Friday, June 14, 2024

Hackers Exploit Netwrix Auditor RCE Flaw in Truebot Malware Attack

A newly found Truebot Malware targets both US and Canada-based organizations to exfiltrate sensitive information by exploiting vulnerabilities in the Netwrix Auditor application(CVE-2022-31199).

Truebot malware is a botnet that is delivered through phishing campaigns to attack victims, now exploiting the vulnerability to gain access to the machine.

CISA and FBI jointly issue warnings about the increased activity of this new malware variant.

Truebot Malware Attack:

Increased activity of truebot has been observed since May 31, 2023, and it is presumed to be used by CL0P Ransomware Gang.

The delivery of the payload is achieved either through phishing attempts or through exploiting the vulnerability.

The payload has been concealed as a legitimate software update notification and was delivered through emails to trick the users into executing.

Once the user executes the email, it redirects to a malicious domain, and script files will be executed to collect the information.

Exploit:

Netwrix Auditor is software used for on-premises and cloud-based IT system auditing. Attackers utilize the remote code execution vulnerability (CVE-2022-31199) in this software for lateral movement.

It employs various tools and techniques to achieve persistence; initially, it loads Flawed Grace, a remote access tool to store payloads and inject additional payloads on scheduled tasks to establish the connection to the C2 server.

Later it uploads Cobalt Strike beacons into memory in dormant mode for further operations.

Through POST requests, it establishes bilateral communication with the C2 server, which downloads additional payloads and self-replicates across the environment.

The best practice to mitigate this attack is to patch the vulnerability and update the applications and software used. And apply controls to prevent remote execution attempts.

Indicator of Compromise:

MD5 HashF33734DFBBFF29F68BCDE052E523C287
MD5 HashF176BA63B4D68E576B5BA345BEC2C7B7
MD5 HashF14F2862EE2DF5D0F63A88B60C8EEE56
MD5 Hash6164e9d297d29aa8682971259da06848
SHA256121A1F64FFF22C4BFCEF3F11A23956ED403CDEB9BDB803F9C42763087BD6D94E
MD572A589DA586844D7F0818CE684948EEA
SHA256717BEEDCD2431785A0F59D194E47970E9544FBF398D462A305F6AD9A1B1100CB
SHA256C92C158D7C37FEA795114FA6491FE5F145AD2F8C08776B18AE79DB811E8E36A3

“AI-based email security measures Protect your business From Email Threats!” – .

Website

Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles