In February, researchers at Kaspersky discovered a Windows zero-day that is being used extensively in sophisticated ransomware attacks similar to Common Log File System (CLFS) driver exploits they had seen previously, but turned out to be a zero-day attack, supporting different versions and builds of Windows, including Windows 11:
While the majority of zero-days that we’ve discovered in the past were used by APTs, this particular zero-day was used by a sophisticated cybercrime group that carries out ransomware attacks. This group is notable for its use of a large number of similar but unique Common Log File System (CLFS) driver exploits that were likely developed by the same exploit author. Since at least June 2022, we’ve identified five different exploits used in attacks on retail & wholesale, energy, manufacturing, healthcare, software development and other industries. Using the CVE-2023-28252 zero-day, this group attempted to deploy the Nokoyawa ransomware as a final payload.
We see a significantly increasing level of sophistication among cybercriminal groups. We don’t often see APTs using zero-day exploits in their attacks, and now there are financially motivated cybercriminal groups that have the resources to acquire exploits for unknown vulnerabilities and routinely use them in attacks.
Microsoft released a patch for this vulnerability (CVE-2023-28252) in this week’s April Patch Tuesday release.
I have a pair of comments on this. Starting with Christopher Peacock, Principal Detection Engineer, SCYTHE:
“This type of activity proves ransomware actors can develop or procure unknown exploits. A zero-day makes placing one piece of a puzzle easier for the adversary and more complicated for defenders to detect. It’s, therefore, necessary for organizations to have holistic defense in depth for all the pieces in the puzzle.”
Jan Lovmand, CTO, BullWall follows up with this:
“Cybercriminals are quicker to exploit zero day vulnerabilities than companies are at deploying patches. The average time to patch these vulnerabilities is more than 60 days for the average enterprise. Once the zero-day fix is announced, cybercriminals know precisely what the vulnerability is and work overtime to write exploits specifically for this.
“If companies think they can prevent every attack, they are mistaken. It is simply a matter of time before a new ransomware variant hits that catches the endpoint security stack by surprise or when a threat actor finds that one lone system on your network that hasn’t been patched.
“To protect against zero-day attacks, companies must be keeping their systems up to date with the latest security patches, use strong and complex passwords, implement MFA, maintain regular backups of critical data and they should consider implementing a rapid containment strategy. Ransomware Containment tools are becoming a critical part of this overall strategy.”
Anyone who has followed this blog will know that I always preach that you should be staying up to date with the latest patches as they stop stuff like this from being hugely problematic. So if you haven’t updated all your Microsoft based PCs, you might want to do so ASAP as the number of threat actors who will be using this vulnerability is about to go up.
PBS Dumps Twitter…. I Wonder In What Immature Way Will Elon Musk React To This?
Posted in Commentary with tags Twitter on April 13, 2023 by itnerdYesterday, I wrote about NPR dumping Twitter because Elon Musk slapped a “government-funded media” label on their Twitter account. At the time, I said this:
This could be the start of other news organizations dumping Twitter. Which will add to the death spiral that Twitter is already in as nobody wants to go someplace where there is no content to view. Perhaps Elon should have thought about that before he decided to slap “government-funded media” labels on both NPR and BBC.
Today, we have PBS announcing that it will be dumping Twitter as well:
The public broadcaster joined NPR in saying it is no longer interested in sharing its content on the platform, after owner Elon Musk slapped a “government-funded” label on its account, which carries more than 2 million followers.
“PBS stopped tweeting from our account when we learned of the change and we have no plans to resume at this time,”a spokesman for the outlet told The Hill. “We are continuing to monitor the ever-changing situation closely.”
Well, that’s going to sting. And it validates that this is going to be one of those situations where you’re likely to see other news outlets do the same thing. But that’s over the medium to long term. In the short term, I wonder how Elon will react to this. In his typical immature way, he posted this Tweet after NPR dumped Twitter:
I fully expect something equally as immature from Elon at any time. Which shows you what type of person he is.
Leave a comment »