groups,” noted Trellix head of threat intelligence, John Fokker.
“This activity, plus a rise in politically motivated hacktivist action and sustained ransomware attacks on healthcare and education systems, signals the need for increased inspection of cyber-threat actors and their methods.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/lockbit-remains-most-prolific/