Menu

Hackers Exploit

Hackers Exploit VPN

Hackers Exploit VPN to Deploy SUPERNOVA malware on SolarWinds Orion

, ,

25th April 2021, Kathmandu

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has disclosed details of a new advanced persistent threat (APT) that’s leveraging the Supernova backdoor to compromise SolarWinds Orion installations after gaining access to the network through a connection to a Pulse Secure VPN device.

“The threat actor connected to the entity’s network via a Pulse Secure virtual private network (VPN) appliance, moved laterally to its SolarWinds Orion server, installed malware referred to by security researchers as SUPERNOVA (a .NET web shell), and collected credentials,” the agency said on Thursday.

CISA said it identified the threat actor during an incident response engagement at an unnamed organization and found that the attacker had access to the enterprise’s network for nearly a year through the use of the VPN credentials between March 2020 and February 2021.

Interestingly, the adversary is said to have used valid accounts that had multi-factor authentication (MFA) enabled, rather than an exploit for a vulnerability, to connect to the VPN, thus allowing them to masquerade as legitimate teleworking employees of the affected entity.

In December 2020, Microsoft disclosed that a second espionage group may have been abusing the IT infrastructure provider’s Orion software to drop a persistent backdoor called Supernova on target systems. The intrusions have since been attributed to a China-linked threat actor called Spiral.

Unlike Sunburst and other pieces of malware that have been connected to the SolarWinds compromise, Supernova is a .NET web shell implemented by modifying an “app_web_logoimagehandler.ashx.b6031896.dll” module of the SolarWinds Orion application. The modifications were made possible by leveraging authentication bypass vulnerability in the Orion API tracked as CVE-2020-10148, in turn permitting a remote attacker to execute unauthenticated API commands.

An investigation into the incident is ongoing. In the meantime, CISA is recommending organizations to implement MFA for privileged accounts, enable firewalls to filter unsolicited connection requests, enforce strong password policies, and secure Remote Desktop Protocol (RDP) and other remote access solutions.

Fortinet Flaws

Hackers Exploit Fortinet Flaw in Sophisticated Cring Ransomware Attacks

, ,

11th April 2021, Kathmandu

Industrial enterprises successful Europe are people of campaign, which forced a shutdown of concern processes successful astatine slightest 1 of its victims’ networks, according to researchers.

Threat actors are exploiting a Fortinet vulnerability flagged by the feds last week that delivers a caller ransomware strain, dubbed Cring, which is targeting concerned enterprises crossed Europe.

 “In at least in one case, an attack of the ransomware resulted in a temporary shutdown of the industrial process due to servers used to control the industrial process becoming encrypted,” Kaspersky senior security researcher Vyacheslav Kopeytsev wrote in the report.