Last week in security news, a U.S. company announced that its penetration tool had incorporated a fully working exploit for the BlueKeep vulnerability. This discovery came around the same time that researchers observed a new version of a cryptocurrency-mining botnet using a BlueKeep RDP protocol vulnerability scanner module. Plenty of other malware- and ransomware-related stories broke during the week as well.

Top Story of the Week: A Commercially Available BlueKeep Exploit

On July 23, Immunity Inc. announced that it had integrated a fully functional BlueKeep exploit into its CANVAS v7.23 penetration testing toolkit. This development made it possible for pen testers to begin abusing the BlueKeep module to open a shell on infected remotes and thereby achieve remote code execution (RCE).

According to ZDNet, the creation of the new module marked the first time that a BlueKeep exploit became available to even a limited audience. The availability of the exploit wasn’t extensive at the time of its release, since licenses for CANVAS range from thousands to tens of thousands of dollars. Even so, ZDNet noted that digital attackers are known to pirate or outright purchase penetration testing software to give an edge to their future attack campaigns.

Source: iStock

Also in Security News

  • Attackers Impersonate BSI to Distribute Sodinokibi Ransomware: The Bundesamt für Sicherheit in der Informationstechnik (BSI), Germany’s Federal Office for Information Security, revealed on July 24 that digital attackers had used the email address [email protected][dot]org to send out messages falsely warning of compromised data. In actuality, these malicious emails contained Sodinokibi ransomware as their payload.
  • Phishers Set Sights on Office 365 Admin Accounts: Digital attackers sent out fake alerts to administrators informing them that their organization’s Office 365 licenses had expired. In those cases where recipients fell for the ruse and clicked a fake sign in link, the campaign redirected them to a phishing page specifically designed to steal their admin credentials.
  • New Version of WatchBog Sporting BlueKeep Scanner: WatchBog, a cryptocurrency-mining botnet that’s been operational since late 2018, implemented a BlueKeep RDP protocol vulnerability scanner module in one of its newer variants. Intezer noted that this change could signal that the operators of WatchBog are building a list of vulnerable systems for future attacks.
  • MegaCortex Uses Aggressive Wording in Ransom Note: A sample of MegaCortex ransomware didn’t use its ransom note to assuage its victims’ concerns. Instead, it urged victims to not “waste our and your time” and to remember that the malware’s handlers “don’t do charity.”
  • FIN8’s Evolving Tool Sets Broaden to Include BADHATCH: In its tracking of the FIN8 threat group, Gigamon observed that the actor had added BADHATCH to its list of evolving tool sets. Further analysis revealed that BADHATCH, a previously unknown tool, bolstered attackers’ arsenals with file transfer and remote shell functionality.
  • Fake FaceApp Installations Spreading MobiDash Malware: Security researchers received reports that FaceApp installations from unofficial sources infected devices with MobiDash malware. These analysts weren’t able to determine how many infections occurred in all, but they did report at least 500 individual compromises within a 48-hour period starting on July 19.
  • Malvertising Campaign Abusing WordPress Weaknesses: WordFence came across a malvertising campaign that abused a few known WordPress vulnerabilities to inject JavaScript into the front end of a victim’s site. This code executed whenever a user visited the site and redirected them to other locations harboring threats such as tech support scams and malicious Android APKs.

Security Tip of the Week: Embrace a Vulnerability Management Program

A couple of months before news of the first BlueKeep exploit became available, Microsoft didn’t mince words in urging system admins to patch vulnerable machines. The company explained that the threat level was too great to do nothing:

“…the vulnerability is ‘wormable’, meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017. While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware.”

To defend against BlueKeep-based attacks, security professionals need to embrace a comprehensive vulnerability management program through which they can prioritize known weaknesses and focus their patching efforts. Toward that end, organizations should break down cybersecurity silos so that IT and security professionals can work together to defend against vulnerabilities such as BlueKeep.

More from

$10.3 Billion in Cyber Crime Losses Shatters Previous Totals

4 min read - The introduction of the most recent FBI Internet Crime Report says, “At the FBI, we know ‘cyber risk is business risk’ and ‘cybersecurity is national security.’” And the numbers in the report back up this statement. The FBI report details more than 800,000 cyber crime-related complaints filed in 2022. Meanwhile, total losses were over $10 billion, shattering 2021's total of $6.9 billion, according to the bureau’s Internet Crime Complaint Center (IC3).  Top Five Cyber Crime TypesIn the past five years, the…

4 min read

How to Boost Cybersecurity Through Better Communication

4 min read - Security would be easy without users. That statement is as absurd as it is true. It’s also true that business wouldn’t be possible without users. It’s time to look at the big picture when it comes to cybersecurity. In addition to dealing with every new risk, vulnerability and attack vector that comes along, cybersecurity pros need to understand their own fellow employees - how they think, how they learn and what they really want. The human element — the individual and social factors that…

4 min read

Detecting Insider Threats: Leverage User Behavior Analytics

3 min read - Employees often play an unwitting role in many security incidents, from accidental data breaches to intentional malicious attacks. Unfortunately, most organizations don’t have the right protocols and processes to identify potential risks posed by their workforce. Based on a survey conducted by SANS Institute, 35% of respondents said they lack visibility into insider threats, while 30% said the inability to audit user access is a security blind spot in their organizations. In addition, the 2023 X-Force Threat Intelligence Index reported that…

3 min read

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…

5 min read