Initial access broker or ransomware gang has 'exclusive' access to Mitel zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-29499 | Unauthenticated RCE in Mitel MiVoice Connect Service Appliance CVE-2022-29499 is an improper input-validation flaw (CWE-20) in the Service Appliance component (SA 100, SA 400, and Virtual SA) of Mitel MiVoice Connect, affecting releases through 19.2 SP3. A remote, unauthenticated attacker can trigger it by sending improperly validated data to the appliance over the network; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no privileges, user interaction, or special conditions are required. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability, giving the attacker a foothold on the appliance inside the organization's voice/UC environment. Any organization running a MiVoice Connect deployment that includes one of the Service Appliances is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2022-06-27 with known ransomware use, and press reports describe the Lorenz ransomware group and others exploiting this Mitel VoIP zero-day for initial access into business networks (EPSS: 55.6% chance of exploitation in 30 days). Do: Apply Mitel's update for the Service Appliance component per the vendor's instructions, since all releases up through 19.2 SP3 are affected; do not delay, as ransomware groups are actively exploiting the flaw for initial access. Identify whether your MiVoice Connect deployment includes an SA 100, SA 400, or Virtual SA, restrict the appliance's web interface from direct internet exposure until patched, and after updating check the appliance for signs of compromise or follow-on ransomware activity. | 9.8 | 56% | KEV ransomware |
| largeestimated tens of thousands of business deployments with thousands of internet-exposed Service Appliances (clearly an estimate) |
Full article688 words · extracted from therecord.media · click to collapse
Ransomware groups are continuing to target a vulnerability discovered earlier this year affecting popular Mitel MiVoice Connect VOIP devices, according to a new report from cybersecurity firm Arctic Wolf. The company released a detailed breakdown of one incident involving the Lorenz ransomware group’s exploitation of CVE-2022-29499 – a vulnerability patched in April by Mitel after CrowdStrike researcher Patrick Bennett discovered the issue during a ransomware investigation. Adrian Korn, manager of threat intelligence research at Arctic Wolf Labs, told The Record that what stood out about the attack his team examined was the fact that no public proof-of-concept (PoC) exploit code for this vulnerability has ever been released, “and there is very little known about which threat actors possess the exploit.” Based on several overlaps, Korn said that the intrusions Arctic Wolf and CrowdStrike analyzed were perpetrated by the same actor. “What was significant about this intrusion was that Lorenz was linked to the exploitation of CVE-2022-29499, a remote code execution (RCE) vulnerability affecting Mitel MiVoice Connect VOIP devices,” Korn explained. “This suggests one of two things: 1. There is an Initial Access Broker (IAB) that has exclusive access to an exploit for CVE-2022-29499. 2. The actors behind Lorenz have exclusive access to an exploit for CVE-2022-29499.” IABs are people with access to hacked enterprise networks that then offload their access to criminal or nation-state groups. A Mitel spokesperson reiterated that the bug was quickly patched by the company and criticized the report for being “quite old and resolved news at this point.” “Mitel addressed the vulnerability by releasing security patches in early June 2022 after releasing a remediation script for affected MiVoice Connect versions in April,” the spokesperson said. On our blog, Arctic Wolf Labs take a deep dive into a Lorenz ransomware intrusion which leveraged a Mitel MiVoice VoIP appliance vulnerability for initial access and Microsoft’s BitLocker Drive Encryption for data encryption.https://t.co/2FSXXLYCsY Arctic Wolf Labs said the Lorenz ransomware group exploited CVE-2022-29499 to gain initial access to a Mitel MiVoice Connect, then waited nearly a month to take further action. The Mitel appliance that was exploited was on the network’s perimeter and the access was parlayed into the theft of credentials for two privileged administrator accounts. During the attack, the group used the privileged accounts to move laterally throughout the organization’s network and eventually exfiltrate data using FileZilla. Lorenz emerged in February 2021. The Dutch cybersecurity firm Tesorion released a free application to help victims of the ransomware recover encrypted files without paying a ransom in June 2021. That has done little to stop the group, which typically performs double-extortion after stealing troves of data. “Over the last quarter, the group has primarily targeted small and medium businesses (SMBs) located in the United States, with outliers in China and Mexico,” the report said. The company suggested a range of actions organizations should take to protect themselves, including implementing external scans that can tell whether critical assets are exposed to the internet. Organizations should also have offline backups and limit access to privileged credentials. “Monitoring just critical assets is not enough for organizations, security teams should monitor all externally facing devices for potential malicious activity, including VOIP and IoT [Internet of Things] devices. Threat actors are beginning to shift targeting to lesser known or monitored assets to avoid detection,” Arctic Wolf said. “In the current landscape, many organizations heavily monitor critical assets, such as domain controllers and web servers, but tend to leave VOIP devices and IoT devices without proper monitoring, which enables threat actors to gain a foothold into an environment without being detected.” A search on Shodan shows that there are nearly 20,000 Mitel VoIP devices exposed to the internet, with almost 9,000 in the U.S. alone. Nearly 20,000 Mitel VoIP devices exposed
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/initial-access-broker-or-ransomware-gang-has-exclusive-access-to-mitel-zero-day-exploit-report