- Written by Ari Denial Cybersecurity & Tech Writer
Microsoft has reported that Iranian nation-state groups are actively exploiting a critical vulnerability discovered in PaperCut print management software. The threat intelligence team at Microsoft observed the involvement of Mango Sandstorm (Mercury) and Mint Sandstorm (Phosphorus) in leveraging the CVE-2023-27350 flaw to gain initial access in their operations.
Microsoft noted that Mint Sandstorm demonstrated the ability to quickly incorporate proof-of-concept exploits into their operations, while Mango Sandstorm relied on tools from previous intrusions to connect to their command and control infrastructure.
Microsoft has identified connections between Lace Tempest, FIN11, TA505 cybercrime gangs, and the Clop ransomware operation in recent attacks. Additionally, Microsoft found that some of these intrusions resulted in LockBit ransomware attacks, although further details were not provided. The Cybersecurity and Infrastructure Security Agency (CISA) included the PaperCut vulnerability (CVE-2023-27350) in its list of actively exploited vulnerabilities. Federal agencies were ordered to secure their PaperCut servers within three weeks.
This vulnerability is a critical remote code execution bug in PaperCut MF or NG versions 8.0 or later and does not require authentication. PaperCut’s enterprise printing management software is widely used by large companies, state organizations, and educational institutions worldwide. The software claims to have over 100 million users across more than 70,000 companies, making it a significant target for attackers.
Researchers quickly released PoC exploits for the RCE bug disclosed in March 2023, and Microsoft later warned that Clop and LockBit ransomware groups were using it to gain initial access to corporate networks. Despite indicators of compromise and detection rules from multiple cybersecurity companies, VulnCheck revealed a new attack method that bypasses existing detections, allowing uninterrupted exploitation of CVE-2023-27350.
It is crucial for defenders to develop robust and comprehensive detections that cannot be easily evaded, as attackers learn from publicly available detection methods. To eliminate the RCE bug and mitigate the associated attack vector, defenders are strongly recommended to promptly upgrade their PaperCut MF and PaperCut NG software to versions 20.1.7, 21.2.11, and 22.0.9 or newer.
Cactus Ransomware Develops New Tactic to Outsmart Antivirus Software by Encrypting Itself
- Written by Ari Denial Cybersecurity & Tech Writer
According to a report by Kroll, cybersecurity researchers have identified a new strain of ransomware called CACTUS that uses known vulnerabilities in VPN appliances to infiltrate targeted networks. Once inside, the ransomware attempts to identify local and network user accounts and endpoints before creating new user accounts and deploying the ransomware encryptor using custom scripts and scheduled tasks.
Kroll investigators have reported that the Cactus ransomware uses encryption to protect its binary and prevent detection. The ransomware uses a batch script to extract the binary with 7-Zip and deploy it with a specific flag for execution.
Kroll researchers have revealed that the Cactus ransomware evades detection and bypasses antivirus and network monitoring tools by using a unique AES key that is hardcoded into its binary. The ransomware has three execution modes and uses the AES key to decrypt the configuration file and RSA key required for file encryption.
Running the binary with the correct key for the -i encryption parameter enables the ransomware to start a multi-thread encryption process and search for files. A diagram has been created by Kroll to demonstrate how the Cactus ransomware binary executes depending on the selected parameter.
According to ransomware expert Michael Gillespie, the Cactus ransomware uses multiple file extensions depending on the processing state of the file. Before encryption, the extension is changed to .CTS0, and after encryption, it becomes .CTS1. Cactus also has a quick mode, which results in the same file being encrypted twice and appending a new extension after each process. In various incidents involving the Cactus ransomware, Kroll has noticed that the number at the end of the .CTS extension differs.
A threat actor gained access to a network and maintained persistent access through an SSH backdoor connected to a command and control (C2) server. The attacker used SoftPerfect Network Scanner to find targets, PowerShell commands to gather information, and a modified version of PSnmap Tool for deeper reconnaissance.
