July 29, 2019 By David Bisson 3 min read

Last week in security news, a U.S. company announced that its penetration tool had incorporated a fully working exploit for the BlueKeep vulnerability. This discovery came around the same time that researchers observed a new version of a cryptocurrency-mining botnet using a BlueKeep RDP protocol vulnerability scanner module. Plenty of other malware- and ransomware-related stories broke during the week as well.

Top Story of the Week: A Commercially Available BlueKeep Exploit

On July 23, Immunity Inc. announced that it had integrated a fully functional BlueKeep exploit into its CANVAS v7.23 penetration testing toolkit. This development made it possible for pen testers to begin abusing the BlueKeep module to open a shell on infected remotes and thereby achieve remote code execution (RCE).

According to ZDNet, the creation of the new module marked the first time that a BlueKeep exploit became available to even a limited audience. The availability of the exploit wasn’t extensive at the time of its release, since licenses for CANVAS range from thousands to tens of thousands of dollars. Even so, ZDNet noted that digital attackers are known to pirate or outright purchase penetration testing software to give an edge to their future attack campaigns.

Source: iStock

Also in Security News

  • Attackers Impersonate BSI to Distribute Sodinokibi Ransomware: The Bundesamt für Sicherheit in der Informationstechnik (BSI), Germany’s Federal Office for Information Security, revealed on July 24 that digital attackers had used the email address meldung@bsi-bund[dot]org to send out messages falsely warning of compromised data. In actuality, these malicious emails contained Sodinokibi ransomware as their payload.
  • Phishers Set Sights on Office 365 Admin Accounts: Digital attackers sent out fake alerts to administrators informing them that their organization’s Office 365 licenses had expired. In those cases where recipients fell for the ruse and clicked a fake sign in link, the campaign redirected them to a phishing page specifically designed to steal their admin credentials.
  • New Version of WatchBog Sporting BlueKeep Scanner: WatchBog, a cryptocurrency-mining botnet that’s been operational since late 2018, implemented a BlueKeep RDP protocol vulnerability scanner module in one of its newer variants. Intezer noted that this change could signal that the operators of WatchBog are building a list of vulnerable systems for future attacks.
  • MegaCortex Uses Aggressive Wording in Ransom Note: A sample of MegaCortex ransomware didn’t use its ransom note to assuage its victims’ concerns. Instead, it urged victims to not “waste our and your time” and to remember that the malware’s handlers “don’t do charity.”
  • FIN8’s Evolving Tool Sets Broaden to Include BADHATCH: In its tracking of the FIN8 threat group, Gigamon observed that the actor had added BADHATCH to its list of evolving tool sets. Further analysis revealed that BADHATCH, a previously unknown tool, bolstered attackers’ arsenals with file transfer and remote shell functionality.
  • Fake FaceApp Installations Spreading MobiDash Malware: Security researchers received reports that FaceApp installations from unofficial sources infected devices with MobiDash malware. These analysts weren’t able to determine how many infections occurred in all, but they did report at least 500 individual compromises within a 48-hour period starting on July 19.
  • Malvertising Campaign Abusing WordPress Weaknesses: WordFence came across a malvertising campaign that abused a few known WordPress vulnerabilities to inject JavaScript into the front end of a victim’s site. This code executed whenever a user visited the site and redirected them to other locations harboring threats such as tech support scams and malicious Android APKs.

Security Tip of the Week: Embrace a Vulnerability Management Program

A couple of months before news of the first BlueKeep exploit became available, Microsoft didn’t mince words in urging system admins to patch vulnerable machines. The company explained that the threat level was too great to do nothing:

“…the vulnerability is ‘wormable’, meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017. While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware.”

To defend against BlueKeep-based attacks, security professionals need to embrace a comprehensive vulnerability management program through which they can prioritize known weaknesses and focus their patching efforts. Toward that end, organizations should break down cybersecurity silos so that IT and security professionals can work together to defend against vulnerabilities such as BlueKeep.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today