Researchers Uncover Hacker Group Behind Organized Financial
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2010-5326 | Unauthenticated Remote Code Execution in SAP NetWeaver Invoker Servlet The Invoker Servlet in SAP NetWeaver Application Server (AS) Java does not require authentication, which allows unauthenticated attackers to trigger remote code execution on the server. The flaw is triggered by sending a crafted HTTP or HTTPS request to the exposed Invoker Servlet on an affected NetWeaver AS Java system, with no credentials required. Successful exploitation gives an attacker the ability to run arbitrary code on the SAP application server, typically at the privileges of the application service, exposing business data and enabling further attacks into the environment. Any organization running SAP NetWeaver with the Java application server stack — particularly instances reachable from the internet or untrusted networks — is affected. Exploitation is confirmed in the wild: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 2021-11-03 (ransomware use unknown), EPSS estimates a 17.4% probability of exploitation within 30 days (97th percentile), and no public proof-of-concept code is known. Do: Inventory all SAP NetWeaver AS Java instances and prioritize internet-exposed ones for remediation, applying SAP's updates per vendor instructions as required by the CISA KEV entry. Until patched, require authentication for or restrict access to the Invoker Servlet and limit HTTP/HTTPS access to the AS Java ports to trusted networks, then verify the fix is in place. | — | 17% | KEV |
| largetens of thousands of internet-exposed SAP NetWeaver AS Java systems (10k–100k order of magnitude) | |
| CVE-2015-7450 | Deserialization RCE in IBM WebSphere Application Server and Hypervisor Edition CVE-2015-7450 is a remote code execution flaw in IBM WebSphere Application Server and WebSphere Application Server Hypervisor Edition, where interfaces that accept serialized Java objects fail to adequately validate them, allowing code injection (CWE-94). A remote attacker who can send a crafted serialized object to a vulnerable serialized-object interface causes the application server to deserialize it and execute arbitrary commands on the host with the server's privileges. Organizations running the affected IBM products, particularly internet-exposed or business-critical WebSphere deployments, are affected. The flaw is confirmed exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-01-10 with a required action to apply vendor updates, and EPSS assigns a 97.7% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is known, CVSS has not yet been scored, and ransomware use is not confirmed. Do: Apply IBM's WebSphere Application Server updates per vendor instructions, as CISA's KEV entry requires, and ensure Hypervisor Edition appliances are updated as well. Until patched, restrict internet access to WebSphere application and administrative serialized-object endpoints with firewalls and monitor for signs of exploitation. Given the 97.7% EPSS and KEV listing, prioritize internet-facing and business-critical WAS instances first. | — | 98% | KEV |
| large≈tens of thousands of internet-exposed WebSphere instances; likely 100k+ total enterprise deployments (est.) | |
| CVE-2017-1000486 | Unauthenticated RCE in PrimeFaces 5.x via Weak ViewState Encryption PrimeFaces 5.x, a widely used JavaServer Faces (JSF) UI component library, ships with inadequate encryption strength (CWE-326) for the ViewState parameter, relying on a weak default key when applications do not configure their own secret. A remote, unauthenticated attacker can craft a malicious serialized Java object, encrypt it with the weak/default key, and submit it in the ViewState parameter of an exposed JSF application, which the server then decrypts and deserializes. Successful exploitation results in remote code execution with the privileges of the application server, giving full confidentiality, integrity, and availability impact (CVSS 9.8, network vector, no privileges or user interaction required). Any web application built on PrimeFaces 5.x and reachable over the network without authentication is affected. The flaw is being actively exploited: it was added to the CISA Known Exploited Vulnerabilities catalog on 2022-01-10, EPSS assigns a 94.1% 30-day exploitation probability (100th percentile), and a public proof-of-concept has been available since the 2016 Minded Security research on JSF/PrimeFaces deserialization RCE. Do: Upgrade PrimeFaces to a fixed, currently supported release per vendor instructions, as required by the CISA KEV action. Where an upgrade is not immediately possible, configure a unique, strong ViewState encryption secret for each application instead of the built-in default, and limit internet exposure of JSF endpoints (*.jsf, *.xhtml). Review web logs for POST requests carrying large ViewState parameters to 5.x-based applications as a sign of exploitation attempts. | 9.8 | 94% | KEV PoC |
| largelikely tens of thousands of internet-facing Java web applications built on PrimeFaces 5.x (exact count unknown) |
Full article639 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 05, 2022
Cybersecurity researchers have taken the wraps of an organized financial-theft operation undertaken by a discreet actor to target transaction processing systems and siphon funds from entities primarily located in Latin America for at least four years.
The malicious hacking group has been codenamed Elephant Beetle by Israeli incident response firm Sygnia, with the intrusions aimed at banks and retail companies by injecting fraudulent transactions among benign activity to slip under the radar after an extensive study of the targets' financial structures.
"The attack is relentless in its ingenious simplicity serving as an ideal tactic to hide in plain sight, without any need to develop exploits," the researchers said in a report shared with The Hacker News, calling out the group's overlaps with another tracked by Mandiant as FIN13, an "industrious" threat actor linked to data theft and ransomware attacks in Mexico stretching back as early as 2016.
Elephant Beetle is said to leverage an arsenal of no fewer than 80 unique tools and scripts to execute its attacks, while simultaneously taking steps to blend in with the victim's environment over long periods to achieve its objectives.
"The unique modus operandi associated with the Elephant Beetle is their deep research and knowledge of victim's financial systems and operations and their persistent search for vulnerable methods to technically inject financial transactions, ultimately leading to major financial theft," Arie Zilberstein, vice president of incident response at Sygnia, told The Hacker News. "Given the long period of persistence this group has in victim's networks, they often change and adapt their techniques and tooling to continue to be relevant."
Zilberstein attributed the success of the campaign to the vast attack surface provided by legacy systems that are present in financial institutions' networks and can serve as entry points, thereby enabling attackers to gain a permanent foothold into target networks.
The adversary's techniques and procedures follows a low-profile pattern that begins with planting backdoors to study the victim's environment, specifically with an aim to understand the various processes used to facilitate financial transactions, followed by inserting rogue transactions of its own into the network that steal incremental amounts of money from the target to avoid setting off alarm.
But in the event the actor's fraudulent actions come to light, they temporarily cease their operations only to return a few months later. The initial access is brokered by taking advantage of unpatched flaws in publicly-exposed Java-based web servers such as WebSphere and WebLogic, ultimately leading to the deployment of web shells that enable remote code execution and lateral movement —
- CVE-2017-1000486 (CVSS score: 9.8) - Primefaces Application Expression Language Injection
- CVE-2015-7450 (CVSS score: 9.8) - WebSphere Application Server SOAP Deserialization Exploit
- CVE-2010-5326 (CVSS score: 10.0) - SAP NetWeaver Invoker Servlet Exploit
- EDB-ID-24963 - SAP NetWeaver ConfigServlet Remote Code Execution
The web shells, for their part, are fashioned as font, image, or CSS and JavaScript resources with a ".JSP" extension to further long-term surveillance, while the operators also bank on a multitude of techniques that range from overwriting non-threatening files to replacing completely the default web page files (e.g., iisstart.aspx or default.aspx) on web servers to prepare for future attacks.
"This attack emphasizes once again that sophisticated attackers are sometimes lurking in networks for [a] long time," Zilberstein said. "While a lot of emphasis is given today to avoiding and preventing the imminent risk of ransomware, some other threat actors are still operating to stealthily proliferate themselves in networks to get a long term and steady financial gain."
"Organizations need to pay extra attention to these systems, particularly those which are externally facing, and perform patching and continuous hunting to prevent and detect attacks of similar nature," Zilberstein added.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/01/researchers-uncover-hacker-group-behind.html