Cisco Talospublished Dec 15, 19:10 UTC (Dec 15, 2022)ingested Sep 10, 06:19 UTC

Threat Source newsletter (Dec. 15, 2022): Talos Year in Review is here

criticalRansomware exploited in the wildimportance 60CVE-2022-26500 CVE-2022-26501

Read the original

Tagscve-2022-26500 cve-2022-26501 ransomware

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2022-26501 +1 in the same advisory: …26500	Unauthenticated RCE in Veeam Backup & Replication 10.x and 11.x CVE-2022-26501 is a critical (CVSS 9.8) missing-authentication/incorrect-access-control flaw in Veeam Backup & Replication 10.x and 11.x that allows unauthenticated remote code execution; it is one of two related flaws (CVE-2022-26500 and CVE-2022-26501) fixed together by Veeam. An attacker who can reach the affected backup service over the network can trigger the flaw without any credentials or user interaction and gain code execution with full confidentiality, integrity, and availability impact on the backup server. This hands attackers control of the backup infrastructure itself, which is valuable for harvesting stored credentials, tampering with or destroying backups, and moving laterally ahead of ransomware detonation. Any organization running Veeam Backup & Replication 10.x or 11.x is affected. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-12-13 with known ransomware use, and public reporting associates these flaws with Cuba ransomware gang activity. Do: Apply Veeam's updates per vendor instructions to all 10.x and 11.x deployments and verify the patched build is installed on every backup server. Restrict network access to Veeam backup infrastructure (including any internet-exposed or cloud-facing Veeam services) to trusted management networks, and hunt for exploitation indicators given the known ransomware use. Because exploitation is in the wild, treat patching of Veeam backup servers as urgent and high priority.	9.8 group max	4%	KEV ransomware	Veeam Backup & Replication 10.x and 11.x	mass≈10^5–10^6 backup server deployments (Veeam reports roughly 500k+ customers and 10.x/11.x were the then-current versions)	Mar 17, 2022

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2022-26501

+1 in the same advisory: …26500

Unauthenticated RCE in Veeam Backup & Replication 10.x and 11.x

CVE-2022-26501 is a critical (CVSS 9.8) missing-authentication/incorrect-access-control flaw in Veeam Backup & Replication 10.x and 11.x that allows unauthenticated remote code execution; it is one of two related flaws (CVE-2022-26500 and CVE-2022-26501) fixed together by Veeam. An attacker who can reach the affected backup service over the network can trigger the flaw without any credentials or user interaction and gain code execution with full confidentiality, integrity, and availability impact on the backup server. This hands attackers control of the backup infrastructure itself, which is valuable for harvesting stored credentials, tampering with or destroying backups, and moving laterally ahead of ransomware detonation. Any organization running Veeam Backup & Replication 10.x or 11.x is affected. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-12-13 with known ransomware use, and public reporting associates these flaws with Cuba ransomware gang activity.

Do: Apply Veeam's updates per vendor instructions to all 10.x and 11.x deployments and verify the patched build is installed on every backup server. Restrict network access to Veeam backup infrastructure (including any internet-exposed or cloud-facing Veeam services) to trusted management networks, and hunt for exploitation indicators given the known ransomware use. Because exploitation is in the wild, treat patching of Veeam backup servers as urgent and high priority.

9.8

group max

KEV ransomware

Veeam Backup & Replication 10.x and 11.x

mass≈10^5–10^6 backup server deployments (Veeam reports roughly 500k+ customers and 10.x/11.x were the then-current versions)

Mar 17, 2022

Indicators of compromiseauto-extracted · verify before use · export allAll →

Type	Indicator	Context
md5	26f927fb7560c11e509f0b8a7e787f79	8cc44f98379e81bd1641e5fbaa81fc9f095b89c10e4d1d2c89274d MD5: 26f927fb7560c11e509f0b8a7e787f79 26f927fb7560c11e509f0b8a7e787f79 Typical Filename: VID001.e
md5	2915b3f8b703eb744fc54c81f4a9c67f	d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Typical Filename: VID001.exe Detection Name: Simple_Custom_
md5	2c8ea737a232fd03ab80db672d50a17a	5689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645 MD5: 2c8ea737a232fd03ab80db672d50a17a Typical Filename: LwssPlayer.scr Detection Name: Auto.125E1
md5	7bdbd180c081fa63ca94f9c22c457376	83227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 MD5: 7bdbd180c081fa63ca94f9c22c457376 Typical Filename: IMG001.exe Detection Name: Trojan.Generic
md5	a087b2e6ec57b08c0d0750c60f96a74c	e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c MD5: a087b2e6ec57b08c0d0750c60f96a74c Typical Filename: AAct.exe Detection Name: W32.File.MalPare
sha256	1077bff9128cc44f98379e81bd1641e5fbaa81fc9f095b89c10e4d1d2c89274d	ware files from Talos telemetry over the past week SHA 256: 1077bff9128cc44f98379e81bd1641e5fbaa81fc9f095b89c10e4d1d2c89274d MD5: 26f927fb7560c11e509f0b8a7e787f79 26f927fb7560c11e509f0
sha256	125e12c8045689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645	ename: AAct.exe Detection Name: W32.File.MalParent SHA 256: 125e12c8045689bb2a5dcad6fa2644847156dec8b533ee8a3653b432f8fd5645 MD5: 2c8ea737a232fd03ab80db672d50a17a Typical Filename: Lws
sha256	9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507	ame: VID001.exe Detection Name: W32.File.MalParent SHA 256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Typical Filename: VID
sha256	a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91	Player.scr Detection Name: Auto.125E12.241442.in02 SHA 256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 MD5: 7bdbd180c081fa63ca94f9c22c457376 Typical Filename: IMG
sha256	e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c	VID001.exe Detection Name: Simple_Custom_Detection SHA 256: e12b6641d7e7e4da97a0ff8e1a0d4840c882569d47b8fab8fb187ac2b475636c MD5: a087b2e6ec57b08c0d0750c60f96a74c Typical Filename: AAc

Full article640 words · extracted from blog.talosintelligence.com · click to collapse

Thursday, December 15, 2022 14:10

Welcome to this week’s edition of the Threat Source newsletter.

It’s the most wonderful time of the year, and I’m not talking about the holidays. The inaugural 2022 Talos Year in Review is here! And it’s taking over the final Threat Source newsletter of the year. Oh and did we mention we’re on Mastodon now? Talos, the gift that keeps on giving.

The one big thing

The 2022 Talos Year in Review is officially launched and with it a compressive story of our work in the past year relying on a wide variety of data and expertise. We expect this data-driven story will shed some insight into Cisco’s and the security community’s most notable successes and remaining challenges. In addition, as these Year in Review reports continue in the future, we aim to provide data and narratives that help explain how the threat landscape changes from one year to the next. We hope you find this report as elucidating to read as it was to research and write, and that it arms the security community with the information and context needed to continue fighting the good fight.

Why do I care?

Talos’ Year in Review takes a broad look not only at the major security events but looks at the major impacts and trends within the larger threat landscapes and takes a deep dive in to the top threats. We’ll be hosting livestreams on four sub-sections of the report with researchers and report contributors to cover the full research and findings.

So now what?

Pour yourself a glass of your favorite beverage, start up the fire and get to reading! Mark your calendar for our next three livestreams in the new year:

2022 Year in Review-APTs: Jan 10^th, 12pm ET

2022 Year in Review- Threat Landscape: Jan 24^th, 12pm ET

2022 Year in Review- Ransomware & Commodity Loaders: February 7^th, 12pm ET

Top security headlines of the week

If you’ve yet to stumble upon ChatGPT or hear about it at the office water cooler you may be living under a rock (we’ve been there too). The AI chat bot developed by OpenAI and released last week, creates human like responses to user-generated prompts. While it has the ability to take on mundane tasks the evolution of AI still raises eyebrows in security communities with concerns of deep fakes and fake news campaigns. (CNET)

The U.S. Department of Justice announced this week the take down of leading global distributed denial-of-service sites for-hire websites. The takedowns were part of a joint operation, “Operation PowerOFF”, between the US, the U.K.’s National Crime Agency, Dutch police, and Europol. The sites were involved in attacks against varied victims in the U.S. and abroad, spanning educational institutions, government agencies, and gaming platforms. (TechCrunch)

The US Cybersecurity and Infrastructure Security Agency (CISA) added new flaws to its Known Exploited Vulnerabilities Catalog including Veeam, Fortinet, Microsoft and Citrix products. Vulnerabilities, CVE-2022-26500 and CVE-2022-26501, are rated ‘critical’ and impact Veeam’s Backup & Replication enterprise backup solutions. Used by 70% of Fortune 2000 companies, Veeam products continue to be tempting targets for malicious actors. (SecurityWeek)