Threat Brief: Ongoing Russia and Ukraine Cyber Activity
Ukrainian government sites were defaced via OctoberCMS CVE-2021-32648 while Microsoft-attributed actor DEV-0586 deployed destructive WhisperGate malware.
Unit 42 tracks January 2022 attacks against Ukrainian government websites that were defaced or made inaccessible, which Ukraine attributed to Russia. Attackers exploited CVE-2021-32648, an account takeover flaw in OctoberCMS prior to 1.0.472, by submitting a boolean true as the password reset code to bypass validation. Separately, WhisperGate malware, attributed by Microsoft to DEV-0586, disabled Windows Defender and corrupted files across multiple Ukrainian organizations, using a ransomware-appearing first stage and an HTTPS-beaconing second stage with LOLBINs and anti-analysis techniques.
- CVE-2021-32648 in OctoberCMS allowed account takeover via crafted password reset requests
- Loose == comparison in checkResetPasswordCode let boolean true validate any reset code
- WhisperGate overwrote master boot records and used an HTTPS beaconing implant payload
- Microsoft attributed WhisperGate to the threat actor DEV-0586
- Palo Alto released protections in Xpanse, Threat Prevention, XDR, WildFire, and XSOAR
- CVEs
- CVE-2021-32648
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1562.001 Impair Defenses: Disable or Modify ToolsT1486 Data Encrypted for ImpactT1105 Ingress Tool TransferT1071.001 Application Layer Protocol: Web Protocols
- Threat actors
- DEV-0586
- Malware
- WhisperGate
- Victims
- Ukrainian government
- Organizations
- Palo Alto NetworksMicrosoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-32648 | Authentication Bypass in October CMS Password Reset Enables Account Takeover | 9.1 | 90% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 111.111.111.111 | to delete file InstallUtil.exe , e.g. cmd.exe /min /C ping 111.111.111[.]111 -n 5 -w 10 > Nul & Del /f /q %TEMP%\InstallUtil.exe 10. F |
| url | https://cdn.discordapp.com/attachments/928503440139771947/930108637681184768/Tbopbh.jpg | cious. The hosted file is retrieved from the following URL: hxxps://cdn.discordapp[.]com/attachments/928503440139771947/930108637681184768/Tbopbh.jpg File Tbopbh.jpg is the malicious payload that is in-memor |
From the original article
9 min read at unit42.paloaltonetworks.com
Beginning on Jan. 14, 2022, reports began emerging about a series of attacks targeting numerous Ukrainian government websites. As a result of these attacks, numerous government websites were found to be either defaced or inaccessible.
By Mike Harbison, Robert Falcone, Josh Grunzweig · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.