A Zero-Day Vulnerability Emerges in Google Chrome

New Google Chrome Zero-Day Vulnerability

Overview

The vulnerability tracked as CVE-2022-2856 is a high-severity issue. The flaw has been described as a case of insufficient validation of untrusted input in Intents. This issue which was reported by Ashley Shen and Christian Resell of Google Threat Analysis Group on 2022-07-19, is the 5th zero-day bug in 2022 for Google Chrome.

(ref. www.bleepingcomputer.com/news/security/google-fixes-fifth-chrome-zero-day-bug-exploited-this-year/)

Recommended Actions for A Zero-Day Vulnerability

Google recommends to update Chrome to the latest version.

Apple New High-Severity Flaws Are Actively Exploited

Overview

Apple urges the iPhone, iPad and MacOS users to update immediately their devices with the latest software versions. The new zero-day vulnerabilities could allow an attacker to gain full administrator rights of a device by exploiting kernel and webkit bugs. In the latest Apple security update, the company says that he new flaws which are tracked as CVE-2022-32894 and CVE-2022-32893, might have been actively exploited.

(ref. https://www.cnn.com/2022/08/18/tech/apple-security-vulnerability-iphone-ipad-mac/index.html)

Recommended Actions for A Zero-Day Vulnerability

It is recommended to apply the latest software versions immediately. (ref. https://support.apple.com/en-us/HT213412)

Microsoft Disrupts SEABORGIUM’s Ongoing Phishing Operations

Overview

Microsoft describes the threat as a highly persistent threat actor that originates from Russia, with objectives and victimology that align closely with Russian state interests. SEABORGIUM’s tactic is to slowly infiltrate targeted organizations’ social networks through constant impersonation, rapport building, and phishing to deepen their intrusion. Since the beginning of 2022, Microsoft has observed SEABORGIUM campaigns targeting over 30 organizations, in addition to personal accounts of people of interest. The ability to detect and track the threat actors’ tactics and IOCs has enabled Microsoft to disable accounts used by the actor for reconnaissance, phishing, and email collection. Microsoft Defender SmartScreen has also implemented detections against the phishing domains represented in SEABORGIUM’s activities.

(ref. https://thehackernews.com/2022/08/microsoft-warns-about-phishing-attacks.html)

Indicators Of Compromise (IOCs)

Indicator	Type	Confidence
cache-dns[.]com	Domain name	High
cache-dns-forwarding[.]com	Domain name	High
cache-dns-preview[.]com	Domain name	High
cloud-docs[.]com	Domain name	High
document-forwarding[.]com	Domain name	High
goo-link[.]online	Domain name	High
y-ml[.]co	Domain name	High

Advanced Hunting Queries for Microsoft Sentinel https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/SEABORGIUMDomainsAugust2022.yaml

Advanced Hunting Queries for Defender365 https://github.com/Azure/Azure-

Sentinel/blob/master/Hunting%20Queries/Microsoft%20365%20Defender/Campaigns/SEABORGIUMDomainIOCsAug2022.yaml

Recommended Actions for A Zero-Day Vulnerability

Check your Office 365 email filtering settings to ensure you block spoofed emails, spam, and emails with malware.

Configure Office 365 to disable email auto-forwarding.

Use the included indicators of compromise to investigate whether they exist in your environment and assess for potential intrusion. Review all authentication activity for remote access infrastructure, with a particular focus on accounts configured with single factor authentication, to confirm authenticity and investigate any anomalous activity.

Require multifactor authentication (MFA) for all users coming from all locations including perceived trusted environments, and all internet-facing infrastructure–even those coming from on-premises systems.

Leverage more secure implementations such as FIDO Tokens, or Microsoft Authenticator with number matching. Avoid telephony-based MFA methods to avoid risks associated with SIM-jacking.

(ref. https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/)

Call-Back Social Engineering Techniques On the Rise

Overview

Ex-members of the infamous group Conti have been adopting call-back phishing tactics as the primary method to gain initial access. Bazar-call is a popular call-back method which was first seen in 2021. This attack tries to convince the victims to call back the hackers by sending them fake subscription notices and start a Zoho remote session with them. Once the remote session is successful, the threat actors are able to install malicious software and intrude further into the network. The cyber intelligence firm AdvIntel reports that they have found evidence of three groups, all part of the former Conti ransomware operation, that used BazarCall or a version of those tactics: Silent Ransom Group, Quantum, and Roy/Zeon.

(ref. https://www.bleepingcomputer.com/news/security/ransomware-gangs-move-to-callback-social-engineering-attacks/)

Recommended Actions for A Zero-Day Vulnerability

Please educate your users about social engineering attacks.

Investigate DNS requests from remote access tooling such as Zoho.

Palo Alto Networks: New high severity flaw

Overview

Palo Alto Networks recently issued a security advisory regarding an actively exploited vulnerability in the wild. This newly discovered flaw, identified as CVE-2022-0028 (CVSS v3 – 8.6), impacts the operating system utilized in the company’s networking hardware products.This bug is a URL filtering policy misconfiguration that could allow an unauthenticated, remote attacker to carry out amplified TCP denial-ofservice (DoS) attacks.

(ref. https://www.bleepingcomputer.com/news/security/palo-alto-networks-new-pan-os-ddos-flaw-exploited-in-attacks/) The PAN-OS versions vulnerable to this vulnerability are the following: