Go Beyond the Headlines for Deeper Dives into the Cybercriminal Underground
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-20877 | VMware Aria Operations contains a privilege escalation vulnerability. VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation. NVD description · AI analysis pending | 8.8 | <1% |
| — | ||
| CVE-2023-20887 | Unauthenticated Command Injection RCE in VMware Aria Operations for Networks VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection flaw (CWE-77) that allows an attacker with network access to the appliance to run arbitrary operating-system commands. Because the attack requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), any party able to reach the product's network interface can trigger it, gaining remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the product is affected, with internet-facing deployments at the greatest risk. Exploitation is confirmed in the wild — CISA added the flaw to the KEV catalog on 2023-06-22, a public proof-of-concept exploit is available, and EPSS puts the 30-day exploitation probability at 98.3% (top percentile). Ransomware use is currently unknown. Do: Apply the vendor's patched update to all Aria Operations for Networks deployments as soon as possible — this is also CISA's required KEV action (apply updates per vendor instructions); verify the installed build against VMware's advisory for affected ranges. Until patching is complete, restrict network access to the appliance (firewall rules, VPN, or management-segment isolation), prioritizing any instance reachable from the internet since no authentication is required to exploit. Hunt for indicators of command injection exploitation, as in-the-wild exploitation has been confirmed. | 9.8 | 98% | KEV PoC |
| moderate≈10,000+ appliance deployments worldwide (low tens of thousands of appliance nodes); only a small fraction, likely hundreds to low thousands of instances, are… |
Full article859 words · extracted from thehackernews.com · click to collapse
Discover stories about threat actors’ latest tactics, techniques, and procedures from Cybersixgill’s threat experts each month. Each story brings you details on emerging underground threats, the threat actors involved, and how you can take action to mitigate risks. Learn about the top vulnerabilities and review the latest ransomware and malware trends from the deep and dark web.
Stolen ChatGPT credentials flood dark web markets
Over the past year, 100,000 stolen credentials for ChatGPT were advertised on underground sites, being sold for as little as $5 on dark web marketplaces in addition to being offered for free.
Stolen ChatGPT credentials include usernames, passwords, and other personal information associated with accounts. This is problematic because ChatGPT accounts may store sensitive information from queries, including confidential data and intellectual property. Specifically, companies increasingly incorporate ChatGPT into daily workflows, which means employees may disclose classified content, including proprietary code. Cybersixgill’s threat analysts detected advertisements for stolen ChatGPT credentials on popular dark web marketplaces, in addition to an advertisement for an AI chatbot allegedly capable of generating malicious content.
What should companies do to protect employees and critical assets from the unintended risks posed by ChatGPT?
Pro-Russian hacktivists attack Microsoft platforms, threaten European banking system
A highly active pro-Russian hacktivist group knocked offline multiple Microsoft platforms, demanding US$1M dollars to halt the attacks, echoing the collective’s strategy in a recent Distributed-Denial-of-Service (DDoS) incident targeting Scandinavian Airlines. While Microsoft initially provided evasive explanations for the outages, it later confirmed that Azure, Outlook, and OneDrive web portals were inaccessible due to Layer 72 DDoS attacks attributed to the hacktivist group. Our threat experts observed the group boasting about the Microsoft attack on the underground, in addition to an ally announcing a new pro-Russian coalition that plans to attack the European banking system.
While DDoS attacks have intensified since Russia invaded Ukraine in February 2022, hacktivists’ recent shift to blackmail indicates an emerging financial dimension of politically motivated incidents. With these risks in mind, what should organizations do to prepare for more DDoS campaigns launched by pro-Russian gangs, and the possibility of accompanying blackmail demands?
New malware steals data from browsers and password managers
Advertisements for a new type of information stealer are showing up on Russian-language cybercrime forums. While the stealer debuted in April 2023, sales reportedly spiked in June, which could indicate an increase in attacks using the malware. The malware allegedly targets close to 200 browsers, extensions, and password managers, among other applications. Our threat research team observed the malware’s developers touting its features on the underground, in addition to threat actors questioning the stealer’s capabilities.
Once executed, the stealer collects data related to the operating system and hardware, sending a screenshot to attackers’ command-and-control3 (C2) servers. The stealer then targets specific information stored in various applications, including web browsers. The malware can be rented for $150/month or $390 for four months, with advertisements posted on popular cybercrime forums that Cybersixgill collects.
As the emergence of new stealer malware illustrates, data theft tools remain popular on the underground. Such tools extract sensitive information, including credentials and other valuable data. With powerful user-friendly stealers readily available on the underground, what should organizations do to protect against such threats?
New VMware critical vulnerability exploited in the wild
VMware recently released an advisory related to a critical remote code execution (RCE) vulnerability (CVE-2023-20877), warning that threat actors are already exploiting the flaw in attacks. While an update was released to address the command injection vulnerability, two unpatched instances of VMware’s Aria Operations for Networks3 remain highly vulnerable. Ultimately, threat actors could leverage CVE-2023-20887 to access networks and inject malicious commands into Aria Operations for Networks, which could lead to data theft, data corruption, or even complete system compromise.
As of July 3, 2023, Cybersixgill’s DVE module assigned CVE-2023-20887 a severe score (9.23), indicating the threat posed by the flaw to unpatched systems. This score is dynamic and may continue to rise – especially given the existence of a publicly available proof-of-concept (PoC) for the CVE published by a threat hunter on GitHub. According to the data collected by the Cybersixgill Investigative Portal, CVE-2023-20887 is related to at least one advanced persistent threat (APT). This means the vulnerability is likely being actively exploited by sophisticated threat actors who may be able to bypass traditional security measures.
Our threat experts observed a PoC for this vulnerability circulating on the underground, and ransomware groups may see this vulnerability as a great opportunity to launch attacks and demand payments in double extortion schemes. In light of this, what should corporations using VMWare do to thwart the actions of cybercriminals?
Subscribe to Cybersixgill’s Beyond the Headlines monthly magazine and receive detailed insights each month from our threat research team about the latest threats and threat actors’ TTPs on the deep, dark web. To get the latest updates, click here.
Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/07/go-beyond-headlines-for-deeper-dives.html