This Week in Cyber 08th December 2023

Analyst Insight

A comprehensive analysis of this week's threat landscape uncovers a myriad of innovative infiltration techniques, putting industry behemoths like Akamai, Docker, Atlassian, Apache, and VMware in the crosshairs. Our recent blog series has underscored the persistent menace of critical vulnerabilities and flaws that demand immediate attention.

For network and system administrators, the timely management and deployment of patches emerge as paramount in the ongoing battle against cyber threats. With Telesoft's potent combination of threat intelligence and human-driven threat hunting, our capability to respond swiftly to emerging vulnerabilities ensures a watchful eye on any attempts to exploit system weaknesses.

P2PBotnet: IOT and Routers at Risk

Designed to target Microprocessors without interlocked Pipelined Stages (MIPS) architecture; it has a large variety of victims open to it.  Routers and IoT devices are now included in the targets vulnerable to this aggressive botnet. Whilst it was first disclosed in July2023, by Palo Alto Networks Unit 42, it was originally designed to exploit a critical vulnerability in the Lua sandbox. Now the Rust-based malware has started to surge in activity.

Arising again in September, it has come equipped with a variety of new tools. Chief amongst these is the aforementioned ability to target MIPS through brute-force attempts against SSH servers. Able to terminate itself if it believes it is being analysed, and disable linux core dumps; the P2Pbotnet is surely going to be a threat to any unsecured router and IoT device. 

CACTUS Ransomware: A Growing Threat

The Ransomware known as CACTUS has been on the offensive against large businesses since earlier this year, capitalising on known weaknesses in VPN applications. This malevolent program stands out with its unique encryption strategy, which involves storing the decryption key in a file named ntuser.dat. This file is subsequently activated through a scheduled task, a method that serves to distinguish CACTUS from its ransomware counterparts.

In addition, the software attaches victim IDs to the encrypted files, marking each breached system distinctly. Interestingly, CACTUS ransomware has the ability to encrypt itself to evade antivirus software, making it especially challenging to counter. 

Trojan-Proxy Hides in Cracked Apps

A surge in cyber threats targets users seeking free software, with cybercriminals embedding a Trojan-Proxy in cracked applications found on unauthorised websites. Disguised in .PKG installers specifically affecting macOS, these compromised versions run post-installation scripts, manipulating critical system files and gaining administrator permissions. The malware, utilising DNS-over-HTTPS, connects with a Command and Control (C&C) server, operating discreetly. Its complex mechanism supports various commands, primarily focused on creating proxy server networks or facilitating criminal acts on behalf of victims.

The Trojan's evolution reveals a shift in tactics, with the latest version lacking self-update capabilities and leaving behind traceable logs. This threat extends beyond macOS, as similar Trojan-Proxies have been identified in cracked software for Android and Windows, underscoring a broader and coordinated cyber threat landscape. Users are urged to exercise caution and prioritise security when downloading software from unofficial sources to mitigate these evolving risks.

Bluetooth Nightmare: Critical Flaw Puts Devices at Risk

A serious security flaw, identified as CVE-2023-45866, in multiple Bluetooth stacks poses a significant threat to Android, Linux, macOS, and iOS devices. Discovered by security researcher Marc Newlin, the flaw allows an attacker to bypass authentication, connecting to vulnerable devices without user confirmation and injecting keystrokes, potentially leading to code execution on the victim's device.

This vulnerability, exploiting an "unauthenticated pairing mechanism," tricks the targeted device into recognising a connection as a Bluetooth keyboard. Of particular concern is the fact that the attack, which doesn't require specialised hardware, can be executed from a Linux computer using a standard Bluetooth adapter. The affected devices span Android versions since 4.2.2 (released in November 2012), iOS, Linux, and macOS. Even Apple's LockDown Mode is not immune, highlighting the far-reaching implications of this Bluetooth nightmare. Users are advised to stay vigilant, and additional technical details are anticipated to be disclosed in the near future.