Last week in security news, a U.S. company announced that its penetration tool had incorporated a fully working exploit for the BlueKeep vulnerability. This discovery came around the same time that researchers observed a new version of a cryptocurrency-mining botnet using a BlueKeep RDP protocol vulnerability scanner module. Plenty of other malware- and ransomware-related stories broke during the week as well.

Top Story of the Week: A Commercially Available BlueKeep Exploit

On July 23, Immunity Inc. announced that it had integrated a fully functional BlueKeep exploit into its CANVAS v7.23 penetration testing toolkit. This development made it possible for pen testers to begin abusing the BlueKeep module to open a shell on infected remotes and thereby achieve remote code execution (RCE).

According to ZDNet, the creation of the new module marked the first time that a BlueKeep exploit became available to even a limited audience. The availability of the exploit wasn’t extensive at the time of its release, since licenses for CANVAS range from thousands to tens of thousands of dollars. Even so, ZDNet noted that digital attackers are known to pirate or outright purchase penetration testing software to give an edge to their future attack campaigns.

Source: iStock

Also in Security News

• Attackers Impersonate BSI to Distribute Sodinokibi Ransomware: The Bundesamt für Sicherheit in der Informationstechnik (BSI), Germany’s Federal Office for Information Security, revealed on July 24 that digital attackers had used the email address meldung@bsi-bund[dot]org to send out messages falsely warning of compromised data. In actuality, these malicious emails contained Sodinokibi ransomware as their payload.
• Phishers Set Sights on Office 365 Admin Accounts: Digital attackers sent out fake alerts to administrators informing them that their organization’s Office 365 licenses had expired. In those cases where recipients fell for the ruse and clicked a fake sign in link, the campaign redirected them to a phishing page specifically designed to steal their admin credentials.
• New Version of WatchBog Sporting BlueKeep Scanner: WatchBog, a cryptocurrency-mining botnet that’s been operational since late 2018, implemented a BlueKeep RDP protocol vulnerability scanner module in one of its newer variants. Intezer noted that this change could signal that the operators of WatchBog are building a list of vulnerable systems for future attacks.
• MegaCortex Uses Aggressive Wording in Ransom Note: A sample of MegaCortex ransomware didn’t use its ransom note to assuage its victims’ concerns. Instead, it urged victims to not “waste our and your time” and to remember that the malware’s handlers “don’t do charity.”
• FIN8’s Evolving Tool Sets Broaden to Include BADHATCH: In its tracking of the FIN8 threat group, Gigamon observed that the actor had added BADHATCH to its list of evolving tool sets. Further analysis revealed that BADHATCH, a previously unknown tool, bolstered attackers’ arsenals with file transfer and remote shell functionality.
• Fake FaceApp Installations Spreading MobiDash Malware: Security researchers received reports that FaceApp installations from unofficial sources infected devices with MobiDash malware. These analysts weren’t able to determine how many infections occurred in all, but they did report at least 500 individual compromises within a 48-hour period starting on July 19.
• Malvertising Campaign Abusing WordPress Weaknesses: WordFence came across a malvertising campaign that abused a few known WordPress vulnerabilities to inject JavaScript into the front end of a victim’s site. This code executed whenever a user visited the site and redirected them to other locations harboring threats such as tech support scams and malicious Android APKs.

Security Tip of the Week: Embrace a Vulnerability Management Program

A couple of months before news of the first BlueKeep exploit became available, Microsoft didn’t mince words in urging system admins to patch vulnerable machines. The company explained that the threat level was too great to do nothing:

“…the vulnerability is ‘wormable’, meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017. While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware.”

To defend against BlueKeep-based attacks, security professionals need to embrace a comprehensive vulnerability management program through which they can prioritize known weaknesses and focus their patching efforts. Toward that end, organizations should break down cybersecurity silos so that IT and security professionals can work together to defend against vulnerabilities such as BlueKeep.