209 lines
32 KiB
JSON
209 lines
32 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--f8912a82-2870-4de2-9663-5fdbee0ed401",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2024-02-23T14:53:09.000Z",
|
||
|
|
"modified": "2024-02-23T14:53:09.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--f8912a82-2870-4de2-9663-5fdbee0ed401",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2024-02-23T14:53:09.000Z",
|
||
|
|
"modified": "2024-02-23T14:53:09.000Z",
|
||
|
|
"name": "OSINT - ConnectWise ScreenConnect attacks deliver malware",
|
||
|
|
"published": "2024-02-23T14:53:22Z",
|
||
|
|
"object_refs": [
|
||
|
|
"x-misp-object--de430685-633a-48a8-b7eb-55c7168f5bce",
|
||
|
|
"vulnerability--85a30426-433a-4ec0-ac82-ac8a13b0b2ac",
|
||
|
|
"indicator--01d80244-d9bb-4eef-a64c-6067475a21da",
|
||
|
|
"indicator--1cd45224-4b4c-4889-829a-343692331a52",
|
||
|
|
"indicator--5ce43c0d-825a-420f-9c87-8b053137f8e5",
|
||
|
|
"note--c077c950-3bc9-4a59-be82-a7388d56e53e"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"osint:lifetime=\"perpetual\"",
|
||
|
|
"tlp:clear",
|
||
|
|
"misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
|
||
|
|
"misp-galaxy:producer=\"Sophos\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--de430685-633a-48a8-b7eb-55c7168f5bce",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2024-02-23T13:48:46.000Z",
|
||
|
|
"modified": "2024-02-23T13:48:46.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "link",
|
||
|
|
"value": "https://news.sophos.com/en-us/2024/02/23/connectwise-screenconnect-attacks-deliver-malware/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "cd7cc81c-2a76-410d-ba7e-cc1b8fe2a068"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "summary",
|
||
|
|
"value": "ConnectWise ScreenConnect attacks deliver malware\r\nMultiple attacks exploit vulnerabilities in an IT remote access tool to deliver a variety of different payloads into business environments",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bb5a7f61-4c78-4f14-961b-29f2fa87ab0d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "title",
|
||
|
|
"value": "https://news.sophos.com/en-us/2024/02/23/connectwise-screenconnect-attacks-deliver-malware/",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "56f9f969-bbff-493f-924a-9268ba0a828d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "Blog",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2bfbc86e-b3bd-41fa-bbf2-f7f8519d4402"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "vulnerability",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "vulnerability--85a30426-433a-4ec0-ac82-ac8a13b0b2ac",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2024-02-23T13:52:35.000Z",
|
||
|
|
"modified": "2024-02-23T13:52:35.000Z",
|
||
|
|
"name": "CVE-2024-1709",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"vulnerability\"",
|
||
|
|
"misp:meta-category=\"vulnerability\"",
|
||
|
|
"misp:to_ids=\"False\""
|
||
|
|
],
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"source_name": "cve",
|
||
|
|
"external_id": "CVE-2024-1709"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"source_name": "cve",
|
||
|
|
"external_id": "CVE-2024-1708"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--01d80244-d9bb-4eef-a64c-6067475a21da",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2024-02-23T13:54:19.000Z",
|
||
|
|
"modified": "2024-02-23T13:54:19.000Z",
|
||
|
|
"description": "At least one threat actor is abusing ScreenConnect to deploy a ransomware executable. Sophos suspects it is the same person or group; an identical payload (SHA-256 2da975fee507060baa1042fb45e8467579abf3f348f1fd37b86bb742db63438a) was discovered in more than 30 different customer networks, beginning on February 22. This distribution pattern is strongly indicative of the threat actor pushing the payload from a compromised server.",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2da975fee507060baa1042fb45e8467579abf3f348f1fd37b86bb742db63438a' AND file:x_misp_state = 'Malicious']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2024-02-23T13:54:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1cd45224-4b4c-4889-829a-343692331a52",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2024-02-23T13:56:38.000Z",
|
||
|
|
"modified": "2024-02-23T13:56:38.000Z",
|
||
|
|
"description": "We also saw a different attacker attempt to drop another payload (a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0) using the certutil utility to download it from a web address, write it to the root of the C:\\ drive with the filename svchost.exe, and execute it. In this case, the behavioral rule Lateral_1b blocked the file from being downloaded and the attack failed.",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0' AND file:x_misp_state = 'Malicious']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2024-02-23T13:56:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce43c0d-825a-420f-9c87-8b053137f8e5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2024-02-23T13:58:31.000Z",
|
||
|
|
"modified": "2024-02-23T13:58:31.000Z",
|
||
|
|
"description": "Telemetry indicates attackers are also pushing the Vidar/Redline data stealer malware (SHA-256 c94038781c56ab85d2f110db4f45b86ccf269e77a3ff4b9133b96745ff97d25f) via ScreenConnect. The HMPA CookieGuard and TTP classifications (T1555.003) trigger on this type of attack. The attack looks like the ScreenConnect.WindowsClient.exe launches the malware from this location:",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c94038781c56ab85d2f110db4f45b86ccf269e77a3ff4b9133b96745ff97d25f' AND file:x_misp_state = 'Malicious']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2024-02-23T13:58:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "note",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "note--c077c950-3bc9-4a59-be82-a7388d56e53e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2024-02-23T13:51:21.000Z",
|
||
|
|
"modified": "2024-02-23T13:51:21.000Z",
|
||
|
|
"abstract": "Report from - https://news.sophos.com/en-us/2024/02/23/connectwise-screenconnect-attacks-deliver-malware/ (1708696253)",
|
||
|
|
"content": "# Situation overview\r\n\r\n On February 19, 2024, ConnectWise released a security advisory for its remote monitoring and management (RMM) software. Their advisory highlighted two vulnerabilities that impact older versions of ScreenConnect and have been **mitigated in version 23.9.8 and later.**\r\n\r\n ConnectWise states in the advisory these vulnerabilities are rated as **\u201cCritical\u2014Vulnerabilities that could allow the ability to execute remote code or directly impact confidential data or critical systems\u201d.** The two vulnerabilities are:\r\n\r\n \r\n * CVE-2024-1709 (CWE-288) \u2014 Authentication Bypass Using Alternate Path or Channel \r\n\t + Base CVSS score of 10, indicating \u201cCritical\u201d \r\n * CVE-2024-1708 (CWE-22) \u2014 Improper Limitation of a Pathname to a Restricted Directory (\u201cPath Traversal\u201d) \r\n\t + Base CVSS score of 8.4, still considered \u201cHigh Priority\u201d \r\n \r\n The vulnerabilities can affect both the ScreenConnect server and ScreenConnect client software, in different ways. Attackers have found that they can deploy malware to servers or to workstations with the client software installed. Sophos has evidence that attacks against both servers and client machines are currently underway. Patching the server will not remove any malware or webshells attackers manage to deploy prior to patching and any compromised environments need to be investigated.\r\n\r\n Cloud-hosted implementations of ScreenConnect, including screenconnect.com and hostedrmm.com, have already received updates to address these vulnerabilities. Self-hosted (on-premise) instances remain at risk until they are manually upgraded, and it is our recommendation to patch to ScreenConnect version 23.9.8 immediately. The upgrade is available on ScreenConnect\u2019s download page.\r\n\r\n On February 21, 2024, proof of concept (PoC) code was released on GitHub that exploits these vulnerabilities and adds a new user to the compromised system. ConnectWise has also updated their initial report to include observed, active exploitation in the wild of these vulnerabilities.\r\n\r\n On February 22, 2024, Sophos X-Ops reported through our social media handle that despite the recent law enforcement activity against the LockBit threat actor group we had observed several attacks over the preceding 24 hours that appeared to be carried out with LockBit ransomware, built using a leaked malware builder tool. It appears that our signature-based detection correctly identified the payloads as ransomware generated by the leaked LockBit builder, but the ransom notes dropped by those payloads identified one as \u201cbuhtiRansom,\u201d and the other did not have a name in its ransom note.\r\n\r\n This article includes additional details and analysis of the ScreenConnect attacks Sophos observed in the past 48 hours.\r\n\r\n # Recommendations\r\n\r\n \r\n * Confirm whether you have an on-premises deployment of ScreenConnect Server \r\n\t + If you have an on-premises instance in your environment running a version prior to 23.9.8, take it offline immediately until you upgrade to the newest version; isolate or shut it down until it is patched and investigated for signs of exploitation\r\n\t + If you have an on-premises version in your environment that was updated to version 23.9.8 or later prior to February 21, you are not at risk, though it would be prudent to inspect the server to ensure no malicious payloads were installed\r\n\t + If you use the cloud-hosted version, you are not at risk and no further actions are necessary \r\n * If your deployment of ScreenConnect Server is hosted by a third-party vendor, confirm with them they have upgraded their instance to 23.9.8 or later; if they have not, recommend that they take it offline until the patches are applied\r\n * Scan your environment and customer environments for instances of ScreenConnect that you may not be aware of, to avoid the risk of those ScreenConnect being unpatched and exposing the environment to a Supply Chain Attack\r\n * If you have ScreenC
|
||
|
|
"object_refs": [
|
||
|
|
"report--f8912a82-2870-4de2-9663-5fdbee0ed401"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|