securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.co/wordpress/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.co/wordpress/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


MUST READ

Headlines
 * Chinese DriftingCloud APT exploited Sophos Firewall Zero-Day before it was
   fixed
 * Experts link Hermit spyware to Italian surveillance firm RCS Lab and a front
   company
 * A Microsoft 365 feature can ransom files on SharePoint and OneDriveCould
 * BlackCat Ransomware affiliates target unpatched Microsoft Exchange servers
 * ALPHV/BlackCat ransomware gang starts publishing victims' data on the clear
   web
 * Researchers disclosed a remote code execution flaw in Fastjson Library



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


CHINESE DRIFTINGCLOUD APT EXPLOITED SOPHOS FIREWALL ZERO-DAY BEFORE IT WAS FIXED

June 17, 2022  By Pierluigi Paganini


Powered by pixfutureⓘ


CHINA-LINKED THREAT ACTORS EXPLOITED THE ZERO-DAY FLAW CVE-2022-1040 IN SOPHOS
FIREWALL WEEKS BEFORE IT WAS FIXED BY THE SECURITY VENDOR.

Volexity researchers discovered that the zero-day vulnerability, tracked as
CVE-2022-1040, in Sophos Firewall was exploited by Chinese threat actors to
compromise a company and cloud-hosted web servers it was operating.

Powered by pixfutureⓘ

The vulnerability was exploited by the Chinese attackers to drop a webshell into
the target systems weeks before it was fixed by the security vendor.

On March 25, Sophos announced to have fixed the authentication bypass
vulnerability, tracked as CVE-2022-1040, that resides in the User Portal and
Webadmin areas of Sophos Firewall.

The CVE-2022-1040 flaw received a CVSS score of 9.8 and impacts Sophos
Firewall versions 18.5 MR3 (18.5.3) and earlier.

“An authentication bypass vulnerability allowing remote code execution was
discovered in the User Portal and Webadmin of Sophos Firewall and responsibly
disclosed to Sophos. It was reported via the Sophos bug bounty program by an
external security researcher. The vulnerability has been fixed.” reads
the advisory published by the company.

A remote attacker with access to the Firewall’s User Portal or Webadmin
interface can exploit the flaw to bypass authentication and execute arbitrary
code.

Source Sophos community

A few days later, Sophos warned that the CVE-2022-1040 flaw is actively
exploited in attacks aimed at a small set of Asian organizations.

“Sophos has observed this vulnerability being used to target a small set of
specific organizations primarily in the South Asia region. We have informed each
of these organizations directly. Sophos will provide further details as we
continue to investigate.” reads the advisory published by the vendor.

Now researchers from Volexity revealed that a Chinese APT group, tracked as
DriftingCloud, exploited the flaw since early March. The threat actors used a
zero-day exploit to drop a webshell backdoor and target the customer’s staff.

“This particular attack leveraged a zero-day exploit to compromise the
customer’s firewall. Volexity observed the attacker implement an interesting
webshell backdoor, create a secondary form of persistence, and ultimately launch
attacks against the customer’s staff. These attacks aimed to further breach
cloud-hosted web servers hosting the organization’s public-facing websites.”
reads the report published by Volexity. “This type of attack is rare and
difficult to detect. This blog post serves to share what highly targeted
organizations are up against and ways to defend against attacks of this nature.”

Volexity discovered the intrusion while investigating suspicious traffic
originating from the Sophos Firewall to key systems in its customer’s networks.
The analysis of the logs revealed significant and repeated suspicious access
aimed at a valid JSP file (login.jsp).



Further investigation revealed that the threat actors use
the Behinder framework, which was employed by other Chinese APT groups in
attacks exploiting the recently disclosed CVE-2022-26134 flaw in Confluence
servers.

The compromise of the Sophos Firewall was the phase of the attack chain, threat
actors later performed man-in-the-middle (MitM) attacks to collect data and use
them to compromise additional systems outside of the network where the firewall
resided.

“Volexity discovered that the attacker used their access to the firewall to
modify DNS responses for specially targeted websites in order to perform MITM
attacks. The modified DNS responses were for hostnames that belonged to the
victim organization and for which they administered and managed the content.
This allowed the attacker to intercept user credentials and session cookies from
administrative access to the websites’ content management system (CMS).” states
the report.”Volexity determined that in multiple cases, the attacker was able to
access the CMS admin pages of the victim organization’s websites with valid
session cookies they had hijacked.”

Once gained access to the target webservers, the DriftingCloud APT deployed
multiple open-source malware, including PupyRAT, Pantegana, and Sliver.

Volexity researchers shared the indicators of compromise for the attacks and
YARA rules to detect the attack pattern.

Security Affairs is one of the finalists for the best European Cybersecurity
Blogger Awards 2022 – VOTE FOR YOUR WINNERS. I ask you to vote for me again
(even if you have already done it), because this vote is for the final.

Please vote for Security Affairs and Pierluigi Paganini in every category that
includes them (e.g. sections “The Underdogs – Best Personal (non-commercial)
Security Blog” and “The Tech Whizz – Best Technical Blog”)

To nominate, please visit: 

https://docs.google.com/forms/d/e/1FAIpQLSdNDzjvToMSq36YkIHQWwhma90SR0E9rLndflZ3Cu_gVI2Axw/viewform

Follow me on Twitter: @securityaffairs and Facebook



Pierluigi Paganini

(SecurityAffairs – hacking, Sophos Firewall)





Powered by pixfutureⓘ





Share this...

Facebook
Twitter
Linkedin


SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 
 * 


ChinaCVE-2022-1040DriftingCloudhacking newsinformation security newsIT
Information SecuritymalwarePierluigi PaganiniSecurity AffairsSecurity NewsSophos
Firewall


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

Experts link Hermit spyware to Italian surveillance firm RCS Lab and a front
company


--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


EXPERTS LINK HERMIT SPYWARE TO ITALIAN SURVEILLANCE FIRM RCS LAB AND A FRONT
COMPANY

June 17, 2022  By Pierluigi Paganini

A MICROSOFT 365 FEATURE CAN RANSOM FILES ON SHAREPOINT AND ONEDRIVECOULD

June 17, 2022  By Pierluigi Paganini






 * SPONSORED CONTENT
   
   
 * 


 * PIXFUTURE

 * 


 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

EXPERTS LINK HERMIT SPYWARE TO ITALIAN SURVEILLANCE FIRM RCS LAB AND A FRONT
COMPANY

Experts uncovered an enterprise-grade surveillance malware dubbed Hermit used to
target individuals in Kazakhstan, Syria,...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me

We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT