Advisories

1.0 Introduction

Recently, MyCERT observed cybercriminals had exploited a malicious android application in a "Wedding Invitation" or “Jemputan Majlis Perkahwinan” malware campaign targeting internet users in Malaysia. The Wedding Invitation Scam preys on people's excitement about wedding invitations. Cybercriminals use text messages sent via instant messaging apps such as WhatsApp to trick victims into installing a malicious APK on their devices that can steal their personal information.

2.0 Impact
Financial loss and disclosure of personal information. An APK is a file format used by the Android operating system for the distribution and installation of mobile apps, usually via Google Play Store. The APK files allow the perpetrators to steal data from users' mobile phones, including users' TAC numbers which enables them to make unauthorised banking transactions from victims' bank accounts.

3.0 Affected System and Devices
Android mobile devices.

4.0 Other related alerts and advisories
Below are references of similar incidents:

• MA-834.052022: MyCERT Alert - SMSSpy campaign to steal Malaysian banking user credential
• MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme
• MA-695.012018: MyCERT Alert - Fake Bank Negara Malicious APK - New Variant
• MA-694.012018: MyCERT Alert - Fake Bank Negara Malicious APK

5.0 Recommendations
The application is meant to retrieve information from the victim’s phone and could be used for other malicious purposes. As a CERT, we would highly recommend the followings:

• Verify application permission and the application author or publisher before installing it.
• Avoid side loading (installing from non-official sources) when you can. If you do need to install Android software from a source other than the trusted marketplace, be sure that it is coming from a reputable source.
• Do not click on adware or suspicious URL sent through SMS/messaging services.
• Malicious programs could be attached to collect users' information.
• Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
• Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.
• Do not root or 'Jailbreak' your phone.
• Contact relevant authorities and report to the National Scam Response Centre at 997 for any inquiries and assistance related to this threat.

Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, don't hesitate to get in touch with MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

6.0    References

• MA-834.052022: MyCERT Alert - SMSSpy campaign to steal Malaysian banking user credential
• MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme
• MA-695.012018: MyCERT Alert - Fake Bank Negara Malicious APK - New Variant
• MA-694.012018: MyCERT Alert - Fake Bank Negara Malicious APK
• https://www.nst.com.my/news/nst-viral/2023/06/921637/nstviral-watch-out-wedding-invitation-scam
• https://www.buletintv3.my/nasional/kad-kahwin-digital-taktik-baru-scammer-kebas-duit-warga-emas1111/

1.0 Introduction

Recently, CISA released four Industrial Control Systems (ICS) advisories on June 22, 2023.

2.0 Impact
These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. 

3.0 Affected Products

• ICSA-23-173-02 Advantech R-SeeNet
• ICSA-23-173-03 SpiderControl SCADAWebServer
• ICSA-23-026-02 Econolite EOS (Update A)
• ICSA-23-061-01 Mitsubishi Electric MELSEC iQ-F Series (Update A)

4.0 Recommendations
MyCERT encourages users and administrators to review the newly released ICS advisories for technical details and mitigations.

Kindly refer to the following URLs:

• ICSA-23-173-02 Advantech R-SeeNet : https://cisa.gov/news-events/ics-advisories/icsa-23-173-02
• ICSA-23-173-03 SpiderControl SCADAWebServer : https://cisa.gov/news-events/ics-advisories/icsa-23-173-03
• ICSA-23-026-02 Econolite EOS (Update A) : https://cisa.gov/news-events/ics-advisories/icsa-23-026-02
• ICSA-23-061-01 Mitsubishi Electric MELSEC iQ-F Series (Update A) : https://cisa.gov/news-events/ics-advisories/icsa-23-061-01

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• https://cisa.gov/news-events/ics-advisories/icsa-23-173-02
• https://cisa.gov/news-events/ics-advisories/icsa-23-173-03
• https://cisa.gov/news-events/ics-advisories/icsa-23-026-02
• https://cisa.gov/news-events/ics-advisories/icsa-23-061-01
• https://www.cisa.gov/news-events/alerts/2023/06/22/cisa-releases-four-industrial-control-systems-advisories

1.0 Introduction

Recently, The Internet Systems Consortium (ISC) has released security advisories that address vulnerabilities affecting multiple versions of the ISC’s Berkeley Internet Name Domain (BIND) 9.

2.0 Impact
A remote attacker could exploit these vulnerabilities to potentially cause denial-of-service conditions.

3.0 Affected Products
Multiple versions of the ISC’s Berkeley Internet Name Domain (BIND) 9

4.0 Recommendations
MyCERT encourages users and administrators to review the following ISC advisories CVE-2023-2828, CVE-2023-2829, and CVE-2023-2911 and apply the necessary mitigations.

Kindly refer to the following URLs:

• CVE-2023-282 : https://kb.isc.org/v1/docs/cve-2023-2828
• CVE-2023-2829 : https://kb.isc.org/v1/docs/cve-2023-2829
• CVE-2023-2911 : https://kb.isc.org/v1/docs/cve-2023-2911

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• https://kb.isc.org/v1/docs/cve-2023-2828
• https://kb.isc.org/v1/docs/cve-2023-2829
• https://kb.isc.org/v1/docs/cve-2023-2911
• https://www.cisa.gov/news-events/alerts/2023/06/22/isc-releases-security-advisories-multiple-versions-bind-9

1.0 Introduction

Recently, Apple has released security updates to address vulnerabilities in multiple products.

2.0 Impact
An attacker could exploit some of these vulnerabilities to take control of an affected device:

• CVE-2023-32434: An integer overflow vulnerability in the Kernel that could be exploited by a malicious app to execute arbitrary code with kernel privileges.
• CVE-2023-32435: A memory corruption vulnerability in WebKit that could lead to arbitrary code execution when processing specially crafted web content.

3.0 Affected Products

• watchOS 8.8.1 - Apple Watch Series 3, Series 4, Series 5, Series 6, Series 7, and SE
• macOS Big Sur 11.7.8
• macOS Monterey 12.6.7
• iOS 15.7.7 and iPadOS 15.7.7 - iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later
• watchOS 9.5.2 -Apple Watch Series 4 and later
• macOS Ventura 13.4.1
• iOS 16.5.1 and iPadOS 16.5.1 - iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation)

4.0 Recommendations
MyCERT encourages users and administrators to review the following advisories and apply the necessary updates.

Kindly refer to the following URLs:

• watchOS 8.8.1 : https://support.apple.com/en-my/HT213808
• macOS Big Sur 11.7.8 : https://support.apple.com/en-my/HT213809
• macOS Monterey 12.6.7 : https://support.apple.com/en-my/HT213810
• iOS 15.7.7 and iPadOS 15.7.7 : https://support.apple.com/en-my/HT213811
• watchOS 9.5.2 : https://support.apple.com/en-my/HT213812
• macOS Ventura 13.4.1 : https://support.apple.com/en-my/HT213813
• iOS 16.5.1 and iPadOS 16.5.1 : https://support.apple.com/en-my/HT213814

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

To update, please refer:

• Update your iPhone, iPad, or iPod touch: https://support.apple.com/en-my/HT204204
• Update Safari and macOS on Mac: https://support.apple.com/en-my/HT201541
• Enable background updates in macOS: https://support.apple.com/en-my/HT207005

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• https://www.cisa.gov/news-events/alerts/2023/06/22/apple-releases-security-updates-multiple-products
• https://thehackernews.com/2023/06/zero-day-alert-apple-releases-patches.html?m=1
• https://nvd.nist.gov/vuln/detail/CVE-2023-32434
• https://nvd.nist.gov/vuln/detail/CVE-2023-32435
• https://support.apple.com/en-my/HT201222

1.0 Introduction

Recently, Progress has discovered a vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment. If you are a MOVEit Transfer customer, it is extremely important that you take immediate action as noted below in order to help protect your MOVEit Transfer environment. In Progress MOVEit Transfer versions released before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an un-authenticated attacker to gain unauthorized access to the MOVEit Transfer database.

2.0 Impact
A cyber threat actor could exploit this vulnerability to take over an affected system. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint which could result in modification and disclosure of MOVEit database content.

3.0 Affected Products
All MOVEit Transfer versions are affected by this vulnerability.
Based on our review of this situation to date, the following products are not susceptible to this SQL Injection Vulnerability in MOVEit Transfer: MOVEit Automation, MOVEit Client, MOVEit Add-in for Microsoft Outlook, MOVEit Mobile, WS_FTP Client, WS_FTP Server, MOVEit EZ, MOVEit Gateway, MOVEit Analytics, and MOVEit Freely. At this time, no action is necessary for the above-mentioned products.

4.0 Recommendations
NOTICE: All MOVEit Transfer customers must take action and apply the patch to address the June 15th CVE-2023-35708 vulnerability discovered in MOVEit Transfer. There are two paths to take depending on if you have applied the remediation and patching steps from the MOVEit Transfer Critical Vulnerability (May 2023) article prior to June 15.

• Have NOT applied May 2023 patch: Follow all the remediation steps and patching in the following article: MOVEit Transfer Critical Vulnerability (May 2023) . That article contains the latest patches, which includes the fix for the June 9 (CVE-2023-35036) vulnerability as well as the original vulnerability from May 31 (CVE-2023-34362). 
  After you have done the above, proceed to the Immediate Mitigation Steps below. 
• Have applied May 2023 (CVE-2023-34362) patch and followed the remediation steps: Proceed to the Immediate Mitigation Steps and apply the June 15 patch (CVE Pending) as outlined below. You will then be up to date for the vulnerabilities announced on May 31 (CVE-2023-34362), June 9 (CVE-2023-35036) and June 15 (CVE Pending). 
• Have applied May 2023 (CVE-2023-34362) patch, followed the remediation steps and applied the June 9 (CVE-2023-35036) patch: Proceed to the Immediate Mitigation Steps and apply the June 15 patch (CVE-2023-35708) as outlined below. You will then be up to date for the vulnerabilities announced on May 31 (CVE-2023-34362), June 9 (CVE-2023-35036) and June 15 (CVE-2023-35708). 

5.0 Immediate Mitigation Steps
To help prevent unauthorized access to your MOVEit Transfer environment, we strongly recommend that you immediately apply the following mitigation measures until you are able to apply the June 15th patch (CVE-2023-35708).

1. Disable all HTTP and HTTPs traffic to your MOVEit Transfer environment. More specifically:

• Modify firewall rules to deny HTTP and HTTPs traffic to MOVEit Transfer on ports 80 and 443. 
• It is important to note that until HTTP and HTTPS traffic is enabled again: 
  • Users will not be able to log on to the MOVEit Transfer web UI 
  • MOVEit Automation tasks that use the native MOVEit Transfer host will not work
  • REST, Java and .NET APIs will not work
  • MOVEit Transfer add-in for Outlook will not work
• SFTP and FTP/s protocols will continue to work as normal

2. As a workaround, administrators will still be able to access MOVEit Transfer by using a remote desktop to access the Windows machine and then accessing https://localhost/. For more information on localhost connections, please refer to MOVEit Transfer Help: https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2023/page/Security-Policies-Remote-Access_2.html 

3. Apply the Patch 
As patches for supported MOVEit Transfer versions become available, links will be provided below. Supported versions are listed at the following link: https://community.progress.com/s/products/moveit/product-lifecycle. Please note, the license file can remain the same when staying on a major release to apply the patch. 

4. Enable all HTTP and HTTPs traffic to your MOVEit Transfer environment 

5. Please bookmark the Progress Security Page and refer to it to ensure you have all of the latest updates. 

DLL Drop-In (for customers who have one of the required versions listed installed)

IMPORTANT: Please read the README.txt before attempting the DLL Drop-in Install. Do not leave old versions of these DLL files on the system. They must be completely removed, not just renamed. 

Full Installer

MyCERT urges users and organizations to review the MOVEit Transfer Advisory, follow the mitigation steps, apply the necessary updates, and hunt for any malicious activity.

Kindly refer to the following URL: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

6.0    References

• https://www.cisa.gov/news-events/alerts/2023/06/01/progress-software-releases-security-advisory-moveit-transfer
• https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023

1.0 Introduction

Recently, Microsoft has released updates to address multiple vulnerabilities in Microsoft software.

2.0 Impact
An attacker can exploit some of these vulnerabilities to take control of an affected system.

3.0 Affected Products
Multiple Microsoft software and products

4.0 Recommendations
MyCERT encourages users and administrators to review Microsoft’s June 2023 Security Update Guide and Deployment Information and apply the necessary updates.

Kindly refer to the following URLs:

• https://msrc.microsoft.com/update-guide/releaseNote/2023-Jun
• https://msrc.microsoft.com/update-guide/deployments

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• https://www.cisa.gov/news-events/alerts/2023/06/13/microsoft-releases-june-2023-security-updates
• https://msrc.microsoft.com/update-guide/releaseNote/2023-Jun
• https://msrc.microsoft.com/update-guide/deployments

1.0 Introduction

Recently, Mozilla has released security updates to address vulnerabilities for Firefox 114 and Firefox ESR 102.12.

2.0 Impact
An attacker could exploit these vulnerabilities to take control of an affected system.

3.0 Affected Products
Firefox 114 and Firefox ESR 102.12.

4.0 Recommendations
MyCERT encourages users and administrators to review Mozilla’s security advisories for Firefox 114 and Firefox ESR 102.12 for more information and apply the necessary updates.

Kindly refer to the following URLs for more information:

• https://www.mozilla.org/en-US/security/advisories/mfsa2023-19/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-20/

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• https://www.cisa.gov/news-events/alerts/2023/06/07/mozilla-releases-security-updates-multiple-products
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-19/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-20/

1.0 Introduction

Open-source data indicates that on May 27, 2023, the CL0P Ransomware Gang, also known as TA505, started exploiting a previously unreported SQL injection vulnerability (CVE-2023-34362) in Progress Software’s managed file transfer (MFT), MOVEit Transfer. 

A web shell called LEMURLOOT was used to infect MOVEit Transfer web apps that were accessible to the public and steal data from the underlying MOVEit Transfer databases. Similar flurry of activity was launched by TA505 in early 2023 targeting Fortra/Linoma GoAnywhere MFT servers and Accellion File Transfer Appliance (FTA) devices in the form of zero-day exploit-driven attacks.

2.0 Impact

• Retrieve Microsoft Azure system settings and enumerate the underlying SQL database.
• Store a string sent by the operator and then retrieve a file with a name matching the string from the MOVEit Transfer system.
• Create a new administrator privileged account with a randomly generated username and LoginName and RealName values set to “Health Check Service.”
• Delete an account with LoginName and RealName values set to ‘Health Check Service.’

3.0 Affected Products

• MOVEit Transfer 2023.0.0
• MOVEit Transfer 2022.1.x
• MOVEit Transfer 2022.0.x
• MOVEit Transfer 2021.1.x
• MOVEit Transfer 2021.0.x
• MOVEit Transfer 2020.1.x
• MOVEit Transfer 2020.0.x

4.0 Indicators of Compromise (IoCs)
4.1 Moveit Campaign Indicators of Compromised

4.2 GoAnywhere Campaign Indicators of Compromise

5.0 Recommendations
MyCERT recommends users and administrators to follow the security best practices as recommended below to improve their organization’s security posture.

• Reduce threat of malicious actors using remote access tools by:
  • Auditing remote access tools.
  • Reviewing logs for execution of remote access software.
  • Using security software.
  • Requiring authorized remote access solutions.
  • Blocking both inbound and outbound connections.
• Implement application controls.
• Strictly limit the use of RDP and other remote desktop services.
• Disable command-line and scripting.
• Restrict the use of PowerShell.
• Update Windows PowerShell or PowerShell Core.
• Review domain controllers, servers, workstation, and active directories.
• Audit user accounts with administrative privileges.
• Reduce the threat of credential compromise.
• Implement time-based access for accounts.

In addition, MyCERT recommend apply the following recommendation to limit potential adversarial use of common system and network discovery techniques and to reduce the impact and risk of compromise by ransomware or data extortion actors:

• Implement a recovery plan.
• Maintain offline backups of data.
• Require multifactor authentication.
• Keep all operating systems, software and firmware up to date.
• Segment networks.
• Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool.
• Install, regularly update, and enable real time detection for antivirus software.
• Disable unused ports and hyperlinks.
• Consider adding and email banner to emails.
• Ensure all backup data is encrypted, immutable.

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

6.0    References

• https://www.cisa.gov/sites/default/files/2023-06/aa23-158a-stopransomware-cl0p-ransomware-gang-exploits-moveit-vulnerability_5_0.pdf
• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
• https://www.bleepingcomputer.com/news/security/clop-ransomware-likely-testing-moveit-zero-day-since-2021/

1.0 Introduction

Recently, Fortinet has released security updates to address a heap-based buffer overflow vulnerability CVE-2023-27997 in FortiOS and FortiProxy.

2.0 Impact
An attacker could exploit this vulnerability to take control of an affected system.

3.0 Affected Products

• FortiOS-6K7K version 7.0.10
• FortiOS-6K7K version 7.0.5
• FortiOS-6K7K version 6.4.12
• FortiOS-6K7K version 6.4.10
• FortiOS-6K7K version 6.4.8
• FortiOS-6K7K version 6.4.6
• FortiOS-6K7K version 6.4.2
• FortiOS-6K7K version 6.2.9 through 6.2.13
• FortiOS-6K7K version 6.2.6 through 6.2.7
• FortiOS-6K7K version 6.2.4
• FortiOS-6K7K version 6.0.12 through 6.0.16
• FortiOS-6K7K version 6.0.10
• FortiProxy version 7.2.0 through 7.2.3
• FortiProxy version 7.0.0 through 7.0.9
• FortiProxy version 2.0.0 through 2.0.12
• FortiProxy 1.2 all versions
• FortiProxy 1.1 all versions
• FortiOS version 7.2.0 through 7.2.4
• FortiOS version 7.0.0 through 7.0.11
• FortiOS version 6.4.0 through 6.4.12
• FortiOS version 6.2.0 through 6.2.13
• FortiOS version 6.0.0 through 6.0.16

4.0 Recommendations
MyCERT encourages users and administrators to review Fortinet security advisory FG-IR-23-097 and apply the necessary updates. For more information, see Fortinet's Analysis of CVE-2023-27997 and Clarifications on Volt Typhoon Campaign.

Kindly refer to the URLs below:

• Fortinet security advisory FG-IR-23-097 : https://www.fortiguard.com/psirt/FG-IR-23-097
• Fortinet's Analysis of CVE-2023-27997 and Clarifications on Volt Typhoon Campaign : https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• https://www.cisa.gov/news-events/alerts/2023/06/12/fortinet-releases-security-updates-fortios-and-fortiproxy
• https://www.fortiguard.com/psirt/FG-IR-23-097
• https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign

1.0 Introduction

Recently, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Australian Cyber Security Centre (ACSC) released a joint Cybersecurity Advisory to disseminate known BianLian ransomware and data extortion group IOCs and TTPs identified through FBI and ACSC investigations as of March 2023. 

BianLian is a ransomware developer, deployer, and data extortion cybercriminal group that has targeted organizations in multiple U.S. critical infrastructure sectors since June 2022. They have also targeted Australian critical infrastructure sectors in addition to professional services and property development. The group gains access to victim systems through valid Remote Desktop Protocol (RDP) credentials, uses open-source tools and command-line scripting for discovery and credential harvesting, and exfiltrates victim data via File Transfer Protocol (FTP), Rclone, or Mega. BianLian group actors then extort money by threatening to release data if payment is not made. BianLian group originally employed a double-extortion model in which they encrypted victims’ systems after exfiltrating the data; however, around January 2023, they shifted to primarily exfiltration-based extortion.

2.0 Technical Details
BianLian is a ransomware developer, deployer, and data extortion cybercriminal group. FBI observed BianLian group targeting organizations in multiple U.S. critical infrastructure sectors since June 2022. In Australia, ACSC has observed BianLian group predominately targeting private enterprises, including one critical infrastructure organization. BianLian group originally employed a doubleextortion model in which they exfiltrated financial, client, business, technical, and personal files for leverage and encrypted victims’ systems. In 2023, FBI observed BianLian shift to primarily exfiltrationbased extortion with victims’ systems left intact, and ACSC observed BianLian shift exclusively to exfiltration-based extortion. BianLian actors warn of financial, business, and legal ramifications if payment is not made.

2.1 Initial access
BianLian group actors gain initial access to networks by leveraging compromised Remote Desktop Protocol (RDP) credentials likely acquired from initial access brokers or via phishing.

2.2 Command and Control
BianLian group actors implant a custom backdoor specific to each victim written in Go (see the Indicators of Compromise Section for an example) and install remote management and access software—e.g., TeamViewer, Atera Agent, SplashTop, AnyDesk—for persistence and command and control.
FBI also observed BianLian group actors create and/or activate local administrator accounts and change those account passwords.

2.3 Defense Evasion
BianLian group actors use PowerShell and Windows Command Shell to disable antivirus tools, specifically Windows defender and Anti-Malware Scan Interface (AMSI). BianLian actors modify the Windows Registry to disable tamper protection for Sophos SAVEnabled, SEDEenabled, and SAVService services, which enables them to uninstall these services. See Appendix: Windows PowerShell and Command Shell Activity for additional information, including specific commands they have used.

2.4 Discovery
BianLian group actors use a combination of compiled tools, which they first download to the victim environment, to learn about the victim’s environment. BianLian group actors have used: 
• Advanced Port Scanner, a network scanner used to find open ports on network computers and retrieve versions of programs running on the detected ports.
• SoftPerfect Network Scanner (netscan.exe), a network scanner that can ping computers, scan ports, and discover shared folders. 
• SharpShares to enumerate accessible network shares in a domain. 
• PingCastle to enumerate Active Directory (AD). PingCastle provides an AD map to visualize the hierarchy of trust relationships. 
BianLian actors also use native Windows tools and Windows Command Shell to: 
• Query currently logged-in users. 
• Query the domain controller to identify:

• All groups.
• Accounts in the Domain Admins and Domain Computers groups.
• All users in the domain. 

• Retrieve a list of all domain controllers and domain trusts. 
• Identify accessible devices on the network. 

2.5 Credential Access
BianLian group uses valid accounts for lateral movement through the network and to pursue other follow-on activity. To obtain the credentials, BianLian group actors use Windows Command Shell to find unsecured credentials on the local machine. FBI also observed BianLian harvest credentials from the Local Security Authority Subsystem Service (LSASS) memory, download RDP Recognizer (a tool that could be used to brute force RDP passwords or check for RDP vulnerabilities) to the victim system, and attempt to access an Active Directory domain database (NTDS.dit).
In one case, FBI observed BianLian actors use a portable executable version of an Impacket tool (secretsdump.py) to move laterally to a domain controller and harvest credential hashes from it. 
Note: Impacket is a Python toolkit for programmatically constructing and manipulating network protocols. Through the Command Shell, an Impacket user with credentials can run commands on a remote device using the Windows management protocols required to support an enterprise network.

2.6 Presistence and Lateral Movement
BianLian group actors use PsExec and RDP with valid accounts for lateral movement. Prior to using RDP, BianLian actors used Command Shell and native Windows tools to add user accounts to the local Remote Desktop Users group, modified the added account’s password, and modified Windows firewall rules to allow incoming RDP traffic. See Appendix: Windows PowerShell and Command Shell Activity for additional information. 
In one case, FBI found a forensic artifact (exp.exe) on a compromised system that likely exploits the Netlogon vulnerability (CVE-2020-1472) and connects to a domain controller.

2.7 Collection
FBI observed BianLian group actors using malware (system.exe) that enumerates registry and files and copies clipboard data from users.

2.8 Exfiltration and Impact
BianLian group actors search for sensitive files using PowerShell scripts (See Appendix: Windows PowerShell and Command Shell Activity) and exfiltrate them for data extortion. Prior to January 2023, BianLian actors encrypted files after exfiltration for double extortion. 
BianLian group uses File Transfer Protocol (FTP) and Rclone, a tool used to sync files to cloud storage, to exfiltrate data. FBI observed BianLian group actors install Rclone and other files in generic and typically unchecked folders such as programdata\vmware and music folders. ACSC observed BianLian group actors use Mega file-sharing service to exfiltrate victim data. 
BianLian’s encryptor (encryptor.exe) modified all encrypted files to have the .bianlian extension. The encryptor created a ransom note, Look at this instruction.txt, in each affected directory (see Figure 1 for an example ransom note.) According to the ransom note, BianLian group specifically looked for, encrypted, and exfiltrated financial, client, business, technical, and personal files.

Figure 1: BianLian Sample Ransom Note (Look at this instruction.txt)

If a victim refuses to pay the ransom demand, BianLian group threatens to publish exfiltrated data to a leak site maintained on the Tor network. The ransom note provides the Tox ID A4B3B0845DA242A64BF17E0DB4278EDF85855739667D3E2AE8B89D5439015F07E81D12D767FC, which does not vary across victims. The Tox ID directs the victim organization to a Tox chat via https://qtox.gitbhub[.]io and includes an alternative contact email address (swikipedia@onionmail[.]org or xxx@mail2tor[.]com). The email address is also the same address listed on the group’s Tor site under the contact information section. Each victim company is assigned a unique identifier included in the ransom note. BianLian group receives payments in unique cryptocurrency wallets for each victim company. 
BianLian group engages in additional techniques to pressure the victim into paying the ransom; for example, printing the ransom note to printers on the compromised network. Employees of victim companies also reported receiving threatening telephone calls from individuals associated with BianLian group.
 

3.0 Indicators of Compromise
See Table 1 for IOCs obtained from FBI investigations as of March 2023.

Table 1: BianLian Ransomware and Data Extortion Group IOCs

Through FBI investigation as of March 2023, FBI has observed BianLian actors use the commands in Table 2. ACSC has observed BianLian actors use some of the same commands.

Table 2: PowerShell and Windows Command Shell Activity

4.0 Recommendations
MyCERT recommend organizations implement the recommendation below to improve your organization’s cybersecurity posture on the basis of the threat actor’s activity.

• Reduce threat of malicious actors using remote access tools by: 
  • Auditing remote access tools on your network to identify currently used and/or authorized software.
  • Reviewing logs for execution of remote access software to detect abnormal use of programs running as a portable executable.
  • Using security software to detect instances of remote access software only being loaded in memory. 
  • Requiring authorized remote access solutions only be used from within your network over approved remote access solutions, such as virtual private networks (VPNs) or virtual desktop interfaces (VDIs).
  • Blocking both inbound and outbound connections on common remote access software ports and protocols at the network perimeter.
• Implement application controls to manage and control execution of software.
• Strictly limit the use of RDP and other remote desktop services.
• Disable command-line and scripting activities and permissions.
• Restrict the use of PowerShell.
• Update Windows PowerShell or PowerShell Core.
• Enable enhanced PowerShell logging.
• Configure the Windows Registry to require User Account Control (UAC) approval for any PsExec operations.
• Review domain controllers, servers, workstations, and active directories.
• Audit user accounts.
• Implement time-based access for accounts set at the admin level and higher.

In addition, MyCERT recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques and to reduce the impact and risk of compromise by ransomware or data extortion actors:

• Implement a recovery plan.
• Maintain offline backups of data.
• Require phishing-resistant multifactor authentication.
• Keep all operating systems, software, and firmware up to date.
• Segment networks.
• Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool.
• Install, regularly update, and enable real time detection for antivirus software.
• Disable unused ports.
• Consider adding an email banner to emails.
• Ensure all backup data is encrypted, immutable.

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a
• https://www.cisa.gov/sites/default/files/2023-05/aa23-136a_stopransomware_bianlian_ransomware_group_1.pdf