This week we briefed our clients on how to detect and prevent Zloader malware and combat Citrix NetScaler password spray attacks.
KEY TAKEAWAYS
Researchers from Zscaler's Threatlabz recently published detailed research on the latest variant of ZLoader. Zloader is a trojan that is derived from the leaked source code of the infamous Zeus banking trojan. This malware is now used primarily for initial access, allowing threat actors to gain a foothold in their target environment which can then be further leveraged to deploy ransomware. Zloader is a popular initial access tool for the Black Basta ransomare gang.
How is it Delivered?
Initial access brokers that use Zloader have shifted to more focused, personalized social engineering attacks to trick users into installing the malware. These attacks go beyond a well-crafted spearphishing email and will include targeted phone calls to build rapport with the target. During these calls, the threat actor will first convince the user to establish a remote access session using a common Remote Monitoring and Management (RMM) tool such as AnyDesk, TeamViewer, or Microsoft Quick Assist. Once this RMM session is established, the threat actor will then deploy an additional piece of malware known as GhostSocks, which facilitates the download and installation of Zloader. This attack chain is shown in the image below:
Fig 1. Zloader Infection Chain | Source: Zscaler
Detection and Prevention Strategies
The report highlights several details and behaviors of Zloader that can be used for detection and prevention opportunities:
Resources:
Citrix Cloud Software group issued a blog highlighting an increase in password spray attacks against NetScaler and NetScaler Gateway devices. Password spray attacks differ from traditional brute-force attacks, where instead of targeting a single account with many passwords, the threat actor targets many accounts with a small set of common passwords. While typically these types of attacks have a low enough volume to go unnoticed by many security tools or alerting rules, the volume observed with these attacks was high enough to cause performance issues and even cause devices to crash. These observed attacks originated across a broad range of dynamic IP addresses, which makes traditional blocking strategies ineffective. Additionally, these attacks mostly target "pre-nFactor" endpoints.
Citrix has the following recommendations to combat these attacks:
Resources:
Vulnerability Roundup
As part of Microsoft's December Patch Tuesday release, they disclosed a critical remote code execution (RCE) vulnerability in the Windows LDAP service, tracked as CVE-2024-49112. Per the advisory, this vulnerability can be successfully exploited via a specially crafted set of LDAP calls, which leads to code execution in the context of the LDAP service, which runs as SYSTEM. Administrators are urged to apply this patch as soon as possible. If unable to apply the patch immediately, administrators are strongly urged to ensure domain controllers are not exposed to the internet, or not allow inbound RPC from untrusted networks.
Last week, Cleo, a software company that has a suite of file transfer and management products (LexiCom, VLTransfer, Harmony), issued an advisory to address CVE-2024-50623, a vulnerability in their MFT products that allows for unauthenticated remote code execution. Shortly after the patch was released, security researchers from Huntress found that the patch does not fully remediate the issue, and this vulnerability is still being actively exploited in the wild. All versions of Cleo Harmony, VLTrader, and LexiCom before and including 5.8.0.21 are vulnerable. The vulnerability is now tracked as CVE-2024-55956, and Cleo has released a new patch, version 5.8.0.24. Administrators are strongly encouraged to move any internet exposed Cleo systems behind a firewall until the patch is applied.
Earlier this month, Veeam issued a security advisory detailing a vulnerability tracked as CVE-2024-42448, which is a critical RCE vulnerability in the Veeam Service Provider Console affecting version 8.1.0.21337 and all earlier version 8 and 7 builds. Per the advisory, "from the VSPC management agent machine, under the condition that the management agent is authorized on the server, it is possible to perform RCE on the VSPC server machine." There are no known mitigations to this vulnerability; administrators are urged to patch to the latest cumulative patch.
This report is provided FREE to the cybersecurity community.
Visit our Cyber Threat Intelligence Blog for additional reports.
Subscribe to be notified of future Reports:
NOTE
We have enhanced our report with data from SOCRadar. You may need to register to view their threat intelligence content.
DISCLAIMER
Kindly be advised that the information contained in this article is presented with no final evaluation and should be considered raw data. The sole purpose of this information is to provide situational awareness based on the currently available knowledge. We recommend exercising caution and conducting further research as necessary before making any decisions based on this information.