Multiple Hacker Groups Exploit 3-Year-Old Vulnerability to Breach U.S. Federal Agency

Various threat actors, including a nation-point out team, exploited a critical a few-yr-outdated security flaw in Development Telerik to split into an unnamed federal entity in the U.S.

The disclosure arrives from a joint advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-State Info Sharing and Examination Centre (MS-ISAC).

“Exploitation of this vulnerability authorized malicious actors to correctly execute distant code on a federal civilian executive branch (FCEB) agency’s Microsoft Internet Info Companies (IIS) web server,” the businesses claimed.

The indicators of compromise (IoCs) affiliated with the digital break-in ended up recognized from November 2022 by means of early January 2023.

Tracked as CVE-2019-18935 (CVSS rating: 9.8), the issue linked to a .NET deserialization vulnerability affecting Development Telerik UI for ASP.NET AJAX that, if still left unpatched, could lead to remote code execution.

It’s really worth noting listed here that CVE-2019-18935 has previously observed a position between some of the most normally exploited vulnerabilities abused by many threat actors in 2020 and 2021.

CVE-2019-18935, in conjunction with CVE-2017-11317, has also been weaponized by a menace actor tracked as Praying Mantis (aka TG2021) to infiltrate the networks of community and non-public companies in the U.S.

Very last thirty day period, CISA also added CVE-2017-11357 – a further distant code execution bug influencing Telerik UI – to the Regarded Exploited Vulnerabilities (KEV) catalog, citing proof of energetic exploitation.

Risk actors are mentioned to have leveraged the flaw to add and execute malicious dynamic-connection library (DLL) data files masquerading as PNG images by using the w3wp.exe system.

The DLL artifacts are built to obtain procedure info, load added libraries, enumerate information and processes, and exfiltrate the data back to a remote server.

WEBINARDiscover the Concealed Potential risks of 3rd-Party SaaS Apps

Are you mindful of the pitfalls affiliated with third-party application accessibility to your firm’s SaaS apps? Be part of our webinar to find out about the sorts of permissions becoming granted and how to limit risk.

RESERVE YOUR SEAT

Yet another set of attacks, observed as early as August 2021 and most likely mounted by a cybercriminal actor dubbed XE Team, entailed the use of aforementioned evasion procedures to sidestep detection.

These DLL documents dropped and executed reverse (distant) shell utilities for unencrypted communications with a command-and-manage area to drop more payloads, like an ASPX web shell for persistent backdoor obtain.

The web shell is outfitted to “enumerate drives to send, get, and delete files and to execute incoming instructions” and “incorporates an interface for quickly browsing files, directories, or drives on the technique, and makes it possible for the consumer to add or download information to any directory.”

To counter these types of attacks, it can be encouraged that corporations enhance their cases of Telerik UI ASP.NET AJAX to the latest edition, employ network segmentation, and enforce phishing-resistant multi-factor authentication for accounts that have privileged obtain.

Located this post appealing? Observe us on Twitter  and LinkedIn to read through extra distinctive content we write-up.

Some elements of this report are sourced from:
thehackernews.com