Endpoint malware and ransomware detections hit all-time high
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-0802 | Memory Corruption RCE in Microsoft Office Equation Editor A memory-corruption flaw (out-of-bounds write, CWE-787) in the legacy Equation Editor component (EQNEDT32.EXE) shipped with Microsoft Office 2007, 2010, 2013, and 2016 allows remote code execution due to improper handling of objects in memory. An attacker triggers it by persuading a user to open a specially crafted document (for example an RTF or DOCX containing a malformed embedded equation object), causing the Equation Editor process to corrupt memory when the file is opened in Word; the user-interaction requirement is reflected in the CVSS 3.1 vector (AV:L/UI:R). Successful exploitation gives the attacker code execution in the context of the current user, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.8, High). Any user of the affected Office versions, the Office Compatibility Pack, or Word on an unpatched system is affected. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, carries a 93.3% EPSS probability of exploitation within 30 days, and multiple public analyses and proof-of-concepts exist. Do: Apply Microsoft's January 2018 security updates for Office 2007, 2010, 2013, and 2016 and the Office Compatibility Pack, and verify the legacy Equation Editor executable (EQNEDT32.EXE) on endpoints has been patched or removed (Microsoft later retired the component). Because the flaw is exploited in the wild and used in ransomware campaigns, prioritize remediation per CISA KEV required action and hunt for Word spawning EQNEDT32.EXE or unexpected child processes when documents are opened. Until patched, open untrusted documents in Protected View and treat email-delivered RTF/DOCX attachments as untrusted. | 7.8 | 93% | KEV ransomware PoC ×3 |
| masshundreds of millions of Office users at time of disclosure (vulnerable Equation Editor shipped by default with Office 2007-2016); largely patched today, with… | |
| CVE-2021-30116 | Credential Disclosure via Unauthenticated Download Page in Kaseya VSA Kaseya VSA before 9.5.7 exposes an unauthenticated client download page (/dl.asp) that leaks agent credentials: the Windows agent stores an Agent_Guid and AgentPassword in KaseyaD.ini, and supplying these to dl.asp via GET parameters authenticates the requester and returns a sessionId cookie. That sessionId can then be used to bypass authentication against services not intended for agent use, and anyone who obtains KaseyaD.ini from a managed endpoint gains enough information to penetrate the VSA installation and its managed clients. On-premises VSA deployments are affected by default, since the vulnerable download page is part of the standard installation. The flaw was exploited in the wild in July 2021 as part of the REvil ransomware campaign against Kaseya VSA, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and carries a very high EPSS of 85.7%. Do: Upgrade Kaseya VSA to 9.5.7 or later per vendor instructions, as required by CISA's KEV catalog. Restrict internet access to the VSA download page (/dl.asp) or disable the agent-login capability there until patched, and review logs for dl.asp GET requests carrying agent credentials (un/pw parameters) or sessionId-based access to services not intended for agent use. Given known ransomware use, treat any unpatched, internet-exposed VSA server as high risk and check managed endpoints for exposed KaseyaD.ini credential material. | 9.8 | 86% | KEV ransomware PoC |
| mass≈40,000 VSA deployments (Kaseya reported ~40,000 customers, mostly MSPs) managing millions of downstream endpoints | |
| CVE-2021-30118 | An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequentl An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leading to RCE. An attacker can upload files with the privilege of the Web Server process and subsequently use these files to execute asp commands. Detailed description --- Given the following request: ``` POST /SystemTab/uploader.aspx?Filename=shellz.aspx&PathData=C%3A%5CKaseya%5CWebPages%5C&__RequestValidationToken=ac1906a5-d511-47e3-8500-47cc4b0ec219&qqfile=shellz.aspx HTTP/1.1 Host: 192.168.1.194 Cookie: sessionId=92812726; %5F%5FRequestValidationToken=ac1906a5%2Dd511%2D47e3%2D8500%2D47cc4b0ec219 Content-Length: 12 private const string password = "pass"; // The password ( pass ) private const string style = "dark"; // The style ( light / dark ) protected void Page_Load(object sender, EventArgs e) { //this.Remote(password); this.Login(password); this.Style(); this.ServerInfo(); ``` The attacker can control the name of the file written via the qqfile parameter and the location of the file written via the PathData parameter. Even though the call requires that a sessionId cookie is passed we have determined that the sessionId is not actually validated and any numeric value is accepted as valid. Security issues discovered --- * a sessionId cookie is required by /SystemTab/uploader.aspx, but is not actually validated, allowing an attacker to bypass authentication * /SystemTab/uploader.aspx allows an attacker to create a file with arbitrary content in any place the webserver has write access * The web server process has write access to the webroot where the attacker can execute it by requesting the URL of the newly created file. Impact --- This arbitrary file upload allows an attacker to place files of his own choosing on any location on the hard drive of the server the webserver process has access to, including (but not limited to) the webroot. If the attacker uploads files with code to the webroot (e.g. aspx code) he can then execute this code in the context of the webserver to breach either the integrity, confidentiality, or availability of the system or to steal credentials of other users. In other words, this can lead to a full system compromise. NVD description · AI analysis pending | 9.8 | 60% | PoC |
| — |
Full article947 words · extracted from helpnetsecurity.com · click to collapse
Endpoint malware and ransomware detections surpassed the total volume seen in 2020 by the end of Q3 2021, according to researchers at the WatchGuard Threat Lab. In its latest report, WatchGuard also highlights that a significant percentage of malware continues to arrive over encrypted connections.
While zero-day malware increased by just 3% to 67.2% in Q3 2021, the percentage of malware that arrived via Transport Layer Security (TLS) jumped from 31.6% to 47%. Data shows that many organizations are not decrypting these connections and therefore have poor visibility into the amount of malware hitting their networks.
“While the total volume of network attacks shrank slightly, malware per device was up for the first time since the pandemic began,” said Corey Nachreiner, CSO at WatchGuard. “The security environment continues to be challenging, so it’s important that organizations go beyond the short-term ups and downs and seasonality of specific metrics and focus on persistent and concerning trends factoring into their security posture. An important example is the accelerating use of encrypted connections to deliver zero days.”
Additional findings on endpoint malware and ransomware detections
As users upgrade to more recent versions of Microsoft Windows and Office, attackers are focusing on newer vulnerabilities – While unpatched vulnerabilities in older software continue to provide a rich hunting ground for attackers, they are also looking to exploit weaknesses in the latest versions of Microsoft’s widely used products. In Q3, CVE-2018-0802 – which exploits a vulnerability in the Equation Editor in Microsoft Office – cracked WatchGuard’s top 10 gateway antivirus malware by volume list, hitting number 6, after showing up in the most-widespread malware list in the previous quarter. In addition, two Windows code injectors (Win32/Heim.D and Win32/Heri) came in at number 1 and 6 on the most detected list respectively.
Attackers disproportionately targeted the Americas – The overwhelming majority of network attacks targeted the Americas in Q3 (64.5%) compared to Europe (15.5%) and APAC (20%).
Overall network attack detections resumed a more normal trajectory but still pose significant risks – After consecutive quarters of more than 20% growth, roughly 4.1 million unique network exploits were detected in Q3. The drop of 21% brought volumes down to Q1 levels, which were still high compared to the previous year. The shift doesn’t necessarily mean adversaries are letting up as they are possibly shifting their focus towards more targeted attacks.
The top 10 network attack signatures account for the vast majority of attacks – Of the 4,095,320 hits detected by IPS in Q3, 81% were attributed to the top 10 signatures. In fact, there was just one new signature in the top 10 in Q3, ‘WEB Remote File Inclusion /etc/passwd’ (1054837), which targets older, but still widely used Microsoft Internet Information Services (IIS) web servers. One signature (1059160), a SQL injection, has continued to maintain the position it has held atop the list since Q2, 2019.
Scripting attacks on endpoints continue at record pace – By the end of Q3, there were already 10% more attack scripts than in all of 2020, which, in turn, saw a 666% increase over the prior year. As hybrid workforces start to look like the rule rather than the exception, a strong perimeter is no longer enough to stop threats.
While there are several ways for cybercriminals to attack endpoints – from application exploits to script-based living-off-the-land attacks – even those with limited skills can often fully execute a malware payload with scripting tools like PowerSploit, PowerWare and Cobalt Strike, while evading basic endpoint detection.
Even normally safe domains can be compromised – A protocol flaw in Microsoft’s Exchange Server Autodiscover system allowed attackers to collect domain credentials and compromise several normally trustworthy domains. Overall, in Q3 5.6 million malicious domains were blocked , including several new malware domains that attempt to install software for cryptomining, key loggers and remote access trojans (RATs), as well as phishing domains masquerading as SharePoint sites to harvest Office365 login credentials.
While down 23% from the previous quarter, the number of blocked domains is still several times higher than the level seen in Q4 2020 (1.3 million). This highlights the critical need for organizations to focus on keeping servers, databases, websites, and systems updated with the latest patches to limit vulnerabilities for attackers to exploit.
Ransomware, ransomware, ransomware – After a steep decline in 2020, ransomware attacks reached 105% of 2020 volume by the end of September, as predicted at the end of the prior quarter and are on pace to reach 150% once the full year of 2021 data is analysed. Ransomware-as-a-service operations such as REvil and GandCrap continue to lower the bar for criminals with little or no coding skills, providing the infrastructure and the malware payloads to carry out attacks globally in return for a percentage of the ransom.
The quarter’s top security incident, Kaseya, was another demonstration of the ongoing threat of digital supply chain attacks – Just before the start of the long 4th of July holiday weekend in the US, dozens of organizations began reporting ransomware attacks against their endpoints. WatchGuard’s incident analysis described how attackers working with the REvil ransomware-as-a-service (RaaS) operation had exploited three zero-day vulnerabilities (including CVE-2021-30116 and CVE-2021-30118) in Kaseya VSA Remote Monitoring and Management (RMM) software to deliver ransomware to some 1,500 organizations and potentially millions of endpoints.
While the FBI eventually compromised REvil’s servers and obtained the decryption key a few months later, the attack provided yet another stark reminder of the need for organizations to proactively take steps like adopting zero-trust, employing the principle of least privilege for vendor access and ensuring systems are patched and up to date to minimize the impact of supply chain attacks.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/01/20/endpoint-malware-ransomware-detections-q3-2021/