SwitHak

Hacktivists in Ukraine-Russia Conflict

Intro

• Since the beginning of the Ukraine invasion in 2022, we observed multiple hacktivists entities involved in the conflict, this document aims to centralize the information collected and provides a short analysis of their operating methods, financing models and some ideas on how-to report on this threat actor type, Mitre ATT&CK mapping.

Disclaimer

• The scope encompass my own collection from January 2022 to July 2023 included, it is mostly based on publicly available data, some Telegrams & VK groups were private.
• The following analysis will not contain Hacktivist entities & alliances names to not make them any publicity
• I can be wrong, I'm a human, do not hesitate to comment the analysis

SwitHak

Security Advisories / Bulletins / vendors Responses linked to 3CX compromise event

General

What's 3CX?

• 3CX evolved from its roots as a PBX phone system to a complete communications platform, offering customers a simple, flexible, and affordable solution to call, video and live chat.

What's happening?

• Per several report the building environment of 3CX for the DesktopApp (MAC & Windows) has been compromised
• The recent releases (details given below) have been compromised to include malicious code inside it
• More details available regarding the compromise with the graphics by Thomas Roccia:

SwitHak

Offensive Cyber Operation against Albania networks by Iran

General

• An offensive cyber operation against Albania government & medias networks occured the 15th July weekend.
• Quickly the AKSHI announced they were forced to disconnect public services & government websites from Internet.
• Mandiant cyber security company in a blog post attributed the activity to LIKELY an iranian threat actor.
• Albania Prime Minister offcially attributed the offensive cyber operation gainst its country to Iran.
• Albania government severed the diplomatic relationship with Iran the 7th September with immediate effect.
• Iran embassy personnel must leave the country.
• Nota: The response to this event depends, some says they're supportive of the Iran attribution, some not.

SwitHak

Security Advisories / Bulletins / vendors Responses linked to Spring4Shell (CVE-2022-22965)

Errors, typos, something to say ?

• If you want to add a link, comment or send it to me
• Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

A B C D E F G H [I](https://gist.github.com/SwitHak/0be6e857174d6ba2a6973f9ff9030c

SwitHak

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

• If you want to add a link, comment or send it to me
• Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

• Royce Williams list sorted by vendors responses Royce List
• Very detailed list NCSC-NL
• The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

SwitHak

SolarWinds Supply-chain Compromises

Detections

General

• This section aims to provide the detections released by security companies to detect the malwares / files linked to SolarWinds supply-chain compromise events. We kindly remind you that this detections signatures could / will evolve in the next days, stays updated by checking the vendors resources to have the last information.

Warning

• SolarWinds in a support article now removed, asked the organizations to exclude SolarWinds products paths of the anti-virus scans. If it is an understandable practice to not impact SolarWinds products functions, the following detections will not work if the installation paths exclusions are not removed first.

Security Products

SwitHak

CVE-2020-10713 AKA BootHole

• Logo
• Cool Name : BootHole

General

• GRUB2 -> GRand Unified Bootloader version 2 -Don't hurry up on the patches, RedHat have some bug within and also test before production. -It's a cool vuln, cool name, cool logo, but take your time to test the patches, boot isn't something you patching every month, take care !
• TBD

SwitHak

July Patch Priorities

Patching priority:

P1

• SHITRIX-II (Critical, Exploited)
• F5 BigIP (Critical, Exploited)
• SAPRecon (Critical, Exploited)
• ASA & FTD CVE-2020-3452 (High, Exploited)
• SIGRed CVE-2020-1350 (Critical, Exploit available (DoS))

SwitHak

Ripple20, set of vulnerabilities inside Treck / KASAGO IP Stacks

General

• Ripple20 is the codename to a set of 19 vulnerabilities discovered by the cybersecurity team JSOF.
• These vulnerabilities are inside an IP stack, selled under two different names (Treck TCP/IP for U.S market Kasago TCP/IP, for Asia market. -These two stacks were bought and used under privated-labeled by several softwares companies, some known names are: GHnetv2, Kwiknet, Quadnet.
• But there's more, these stacks were also integrated, sometimes with modifications, inside several RTOS (real-time operating system).
• Last, some of the vulnerabilities, depending the device operating system, configuration or location can have greater or lower CVSS score.
• My advice is for companies to ask their suppliers if they use one of this stack and assess the risk following their company risk policy.
• This will not be an easy set of vulnerabilities to patch, sadly.

SwitHak

CVE-2020-11651 AKA SaltStack RCE

• Currently no cool name, what are you doing @GossiTheDog ? ;)

General

• A critical vulnerability have been discovered by FSECURE Labs team in the SaltStack product.
• The vulnerability is a Remote Code Execution with the higher CVSS number possible 10/10 and the CVE number is CVE-2020-11651.
• there's also another vulnerability referenced under the CVE-2020-11652, discovered in the same time also per FSECURE.
• The vulnerability is actively exploited (Some says since Saturday morning 2020-05-02) and several exploits are in the wild.
• We currently knows at least 5 victims, even big names are concerned.
• This is not a drill or something you can patch later, act now.