Hackers Exploit Netwrix Auditor RCE Flaw in Truebot Malware Attack

A newly found Truebot Malware targets both US and Canada-based organizations to exfiltrate sensitive information by exploiting vulnerabilities in the Netwrix Auditor application(CVE-2022-31199).

Truebot malware is a botnet that is delivered through phishing campaigns to attack victims, now exploiting the vulnerability to gain access to the machine.

CISA and FBI jointly issue warnings about the increased activity of this new malware variant.

Truebot Malware Attack:

Increased activity of truebot has been observed since May 31, 2023, and it is presumed to be used by CL0P Ransomware Gang.

The delivery of the payload is achieved either through phishing attempts or through exploiting the vulnerability.

The payload has been concealed as a legitimate software update notification and was delivered through emails to trick the users into executing.

Once the user executes the email, it redirects to a malicious domain, and script files will be executed to collect the information.

Exploit:

Netwrix Auditor is software used for on-premises and cloud-based IT system auditing. Attackers utilize the remote code execution vulnerability (CVE-2022-31199) in this software for lateral movement.

It employs various tools and techniques to achieve persistence; initially, it loads Flawed Grace, a remote access tool to store payloads and inject additional payloads on scheduled tasks to establish the connection to the C2 server.

Later it uploads Cobalt Strike beacons into memory in dormant mode for further operations.

Through POST requests, it establishes bilateral communication with the C2 server, which downloads additional payloads and self-replicates across the environment.

The best practice to mitigate this attack is to patch the vulnerability and update the applications and software used. And apply controls to prevent remote execution attempts.

Indicator of Compromise:

“AI-based email security measures Protect your business From Email Threats!” – .