ICYMI: Critical Cisco RCE Bug, Microsoft Breaks Down Hive, SHI Cyberattack
Dark Readings digest of the other dont-miss stories of the week, including a new ransomware targeting QNAP gear, and a destructive attack against the College of the Desert that lingers on.
Cybercrime never sleeps — but editors do. To cap off this short Fourth of July week, Dark Readings editors are collecting all of the interesting threat intelligence and cyber-incident stories that we just didnt get to earlier but would be remiss to not cover.
Were talking a critical Cisco vulnerability, a Microsoft alert on upgrades to the Hive ransomware, QNAP issues, and a pair of cyberattacks.
In this weeks in case you missed it (ICYMI) digest, read on for more about the following:
Critical Cisco Security Vulnerability Allows Root Access to OS
Hive Ransomware Gets a Rust-y Upgrade
QNAP Warns on Checkmate Ransomware Attacks
SHI-eesh: IT Giant Knocked Offline in Coordinated Cyberattack
California College Remains Offline After Ransomware Hit
Cisco has rolled out patches for 10 security bugs, including a critical flaw that could allow cyberattackers to manipulate application source code, or configuration and critical system files.
The critical issue (CVE-2022-20812, CVSS severity score of 9.0) is a path-traversal vulnerability affecting the Cisco Expressway Series software and Cisco TelePresence VCS software, if they are in the default
A vulnerability in the cluster database API of Cisco Expressway Series and Cisco TelePresence VCS could allow an authenticated, remote attacker with Administrator read-write privileges on the application to conduct absolute path traversal attacks on an affected device and overwrite files on the underlying operating system as a root user, according to
the advisory
, the latest since Ciscos
last bug disclosure
in May.
The vulnerability arises thanks to insufficient input validation of user-supplied command arguments, the networking giant noted.
An attacker could exploit this vulnerability by authenticating to the system as an administrative read-write user and submitting crafted input to the affected command.
The ransomware-as-a-service (RaaS) offering known as Hive has overhauled its infrastructure, using the programming language Rust.
Thats the buzz from Microsoft, whose security researchers noted that
Hive is an exemplar
of adapting to the rapid change found in the underground economy.
With its latest variant carrying several major upgrades, Hive also proves it’s one of the fastest-evolving ransomware families, exemplifying the continuously changing ransomware ecosystem, researchers said
in a post
this week. The most notable changes include a full code migration to another programming language [from GoLang to Rust] and the use of a more complex encryption method.
Rust, a language also used by the BlackCat ransomware, allows advances in coding control, memory usage, resistance to reverse engineering, and access to a range cryptographic libraries, the researchers said.
As for the encryption, the new Hive variant uses string encryption that can make it more evasive, according to the advisory. “The constants that are used to decrypt the same string sometimes differ across samples, making them an unreliable basis for detection.”
QNAP, the network-attached storage (NAS) vendor, is flagging activity against its devices that results in the execution of the Checkmate ransomware.
The cyberattackers are specifically targeting SMB file-sharing services exposed to the Internet, using a dictionary attack to break accounts with weak passwords.
Once the attacker successfully logs in to a device, they encrypt data in shared folders and leave a ransom note with the file name !CHECKMATE_DECRYPTION_README in each folder, according to
QNAPs advisory
this week. It added, We are thoroughly investigating the case and will provide further information as soon as possible.
Customers of the Taiwan-based appliance maker have been suffering ongoing, relentless ransomware activity — which Dark Reading broke down earlier this week (along with potential defenses) in an
extensive roundtable of experts
.
To protect their businesses and avoid a ransomware checkmate, users should avoid exposing the SMB service to the internet and should employ strong passwords in any event.
IT-supplier bigwig SHI International said this week that it was the target of a coordinated and professional malware attack.
The New Jersey-based vendor, which has 5,000 employees and 15,000 customers around the world, said that it moved quickly to stop the infection and minimize the impact on SHI’s systems and operations. That meant that some systems, such as SHI’s public websites and email, were knocked offline while the attack was investigated and the integrity of those systems was assessed.
The SHI staff regained access to email, but as of Thursday the main website was still not operational. The company
said in a website notice
that IT teams continue to work to bring other systems back online.
Its unclear what the cyberattackers goal was, but some researchers noted that a
supply chain compromise
attempt is a real possibility.
“Apart from being a large enterprise, SHI is a major software and hardware provider to several Fortune 500 companies, and while there is no evidence regarding third-party suppliers getting breached or customer data getting exfiltrated, this is certainly too close for comfort for many of their customers, Rajiv Pimplaskar, CEO at Dispersive Holdings, said via email.
As the latest example of what happens when IT isnt prepared for a hit, the 12,500-student College of the Desert, a community college in Palm Desert, Calif., remains offline after suffering which researchers suspect was a ransomware attack.
The cyberattack brought down the schools online services and campus phone lines on July 4. As of late Thursday, the schools website still returned
a notice
that it is currently experiencing a system-wide outage of most services, including the ability for students to request transcripts, add or drop classes, or register for classes.
Educational institutions have
continued to be a prime target for ransomware groups
over the last couple of years, says Josh Rickard, senior security solutions architect at Swimlane, noting that this is the second time College of the Desert has been hit with a malware attack; the first incident took place in August 2020. To prevent similar attacks in the future and ensure that operations continue to run smoothly, education institutions such as College of the Desert need to devote more resources to information security teams, tools, processes, and products.
Rickard suspects the incident was ransomware due to the severe operational disruption, but it should be noted that College of the Desert has not confirmed that, admitting only to a computer network disruption.
Tags:
ICYMI: Critical Cisco RCE Bug, Microsoft Breaks Down Hive, SHI Cyberattack