|
|
Activity profile: Lace Tempest exploits SysAid zero-day vulnerability. Beginning October 27, 2023, Microsoft Threat Intelligence observed the ransomware group Lace Tempest (DEV-0950) performing attacks on servers running the SysAid IT automation software, where Lace Tempest issued commands via the SysAid software to deliver a malware loader. Microsoft notified SysAid of the activity, who investigated and determined that there was a zero-day vulnerability in the SysAid on-premises software. SysAid quickly released an update addressing CVE-2023-47246, a path traversal vulnerability. |
| |
Vulnerability profile: CVE-2023-46604 vulnerability in Apache ActiveMQ. CVE-2023-46604 is a critical vulnerability in Apache ActiveMQ, an open-source message broker. Exploitation could allow remote attackers to launch commands. Public exploitation code is available, and Microsoft Threat Intelligence and other security researchers have identified attacks exploiting this vulnerability to deliver HelloKitty ransomware. |
| |
Vulnerability profile: CVE-2023-36033 in Windows Desktop Window Manager. CVE-2023-36033 is an elevation of privilege vulnerability in the Windows Desktop Window Manager (DWM) Core Library. This vulnerability could allow an adversary with access to a vulnerable environment to gain unauthorized privileged access. Microsoft released a patch on November 14, 2023. |
| |
Tool profile: Impacket. Impacket is a collection of open-source Python classes designed for working with network protocols. This tool is maintained by Fortra’s Core Security and has become popular with adversaries due to ease of use and wide range of capabilities. |
| |
Actor profile: Pearl Sleet. The actor Microsoft tracks as Pearl Sleet (LAWRENCIUM) is a nation state activity group based out of North Korea that has been active since at least 2012. Pearl Sleet is known to primarily target defectors from North Korea, digital, print and broadcast media, and religious organizations, particularly in East Asia. |
| |
Vulnerability profile: CVE-2023-22518 vulnerability in Atlassian Confluence Server and Data Center. In early November 2023, Microsoft researchers observed the exploitation of CVE-2023-22518, a pre-authentication vulnerability that affects all unpatched versions of Atlassian Confluence Server and Data Center. Multiple adversaries have successfully exploited this vulnerability, including Storm-0062 – an actor Microsoft tracks that has previously been known to attempt exploiting Confluence vulnerabilities. |
| |
Actor profile: Storm-0365. The actor that Microsoft tracks as Storm-0365 (DEV-0365) is an infrastructure as a service (IaaS) layer directly managed by, or is in a business relationship with, Periwinkle Tempest (also known as Trickbot LLC) for use as command and control (C2) domains and servers. |
| |
Activity profile: Diamond Sleet supply chain compromise distributes a modified CyberLink installer. Microsoft Threat Intelligence detected a malicious variant of an application developed by the multimedia software company CyberLink Corp being downloaded from CyberLink’s infrastructure. The malicious file, detected as LambLoad, was developed by the North Korea-based threat actor Microsoft tracks as Diamond Sleet (ZINC). |
| |
Activity profile: Iranian MOIS operators opportunistically deploy limited-impact wiper in response to Israel-Hamas war. In late October 2023, operators associated with Storm-0842, an Iran-based group with ties to the Ministry of Intelligence and Security (MOIS), deployed a destructive payload known as the Bibi wiper, in an Israeli organization. This organization was previously compromised by Storm-0861, another Iranian group with ties to the MOIS, suggesting these groups might have collaborated. Storm-0842’s use of the Bibi wiper appeared to be part of an opportunistic attack with limited impact. |
| |
Actor profile: Hazel Sandstorm. Hazel Sandstorm is a composite name used to describe several subgroups of activity assessed to have ties to Iran’s Ministry of Intelligence and Security (MOIS), the primary civilian intelligence agency in Iran. Hazel Sandstorm operators are known to pursue targets in the public and private sectors in Europe, the Middle East, and North America. In past operations, Hazel Sandstorm has used a combination of custom and commodity tools in their intrusions, likely as a means of gathering intelligence to support Iranian national objectives. |
