July 29, 2019 By David Bisson 3 min read

Last week in security news, a U.S. company announced that its penetration tool had incorporated a fully working exploit for the BlueKeep vulnerability. This discovery came around the same time that researchers observed a new version of a cryptocurrency-mining botnet using a BlueKeep RDP protocol vulnerability scanner module. Plenty of other malware- and ransomware-related stories broke during the week as well.

Top Story of the Week: A Commercially Available BlueKeep Exploit

On July 23, Immunity Inc. announced that it had integrated a fully functional BlueKeep exploit into its CANVAS v7.23 penetration testing toolkit. This development made it possible for pen testers to begin abusing the BlueKeep module to open a shell on infected remotes and thereby achieve remote code execution (RCE).

According to ZDNet, the creation of the new module marked the first time that a BlueKeep exploit became available to even a limited audience. The availability of the exploit wasn’t extensive at the time of its release, since licenses for CANVAS range from thousands to tens of thousands of dollars. Even so, ZDNet noted that digital attackers are known to pirate or outright purchase penetration testing software to give an edge to their future attack campaigns.

Source: iStock

Also in Security News

  • Attackers Impersonate BSI to Distribute Sodinokibi Ransomware: The Bundesamt für Sicherheit in der Informationstechnik (BSI), Germany’s Federal Office for Information Security, revealed on July 24 that digital attackers had used the email address meldung@bsi-bund[dot]org to send out messages falsely warning of compromised data. In actuality, these malicious emails contained Sodinokibi ransomware as their payload.
  • Phishers Set Sights on Office 365 Admin Accounts: Digital attackers sent out fake alerts to administrators informing them that their organization’s Office 365 licenses had expired. In those cases where recipients fell for the ruse and clicked a fake sign in link, the campaign redirected them to a phishing page specifically designed to steal their admin credentials.
  • New Version of WatchBog Sporting BlueKeep Scanner: WatchBog, a cryptocurrency-mining botnet that’s been operational since late 2018, implemented a BlueKeep RDP protocol vulnerability scanner module in one of its newer variants. Intezer noted that this change could signal that the operators of WatchBog are building a list of vulnerable systems for future attacks.
  • MegaCortex Uses Aggressive Wording in Ransom Note: A sample of MegaCortex ransomware didn’t use its ransom note to assuage its victims’ concerns. Instead, it urged victims to not “waste our and your time” and to remember that the malware’s handlers “don’t do charity.”
  • FIN8’s Evolving Tool Sets Broaden to Include BADHATCH: In its tracking of the FIN8 threat group, Gigamon observed that the actor had added BADHATCH to its list of evolving tool sets. Further analysis revealed that BADHATCH, a previously unknown tool, bolstered attackers’ arsenals with file transfer and remote shell functionality.
  • Fake FaceApp Installations Spreading MobiDash Malware: Security researchers received reports that FaceApp installations from unofficial sources infected devices with MobiDash malware. These analysts weren’t able to determine how many infections occurred in all, but they did report at least 500 individual compromises within a 48-hour period starting on July 19.
  • Malvertising Campaign Abusing WordPress Weaknesses: WordFence came across a malvertising campaign that abused a few known WordPress vulnerabilities to inject JavaScript into the front end of a victim’s site. This code executed whenever a user visited the site and redirected them to other locations harboring threats such as tech support scams and malicious Android APKs.

Security Tip of the Week: Embrace a Vulnerability Management Program

A couple of months before news of the first BlueKeep exploit became available, Microsoft didn’t mince words in urging system admins to patch vulnerable machines. The company explained that the threat level was too great to do nothing:

“…the vulnerability is ‘wormable’, meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017. While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware.”

To defend against BlueKeep-based attacks, security professionals need to embrace a comprehensive vulnerability management program through which they can prioritize known weaknesses and focus their patching efforts. Toward that end, organizations should break down cybersecurity silos so that IT and security professionals can work together to defend against vulnerabilities such as BlueKeep.

More from

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Can memory-safe programming languages kill 70% of security bugs?

3 min read - The Office of the National Cyber Director (ONCD) recently released a new report, “Back to the Building Blocks: A Path Toward Secure and Measurable Software." The report is one of the first major announcements from new ONCD director Harry Coker and makes a strong case for adopting memory-safe programming languages. This new focus stems from the goal of rebalancing the responsibility of cybersecurity and realigning incentives in favor of long-term cybersecurity investments. Memory-safe programming languages were also included as a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today