This week, we explore the new Akira ransomware advisory and provide insights on three critical vulnerabilities.
Per the advisory, as of January 1, 2024, Akira has already claimed about $42 million in ransomware payments. Based on Akira's ransomware-as-a-service (RaaS) infrastructure, and their encryptor's ability to target Windows, Linux, and VMware ESXi hosts, they have the ability to compromise a wide range of targets across almost every industry vertical.
To gain initial access into their target environment, Akira relies heavily on remote exploitation of VPN devices. They target VPNs that do not have multifactor authentication enabled and most commonly attempt to exploit known Cisco vulnerabilities, CVE-2020-3259 and CVE-2023-20269.
Akira has also been observed using external services such as Remote Desktop Protocol (RDP), spear phishing (social engineering), and valid (stolen) credentials for initial access.
After gaining initial access, Akira will quickly create new administrator accounts to establish persistence.
Of note, Akira has been observed on several occasions to create an admin account named 'itadm'.
Once persistence has been established, Akira leverages a variety of basic techniques and tools to further elevate privileges and move laterally through the network.
Akira has been observed using Kerberoasting to grab credentials out of memory, as well as popular open-source tools such as Mimikatz and LaZagne.
Akira uses SoftPerfect and Advanced IP Scanner to enumerate the internal network and uses the built-in Windows 'net' command to discover domain controllers and identify trust relationships.
While Akira has had wide-ranging success over the last year, the group does not use any tool or technique that would be considered 'advanced' or novel. Their TTPs provide a variety of detection and prevention opportunities.
protocol:(rdp OR ftp)
http.host:(*.anydesk.com) OR dns.host:(*.anydesk.com) OR destination port:6568
\*.host:(*.mega.nz OR *.mega.co.nz OR *.mega.io)
\*.host:(cfargotunnel.com OR *.cfargotunnel.com)
\*.port:[21114 TO 21119] AND protocol:(tcp OR udp)
Additional Resources
Here are the latest critical vulnerabilities we think you should know about:
Palo Alto Networks released a security bulletin detailing a new critical command injection vulnerability in their PAN-OS software, tracked as CVE-2024-3400 which carries a maximum CVSS score of 10.0. According to the advisory, this vulnerability has been under active exploitation. Proof-of-concept exploit code has also been published in the wild. Successful exploitation of this flaw allows for a threat actor to execute arbitrary code with root privileges on the device.
The vulnerability only affects certain versions of PAN-OS when both GlobalProtect gateway and device telemetry are enabled. Affected versions are:
Per the Palo Alto advisory, administrators can verify if the GlobalProtect gateway is configured by checking in the firewall web interface (Network > GlobalProtect > Gateways). Device telemetry features can also be verified in the web interface (Device > Setup > Telemetry).
The patch for this vulnerability has been published by Palo Alto. Administrators are urged to apply this patch as soon as possible.
There are several mitigation steps that can be taken if the patch cannot be applied immediately. Palo Alto customers with the Threat Prevention subscription enabled can block attacks for the vulnerability by enabling Threat ID 95187. Additionally, those customers must ensure vulnerability protection has been applied to their GlobalProtect interface to prevent exploitation on their device. Additional information for this can be found here.
Additional Resources
Among the 441 security patches released by Oracle across a wide range of their products, is a severe vulnerability in Oracle WebLogic Server. Successful exploitation of this vulnerability, CVE-2024-21006, allows an unauthenticated attacker with network access to compromise the server. The vulnerability affects versions 12.2.1.4.0 and 14.1.1.0.0. While the exploitation of this vulnerability is not complex, it does require network access via T3 (a proprietary Oracle/WebLogic protocol) and IIOP (Internet Inter-ORB Protocol, used for facilitating communication between distributed programs written in different programming languages). Administrators are urged to patch as soon as possible, as well as review the Oracle security bulletin for patches of other Oracle products.
On April 17, Cisco released a patch for a high-severity vulnerability in the CLI of their Integrated Management Controller (IMC). This vulnerability, tracked as CVE-2024-20295, is a command injection privilege escalation vulnerability that can allow the threat actor to gain root privileges on the device due to insufficient validation of user input. Per the advisory, the following products are affected if they are running vulnerable IMC versions in default configurations:
Additional products may be affected if they expose access to the Cisco IMC CLI. The full list can be found in the Cisco advisory here. Proof-of-concept exploit code has been observed in the wild. Administrators are urged to patch as soon as possible.
Stay updated with PacketWatch's cybersecurity content by subscribing to our monthly newsletter, delivered to your inbox on the last Tuesday of the month.
PacketWatch publishes this report and other cybersecurity threat intel to the security community for free via our blog.
If you want personalized threat intel, contact us today to learn about our enterprise threat intelligence services.
Note: We've also enriched our original threat intelligence report by including resources from our partner in cyber threat intelligence, SOCRadar. You may need a registered SOCRadar account to view their threat intelligence resources.
DISCLAIMER
Kindly be advised that the information contained in this article is presented with no final evaluation and should be considered raw data. The sole purpose of this information is to provide situational awareness based on the currently available knowledge. We recommend exercising caution and conducting further research as necessary before making any decisions based on this information.