Google said it has tracked 90 zero-day vulnerabilities exploited in the wild in 2025 – a dozen more than in 2024, but lower than 2023's record high of 100.

Of these, 47 targeted end-user platforms and 43 enterprise products, the latter showing an all-time high. Abuse of operating systems was also on the rise, although browser-based exploitation fell to a historical low.

"State-sponsored espionage groups continue to prioritize edge devices and security appliances as prime entry points into victim networks, with just over half of attributed zero-day exploitation by these groups focused on these technologies," the Google Threat Intelligence (GTG) researchers said.

"Commercial surveillance vendors (CSVs) maintained an interest in mobile and browser exploitation, adapting and expanding their exploit chains to bypass more recently implemented security boundaries and other mobile security improvements."

For the first time, in fact, more zero-days were attributed to CSVs than to traditional state-sponsored cyber espionage groups.

Multiple intrusions linked to Brickstorm malware deployment had a range of different objectives, while technology companies were targeted with the aim of stealing valuable IP and furthering the development of zero-day exploits.

Meanwhile, said the team, mobile zero-day discovery have bounced about in recent years, dropping from 17 in 2023 to nine in 2024, before rebounding to 15 in 2025.

China-linked cyber espionage groups were again the most prolific users of zero-day vulnerabilities in 2025, with groups such as UNC5221 and UNC3886 continuing to focus heavily on security appliances and edge devices to maintain persistent access to strategic targets.

And zero-day exploitation by financially motivated threat groups remained much the same, with nine detected.

"Enterprise software and edge devices keep showing up as the highest leverage targets because they sit at key crossroads where access, connections, and control come together. Attackers keep leaning into these surfaces because one successful exploit can deliver initial access, lateral movement, and durable control across a wide set of systems," said Nick Tausek, lead security automation architect at Swimlane.

"Edge devices are especially attractive because they typically provide only partial breadcrumbs like login events, configuration changes, or basic traffic summaries rather than a clear view of what's happening inside the device, leaving gaps in detection and masking the true scale of exploitation."

Michael Jepson, penetration testing manager at CybaVerse, said the continued rise in exploited zero-days highlights a broader issue around how software is built and maintained.

Security, he said, needs to be embedded much earlier in the development lifecycle, with vendors prioritising secure-by-design principles, rigorous code review, and continuous security testing as part of standard engineering practices.

"While vulnerability discovery and disclosure are a normal part of the ecosystem, organisations should not be learning about critical flaws in widely deployed products only after attackers have already begun exploiting them," he said.

Stronger development standards, clearer vendor accountability, and potentially regulatory pressure in some sectors may be necessary to drive improvements in software security."

Tenable CEO Amit Yoran has accused Microsoft of "negligent practices” for its response to security vulnerabilities in a scathing critique of the tech giant. 

Yoran criticized Microsoft’s alleged “lack of transparency” regarding data breaches and security vulnerabilities, suggesting that the company has deliberately kept customers in the dark. 

This criticism focuses specifically on the tech giant’s response to a recent Chinese-backed cyber espionage campaign which targeted senior US government officials. 

The incident enabled threat actors to access officials’ emails, and at the time Microsoft said the attack was part of a targeted campaign against the US. 

Last week, US senator Ron Wyden penned a letter calling Microsoft “negiligent” in its response to the attacks and called on the Justice Department to investigate whether the company’s approach broke the law.

Yoran echoed Wyden’s comments in his broadside against the firm, claiming that the company’s track record on security is “even worse than we thought”. 

“Microsoft’s lack of transparency applies to breaches, irresponsible security practices, and to vulnerabilities, all of which expose their customers to risks they are deliberately kept in the dark about,” he said. 

“What you hear from Microsoft is ‘just trust us’, but what you get back is very little transparency and a culture of toxic obfuscation. 

“How can a CISO, board of directors, or executive team believe that Microsoft will do the right thing given the fact patterns and current behaviors? Microsoft’s track record puts us all at risk. And it’s even worse than we thought,” Yoran added. 

In March this year, Tenable researchers uncovered a vulnerability in Microsoft’s Azure platform that would enable attackers to access applications and sensitive data, such as authentication secrets. 

Yoran pointed to this incident as an example of Microsoft’s alleged negligent practices, noting that it took more than 90 days to implement a “partial fix” after researchers notified the firm. 

“To give you an idea of how bad this is, our team very quickly discovered authentication secrets to a bank,” Yoran said. “They were so concerned about the seriousness and the ethics of the issue that we immediately notified Microsoft.”

“Did Microsoft quickly fix the issue that could effectively lead to the breach of multiple customers' networks and services? Of course not. They took more than 90 days to implement a partial fix – and only for new applications loaded in the service.”

Is Microsoft truly ‘negligent’?

Yoran’s public criticism of Microsoft raises questions over the company’s approach to security in recent years. According to data from Google Project Zero, Microsoft products have accounted for around 42.5% of all zero days discovered since 2014. 

While these statistics might raise eyebrows, the scale of Microsoft’s global footprint does indeed put things into perspective. Microsoft software is used by more than 1.4 billion people globally, including millions of organizations such as US government departments. 

Within that context, Microsoft being responsible for a significant volume of zero days doesn’t point to outright negligence, but more of a byproduct of its size and scope of integration within organizations. 

Jake Moore, global cyber security advisor at ESET, told ITPro that although the firm may seem to be turning a blind eye to known vulnerabilities, critics must remember that updates from vendors large and small are all known to cause issues, not just Microsoft’s. 

“Keeping systems completely secure is a challenging role, if not impossible, but it is best approached using as many layers of defense as possible,” he said. 

“Zero days naturally need vital attention but when attackers strike it can be relentless and often on large swathes making patches that much more difficult to produce, control, and distribute.”

However, Moore added that the length of time between vulnerability disclosure and remediation in the Tenable research should be a cause for concern for organisations.

“Over 100 days is naturally concerning for clients but this is yet another important reminder that no one single security measure will protect entities on their own and multiple defenses are required to remain best protected.”

Apple has released a patch for a number of vulnerabilities including an actively-exploited zero-day vulnerability linked to an ongoing spyware campaign.

The zero-day flaw, tracked as CVE-2023-38606, made it possible for an app to alter the state of a device’s kernel which could allow an attacker to leverage root-level control over a compromised device.

It was reported by researchers at Kaspersky Lab as part of an ongoing effort to uncover a sophisticated attack chain used as a vector in a spyware operation dubbed ‘Operation Triangulation’.

Researchers first reported the spyware in June, after uncovering evidence to suggest that an advanced persistent threat (APT) campaign had been working against Kaspersky staff since 2019.

At the time, it was noted that the spyware arrives through a malicious iMessage. This subsequently activates a payload using a zero-click method, so goes entirely unnoticed by victims.

Apple’s update also introduced fixes to a WebKit remote code execution flaw (CVE-2023-38594), a libxpc vulnerability that could allow an app to obtain root privileges (CVE-2023-38565), and an Apple Neural Engine flaw linked to arbitrary code execution (CVE-2023-38136).

In all, updates were released for:

• Safari 16.6 (macOS Big Sur and macOS Monterey)
• iOS 16.6, iPadOS 16.6 (iPhone 8 and later, all iPad Pro models, iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later)
• iOS 15.7.8 and iPadOS 15.7.8 (all models of iPhone 6s and iPhone 7, 1st generation iPhone SE, iPad Air 2, 4th generation iPad mini, and 7th generation iPod touch
• macOS Ventura 13.5
• macOS Monterey 12.6.8
• macOS Big Sur 11.7.9
• tvOS 16.6 (All models of Apple TV 4K and Apple TV HD)
• watchOS 9.6 (Apple Watch Series 4 and later)

In the weeks since Operation Triangulation was made public, researchers have performed more detailed analyses on the vector and exfiltration implant used by the spyware’s operators. 

The threat actors exploit the zero day (CVE-2023-38606) to gain root privileges on a victim’s iOS device, and then deploy the implant, which Kaspersky dubbed ‘TriangleDB’.

This works to alter or delete files, exfiltrate key files such as certificates or keys, and send precise geolocation data back to the operators. 

Removing the spyware via a factory reset of the phone removes all evidence of the attack, and as it operates in a device’s memory it has proved difficult to track. 

By default, TriangleDB deletes itself after 30 days, though attackers can extend or shorten this period through commands send from their command-and-control (C2) infrastructure.

Researchers also found that TriangleDB’s configuration class contains a method titled ‘populateWithFieldsMacOSOnly’, leading them to warn that future such spyware attacks could occur against macOS devices.

“An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1,” Apple wrote.

The firm stated that the issue has been resolved using an improved state management method, but did not go into further detail on what this entails.

The cyber criminals believed to be behind the MOVEit File Transfer supply chain attack have taken the unusual step of demanding victims contact them first to negotiate extortion payments.

In a broken-English statement published on its deep web blog, Cl0p announced victims have seven days to contact the group to negotiate a payment before their data is posted online.

The approach taken by the group is atypical from most extortion scenarios which usually sees the attackers approach the victims first.

Members of the cyber security industry have speculated that Cl0p, which was blamed for the supply chain attack by Microsoft earlier this week, has ingested too much data for it to identify the company to which it belongs.

“The attackers have chosen to ask their victims to begin negotiation tactics by reaching out initially but this approach deviates from the norm as typically ransom demands are sent to the targeted organizations with a predetermined amount chosen by the hackers,” said Jake Moore, global cyber security advisor at ESET.

”This decision is likely to stem from the overwhelming magnitude of the ongoing hack which is still affecting large numbers of systems worldwide and potentially overpowering the capabilities of Cl0p itself.”

“Sure looks like they can’t keep up with the scale of the hack,” said Dominic Alvieri, cyber security researcher, in a tweet.

Cl0p gave victims a deadline of 14 June to begin negotiations. Failure to contact the attackers will lead to the publication of stolen data, according to the group’s statement.

The information provided was unclear in places. A final deadline of 14 June was given, but it’s not certain if victims can contact Cl0p on the 14th and still benefit from the three-day negotiation window or not.

Cl0p also stated that victims’ chats will be closed and its data then published after ten days of non-productive talks, adding to the confusion around the true absolute final deadline for victims.

The attackers said data belonging to government, city, or police services has already been erased.

“You do not need to contact us. We have no interest to expose such information,” Cl0p said.

The reason for these exceptions is likely rooted in the social pressure placed on cyber criminal operations to not target organizations with shallow pockets and those that operate essential services such as hospitals.

Regardless, experts have advised to remain cautious since cyber criminals have been known to lie in such statements.

“Cl0p claims to have deleted information relating to public sector organizations but from what we have learnt in the past is that we cannot trust the words of cyber criminals and therefore, anyone who believes their data has been stolen must remain on high alert,” said Moore.

“Although it is never advised to pay ransom demands to cyber criminals, there is an inevitable risk that some of the targeted companies will succumb to the pressure. This will only fuel the fire and continue the cycle of this devastating criminal group. 

“It is more important that the companies affected are open and honest with their employees and customers offering support in how to protect themselves and how to spot follow-up phishing and smishing attacks.”

What is the MOVEit cyber attack?

News broke of the exploitation of a zero-day vulnerability in the MOVEit file transfer product, developed by Progress subsidiary Ipswitch, on 31 May.

The application is used by thousands of major organizations across the world, and has already impacted the likes of British Airways, Aer Lingus, the BBC, and UK retailer Boots.

Experts at the time revealed that their telemetry indicated that other victims may include banks and areas of the US government.

The vulnerability, tracked as CVE-2023-34362, has been added to CISA’s known exploited vulnerabilities list which compels federal agencies to apply available patches expeditiously.

Every version of MOVEit Transfer is thought to be affected by the vulnerability and organizations have been urged to apply the patch released last week.

Microsoft Threat Intelligence attributed the supply chain attack to cyber criminal outfit Cl0p, believed to be operating out of Russia.

Cl0p is known for its namesake ransomware as a service (RaaS) but has notoriously adopted a pure extortion approach this year. 

The group is also believed to be behind the attack on Fortra’s GoAnywhere MFT product. 

The exploitation of a vulnerability in the software led to successful attacks on more than 130 organizations, by the group’s own calculations.

Microsoft has named Lace Tempest as the threat group behind attacks on MOVEit Transfer, a service that handles business-critical file transfers for major banks, credit unions, and federal agencies.

Hackers exploited a flaw, tracked as CVE-2023-34362, to obtain access to the database of MOVEit Transfer, a widely-used secure managed file transfer application.

Microsoft Threat Intelligence said the attack pattern matched that of the Lace Tempest group, also known as FIN11, which runs the Cl0p ransomware-as-a-service (RaaS). 

At this stage, the contents of affected databases are unclear as no stolen data has been posted on the dark web.

The hacker group has become known for data theft and extortion through the exploitation of vulnerabilities and deploying ransomware. 

Microsoft researchers matched behaviors from the attacks with those from recent Lace Tempest activity, although it has not detailed its specific evidence for attribution.

The group has exploited similar vulnerabilities in past operations, and Mandiant noted both the MOVEit attackers and FIN11 have made use of data exfiltration web shells.

In attacks observed in the wild, attackers exploited the flaw using SQL injection to escalate their privileges, allowing them to gain access to a victim’s MOVEit Transfer database and exfiltrate or alter files.

Thousands of organizations are understood to use MOVEit Transfer in their operations.

MOVEit Transfer was developed by Ipswitch, a subsidiary of Progress Software Corporation, which released a notice on the breach on May 31.

“Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements,” Progress wrote.

Every version of MOVEit Transfer, including MOVEit Cloud, are thought to be affected by the vulnerability. Progress has released patches for each version, but reports of databases that were compromised in the interim are expected to continue in the coming weeks.

Progress has urged customers to delete .cmdline script files and the file ‘human2.aspx’, remove unauthorized accounts, and analyze logs for large file transfers or access to Azure Blob Storage Keys.

It also recommended MOVEit Transfer users change their firewall settings to block HTTP and HTTPS traffic to the application through ports 80 and 443 until such time as the relevant patch has been applied.

A MOVEit spokesperson told ITPro that the company cut off web access to MOVEit Cloud, sent customers mitigation steps, and launched an investigation after it found the flaw. It re-enabled Cloud and patched both it and MOVEit Transfer within 48 hours.

“We are continuing to work with industry-leading cybersecurity experts to investigate the issue and ensure we take all appropriate response measures," a MOVEit spokesperson told ITPro. 

"We have engaged with federal law enforcement and other agencies with respect to the vulnerability. We are also committed to playing a leading and collaborative role in the industry-wide effort to combat increasingly sophisticated and persistent cybercriminals intent on maliciously exploiting vulnerabilities in widely used software products.

"Additional details are available on our knowledge base articles for MOVEit Transfer and MOVEit Cloud.”

Following the public disclosure of the vulnerability, security teams and system admins across the thousands of firms that use MOVEit to transfer sensitive information have been assessing their vulnerability and taking to forums to compare notes.

“Jack Henry uses MOVEit for almost all their automation and sending of files to thousands of clients banks/credit unions/providers multiple times per day,” wrote one user of the sys admins subreddit.

Cyber security researcher Kevin Beaumont tweeted that according to his analysis, several organizations, including some in banking and the US government, have had data stolen through the attacks.

“MoveIT Transfer is used across the US Government as a recommended solution and all of them were vulnerable (and in many cases still are as many orgs haven’t patched yet),” he wrote.

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2023-34362 to its exploited vulnerabilities list, which compels all federal agencies to apply patches against the flaw by June 23.

Mandiant had previously attributed the attacks to a new threat group it tracked as UNC4857, and predicted that victims were likely to receive ransom emails in coming days.

Researchers noted the similarities between UNC4857 activity and that of FIN11, but did not definitively prove an overlap between the two for lack of evidence.

It found that attacks had been occurring since at least May 27, and identified a web shell dubbed ‘LEMURLOOT’ that the attackers have deployed following exploitation. This is used to download files, generate enumeration commands within MOVEit, pass config data back to attackers, and alter user accounts.

Detection of LEMURLOOT samples on repositories from Germany, Italy, and Pakistan led researchers to suggest that the group has also targeted victims in these countries.

At the time of writing, the vulnerability has not received an official CVSS score. 

“The first step for administrators utilizing MFT should be to patch the vulnerability or take the service offline until it can be patched, especially now that it is public knowledge," Darren Guccione, CEO and co-founder, Keeper Security told ITPro.

"While not every attack can be prevented, steps can be taken to mitigate the access of cybercriminals and minimize impacts on systems, data and operations."

Security researchers have successfully exploited zero-day vulnerabilities found in macOS, Windows, and Tesla software at the Zero Day Initiative’s Pwn2Own conference.

Day one of the 2023 competition, hosted in Vancouver, saw 12 unique zero-day vulnerabilities exploited in Microsoft SharePoint, Windows 11, Adobe Reader, Oracle VirtualBox, Tesla Gateway, and macOS.

Abdul Aziz Hariri of security firm Haboob successfully exploited vulnerabilities in Adobe Reader. Hariri used a six-bug chained exploit to escape the Adobe sandbox and circumvent APIs on macOS, earning a $50,000 prize in the process.

A key talking point on day one of Pwn2Own came when STAR Labs successfully executed a chained exploit against Microsoft SharePoint. The team also hacked Ubuntu Desktop with a previously known vulnerability which saw them scoop a combined prize of $115,000.

Synacktiv secured a $140,000 prize haul - and a Tesla Model 3 - after hacking Apple’s macOS kernel through an elevation of privilege attack as well as a successful vulnerability exploit of Tesla Gateway. This attack saw the team execute a time-of-check to time-of-use (TOCTOU) attack against the Gateway.

Tesla’s Gateway is a system in its Powerwall product which controls a vehicle’s connection to the grid. The Gateway automatically detects outages and provides a “seamless transition” to backup power in the event of an outage.

This isn’t the first time Tesla Gateway has been exploited successfully. In 2020, researchers at security firm Rapid7 highlighted security risks due to the Gateway’s connection to the internet.

Meanwhile, security researcher Marcin Wiazowski used an improper input validation bug to elevate privileges on Windows 11 which saw him secure a $30,000 prize.

Bien Pham rounded off the first day with a successful exploit against Oracle VirtualBox, earning a prize of $40,000.

More to come at Pwn2Own

The annual competition saw $375,000 in prizes awarded over the course of day one, with Justin Childs, head of threat awareness at the Zero Day Initiative, stating that the contest is “well on its way to a million dollars”.

Last year’s contest saw researchers take home more than $1.1 million in winnings after hacking Windows 11 a total of six times and demonstrating three critical Microsoft Teams zero days.

With two more days still to run at Pwn2Own, Childs said there’s much more to come.

This includes demos for zero-day exploits in Microsoft Teams and follow-up attempts on Ubuntu Desktop and Oracle VirtualBox.

Tesla’s Infotainment Unconfined Root will also be in the crosshairs while day three will see additional attempts on Windows 11, Teams, and VMware Workstation.

For IT managers it never ends. In the morning it’s endless tickets about individual desktop issues, then a database isn’t responding, a server goes down, or for some unknown reason backups are failing. Even the most diligent administrator gets hit with a pile of issues, and as always they tend to cluster around the worst times of day like early morning or quitting time.

That’s why many IT managers look to simplify their systems as much as possible. Not only does it make life easier, but it also increases the chance that you won’t be staying late to fix some obscure server issue. Some things just can’t be pared down, of course, but what if we told you edge networking wasn’t one of those things?

Download now to learn more about how Zero Trust Network Access, a dependable Firewall-as-a-Service, and a Secure Web Gateway wrapped up in a single, secure, networking package can get you home in time for dinner.

Provided by

In this webinar you will:

• Learn how Zero Trust can help your organisations' network security
• Understand how Zero Trust solves challenges of modern security deployment
• Discover just how new (or not) the Zero Trust concept is
• Determine the difference between Zero Trust and legacy business VPNs

Provided by

Between the rise in social-engineering attacks and the Biden Administration’s executive order for mandating zero-trust initiatives across government agency networks, demand for zero trust is at an all-time high.

In this webinar, experts discuss the growing importance of zero trust models to the future of cybersecurity. The panel of speakers follow their discussion with a real time demonstration of Perimeter 81’s zero trust offering.

Watch the full webcast to learn more about zero trust initiatives and see how partnering with Perimeter 81 could accelerate your zero-trust journey.

Provided by

Many businesses today are rethinking their network security solutions since the adoption of remote and hybrid work, and considering the multiple cyber security options now available. For the majority, the best solution would be to introduce new elements - like Zero Trust - that can be implemented alongside legacy infrastructure.

This study shares how converged network security - Security Services Edge (SSE) - could be the solution to achieve this, offering integrated cloud-based abilities without compromising existing environments.

Download now for the full results of this study, discover the main challenges in managing network security, including remote access, and realise the numerous drivers for adopting SSE.

Provided by

IT leaders today are tasked with finding innovative ways to secure their remote workforce, with legacy hardware firewall VPNs no longer able to meet today’s security needs. One solution is enterprise level network security with Zero Trust, that enables network access for users to only what they need to perform their roles.

This guide further explains the benefits of a Zero Trust Network Access (ZTNA) security model and how organisations can significantly reduce the level of exposure to cyber attacks and limit unwanted access to their data.

Download now to see how ZTNA compares to On-premise Firewall VPNs, and how it can offer a safer hybrid work environment.

Provided by

Since the global pandemic, the modern workforce has become largely remote in a bid to continue business operations. With more remote devices now accessing the company network from multiple locations, and the adoption of cloud-based collaborative tools, cyber criminals have revelled in exploiting vulnerabilities following this shift.

With employees today determining how they work - the majority opting for remote/hybrid opportunities - this resource can help organisations ensure the security of their remote employees with ten clear cyber security checks.

Download now to learn how to radically simplify your cyber security and discover the tools that can meet the needs of both your remote workforce, and deliver the robust protection your IT teams require.

Provided by

According to a recent study by Perimeter 81, two thirds of the 500 IT professionals they surveyed had experienced a ransomware attack during the course of their career, highlighting just how encompassing ransomware has become. As malicious actors continue to take advantage of zero-day vulnerabilities, the time has come for businesses to ensure they have the tools to counter attacks.

This eBook focuses on practical data to help organisations understand the full implications of a ransomware attack, from the risks associated with hardware VPNs, to how to protect your remote workforce, and shares how to select the best approach to prevent malware, both now and in the future.

Download now to learn the six principles of Zero Trust Network Access (ZTNA), and discover how this key component of Security Services Edge (SSE) can offer your business complete cloud security.

Provided by

In today’s working environments, where many businesses have adopted a hybrid working policy, CISOs have the additional challenge of not only ensuring the security of their internal infrastructure, but also their remote employees. And with cyber threats becoming more sophisticated, it can be difficult to prioritise security networks.

This resource shares five network security practices that CISOs can adopt to mitigate these challenges. From ensuring visibility, to implementing a Zero Trust network, to establishing safety in the cloud, CISOs can ensure they’re covering all security needs.

Download now to learn how there are no shortcuts when it comes to security compliance, and discover a cloud-native network security solution that can keep all networks safe.

Provided by

Every security leader understands the challenges that cloud migration and distributed workforces pose to their corporate network and endpoints, and the importance of moving to a Zero Trust architecture. But the journey to Zero Trust can seem complex and difficult.

This recorded session shares how Cloudflare offers one uniform, composable platform to make this journey extremely simple and effective for organisations of all sizes.

Watch now to discover how joint customers of Cloudflare and CrowdStrike use both platforms to achieve end-to-end protection across endpoints, networks, and applications.

Provided by

One year on from the disclosure of the Log4Shell vulnerability, security researchers are urging businesses to remain vigilant amidst continued threats.

Log4Shell is a zero-day remote code execution vulnerability in Java logger Log4j – the most popular used worldwide.

Log4j is used by a myriad of organisations and woven into virtually every internet service or application, including Twitter, Microsoft, Amazon and many more.

Naturally, when news of the vulnerability broke in December 2021, organisations globally scrambled to patch the Log4j flaw, which security specialists rightly warned could have wide-reaching implications.

Researchers at Check Point recorded almost 200,000 attempts to exploit the vulnerability within just 24 hours of disclosure. Similarly, within the space of a week, hackers launched more than 1.2 million attacks globally off the back of the vulnerability.

In the wake of the disclosure, cyber security firm Sophos also detected “hundreds of thousands of attempts” to remotely execute code using the vulnerability.

Analysis by other organisations, including Cloudflare, even suggested that Log4Shell may have been exploited by threat actors for some time prior to its public announcement.

The continued threat of Log4Shell

And as the world entered the new year, businesses continued to feel the pressure. In February, Iranian state-sponsored threat actors used the flaw to target US government networks.

This particular incident allowed hackers to illegally mine cryptocurrency, steal credentials, and alter passwords.

Indeed, throughout 2022 the impact of the Log4Shell vulnerability was felt. October saw a cybercriminal group with links to the Chinese government capitalise on the flaw to launch attacks on targets in the Middle East and a host of manufacturing companies.

Research published by Tenable in November showed that the problem still lingers. As of October 2022, 72% of organisations still remained vulnerable to Log4Shell – and that includes organisations that initially patched and mitigated threats.

“As of October 2022, 29% of vulnerable assets saw the reintroduction of Log4Shell even after full remediation was achieved,” the company confirmed in a statement.

Deryck Mitchelson, Field CISO at Check Point described Log4j as a “game changer” due to the relative ease with which threat actors could target services and devices around the world.

“It is estimated that 1 in 10 corporate servers were exposed,” he said. “I think it was a wake-up call for an industry that was relatively blasé around the management of open source libraries and their use therein, and were perhaps too trusting of their vendors and the supply chain’s vulnerability.”

What made Log4Shell so impactful?

The impact of Log4Shell was particularly acute due to rapid ease of exploitation. For threat actors, no privileged access was required to exploit the zero day vulnerability.

Similarly, the vast attack surface that could be targeted also exacerbated the situation. Millions of Java applications worldwide were affected.

At the time, security specialists noted that the difficulty in finding bugs and patching would likely cause issues for a significant number of organisations.

Muhammad Yahya Patel, Security Engineer at Check Point said that Log4j acted as a “stark reminder that security needs to underpin all applications and services”.

“Time is of the essence in these situations,” he added. “It forced many companies to review their vulnerability patch policies; any delay could cost them significantly."

Patel said that organisations must remain vigilant and learn from zero-day vulnerabilities to avoid similar situations unfolding in the future.

“Don’t trust open source software without doing your own checks,” he explained. “It is good practice to take open source software and put your security controls around it.”

“Build software code securely right from the start to avoid any surprises in the future, and make sure any changes to the software pass through your security checks.”

Google's cyber security team has identified a zero-day exploit for an Internet Explorer vulnerability that was used to target users in South Korea.

The tech giant’s Threat Analysis Group (TAG) made the discovery in October 2022 and found malware embedded in documents that were emailed to targets. The hidden malware residing in the documents exploited a vulnerability in the browser's JScript engine, tracked as CVE-2022-41128.

TAG attributed the attacks to APT37, a known threat group that is has attributed to North Korean state-sponsored hackers. It said that APT37 has used Internet Explorer zero-days in the past to target users, and tends to focus on those based in South Korea including journalists, human rights activists, and North Korean defectors.

The malware-laden document was titled “221031 Seoul Yongsan Itaewon accident response situation (06:00).docx”, which Google said was attempting to take advantage of public interest in an accident, a Halloween crowd crush, that took place in South Korea in October.

Multiple submitters from South Korea flagged the malware to Google's TAG by uploading this Microsoft Office document to VirusTotal, a website Google owns that analyses suspicious files, domains, or URLs.

Researchers found that the document downloaded a rich text file (RTF) remote template which then went on to fetch HTML content.

“Because Office renders this HTML content using Internet Explorer (IE), this technique has been widely used to distribute IE exploits via Office files since 2017 (e.g. CVE-2017-0199),” said TAG. “Delivering IE exploits via this vector has the advantage of not requiring the target to use Internet Explorer as its default browser, nor to chain the exploit with an EPM sandbox escape.”

“The vulnerability resides within “jscript9.dll”, the JavaScript engine of Internet Explorer, and can be exploited to execute arbitrary code when rendering an attacker-controlled website,” said TAG. “The bug itself is an incorrect JIT optimisation issue leading to a type confusion and is very similar to CVE-2021-34480, which was identified by Project Zero and patched in 2021.”

TAG informed Microsoft of the vulnerability on 31 October 2022, and it was then assigned the CVE-2022-41128 tracking code. Five days later, on 8 November 2022, the vulnerability was patched.

Microsoft has fixed Internet Explorer bugs in the past that were previously exploited by North Korean hackers. The flaw, discovered in March 2021, was used to target security researchers through a memory corruption vulnerability which enabled hackers to run malware on a victim’s PC. It did this by encouraging them to access a malicious website.

In September 2021, Microsoft also had to issue another fix for a zero-day vulnerability embedded in the browser that powers legacy Internet Explorer. It was a remote code execution flaw embedded in the MSHTML browser engine which allowed hackers to create a malicious ActiveX control which was used by a Microsoft Office document hosting the engine. The attackers would then tempt victims into opening the document.

Rackspace's recently confirmed ransomware attack allegedly may have been facilitated by hackers exploiting the company's out-of-date Exchange clusters, according to one researcher.

The cloud computing firm confirmed the attack on 6 December had affected its hosted Microsoft Exchange environment, the fallout from which is causing service disruptions for customers.

It was suggested by security researcher Kevin Beaumont that the cyber criminals were able to launch their attack after exploiting Exchange server clusters that didn't appear to have been patched since August 2022, before the patches for the ProxyNotShell exploit were released.

In his analysis Beaumont added that Exchange log build numbers aren’t always reliable, and the breach could have happened because of other issues.

Microsoft released the patch for the ProxyNotShell vulnerability at the start of November. It implemented fixes for two security issues that affect Microsoft Exchange Server 2013, 2016, and 2019. Attackers were able to escalate privileges to run PowerShell and achieve arbitrary or remote code execution, enabling them to target server accounts. Attackers can then try to trigger malicious code.

“The Microsoft-supplied mitigations for ProxyNotShell are bypassable," said Beaumont. "IIS rewrite, which Microsoft used for mitigations, doesn’t decode all URLs correctly and as such can be bypassed for exploitation. If you relied on the PowerShell mitigation or EEMS application, your Exchange Server is still vulnerable - Microsoft just hasn't told you this clearly. The fix is to patch."

He added that the exploits function without multi-factor authentication as Exchange Server doesn’t support Modern Authentication, due to Microsoft deprioritising this implementation work.

“If you are an MSP running a shared cluster, such as hosted Exchange, it means that one compromised account on one customer will compromise the entire hosted cluster. This is high risk,” said Beaumont.

Scale of the attack

Rackspace believes the attack only affected its hosted Exchange business, and its other products and services are fully operational.

It’s committed to implementing additional security measures and is monitoring its systems for any suspicious activity. It has also hired an incident response firm to investigate the matter, alongside its internal security team.

Rackspace is helping Hosted Exchange customers to migrate their data to a new environment as rapidly as it can, it said. It has increased the amount of support staff it has to help with this and is aiming to help customers through the migration process so that their own operations aren’t impacted as much.

“Although Rackspace Technology is in the early stages of assessing this incident, the incident has caused and may continue to cause an interruption in its Hosted Exchange business and may result in a loss of revenue for the hosted Exchange business, which generates approximately $30 million of annual revenue in the apps and cross-platform segment,” said the company. “In addition, Rackspace Technology may have incremental costs associated with its response to the incident.”

Thousands of companies across the world will feel the consequences of this attack, said Jordan Schroeder, managing CISO at Barrier Networks. He said that it will also underline the duty organisations that store or host business data have to also keep it secure.

“Rackspace also must re-evaluate its defences against ransomware, because when it comes to modern threats, prevention is always better than cure,” said Schroeder. “This involves re-establishing their cyber hygiene baseline, using zero trust principles to limit the impact of breaches by protecting key accounts and preventing lateral movement, and training employees regularly on cybersecurity and the evolving threat landscape.”

The company first reported that the incident began on 2 December, communicating that it was investigating an issue on its hosted Exchange environments.

Hours later, it told customers it was working through an issue with hosted Exchange accounts and that it had proactively shut down the environment to avoid further issues. It also gave customers access to Microsoft Exchange Plan 1 licences on Microsoft 365 as a temporary workaround.

The next day, Rackspace said the issue was a security incident that affected a portion of its hosted Exchange platform. On 4 December, the company said the incident was set to be an extended outage of the hosted Exchange.

It urged customers to move to Microsoft 365, saying this was the best solution. Although it said that it had restored email services to thousands of customers on Microsoft 365, it said that it understood that self-migration wasn't simple and could be challenging to implement.

Google has tied a previously unknown spyware operation to a private company in Spain after receiving an anonymous tip-off regarding the malicious activity.

Its Threat Analysis Group (TAG) said the evidence suggests that Barcelona-based Variston IT has developed an exploit framework which leveraged zero days in Windows Defender, Firefox, and Chrome.

Google said the operation tied to Variston IT had developed the Heliconia framework which itself was split into smaller frameworks that exploited different systems and applications, like Windows and Chrome. The product gives customers all the tools needed to deploy a payload to a target device.

The frameworks included mature source code that could deploy the exploits. The first was Heliconia Noise, a web framework used to deploy an exploit for a Chrome renderer bug, followed by a sandbox escape.

Heliconia Soft was a separate web framework that dropped a malicious PDF to exploit a vulnerability in Windows Defender. The third and final framework was called Files - it consisted of a set of exploits targeting Firefox versions on both Windows and Linux systems.

The three companies targeted in the exploit, Microsoft, Mozilla, and Google, fixed the vulnerabilities in 2021 and early 2022. Google said it hadn’t detected active exploitation of the now-patched vulnerabilities, but instead predicted that they were used as zero-days in earlier attacks.

The tech giant only became aware of the Heliconia framework when it received an anonymous submission to its Chrome bug reporting programme.

“The submitter filed three bugs, each with instructions and an archive that contained source code,” said Google TAG researchers in a blog post. “They used unique names in the bug reports including, ‘Heliconia Noise,’ ‘Heliconia Soft’, and ‘Files'.

"TAG analysed the submissions and found they contained frameworks for deploying exploits in the wild and a script in the source code included clues pointing to the possible developer of the exploitation frameworks, Variston IT.”

Heliconia Noise, for example, leaked the name of the company in a line of code that prevented the framework from generating binaries containing strings such as 'Variston'.

The same for loop in Heliconia Noise's code also leaked the aliases of the developers who worked on the project: majinbuu, janemba, and freezer - all references to characters in the Dragon Ball manga franchise.

Google said that commercial spyware is used by governments to spy on journalists, human rights activists, and political opposition through its advanced surveillance abilities. The tech giant is aiming to disrupt the threat of these types of companies to protect users and raise awareness of the industry, it said.

IT Pro has contacted Variston for comment. It appears to be registered at an address in Barcelona and was founded by Jayaraman Ramanan and Ralf Dieter Wegener in 2018, according to Datos Cif, a Spanish database containing information about companies. Deloitte is also named as its auditor.

Google has patched a zero-day vulnerability in its Chrome browser, the eighth of its kind this year.

The vulnerability was caused by a “heap buffer overflow in GPU”, Google said. Such vulnerabilities can allow attackers to modify the data stored in the application’s heap, potentially altering what data the Chrome Browser outputs.

The exploitation of buffer overflow flaws could also lead to general data corruption within the application, or the manipulation of the Chrome browser’s internal structures.

It has been assigned a severity rating of ‘high’ although a specific CVSSv3 score has not yet been released.

‘High’ severity ratings typically indicate a score in the range of 7.0-8.9 - the second-highest severity classification on the widely used metric.

Google assigned the vulnerability with a CVE for vulnerability tracking and management (CVE-2022-4135) and released the new stable channel version of Google Chrome on Thursday across Windows, macOS, and Linux.

Google said it will be keeping more detailed information on the vulnerability under wraps until more users have had time to install the update.

It will also refrain from releasing further details if the Google Chrome team find the issue to be present in a third-party library on which other applications depend, for example, at least until that library also releases a fix.

The vulnerability was discovered by Clement Lecigne, security engineer at Google’s Threat Analysis Group - its security team primarily devoted to countering government-backed hacking efforts - and Google made no indication that the vulnerability has been actively exploited in the wild.

CVE-2022-4135 marks the eighth zero-day vulnerability found in Google Chrome since the start of 2022 and the second zero-day caused by a heap buffer overflow.

Three of the eight zero-days affecting the world’s most popular browser have been caused by errors in Google’s proprietary and open-sourced JavaScript V8 engine.

Since other major browsers also run on Chromium, such as Microsoft Edge, Opera, Vivaldi, and others, these were also vulnerable because they too relied on Google’s V8 engine.

The full list of Google Chrome zero-day vulnerabilities found in 2022 can be found below:

• CVE-2022-3723
• CVE-2022-3075
• CVE-2022-2856
• CVE-2022-2294
• CVE-2022-1364
• CVE-2022-1096
• CVE-2022-0609

The OpenSSL Project, which runs the widely-used OpenSSL library, has announced it will issue a critical vulnerability patch on 1 November.

The announcement marks the first OpenSSL critical vulnerability patch since 2016, and only the second in the project’s history. Full details of the flaw will be revealed at the time of the patch to reduce the possibility of attackers reverse engineering to develop an exploit.

However, it has already been stated that the vulnerability does not affect versions earlier than OpenSSL 3.0, with the patch forming part of the 3.07 release. This appears to mean that devices which run versions before 3.0, which was released in 2021, should remain unaffected by the vulnerability.

“Given the number of changes in 3.0 and the lack of any other context information, such scouring is very highly unlikely,” said Mark J Cox, former head of product security at Red Hat and one of the co-founders of OpenSSL, responding to a question in his original announcement tweet.

While the 2016 flaw allowed for remote execution of code, it was only active for four days before being caught and patched. In contrast, the newly-announced vulnerability affects all versions after 3.0 which was released in September 2021.

OpenSSL is the most popular open source cryptography library in the world and is used by the majority of HTTPS websites as well as on a range of web servers. As such, a critical vulnerability within its code could represent a serious threat to a wide range of businesses, as well as to individual privacy online.

The OpenSSL Project policy states that in the event of an upcoming patch to a flaw rated ‘critical’ in severity, a warning will be made publicly available to notify users of the exact date and rough time at which the patch will be made available.

Alongside this, select organisations will be given patches early, as well as briefings on the exact nature and seriousness of the flaw.

Some are already drawing comparisons between the upcoming announcement and 2014’s Heartbleed vulnerability, tracked as CVE-2014-0160, which garnered widespread media attention and concern in 2014 as it allowed threat actors to view data on any website utilising OpenSSL.

It is also likely to add to growing fear of using open source solutions amongst companies, especially in the wake of the damaging Log4Shell vulnerability.

“The announcement of the new OpenSSL critical vulnerability immediately brought back not-so-fond memories of Heartbleed or - more recently - the Log4J vulnerability,” said Mattias Gees, container product lead at Venafi.

“Heartbleed had a significant impact on all operations teams worldwide, and since then IT infrastructure has become ten times more complicated. The attack vector has become a lot larger, and rather than just having to examine their VMs, organisations need to start preparing to patch all their container images in response to this announcement.

“We also now know that OpenSSL versions prior to 3.0 are not impacted, and a lot of operating systems use OpenSSL 1.1, so these environments won’t be impacted. This knowledge will allow cybersecurity and operations teams to dismiss large sections of their infrastructure, and hopefully make the impact of this vulnerability smaller than initially expected. But platform engineering teams should keep investing in better auditing of their environments and their dependencies for the next threat, which is always just around the corner.”

What was the Heartbleed vulnerability?

In 2014, security researchers discovered a flaw within the OpenSSL software library, which could be exploited by threat actors in order to track the activity of targets online, as well as serruptiously steal data entered on web pages. At the time of identification, some researchers worried that Heartbleed may have been exploited in the wild since 2012.

This was possible due to a coding error in the ‘heartbeat’ extension within OpenSSL, through which users could test transport layer security (TLS) encryption by sending data (typically a text string) and an integer representing the number of characters in the string to a computer or server device, which would then ‘echo’ the string back exactly.

As it was possible to send a string of a length equivalent to 64 KiB of data, that much memory was reserved for returns using the extension. However, it was discovered that if users only sent a nominal amount of data, but a length figure equal to 64KiB, the computer at the end would echo back the data sent, along with 64-1KiB of data from its memory buffer. This could reveal passwords entered, private server keys, sensitive user cookies — whatever happened to be in the memory at the time of the request.

As a result, threat actors were unable to specify precisely what data they would expose through each attack, but through repeat executions were able to invisibly monitor activity on any website which used OpenSSL, and exfiltrate data without any possibility of detection.

Given the scale at which OpenSSL is used throughout the internet, from financial services to critical backend apps, the Heartbleed vulnerability prompted considerable alarm within the cyber security community. Although a fix was quickly released, the fact that attacks carried out using the vulnerability left no trace made it hard to say for certain just how far reaching its impact was, and whose data has been stolen.

Apple has released an update providing a number of patches for iOS and iPadOS, including one zero-day that “may have been actively exploited".

Tracked as CVE-2022-42827, the zero-day vulnerability was the result of an out-of-bounds write error in the kernel, which could be used by threat actors to execute malicious code on the kernel level.

This could allow for custom, potentially malicious programs to be run on the victim’s device, as well as putting all data on it at serious risk of exfiltration or destruction.

An out-of-bounds write error occurs when a program writes beyond the end of an intended buffer or specified array, and typically results in a crash or corruption of data. If exploited, they can be used to modify system data and execute code on impacted devices remotely.

In its post for the iOS 16.1 and iPadOS 16 security updates, Apple noted that through the flaw an “application may be able to execute arbitrary code with kernel privileges".

Beyond this, the firm offered little detail of the precise nature of the zero-day, in line with its policies on security issues and in accordance with its longstanding approach of providing little detail on security incidents.

“For the protection of our customers, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are generally available,” stated a notice in the update post.

Affected devices include all of its smartphones from iPhone 8 and above, all models of the iPad Pro, iPad Air 3rd generation and above, and iPad and iPad Mini - both 5th generation and above.

Beyond the zero-day, the latest security update also provides patches for 18 other vulnerabilities. Of these, two more were in the kernel, though these are not thought to be actively exploited, while three were in WebKit, Apple’s browser engine which powers Safari.

Other flaws were fixed in the point-to-point protocol (PPP), a TCP/IP protocol used to send data between devices, as well as in core Bluetooth and the GPU drivers.

The patch marks the ninth overall update addressing a zero-day flaw by Apple this year. In September, the tech giant patched a similar kernel vulnerability, which allowed for arbitrary code to be executed with kernel privileges. This vulnerability also affected macOS Monterey, and had been potentially exploited in the wild by the time it was patched.

In August, Apple patched a 'superpower' zero-day affecting WebKit, in which threat actors could use remote code execution (RCE) to alter web pages, which would then run malicious code on Apple devices that visited them.

More recently, earlier this month Apple was forced to release a fix for a denial of service vulnerability, tracked as CVE-2022-22658, affecting iPhones 8 and newer.

Apple said that processing a maliciously crafted message could lead to denial of service and was fixed in its iOS 16.0.3 by improving input validation.

Fortinet has issued an urgent warning to customers advising once again to update devices against a zero-day vulnerability that has been exploited at least once in the wild.

FortiOS, FortiProxy, and FortiSwitchManager are all affected by the zero-day, an authentication bypass flaw which allows threat actors to run operations on a device’s administrative interface. Tracked as CVE-2022-40684, the vulnerability carries a CVSS score of 9.6, and is therefore considered critical.

Before going public with the zero-day on October 10, Fortinet privately contacted the owners of potentially affected devices on October 6, with a list of recommended mitigations. However, the company has said that, at the time of writing, many devices have still not been updated or had mitigations applied, leaving a large number of customers at risk of cyber attacks and opening networks to threats such as malware, ransomware, and data breaches.

FortiProxy OS versions 7.0.0 to 7.2.1 are affected by the flaw, along with FortiProxy versions 7.0.0 to 7.2.0, and FortiSwitchManager 7.0.0 and 7.2.0. In response, the company has released a number of updates, as well as manual workarounds for the three affected services.

“After multiple notifications from Fortinet over the past week, there are still a significant number of devices that require mitigation, and following the publication by an outside party of POC code, there is active exploitation of this vulnerability,” reads Fortinet’s blog post on the update.

“Based on this development, Fortinet again recommends customers and partners take urgent and immediate action as described in the public Advisory.”

The exploit has now been added to the Cybersecurity and Infrastructure Security Agency’s (CISA) ‘known vulnerabilities’ catalogue, which is regularly updated with threats that the agency considers an active threat to federal operations. As a result of being added to the list, federal agencies have until November 1 to patch all Fortinet equipment and apply appropriate mitigations.

“This is a critical vulnerability,” stated Avishai Avivi, CISO at SafeBreach.

“It basically allows the malicious actor to take control of the organisation’s firewall. We join Fortinet in their recommendation. With this being a zero-day vulnerability, we also strongly recommend that organisations take steps to validate their firewall configuration.

"If an attacker manages to take control of the firewall, they can modify the firewall configuration to remove protection, add potential vectors for the attacker to use, and even add users. This is also an important reminder that companies should always keep a backup copy of their firewall configuration files.”

Microsoft has released patches for 96 different vulnerabilities in its monthly Patch Tuesday, but has still failed to address the zero-days dubbed ‘ProxyNotShell’, leaving Exchange Servers at potential risk as the company searches for a solution.

Discovered last month, the pair of zero-day vulnerabilities that comprise ProxyNotShell consists of a server-side request forgery (SSRF) flaw and a remote code execution (RCE) bug that affects Microsoft Exchange versions 2013, 2016, and 2019.

There is evidence threat actors have already used the pair to install the China Chopper web shell on Exchange servers in the wild and Microsoft's attempts to mitigate the attacks have been shrouded in confusion.

Exchange Server customers are still waiting for a full patch to fix the widely discussed exploit, beyond manual mitigations already supplied publicly. Experts told IT Pro that customers may begin to question why a patch has taken so long for such a ubiquitous product.

“With products as complex as Microsoft Exchange, one can empathise with how long it is taking to develop - but that is the cost of doing business and when so many organisations rely on your products for their day-to-day operations, security patches in particular need to be prioritised so that customers are not left vulnerable," said Javvad Malik, lead security awareness advocate at KnowBe4.

Microsoft may also be pursuing fixes for an additional zero-day vulnerability that has supposedly led to a wave of recent LockBit ransomware attacks on Exchange Server customers.

Discovered by cyber security researchers at South Korean firm AhnLab, the company's report indicated that attacks have been observed using web shells to perform privilege escalation and exfiltrate terabytes of data.

Other security researchers have expressed doubt over the lack of evidence used to reinforce claims in the AhnLab report, which is at the time of writing returning a 404 error indicating that it may have been taken down by the researchers following criticism.

“There's a lot going on in this report about LockBit ransomware, and I'm not convinced it's a zero-day (there's no evidence in report), but one to keep an eye on," said researcher Kevin Beaumont in a tweet.

Microsoft has not yet publicly confirmed the vulnerability highlighted in the AhnLab report to be a legitimate zero-day.

Patch Tuesday brings critical fixes

In total, Microsoft patched 96 vulnerabilities this week, notably including two zero-day vulnerabilities. Tracked as CVE-2022-41033 and CVE-2022-41043, these vulnerabilities pertain to the Windows COM+ Event System Service and Microsoft Office respectively.

Of the two, only CVE-2022-41043 has been actively exploited in the wild, which if successfully executed, can expose “user tokens and other potentially sensitive information” to threat actors. Despite no active exploitation being observed, experts have said that CVE-2022-41033 "should be at the top of everyone's list to quickly patch".

"This specific vulnerability is a local privilege escalation, which means that an attacker would already need to have code execution on a host to use this exploit," said Kev Breen, director of cyber threat research at Immersive Labs to IT Pro.

"Privilege escalation vulnerabilities are a common occurrence in almost every security compromise. Attackers will seek to gain SYSTEM or domain-level access in order to disable security tools, grab credentials with tools like Mimkatz and move laterally across the network."

Additionally, 13 critical vulnerabilities have been fixed in the patch. This includes CVE-2022-37968, carrying the highest possible value on the CVSSv3.1 severity scale with a score of 10, which could be used to wrest administrative control over Azure Arc-enabled Kubernetes clusters.

"CVE-2022-37968, [a] connect elevation of privilege vulnerability, has a rare CVSS score of 10, said Mike Walters, VP of vulnerability and threat research at Action1.

"Successful exploitation of this vulnerability allows an unauthenticated user to elevate their privileges to cluster admin and potentially gain control over the Kubernetes cluster. If you are using these types of containers with a version lower than 1.5.8, 1.6.19, 1.7.18, and 1.8.11, and they are available from the internet, upgrade immediately."

Additionally, the patch covers a critical flaw in SharePoint servers that allowed for RCE (CVE-2022-41038), one in Windows CryptoAPI (CVE-2022-34689) that opened the possibility for identity spoofing and code signing, and seven critical vulnerabilities in the Windows point-to-point tunnelling protocol used for public virtual private network (VPN) tunnels.

The remaining 72 patches, one ranked as ‘moderate’ and the rest as ‘important’, cover a range of flaws including those found in Chromium Open Source, which powers Microsoft Edge, as well as elevation privilege vulnerabilities in Windows Kernel, a number of information disclosure vulnerabilities, and several denial of service vulnerabilities across several services.

All patches for the vulnerabilities in this October's Patch Tuesday updates are available to download through Microsoft's Update Catalog.

Microsoft has published its third update for its mitigation of an exploit abusing two zero-day vulnerabilities in Microsoft Exchange Server, known as ProxyNotShell.

It marks the latest step towards providing a fix for the issue, which chains the two vulnerabilities together to execute the attack.

Security researcher Kevin Beaumont highlighted on Friday that there is already a bypass for the Microsoft-provided mitigation. It means every one of the company's attempts to prevent the exploit from harming customers has been circumvented within hours of publication.

The issue is in the way Microsoft's signatures detect the exploit. Signatures monitor the w3wp.exe internet information services (IIS) module but for customers of Windows Server 2016 and above, w3wp.exe is excluded automatically by Exchange Server when IIS is installed.

"The only way to correct this is to turn off automatic exclusions," he said, but Microsoft states explicitly in its documentation to not do this.

The original vulnerability disclosure for the ProxyNotShell exploit was atypical in nature and the information regarding potential fixes has been fragmented and confusing to follow for many.

Discovered last week by security researchers at Vietnam-based company GTSC, the pair of zero-days has received a number of attempted fixes - the first of which was bypassed “easily”.

GTSC said in its report that it had noticed in-the-wild exploitation of both vulnerabilities for at least a month before publishing its findings.

The security issues are related to, but different from, the ProxyShell exploit which was developed in 2021 and are not protected by the patch Microsoft provided for ProxyShell that year.

Tracked as CVE-2022-41040 and CVE-2022-41082, they each received a CVSSv3 severity score of 8.8/10. Microsoft Exchange versions 2013, 2016, and 2019 are affected.

Exploitation requires access to an authenticated user account but initial tests indicated that any email user’s account, regardless of the level of privileges they had, could be used to launch an attack.

Microsoft Exchange Server customers are advised to monitor the official mitigation page and apply new ones as they become available in order to protect against exploitation. There is currently no available patch.

Exploitation has been linked to China by cyber security company Volexity, which first discovered the ProxyLogon exploit last year.

It publicly tied “at least some of” the exploitation of both zero-days to a known Chinese threat actor that’s been active in Asia for the past 12 months.

Support for the link with China was also found in GTSC’s original report which detailed the use of China Chopper web shells in successful attacks - a tool known for being used by Chinese threat actors.

Explaining the ‘confusing’ vulnerability disclosure and mitigation releases

GTSC originally published its report on the two vulnerabilities last week but its claims that the flaws were legitimate zero-days were contested by prominent members of the cyber security community.

Details of the two-part exploit process were included in the company’s blog post but the first stage which described a similar format to the exploitation of ProxyShell was criticised by one security researcher who said the exploit looked too similar to ProxyShell’s to be considered a new method.

Matters weren’t helped by GTSC not working with Microsoft before publishing its findings, either.

In an atypical move, the Vietnam-based security firm instead went to the Zero Day Initiative (ZDI) which accepted the two vulnerabilities as zero-days.

The company said it hoped ZDI would work with Microsoft on a mitigation. It’s unusual for security researchers to publish details of zero-day vulnerabilities without alerting the affected vendor.

GTSC omitted many of the technical details from its report, reducing the risk of hackers developing exploits using information in it, and likely published ahead of informing Microsoft due to the risk it posed to the global threat landscape.

Days after GTSC’s original publication, Microsoft triaged the two vulnerabilities and issued CVE tracking codes for them both, confirming they were indeed zero-day vulnerabilities.

Zero-day vulnerabilities are security flaws in software, firmware, or hardware that are unknown to the party responsible for maintaining the affected product.

Microsoft Exchange Server was the impacted product but because Microsoft was not aware of the issues that were being actively exploited, and the fact the vulnerabiltities were eventually proved to be novel, both CVE-2022–41040 and CVE-2022–41082 were classified as zero-days.

In the days after issuing the CVEs, Microsoft released a number of mitigations for the exploit and the security community developed bypasses on numerous occasions.

Microsoft also originally said that Exchange Online customers did not need to take any action, a message later disputed as false since Exchange hybrid servers were still vulnerable.

The information surrounding the disclosure and potential fixes for the ‘ProxyNotShell’ exploit has been disseminated over a number of days and through fragmented sources.

Microsoft’s official blog has served as the central point of information but mitigation bypasses and other useful information have been sourced from various figures from the cyber security community across the internet.

Additional mitigation details

Microsoft’s latest update ‘further improves’ its mitigation strategy, first released on 30 September, which involves implementing URL rewrite rules.

The company originally instructed vulnerable customers to block ports used for Remote PowerShell to stop attackers from triggering remote code execution (RCE) through CVE-2022-41082.

This advice was later removed as a result of the community highlighting that PowerShell is available directly via Exchange and doesn’t require any other ports.

There are also a number of caveats to the provided mitigations that customers and system admins should take into account when locking down their service.

One of the updated mitigations supplied on Tuesday referenced an earlier Exchange Emergency Mitigation Service (EEMS) rule it released on 30 September.

Microsoft said this was automatically applied but others suggested that the EEMS rule was only automatically applied if the customer was on the latest Exchange cumulative update, which many aren’t according to scans.

Microsoft’s URL rewrite mitigation was delivered using the EEMS rule and an Exchange On-premises Mitigation Tool v2 (EOMTv2) that it made available. Some users also chose to manually apply the mitigation.

A bypass was made public for both EEMS and EOMTv2 methods on Wednesday, with the wider security community sharing their own manual rules to help block incoming attacks.

Microsoft issued an update to its mitigation on Thursday. Those who manually applied the mitigation are advised to update it and those who used the EEMS and EOMTv2 methods must redownload and rerun the script.

Admins who also follow Microsoft’s own advice to exclude the w3wp.exe internet information services (IIS) module from antivirus detections should understand that the new rules and signatures do not work when w3wp.exe is excluded, according to one researcher.

Apple has released a large package of security fixes for various bugs in iOS and iPadOS including four code-execution flaws and one serious zero-day.

The most significant of the 11 total security issues was the zero-day vulnerability that allowed hackers to potentially execute arbitrary code with kernel privileges - the most serious kind.

Apple said it is aware of a report that the issue may have been actively exploited in the wild. A zero-day vulnerability is characterised as a security flaw that was previously unknown to the affected vendor but not patched.

Tracked as CVE-2022-32917, the vulnerability was one of the four code-execution bugs patched in the update and the eighth zero-day Apple has patched this year.

It was not the only other bug that could be exploited with kernel privileges, though. The other is tracked as CVE-2022-32911 but unlike the first, this is not believed to be under active exploitation.

The other two were found in WebKit, Apple’s proprietary browser engine that’s used to power its Safari app, as well as all the in-app browsers found in apps allowed on Apple’s App Store.

They both may have allowed arbitrary code execution if a user accessed a maliciously crafted web page, but neither is thought to be under active exploitation either.

All of the security fixes apply to version 15.7 of each operating system (OS) which is the most recent version for iPads and the second most recent version for iPhones after iOS 16 was launched on Monday.

Affected devices are the same for all vulnerabilities in the list. These include all officially supported iPhones (iPhone 6s and newer), all iPad Pro models, iPad Air 2 and later, iPad 5th generation and later, iPad Mini 4 and later, and iPod touch (7th generation).

Also included in the package of patches were fixes for three separate privacy issues. The first of these impacted the affected devices’ Contacts app and Apple’s nondescript explanation of the issue offered very little other than: “an app may be able to bypass privacy preferences”.

Apple’s security advisories are famously brief in their explanation of each vulnerability and the potential capability of a method to exploit it. It’s unclear how another app could impact the privacy preferences of the contacts app.

“For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available,” it said in the update’s notes.

Apple’s Maps app also suffered a privacy issue whereby another app installed on an affected device may have been able to read “sensitive location information”.

Apple was equally as vague as to the finer details of this vulnerability, too, as it was with the third privacy flaw found in Safari’s web extensions.

Exploiting this vulnerability would potentially allow websites to track users through browser extensions in Apple’s Safari app.

Apple did not specify if this vulnerability would also circumvent its built-in App Tracking Transparency functionality introduced in iOS 14 or if websites could track users if they enabled the hiding of their IP address in the device’s settings.

Elsewhere, vulnerabilities potentially allowing photos to be accessed from the lock screen through the exploitation of Shortcuts, address bar spoofing in Safari, and privilege escalation flaws in MediaLibrary were also fixed.

Apple’s security updates rarely deliver this many fixes in one release but the update is potentially more impactful for iPad owners.

The security updates must be applied to Apple’s tablets but the vulnerabilities no longer affect the latest version of iOS, so if users updated to iOS 16 on Monday, then the fixes would automatically be ported over with the newer OS.

The latest iOS update brought with it several new security features for iPhone users and one of the most notable was the decoupled security updates.

Users would typically have had to wait for full iOS updates to receive new security patches but Apple is now releasing updates for its OS and security flaws separately so fixes can be applied more quickly.

The same security features will also be coming to iPad users when its iPadOS is eventually rolled out.

Apple has confirmed that the OS has been delayed by a month, although it is usually released at the same time as iOS.

The search giant has long since been just a search giant, but one area in which Google excels is in threat discovery. Project Zero is a team of security researchers. If Marks and Spencer did cyber security research then these would be the calibre of hackers it employed. Seriously, the Project Zero researchers are drawn from some of the best in their respective fields. Which is why when it issues reports, they’re well worth reading.

Take the analysis of zero-days disclosed by Project Zero across 2021. The obvious headline takeaway is that 2021 broke the record for number of zero-days across multiple platforms, 58 if you care about such things, and ditto for those impacting Google Chrome, at 14. Another potential takeaway is that despite the maturity of Google’s security ecosystem, a team of truly “elite” researchers can still find this number of zero-days.

Another possible takeaway is that the vast majority of them fell into the same-old-same-old category of memory corruption vulnerabilities enabling the exploits. Although this is a tried and tested method, it’s not a tired one. Indeed, that so many zero-day exploits were going down that route demonstrates how important this class of vulnerability is and how much further there is to travel for DevSec folk.

“Memory corruption vulnerabilities have been the standard for attacking software for the last few decades, and it’s still how attackers are having success,” said Maddie Stone, the Project Zero researcher behind the analysis. Stone also made the point that while it’s great finding zero-days, and the improvement amongst researchers in being able to do so, there’s a “lot more improving to be done”.

That attackers are, on the whole, sticking to legacy exploit techniques should be a huge concern to the tech industry as a whole, but it’s also a huge opportunity to close them out by putting a greater focus on closing those rogue code gaps.

What really stood out to me from the 58 zero-days detailed in this report was that only two of them made the researchers go “wow”, and that they avoided the memory corruption methodology completely. Both targeted Apple users, via iOS and iMessage respectively, and both invested in novel exploit techniques with great impact. How great? If I said “NSO Pegasus” that should be enough to get your head spinning into overdrive.

The two exploits were singled out as, firstly an iOS security sandbox escape that only used logic bugs to work and, secondly, a zero-click iMessage exploit in reality rather than the realm of hyperbolic headlines. The Project Zero researchers described the latter as being “one of the most technically sophisticated exploits” they had ever seen, according to the report.

“Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations,” the report said. “It’s not as fast as JavaScript, but it’s fundamentally computationally equivalent.”

I’ll add my wow into the mix at this point.

Apple has made a rare exception to its policy of not patching older-than-officially-supported devices by releasing security updates for the iPhone 5s and newer following the ‘severe’ zero-days discovered in August.

The zero-day vulnerabilities affecting iOS, iPadOS, and macOS Monterrey essentially granted “administrative superpowers” to hackers, according to some security researchers.

The two ‘critical’ vulnerabilities could be chained together to gain control of an entire device with kernel privileges, Apple said at the time.

It meant attackers who managed a maliciously crafted web page could exploit an Apple device and assume control of features like the camera and microphone, and carry out other activities such as spying on apps and accessing nearly all data stored on the device.

Apple very rarely breaks its own policy of not applying security patches to unsupported devices. Apple currently supports iPhones as old as the iPhone 6, but this week’s updates push fixes to devices such as the iPhone 5s, iPad Air, iPad Mini 2, and the iPod touch (6th generation).

The last time it issued a backported fix for a major vulnerability was in 2018 when it updated older Macs to protect against the infamous Meltdown vulnerability affecting most Intel chips in use at the time of discovery.

The discovery of Meltdown was a significant one - Intel was the dominant chipmaker, for some time, in the PC and Mac market and the vulnerability was found to affect nearly every Intel chip from the previous 20 years.

The exploitation of Meltdown would allow attackers to ‘melt’ the kernel-level restrictions on the chip’s hardware and potentially access highly sensitive protected data.

It’s common for tech companies to decide when a device goes ‘end of life’ - the point at which it will no longer receive security updates. It can make the creation and management of security fixes easier but companies have drawn criticism over the practice which has been seen by some as a way of forcing users to pay for newer hardware sooner than needed.

Apple, however, is known to be one of the companies that offer the most amount of updates to older hardware with the current policy extending to iPhone 6 devices, released in September 2014 - eight years ago.

Other manufacturers in the Android ecosystem offer comparatively fewer updates for their devices. The generally perceived average is that Android OS devices will receive three years of security updates.

This can vary by manufacturer, though. For example, Samsung offers four years of security updates (five for enterprise devices) and other companies like Xiaomi offer no guarantees on the number of security updates they will provide users.

The Apple zero-days explained and analysed

Apple fixed two zero-day vulnerabilities, that may have been actively exploited in the wild, earlier in August.

The first of these, tracked as CVE-20220-32893, was a remote code execution (RCE) flaw in WebKit, Apple’s proprietary browser engine.

The vulnerability was exploitable in any WebKit-enabled browser such as Safari and all in-app browsers on iOS and iPadOS. It meant that nearly all devices could be exploited given the prevalence of in-app browser use, regardless of whether the user’s default browser was changed from Safari or not.

The second flaw, tracked as CVE-2022-32894, was a bug that required the attacker to gain an initial foothold on the target device to exploit it. The aforementioned WebKit vulnerability would have granted the necessary privileges to exploit the second.

It was a kernel-level code execution bug and the pair together garnered widespread attention from the world’s media given the severity of the potential outcomes.

Apple releases security updates for its devices usually, at least, every month so it’s not uncommon for users to skip an update or two due to the time it takes to download and install them on each device.

The widespread reporting on the vulnerabilities could have influenced Apple to break its policy on providing security fixes for end-of-life devices - Apple has not commented on this explicitly, though.

Apple has fixed two zero-day vulnerabilities affecting iOS, iPadOS, and macOS Monterrey that may have been actively exploited.

The first exploit is a remote code execution (RCE) flaw affecting Apple’s proprietary browser engine WebKit, tracked as CVE-20220-32893.

An attacker could maliciously alter a web page and if visited by a WebKit-powered browser, then unauthorised code could run on unpatched devices.

WebKit is Apple’s browser engine and is naturally used to power the native Safari browser on currently supported iPhones and iPads. It’s also the engine that Apple compels app developers to use when building for its mobile devices.

This means even Google Chrome has to forfeit its Blink and V8 engines on iOS and iPadOS, and other browsers also have to use WebKit to pass Apple’s App Store checks.

Other apps that may not be browsers primarily, but have browsing features within them, also use WebKit to display web content which means the vulnerability may have a wide-reaching attack surface.

Devices affected by CVE-20220-32893 include iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, iPod touch (7th generation), and macOS Monterrey.

This vulnerability is the third critical WebKit bug Apple has been made to fix this year after the first two patches were released within weeks of each other at the start of the year.

The second zero-day exploit patched by Apple on Wednesday is a kernel-level code execution bug that can be abused once an attacker gains an initial foothold on an affected device.

Tracked as CVE-2022-32894, one way an attacker could achieve that initial foothold is by exploiting the aforementioned WebKit flaw, according to researchers at Sophos.

This means an attacker “could jump from controlling just a single app on your device to taking over the operating system kernel itself, thus acquiring the sort of ‘administrative superpowers’ normally reserved for Apple itself,” said Paul Ducklin, principal research scientist at Sophos.

Such privileges could afford an attacker the ability to carry out activities such as spying on apps, accessing nearly all data on the device, retrieving locations, using cameras, taking screenshots, activating the microphone, and more, he said.

Like the WebKit flaw, the code required to exploit this vulnerability would have to be embedded within a maliciously crafted web page and executed after the WebKit vulnerability had already been exploited.

This zero-day also affects all the aforementioned iPhone and iPad devices, in addition to Macs running macOS Monterrey.

Both issues were caused by an out-of-bounds write issue and were addressed by improving the bounds checking of the vulnerable components.

The two vulnerabilities patched by Apple on Wednesday represent the sixth and seventh zero-day exploits that Apple has been forced to fix this year.

The company also patched a swathe of zero-day vulnerabilities in 2021 including the ForcedEntry exploit used by the notorious Pegasus spyware developed by NSO Group.

Microsoft has patched 17 ‘critical’ vulnerabilities and one remote code execution (RCE) zero-day in its August monthly Patch Tuesday.

A total of 121 vulnerabilities were patched in the Tuesday update, as well as 20 additional Chromium-based Microsoft Edge flaws on Friday 5 August.

Impacting Microsoft Windows Support Diagnostic Tool (MDST), the zero-day vulnerability (CVE-2022-34713) is among the most notable fixes this month and is a variant of the previously disclosed ‘Dogwalk’, Microsoft said.

Rated 7.8 on the CVSSv3 severity scale, it can be exploited by tricking a target into opening a malicious document via email phishing, or through an attacker-controlled website that hosts a malicious file.

Dogwalk drew major attention in May 2022 but dates back to an initial discovery in 2020. It was ‘lazily’ named by a security researcher who was walking his dog at the time of being asked to name it, he claimed.

The vulnerability itself is a path traversal flaw in MDST affecting Windows 7 devices or newer. To exploit it, targets have to become infected with a malicious .diagcab file which drops the payload into the Windows Startup folder and executed by Windows when the user next logs in, according to an analysis by SOC Prime.

A zero-day vulnerability is one that has been previously disclosed publicly and with active exploitation spotted. A separate RCE flaw in MDST (CVE-2022-35743) was also patched this month, but active exploitation has not been found and therefore cannot be considered a zero-day.

Microsoft categorised 17 of the now-patched vulnerabilities as ‘critical’ since they facilitated the elevation of privileges and RCE. Only three of the 121 total flaws were classified as ‘critical’ on the CVSSv3 severity scale - vulnerabilities with scores between 9.0 and 10.0.

All three of the most severe vulnerabilities were all RCEs with one affecting Windows Network File System (NFS) (CVE-2022-34715) and two separate flaws impacting the Windows Point-to-Point Protocol (PPP) (CVE-2022-30133 and CVE-2022-35744).

CVE-2022-34715 was classed as a low-complexity exploit by Microsoft and involves an attacker making an unauthenticated call to an NFS service (version 4.0) to trigger an RCE.

Although rated 9.8/10.0 on the CVSSv3 scale, Microsoft branded this vulnerability as ‘important’ - the second-highest severity rating because a target would be presented with a prompt or warning during the kill chain.

CVE-2022-30133 and CVE-2022-35744 were both rated 9.8/10.0 on the CVSSv3 scale and also classified as ‘critical’ by Microsoft since RCE could be achieved without any user intervention at all.

In both cases, an unauthenticated attacker could send a specially crafted connection request to a remote access server (RAS), Microsoft said, which could lead to RCE on the RAS server machine.

The remaining critical-rated vulnerabilities, as classified by Microsoft, all fell below the ‘critical’ threshold of the CVSSv3 scale but require no user intervention to exploit them.

The remaining flaws impacted the following: Active Directory Domain Services, Windows Secure Socket Tunneling Protocol, Windows Hyper-V, SMB Client and Server, and Microsoft Exchange Server.

The full list of fixed vulnerabilities can be found on Microsoft’s dedicated web page.

August’s Patch Tuesday marks the second-biggest round of updates in 2022, behind April’s which fixed 145 different flaws.

Early reports from system administrator communities are indicating that the updates are applying successfully and not impacting any wider components as Patch Tuesday updates have in the past.

Earlier this year, Windows Server admins collectively agreed to forgo a month of patches due to the security updates causing other services in their IT environments to break.

Microsoft’s latest monthly security updates for July have been released this week, with 84 total vulnerabilities fixed including one actively exploited zero-day.

The zero-day (CVE-2022-22047) is a privilege escalation flaw affecting Windows Client/Server Runtime Submission (CSRSS), the exploitation of which could grant attackers system privileges.

It has been given a CVSSv3 score of 7.8/10 - a ‘high’ rating - and Tenable said it is a vulnerability that is most likely to be used after initially gaining a foothold in an organisation.

“This type of vulnerability is likely to have been used as part of post-compromise activity, once an attacker has gained access to their targeted system and run a specially crafted application,” it said.

No other details on the zero-day have been released other than Microsoft’s assessment that exploitation requires a low level of complexity, albeit through a local attack vector.

This means an attacker would either have to have their hands on the victim’s keyboard or be able to control a machine remotely, supporting Tenable’s conclusion that it would likely be used after initially compromising an organisation.

Given that CVE-2022-22047 is the only actively exploited bug in this month’s list of patches, businesses are more seriously advised to patch this one especially.

The US’ cyber security authority CISA added the zero-day to its list of mandatory patches that all federal civilian and executive branch agencies must deploy pursuant to the binding operational directive 22-01, first imposed last year but regularly updated since.

Four critical-rated vulnerabilities were fixed in this month’s ‘Patch Tuesday’, though none of these are believed to have been actively exploited.

The first of these is CVE-2022-30222 which has been given a CVSSv3 score of 8.4/10. The remote code execution (RCE) vulnerability affects PCs with a Japanese language pack installed and attackers can use the input method editor (IME) to gain system privileges.

An IME is software that allows users to input characters that aren’t typically supported by qwerty keyboards. Users type combinations of keys to display characters that otherwise aren’t present on their keyboard, rather than hitting dedicated buttons for specific characters.

CVE-2022-30216 received a severity rating of 8.8/10 and is a Windows Server service tampering vulnerability, the exploitation of which is “more likely” according to Microsoft.

To exploit the bug, an attacker would need to be authenticated which may limit the real-world effectiveness, unless the attacker could upload a malicious certificate to the Windows Server service.

Another 8.8-rated bug was CVE-2022-30221, an RCE flaw affecting the Windows Graphics Component. Exploitation is less likely with this one given that a victim would have to be convinced to connect to a remote desktop protocol (RDP) server, limiting real-world impact.

Regardless, if a business’ employee was convinced to join an attacker-controlled RDP server, they could exploit the flaw to execute code on the victim’s system.

The final ‘critical’ vulnerability for this month is the 8.8-rated CVE-2022-20226, a privilege escalation bug again affecting Windows CSRSS, like the aforementioned zero-day.

Exploitation is assessed as “less likely” again by Microsoft, but an authenticated attacker could send a specially crafted request to the CSRSS to elevate their privileges from AppContainer to the system, before executing code or accessing resources.

In summary, July’s Patch Tuesday has been described by some experts as “boring” given the low number of seriously threatening security vulnerabilities compared to months gone by.

For the full list of vulnerabilities and Microsoft’s assessments on each, visit the company’s dedicated security update guide.

The exploitation of a critical-severity remote code execution (RCE) zero-day flaw in Atlassian Confluence Server and Data Center has increased by nearly fifteen times in the two days since active attacks were first registered.

Experts at internet security firm GreyNoise said the number of unique IP addresses launching attacks using the RCE flaw, tracked as CVE-2022-26134, has risen from 28 to 400 since Friday when exploitation began.

Cyber security company Volexity first reported that it discovered the RCE vulnerability over the US’ Memorial Day weekend (28-30 May) after noticing suspicious activity on two internet-facing web servers.

It was assigned a CVE tracking code on 31 May and Volexity published its findings last week, with a clear rise in active exploits on current versions following a day after, on 3 June.

Atlassian released a patch for the unauthenticated RCE flaw on Friday, urging all customers to upgrade to the latest version to avoid being targeted by attackers with access to proof-of-concept (PoC) exploit code.

According to Atlassian, the company has released the following new Confluence versions that all contain a fix for the security issue:

• 7.4.17
• 7.13.7
• 7.14.3
• 7.15.2
• 7.16.4
• 7.17.4
• 7.18.1

Admins who are unable to upgrade to the latest versions of Confluence are advised to mitigate the flaw with a workaround which involves updating several specific .JAR files. More information and full instructions can be found via Atlassian’s security advisory.

An analysis of the situation by Unit 42 revealed nearly 20,00 Confluence servers found to be potentially affected by the exploit as of last week, with most of the victims residing either in the US, German, Russia, and China.

It also said there was evidence of early exploitation as far back as 26 May with targets across various industries.

Volexity said in its initial analysis that early exploits seemed to be conducted by multiple threat actors likely to be operating out of China.

Deconstructing the zero-day

Volexity’s initial analysis of the zero-day’s exploitation revealed that attackers were using the vulnerability to drop several malicious implants in the form of web shells on victims’ environments.

Attackers were using the open-source Behinder web server implant previously linked to Chinese threat actors by Avast.

“Behinder provides very powerful capabilities to attackers, including memory-only web shells and built-in support for interaction with Meterpreter and Cobalt Strike,” said Volexity. “This method of deployment has significant advantages by not writing files to disk. At the same time, it does not allow persistence, which means a reboot or service restart will wipe it out.

“Once Behinder was deployed, the attacker used the in-memory web shell to deploy two additional web shells to disk: China Chopper and a custom file upload shell.”

The researchers noted that China Chopper was installed but was rarely accessed, according to web logs, leading them to the conclusion that it was installed simply as a means of secondary access.

Delving further into the web logs, Volexity also discovered the commonly executed commands made by the attackers once they had access.

Among these were reconnaissance commands - checking the operating system version and examining the contents of password files.

Attackers then looked for user tables from the Confluence database and dumped them before attempting to deploy anti-analysis tactics by altering web logs to remove evidence of exploitation.

They also wrote additional web shells to the victims’ disks, but not all of these could be recovered, Volexity said.

Specific details regarding how the exploit takes place have not been made public, but Tenable said that past attacks on Atlassian Confluence have involved sending specially crafted requests to vulnerable Confluence Server or Data Center instances to execute code and fully take over the system.

One of the most recent examples of attacks on Confluence came less than a year ago when the US Cyber Command warned of a highly exploitable flaw that led to code execution.

That security incident came three months after a separate one-click flaw was found to affect Atlassian Jira, the company’s bug-tracking and project management tool, that allowed hackers to steal sensitive information.

State-sponsored cyber attacks on Microsoft Exchange servers throughout 2021 are the reason why the latest version of the on-prem mail and calendaring server will be delayed by four years, Microsoft said.

A new version of Microsoft Exchange Server was originally on course for an H2 2021 release but Microsoft has updated its roadmap delaying the release to H2 2025 due to the time it took developers to improve security in the wake of the Hafnium attacks.

Hafnium is a state-sponsored hacking group Microsoft has previously said is linked to China. In 2021, Hafnium attacked Microsoft Exchange servers consistently using a flurry of zero-day vulnerabilities to exfiltrate information from victims across various business verticals.

In addition to an extra four-year wait for the next version, IT admins can expect to hear more about the new features, pricing, requirements, and naming of the updated version in the first half of 2024.

Microsoft also said the latest version will require Server licenses and Client Access Licenses (CALs) and will only be accessible to customers with Software Assurance - a service pack that automatically provides customers with licenses to the latest versions of software.

The current support dates for Exchange Server 2013 (11 April 2023), Exchange Server 2016 (14 October 2025), and Exchange Server 2019 (14 October 2025) are unchanged.

The next version of Exchange Server will move to Microsoft’s Modern Lifecycle Policy which does not set end-of-life (EOL) dates for products or services but continues to offer support as long as there is demand for it in the market.

Customers running Exchange Server 2019 may have an easier time upgrading to the new version when the time comes, Microsoft hinted.

After resolving previously known upgrading issues relating to hardware requirements and mailbox migration, Microsoft is introducing an in-place upgrade capability to Exchange Server 2019 and recommends all customers upgrade to the version “as soon as possible”.

Hafnium’s server siege

Last year, the Chinese-linked state-sponsored hacking group exploited a chain of zero-day vulnerabilities in Microsoft Exchange, leading to hacks on hundreds of thousands of businesses.

Microsoft said at the time that the group was known for harvesting data from various types of organisations including those in the medical, education, military, NGO, and policy sectors.

Based in China but operating from US-based virtual private servers (VPS), Hafnium gained access to Exchange Servers, installed a web shell for remote control, and stole data.

The White House was especially concerned about the threat to national security and urged all businesses to patch their Exchange servers to the latest version as a matter of priority, at the time.

More than a month after the exploits became public knowledge, US government agencies were still finding unpatched Exchange Server vulnerabilities in their systems.

Experts said that if organisations hadn’t patched on the day of release, there was a strong chance that the environment was already compromised, and the web shell had already been planted.

It was later revealed that Microsoft first became aware of the zero-day exploits in January 2021, two months before Hafnium’s activity ramping up in March.

Hafnium’s exploit chain was ultimately used in separate attacks throughout the year, namely by the Qakbot and SquirrelWaffle malspam campaigns spreading via unpatched servers in October 2021.

Microsoft’s work so far

The delay to the latest version of Microsoft Exchange Server came as a result of Microsoft's security experts being forced to work throughout 2021 to combat the heavy attacks from the exploits used by Hafnium.

It said that work on the new release was stalled as the team was busy pushing out-of-band security updates, a one-click mitigation tool - which was later integrated as a core feature of Exchange Server and integrating other services to improve the security of the service for IT admins.

It also launched a bug bounty programme for Exchange Server and Office Server under the Microsoft Applications and On-Premises Servers Bounty Program to improve the company’s collaboration with the private sector and independent security researchers and ultimately improve the security of Exchange Server.

The Microsoft Office zero-day vulnerability reported widely this week is already being used in active attacks by Chinese state-sponsored hackers, a cyber security company has said.

The advanced persistent threat (APT) group tracked as TA413 has been spotted impersonating the Women’s Empowerment Desk of the Central Tibetan Administration - a genuine division dedicated to issues such as gender equality and combating violence against women.

Proofpoint researchers said the malicious documents are delivered via zip archives through URLs that aim to imitate the genuine Tibetan government, but didn’t comment on the type of payload that’s delivered.

The vulnerability that exploits the ms-msdt Microsoft Office Uniform Resource Identifier (URI) scheme is now tracked with CVE-2022-30190 and has been shown to work on all versions of Microsoft Office and Windows Server, including Office 365 which was previously thought to not be vulnerable.

Successful exploitation of the diagnostic and troubleshooting tool can lead to the execution of malicious code on Windows systems.

If the malicious document is saved using the Rich Text Format (RTF), code can also be executed by looking up the document in the Windows Explorer preview tab, without even opening it up.

Under the radar

Since CVE-2022-30190 became widely reported this week, it has since emerged that Microsoft was made aware of the vulnerability as far back as 12 April 2022.

A researcher by the alias of crazyman, who is part of a bug-hunting collective called Shadow Chaser Group, was credited with the discovery once Microsoft assigned the vulnerability a CVE code.

Crazyman posted proof of their submission to Microsoft online and found an example of in-the-wild exploitation seemingly from a Russian-speaking threat actor more than a month ago.

A member of Microsoft Security Response Centre (MSRC) responded to the submission after looking at it “critically” and decided that it was “not a security-related issue”.

The team acknowledged that the MSDT scheme was executed as part of the malicious document but since it required a passcode when it started - a passcode that did not work for the MSRC analyst during testing - the case was ultimately closed.

Independent security researcher and former Microsoft-employed security professional Kevin Beaumont, whose report of the zero-day vulnerability sparked wider interest in it this week, said MSRC’s response sounded like they wanted to re-triage the report, rather than dismiss it entirely.

On the same day, a threat intelligence researcher at MalwareBytes also discovered the Russian-language maldoc sample but the cyber security company said the remote template was already down at the time which meant that identification was not possible.

Microsoft’s guidance

Along with assigning the zero-day CVE tracking identifier, Microsoft has released a support document for Windows and Microsoft Office users, advising of the temporary workarounds they can deploy to mitigate the threat.

The recommended workaround is to disable the MSDT URI to prevent troubleshooters from being launched as links, including links throughout the operating system.

Troubleshooters can still be accessed by using the Get Help application, Microsoft said, and through system settings.

To disable MDST, Microsoft instructed users to do the following:

• Run Command Prompt as Administrator.
• To back up the registry key, execute the command “reg export HKEY_CLASSES_ROOT\ms-msdt filename”
• Execute the command “reg delete HKEY_CLASSES_ROOT\ms-msdt /f”.

To undo the workaround - potentially useful information when a full patch is released, users should do the following:

• Run Command Prompt as Administrator.
• To restore the registry key, execute the command “reg import filename”

It was previously reported that Microsoft Defender for Endpoint did not detect exploitation of CVE-2022-30190 but Microsoft said it now provides alerts in Microsoft 365 Defender portal under the following titles:

• Suspicious behaviour by an Office application
• Suspicious behaviour by Msdt.exe

Microsoft Defender Antivirus also now provides detections for possible exploitation using the following signatures using detection build 1.367.719.0 or newer:

• Trojan:Win32/Mesdetty.A (blocks msdt command line)
• Trojan:Win32/Mesdetty.B (blocks msdt command line)
• Behavior:Win32/MesdettyLaunch.A!blk (terminates the process that launched msdt command line)

A new Microsoft Office zero-day vulnerability has been discovered by security researchers that leads to code execution.

The vulnerability involves exploiting maliciously crafted documents (maldocs) to load HTML code which then uses the ms-msdt Microsoft Office Uniform Resource Identifier (URI) scheme to execute PowerShell code.

Office URIs were introduced in Office 2010 Service Pack 2 and allow Office applications to be invoked using various commands.

Ms-msdt is a URI that invokes a troubleshooting pack at the command line or as part of an automated script and enables additional options without user input.

The exploit is an example of ways cyber attackers are bypassing Microsoft’s tougher rules on macro-enabled documents - a method of malware delivery previously very popular until Microsoft’s intervention earlier this year.

In testing the vulnerability, independent security researcher Kevin Beaumont noticed that Defender for Endpoint was not detecting the execution of the code embedded in the maldocs and that it would still work when Office macros were fully disabled.

Other researchers have spotted Defender for Endpoint and the free version of the anti-malware tool picking up the malicious sample, though.

Beaumont also noted the Office’s limited-functionality Protected View does initiate in the most up-to-date Office versions, requiring the user to click out of the safer mode for the document to execute.

However, if the maldoc is saved in a Rich Text Format (RTF), then the malicious code can run even if the document hasn’t been opened, via the Windows Explorer preview tab.

Beaumont said he was able to exploit the vulnerability in Office versions 2013 and 2016, and added that he was unable to reproduce the exploit on the current public and insider builds.

Other researchers have been able to test the vulnerability further, with one achieving a working exploit using Windows 11 and an April version of Office Pro Plus. Another was able to replicate it on a fully patched Microsoft Office 2021.

Despite it not currently believed to be affecting the most recent versions, Beaumont - a former Microsoft-employed cyber security expert - said the zero-day is still noteworthy given that many businesses run older channels of Office software.

“Detection is probably not going to be great, as Word loads the malicious code from a remote template (webserver), so nothing in the Word document is actually malicious,” he said.

“Microsoft are going to need to patch it across all the different product offerings, and security vendors will need robust detection and blocking. Microsoft will probably point towards Protected View, however, Protected View also applies by default to all macros, and Office macro malware is most definitely a major problem regardless.

“Additionally, you can use MS Protocol URI schemes in Outlook emails,” he added.

It’s currently unclear how Microsoft intends to respond to the discovery and how quickly a patch will be made available.

IT Pro contacted Microsoft for a response but it did not reply at the time of publication.

Datadog has announced its plans to acquire security software provider Hdiv Security for an undisclosed sum.

Hdiv Security is best known for its RASP security technology that provides applications, microservices, and APIs protection by flagging both known and unknown (zero-day) vulnerabilities at runtime. The early vulnerability assessment allows for quick remediation, lowering the risk of a security breach.

Hdiv Security’s unified application security solutions will add to Datadog's Cloud Security platform. The fusion will lead to an integrated approach to application security, according to Datadog.

Hdiv Security’s threat detection capabilities also complement Datadog’s latest Application Security Monitoring (ASM) platform that alerts organizations to atypical application behavior through distributed tracing.

"Combining security and observability provides Datadog customers unique insights into sensitive services that are vulnerable or under attack," said Pierre Betouin, VP of product and cloud security platform at Datadog.

"Adding Hdiv Security's capabilities to Datadog's Cloud Security Platform will deepen security visibility across the entire software life cycle to help our customers develop more secure and resilient applications," added Betouin.

The Datadog-Hdiv Security acquisition deal is slated to close by the third quarter of the current fiscal year, pending regulatory approvals.

"Our focus at Hdiv Security has always been on detecting security vulnerabilities and protecting software, regardless of where it is deployed. Datadog is the perfect partner to advance this mission to continuously and accurately detect vulnerabilities in applications," commented Roberto Velasco, founder and CEO of Hdiv Security.

Software security company Intego estimates around 35-40% of all Mac computers are currently vulnerable to zero-days Apple 'neglected' to patch.

The two actively exploited zero-day vulnerabilities were addressed by Apple in an earlier security fix, but it failed to release patches for older versions of macOS, namely Big Sur and Catalina.

Apple released an emergency patch for two zero-days last week, tracked as CVE-2022-22674 and CVE-2022-22675, both of which Apple said was under active exploitation.

Both security vulnerabilities affected macOS and the latter (CVE-2022-22675) also affected iOS and iPadOS too, said Joshua Long, chief security analyst at Intego. Some older versions such as iOS 14 were also neglected in last week’s patch but this could be explained by Apple “quietly” ending support for iOS 14 in January 2022.

“Both of these macOS versions are ostensibly still receiving patches for ‘significant vulnerabilities’ - and actively exploited zero-day vulnerabilities certainly qualify as significant,” said Long in a blog post.

“Apple has maintained the practice of patching the two previous macOS versions alongside the current macOS version for nearly a decade. But now, Apple has neglected to patch both Big Sur and Catalina to address the latest actively exploited vulnerabilities.”

Long said Catalina does not have the vulnerable component, AppleAVD, involved in CVE-2022-22675 so is not vulnerable to this specifically. However, it is believed to be vulnerable to CVE-2022-22674 and Big Sur is believed to be vulnerable to both.

Apple has reportedly not responded to Intego’s requests for clarity on why the older macOS versions have not received the security patches, despite still receiving security updates more generally.

Long pointed out that this isn’t the first time Apple has neglected older macOS versions in security updates. According to the security analyst, Apple failed to patch two out of the total seven WebKit vulnerabilities found in Safari back in October for macOS Big Sur and Catalina too.

“A preliminary assessment of just the first round of patches at macOS Monterey’s release in October 2021 indicated that there may have already been well over a dozen vulnerabilities that were not patched for previous macOS versions,” said Long.

Back when Big Sur was the newest macOS version running on Apple computers, the researcher’s analysis showed less than half of the hundreds of security vulnerabilities known at the time were fixed for the then-three most recent macOS versions.

Around 16% were patched for the most recent two versions and 34% were patched only for the most recent, Big Sur.

Apple has released a set of emergency security updates for iPhone, iPad, and Mac following the discovery of two new zero-day vulnerabilities that were actively being exploited.

An anonymous researcher made Apple aware of the security issues, which are tracked as CVE-2022-22674 and CVE-2022-22675 respectively.

The first issue (CVE-2022-22674) only affects Macs, and more specifically the Intel Graphics Driver. Apple said the vulnerability involved an out-of-bounds read issue that could lead to the disclosure of kernel memory.

Apple believes the issue may have been exploited by hackers in the past and has fixed it by improving input validation, it said in an advisory.

Out-of-bounds read flaws typically allow attackers to read sensitive information from other memory locations, or cause a crash on the device.

The second vulnerability (CVE-2022-22675) affects iPhones, iPads, and Macs. A flaw in AppleAVD, an audio/video decoding framework used by Apple devices, allowed for arbitrary code to be executed with kernel privileges. The vulnerability, also believed to have been exploited in the past, was caused by an out-of-bounds write issue that Apple fixed by improving bounds checking.

Similar to out-of-bounds read issues, out-of-bounds write flaws occur when software modifies an index or performs pointer arithmetic that references a memory location outside of the buffer’s boundaries. This can lead to data corruption, a device crash, or, in this case, code execution.

Apple has released emergency patches for all affected devices on iOS (15.4.1), iPadOS (15.4.1), and macOS (12.3.1). These include iPhone 6 models and newer, all iPad Pro models, iPad Air 2 and newer, iPad 5th generation and newer, iPad mini4 and newer, and iPod Touch 7th generation.

Importantly, the security patch for Macs seems to only be available on macOS Monterey, which means devices will need to be updated to the latest version of the operating system.

Security fixes for Apple TV (tvOS 15.4.1) and Apple Watch (watchOS 8.5.1) were also released in new updates, but Apple has not yet supplied any information for these or assigned CVE tracking codes.

A year full of zero-days

The latest round of emergency patches from Apple addresses the fourth and fifth zero-day vulnerabilities affecting devices in the company’s device ecosystem this year.

An array of security issues, including two zero-days, were patched in January that all involved code execution flaws, some with kernel privileges too, similar to CVE-2022-22675.

Around two weeks later, Apple was forced to issue another emergency patch for a critical WebKit flaw. WebKit is the engine that powers the Safari browser and the code execution flaw also had evidence of previous active exploitation.

Spring has released an update to its core framework that is thought to bring with it a security fix for the Spring4Shell zero-day discovered this week.

The maintainer of the widely used open source Java framework announced the fix was available on Thursday afternoon after businesses scrambled to assess their exposure to the newly discovered zero-day, for which there were already publicly available proof-of-concept (PoC) exploits.

The latest version, dubbed 5.3.18, can be downloaded now and early reports from experts suggest the security fix is working. Businesses are recommended to upgrade to the latest version to avoid falling victim to the remote code execution (RCE) flaw.

"[I] quickly tested Spring Framework's 5.3.18 release and it does stop the original PoC," said security researcher Jacob Baines. "Obviously, need to spend some time looking at their changes, but a good start."

A backported fix for Spring4Shell is also included in Spring's 5.2.20 version update which is also available now. The community is still waiting for a CVE tracking code.

What is Spring4Shell?

Businesses were left exposed this week to a zero-day security vulnerability branded ‘Spring4Shell’ while PoC exploits proliferated in the public domain.

Spring4Shell is a zero-day vulnerability found in the popular Spring Core Framework for Java applications, that could be exploited for remote code execution (RCE) attacks on affected machines.

The open source Spring Core Framework is one of the most popular Java Enterprise Edition frameworks and offers features to create high-performance Java applications. All Spring Core Framework versions running JDK 9 and newer are thought to be vulnerable.

The flaw has been compared to the Log4Shell vulnerability affecting the log4j2 Java logging utility, but the two are unrelated. Spring4Shell can also only be exploited if a number of prerequisites are met, according to security researcher Will Dormann, unlike Log4Shell which affected all versions of log4j2.

All vulnerable versions of the Spring Core Framework also use Spring Beans, he said - a complex component of the framework that involves a project’s supporting objects, Spring Parameter Binding, and Spring Parameter Binding must also be configured using a non-basic parameter type such as POJOs.

Cyber security company Tenable said it’s unclear how common these prerequisites are in real-world applications, but they are necessary for exploitation and there is evidence of PoCs already.

“In certain configurations, exploitation of this issue is straightforward, as it only requires an attacker to send a crafted HTTP request to a vulnerable system,” said Praetorian, one of the first security companies to confirm the vulnerability, in a blog post. “However, exploitation of different configurations will require the attacker to do additional research to find payloads that will be effective.

“This vulnerability allows an unauthenticated attacker to execute arbitrary code on the target system.”

Praetorian also said the vulnerability is effective since it bypasses a previous patch made nearly 12 years ago for CVE-2010-1622, a separate code injection vulnerability in the Spring Core Framework.

Some members of the security community have been confusing two separate Spring vulnerabilities. This week's Spring4Shell and CVE-2022-22963 are entirely separate, the latter being a flaw in the Spring Cloud Function, which was patched on 29 March, one day before Sring4Shell was identified, Tenable said.

“With some early reports surfacing that Spring4Shell is significantly different from log4j, we’ll know more as an industry soon enough on its severity and risk level,” said Sam Curry, CSO at Cybereason to IT Pro.

“More embedded system weaknesses are lurking out there. Sadly, we live in an age where adversaries have the skills to quickly exploit these vulnerabilities. Now the call is out for defenders to adapt, innovate faster and thrive. Spring4Shell is another wake up call, but there will be more vulnerabilities coming next month and beyond.”

Google has now patched the second actively exploited zero-day vulnerability in its Chrome browser this year.

Most of the details about the security vulnerability were left unpublished by Google, but the company confirmed it was a type confusion flaw, tracked as CVE-2022-1096, found in the V8 Javascript engine.

Type confusion issues occur when a product’s code is fed objects that aren’t verified, and using these objects without type-checking can create type confusion. In some cases, code execution can be achieved when wrong function pointers or data are fed into certain parts of a codebase.

“Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” said Google Chrome in a blog post. “We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”

The Google Chrome Stable Channel has been updated to version 99.0.4844.84 across Windows, Mac, and Linux, and users should start to see their browsers update “over the coming days/weeks,” Google said.

The vulnerability was reported on 23 March which prompted a swift response from Google Chrome which released a patch two days later on 25 March.

Being based on the Chromium engine, Microsoft released a separate notice informing Edge browser users that it was also vulnerable to the zero-day exploit. Microsoft rolled out a patch on 26 March for its browser.

The latest patch fixes the second zero-day vulnerability found in the Chrome browser in nearly as many months. Google released a wave of patches earlier in February addressing seven high-severity security issues among which was the first zero-day of the year.

Tracked as CVE-2022-0609 and carrying a CVSSv3 score of 9.8/10, the initial zero-day was also under active exploitation at the time of discovery and was a UAF in animation flaw - such vulnerabilities can typically lead to code execution on victim machines.

Google’s cyber security research division has unearthed details of initial access brokers (IABs) working on behalf of some of the biggest ransomware gangs in existence.

IABs are groups of cyber criminals that exploit vulnerabilities in organisations and sell that access to the highest bidder so they can launch meaningful cyber attacks without conducting the initial leg work.

The Threat Analysis Group (TAG) observed the EXOTIC LILY IAB operating from at least as far back as September 2021 and has provided access to companies for the likes of Conti and FIN12 so they can launch profitable ransomware attacks.

These types of IAB groups have been operating for some time but have gained popularity in recent years and are approaching the peak of their operational maturity, according to recent reports.

FIN12 and the now-shuttered Conti are among the most infamous ransomware operators of recent times. They have both indiscriminately targeted organisations for financial gain and, unlike other groups, display few ethical boundaries, both having targeted hospitals and healthcare organisations in the past.

The well-resourced EXOTIC LILY group, at the peak of its activity, is said to have targeted upwards of 5,000 emails a day across 650 global organisations, attempting to exploit a Microsoft zero-day vulnerability (CVE-2021-40444) to achieve initial access.

Uniquely personal approach

Google’s TAG said EXOTIC LILY displayed targeted attack techniques such as spoofing companies and employees as a means to gaining trust through email campaigns but “rather uniquely” devoted a considerable amount of time to each target in an attempt to build trust.

Like the large-scale ransomware gangs it works for, EXOTIC LILY is comprised of many individuals so they can devote time to each target. TAG said the “level of human-interaction is rather unusual for cyber crime groups focused on mass-scale operations”.

TAG said EXOTIC LILY would customise business proposal templates when first contacting organisations rather than relying on just one, a technique requiring more effort than typically observed with such groups.

The IAB also handled additional communications with the victims in order to build trust sending a link to a malicious payload using legitimate file-sharing services.

The likes of WeTransfer, TransferNow, and OneDrive were used to deliver the payload that exploited the Microsoft zero-day, which was another technique the attackers used to evade detection mechanisms, TAG said.

EXOTIC LILY’s attack chain remained consistent throughout TAG’s analysis and can be broken down into just a few steps:

1. Register [legitimate company name].us to imitate [legitimate company name].com
2. Create “employee@[legitimate company name].us” email address
3. Use OSINT or a website contact form to acquire target’s email address, send a phishing email
4. Establish trust with further discussion or by scheduling a meeting
5. Share payload with target
6. Send a file-sharing notification

The group first used fake online profiles with AI-generated faces to impersonate employees at a spoofed company, but later resorted to stealing genuine employees’ data and harvesting more from databases like CrunchBase and RocketReach.

The use of a legitimate file-sharing service became a powerful method of avoiding detection, as not only are they familiar companies, but the target also receives a genuine file-sharing notification from that provider to increase the perceived authenticity.

EXOTIC LILY first used documents containing an exploit for a Microsoft zero-day but later changed strategy to delivering ISO files with hidden BazarLoader DLLs – a fileless attack method also common with ransomware groups.

Microsoft shortcut files, known as LNK shortcuts, were also delivered in these ISO files, with samples indicating they were custom-made by EXOTIC LILY rather than off-the-shelf exploit kits, TAG said.

Google has announced it will be doubling the rewards it offers to bug hunters who can demonstrate working exploits for a range of zero-day and one-day vulnerabilities across a variety of platforms.

The reward increases will be applied to exploits discovered in the Linux Kernel, Kubernetes, Google Kubernetes Engine (GKE), or kCTF (Kubernetes-based infrastructure for capture the flag exercises), with the next review coming at the start of 2023.

Rewards offered for valid one-day security exploits increase by more than double to a maximum of $71,337, up from $31,337 previously. Sometimes known as 'n-days', one-days are publicly known vulnerabilities that have patches for them, but Google will offer rewards for novel exploits in this case.

Bug hunters seeking rewards for valid one-day exploits will have to provide a link to the existing patch in their report. Google also said it will be limiting the number of rewards for one-day vulnerabilities to only one version or build.

"There are 12-18 GKE releases per year on each channel, and we have two clusters on different channels, so we will pay the $31,337 base rewards up to 36 times (no limit for the bonuses)," said Eduardo Vela, Product Security Response TL/M at Google. "While we don't expect every upgrade to have a valid 1day submission, we would love to learn otherwise."

Valid exploits for previously unknown zero-day vulnerabilities will nearly double to a maximum reward of $91,337, up from $50,337 previously. Zero-day vulnerabilities typically attract greater rewards because any given vendor would always want to secure the weakness before news of it ever reached cyber criminals.

"We launched an expansion of kCTF VRP on 1 November 2021 in which we paid $31,337 to $50,337 to those that are able to compromise our kCTF cluster and obtain a flag," said Vela. "We increased our rewards because we recognised that in order to attract the attention of the community we needed to match our rewards to their expectations. We consider the expansion to have been a success, and because of that, we would like to extend it even further to at least until the end of the year (2022)."

An increasing amount of recent research has highlighted cyber criminals' shift in focus towards Linux environments, both in and outside of the cloud.

Qualys published findings earlier this year regarding a Linux root privilege flaw that went unnoticed for 12 years while "hiding in plain sight", while VMware observed an increasing number of ransomware attacks targeting Linux-based multi-cloud environments last week.

Full details on the reporting process can be found in the Google blog post.

Reward structure

Google will offer a base reward of $31,337 for the first valid exploit for a given vulnerability, zero-day or one-day. This will only be paid once per vulnerability and once per cluster version or build. Duplicate exploits will not be awarded unless it presents a novel exploit chain, Google said.

From there, a total of three bonuses of $20,000 are available depending on the nature of the exploit disclosed.

• $20,000 will be awarded if the exploit is a zero-day
• A further $20,000 will be awarded for exploits that do not require unprivileged user namespaces
• Another $20,000 is on offer to those who can demonstrate novel exploit techniques. This also applies to duplicate exploits and Google requires a full write-up to qualify as a valid submission

Apple has patched a serious security flaw in WebKit affecting iOS, iPadOS, and macOS that allowed arbitrary code execution on a range of Apple devices, with evidence indicating that the issue has been actively exploited.

Experts have advised all Apple users to update their iPhones and iPads to the latest version (15.3.1) to prevent potential attacks caused by accessing maliciously crafted web content.

The flaw affects iPhones as old as the iPhone 6s, all iPad Pro models, iPad Air 2 and later, iPad 5th generation and later, iPad Mini 4th generation and later, and iPod Touch 7th generation.

The same WebKit issue also affects Safari, which prompted Apple to release security updates for its Mac-based browser, available on macOS Big Sur and macOS Catalina. Macs running the latest macOS Monterey have been issued a patch for the operating system itself, version 12.2.1.

The security vulnerability is tracked as CVE-2022-22620 and was disclosed to Apple by an anonymous researcher. In typical fashion, Apple has offered very few details about the vulnerability but said the issue is related to the use after free class, which means it is related to incorrect use of dynamic memory in applications, Kaspersky said in its analysis.

WebKit is a browser engine developed by Apple and mainly used in its Safari browser but also many other applications on Apple's operating systems. It's also present on Linux, as well as Google Chrome and Mozilla Firefox for iPhone.

Owners of affected Apple devices should check for a software update in their device's settings menu, providing they haven't already received a push notification that an update is ready.

The patches mark the third major security update this year for Apple after January's array of security issues, including two zero-day vulnerabilities, were found to affect iPhones, iPads, and Macs.

The vulnerabilities included serious issues which could have led attackers to execute arbitrary code with kernel privileges with some of them also believed to be actively exploited in the wild.

Earlier in January, a separate flaw in WebKit was also found that let websites track user's browsing activity and unique identifiers. Described at the time as a 'privacy violation', the bug was particularly troublesome for Apple given its stance on web tracking.

The company released an anti-tracking App Tracking Transparency feature in 2021 which allowed users to opt-in to a device setting that required installed apps to explicitly ask for their ability to collect data allowing them to track users across other apps and websites. A boon to end-user privacy, Meta recently said the feature will cost its business $10 billion.

It follows what was a tricky 2021 in terms of security for Apple. Throughout the course of last year, the company patched numerous zero-day vulnerabilities as well as other security flaws affecting devices in its ecosystem. Most notable among the patches was a fix for the ForcedEntry exploit used by NSO Group's Pegasus spyware to gain a foothold in iPhones.

Microsoft's latest round of security updates for Windows, often referred to as 'Patch Tuesday', have been released addressing a total of 70 vulnerabilities across Microsoft and Windows products.

The latest round of patches include fixes for 17 privilege escalation flaws, 16 remote code execution (RCE) issues, 22 Chromium-based Edge browser flaws, and three security feature bypasses, among others.

None of the vulnerabilities are rated critical - categorised by a CVSSv3.1 score of 8.9 or higher - though there are a significant number that have a score of 8.8, just shy of critical status and categorised as 'important'.

There is also no known active exploitation of any of the 70 vulnerabilities fixed by Microsoft at the time of writing, though proof of concept (PoC) code does exist for a small number of them, meaning businesses should apply patches regardless of the level of exploitation currently.

"It may have happened before, but I can’t find an example of a monthly release from Microsoft that doesn’t include at least one Critical-rated patch," said Dustin Childs at the Zero-Day Initiative.

"It certainly hasn’t happened in recent memory. Interestingly, Microsoft has chosen to provide some additional explanations of CVSS ratings in this month’s release, but there are still many details about the bugs themselves that are left obscured."

Among the most severe of the 70 bugs addressed in this week's update are issues related to Microsoft SharePoint, an assortment of Windows 10 and Windows Server versions, Azure Data Explorer, and Visual Studio code.

Patch Tuesday highlights

Windows DNS Server RCE Vulnerability - CVE-2022-21984

Given a score of 8.8/10, this RCE flaw is among the most severe in this week's patch list and is considered by Microsoft to be a low complexity attack, require low levels of privileges in order to execute, and could result in "a total loss of availability". If exploited, the attacker could fully deny access to resources in the impacted component.

Qualys said: "the server is only affected if dynamic updates are enabled, but this is a relatively common configuration. An attacker might entirely take control of your DNS and execute code with elevated privileges if you have this set up in your environment."

Windows Kernel Elevation of Privilege Vulnerability - CVE-2022-21989

Although on the lower-end of the severity scores with a CVSSv3.1 rating of 7.8/10, this privilege escalation flaw has PoC available which led Microsoft to describe this particular vulnerability as more likely to be exploited.

It also noted this is a high complexity attack and likely only able to be carried by a sophisticated threat actor given that exploitation success is dependent on conditions beyond the attacker's control.

"A successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected," said Microsoft.

Given the local attack vector, a hacker would either need physical access to the target machine via its own connected keyboard and mouse. Alternatively, a remote attack could feasibly work via SSH remote access or tricking a user into opening a malicious document.

Microsoft SharePoint Server RCE Vulnerability - CVE-2022-22005

Another of the "more likely" vulnerabilities patched in this update is an 8.8/10-rated RCE flaw affecting Microsoft SharePoint Server. A low complexity attack requiring low levels of privileges, Microsoft said "an attacker can expect repeatable success against the vulnerable component" due to the absent specialised access conditions or extenuating circumstances required to achieve exploitation.

Windows administrators can access the updates via Microsoft Update Catalogue.

Patch Tuesday problems

January's Patch Tuesday caused somewhat of an uproar among Windows administrators last month which led many to forgo the myriad security patches released by Microsoft, including a number of zero-day vulnerabilities.

Online discussions revealed many admins were complaining that updates were breaking core components of their business environments and some uninstalled the updates entirely to resume normal order.

Experts at the time commented that security patches are almost always recommended to be applied as soon as they become available, but it "is very much a question of risk management and risk assessment," according to Andy Norton, European cyber risk officer at Armis.

It's not generally advised to ignore security updates, but if they are causing more disruption than they potentially may fix, then businesses may feel it would be better to wait a month for a more stable version to be released.

"January’s patch release may have left some IT teams feeling somewhat sour as Microsoft had to re-issue updates to fix some unexpected issues caused by the updates," said Kev Breen, director of cyber threat research at Immersive Labs to IT Pro in relation to today's patches.

"This should not be used as an excuse to skip updates, but it does reinforce how important it is to test patches in a staging environment or use a staggered rollout, and why monitoring for any adverse impacts should always be a key step in your patching policy."

Apple has patched an array of security issues affecting iOS, iPadOS, and macOS devices, including two zero-day vulnerabilities.

Among the other myriad fixes for iOS and iPadOS 15.3, and macOS Monterrey 12.2 released on Wednesday were code execution flaws and some that allowed arbitrary code to run on affected devices with kernel privileges.

The first of the two critical flaws, tracked as CVE-2022-22587, involves an issue with the IOMobileFrameBuffer, a kernel extension responsible for managing a device's framebuffer - a portion of RAM that drives the video display. It's believed to have affected the iPhone 6s and later, all iPad Pro models, iPad Air 2 and later, and other devices in the ecosystem too.

Apple said a malicious application could exploit a flaw in this extension to execute arbitrary code with kernel privileges. Apple also said it previously knew about the security issue and that it believes it may have already been actively exploited in the wild. It was a memory corruption issue Apple fixed with improved input validation.

The bug was discovered by Meysam Firouzi of MBition - Mercedes-Benz Innovation Lab, and independent researcher Siddharth Aeri. A third, anonymous researchers was also thought to be involved.

Aeri published a proof-of-concept (PoC) for the security issue on 31 December 2021 and noted on their Twitter page that the bug was demonstrated by Pangu Team at Tianfucup 2021, a hacking competition similar to Zero Day Initiative's Pwn2Own.

The second zero-day flaw was found in Apple's WebKit browser engine and affects Safari 15 on macOS, and all browsers on iOS and iPadOS 15, as IT Pro previously reported.

Martin Bajanik of FingerprintJS first discovered the bug on 28 November 2021 and made it publicly available on 14 January, before Apple assigned it CVE-2022-22594 and patched it in Wednesday's slew of updates.

Exploiting the bug would see websites able to track sensitive user information and stemmed from a cross-origin issue in the IndexDB API. Apple fixed it using the same method as the first zero-day, by improving the input validation.

When he made the public disclosure earlier this month, Bajanik labelled the flaw a privacy violation. "It lets arbitrary websites learn what websites the user visits in different tabs or windows," said Bajanik who authored FingerprintJS' analysis of the bug. "This is possible because database names are typically unique and website-specific."

A total of five arbitrary code execution issues were found to affect iOS 15.3 and iPadOS 15.3, and seven affected macOS Monterrey 12.2. Four of the vulnerabilities in macOS also affected iPhones and iPads, meaning there was a single vulnerability exclusive to iOS 15.3 and iPadOS 15.3, three exclusive to macOS, and four shared across the operating systems of Apple's popular iPhones, iPads, and Mac computers.

Apple's zero-day-ridden 2021

The latest wave of patches marks Apple's first release of fixes this year and the company was forced to patch a score of zero-day and other critical vulnerabilities throughout 2021, including the infamous ForcedEntry exploit used to enable NSO Group's Pegasus spyware.

Arbitrary code execution zero-days in WebKit were also found in May 2021 affecting Safari, all third-party iOS browsers, Apple Mail, and the App Store too. An additional emergency patch was also released a month later to fix more WebKit flaws in iOS 12 which could lead to remote code execution attacks.

May 2021 was a particularly troubled period for the company, the products from which were once said to not even need antivirus protection. Another significant number of vulnerabilities were fixed at the end of May across iOS, macOS, tvOS, watchOS and Safari, including a macOS Big Sur zero-day vulnerability under active attack at the time.

Microsoft has fixed a total of 98 security vulnerabilities as part of its January 2022 Patch Tuesday update released this week, including 29 remote code execution (RCE) flaws and six zero-days.

Of the 98 total vulnerabilities, nine were rated 'critical' - having a CVE score of nine or greater. Among the most severe security issues patched by Microsoft were a pair of RCEs both with scores of 9.8/10 affecting Windows Servers and systems with internet key exchange (IKE).

The flaw affecting Windows servers that are configured as a webserver, tracked as CVE-2022-21907, allows unauthenticated cyber attackers to send specially crafted packets to targeted servers utilising the HTTP Protocol Stack. Microsoft also said the issue is wormable and recommends patching all affected servers as a priority task.

Another of the more serious flaws Microsoft patched this week was one found affecting internet key exchange (IKE), though Microsoft has been tight-lipped on the full details of the problem.

"CVE-2022-21907 is a particularly dangerous CVE because of its ability to allow for an attacker to affect an entire intranet once the attack succeeds," said Danny Kim, principal architect at Virsec, to IT Pro.

"Although Microsoft has provided an official patch, this CVE is another reminder that software features allow opportunities for attackers to misuse functionalities for malicious acts," he added. "Instead of trying to continuously patch and identify these vulnerabilities, enterprises should look for a real-time monitoring solution to safeguard applications and their functionalities from these types of attacks."

The RCE vulnerability, tracked as CVE-2022-21849, can be exploited with 'low complexity', according to Microsoft's patch notes, and allows unauthenticated attackers to trigger multiple vulnerabilities when the IPSec service is running on Windows.

Microsoft Exchange Server also received five separate fixes for one critical-rated RCE vulnerability, tracked as CVE-2022-21846, rated 9.0/10, with an 'adjacent' attack vector which means the attack is limited at the protocol level. This particular flaw was first flagged to Microsoft by the National Security Agency (NSA), which has raised attention to other Microsoft Exchange security issues throughout 2021.

In order to achieve exploitation, cyber attackers would have to first gain a foothold onto a victim's environment, such as being on the same shared physical network, like Bluetooth or IEEE 802.11. This type of flaw is common with man-in-the-middle setups, Microsoft said.

Numerous flaws affecting the Microsoft Office suite were also patched by Microsoft but perhaps the most serious one, tracked as CVE-2022-21840, addressed 26 individual critical-rated flaws in one vulnerability. It has a CVE score of 8.8/10 and attackers could achieve remote code execution on a victim's machine if they opened a specially crafted file.

The flaw is thought to be slightly less likely to exploit given that some user interaction is required (opening the file), but Microsoft still categorised it as a 'low complexity' exploit, meaning cyber attackers can expect repeatable success against the vulnerable component.

Microsoft has issued updates for Windows machines, all of which are advised to be installed, but certain Mac users will have to wait for patches as they are not immediately available.

A full list of the now-patched security issues has been published by Microsoft with RCE flaws affecting products including Windows Server, Microsoft Exchange Server, SharePoint Server, the Microsoft Office suite, DirectX, Windows Remote Desktop Protocol, Windows Resilient File System, and other areas.

"This massive Patch Tuesday comes during a time of chaos in the security industry whereby professionals are working overtime to remediate Log4Shell – reportedly the worst vulnerability seen in decades," said Bharat Jogi, director, vulnerability and threat research at Qualys to IT Pro. "Unpredictable events such as Log4Shell add significant stress to the security professionals dealing with such outbreaks – and bring to the forefront the importance of having an automated inventory of everything that is used by an organisation in their environment.

"It is the need of the hour to automate deployment of patches for events with defined schedules, such as Microsfot's Patch Tuesday, so security professionals can focus energy to respond efficiently to unpredictable events that pose dastardly risk to an organisation’s crown jewels."

Six zero-day vulnerabilities

In addition to the array of security vulnerabilities affecting Microsoft products, six zero-days are also now patched, though no evidence suggests any of them were actively exploited.

• CVE-2022-21919 - Windows User Profile Service Elevation of Privilege Vulnerability
• CVE-2022-21836 - Windows Certificate Spoofing Vulnerability
• CVE-2022-21839 - Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability
• CVE-2022-21874 - Windows Security Center API Remote Code Execution Vulnerability
• CVE-2021-22947 - Open Source Curl Remote Code Execution Vulnerability
• CVE-2021-36976 - Libarchive Remote Code Execution Vulnerability

None of the above zero-days were actively exploited, but publicly available proof of concept (PoC) code is available so businesses should still patch these as a matter of priority before exploitation attempts do start occurring.

It’s been a whirlwind of a year, with the very worst of COVID-19 sandwiching Facebook’s annual PR crisis and a litany of cyber security tales from the deep. Indeed, security teams are still scrambling daily to wrestle with the number of threats facing businesses, while ransomware gangs continue to ransack their way across the globe.

The likes of REvil and Emotet have terrorised businesses, while also sporadically and unexpectedly shutting down amid mounting pressure from law enforcement. From crippling attacks on critical national infrastructure to the persistent exploitation of zero-day vulnerabilities, most recently in the form of the Log4Shell vulnerability, we round up the most shocking cyber security scandals of the past 12 months.

Microsoft Exchange under siege

It’s been a torrid time for Microsoft Exchange this year, with zero-day exploits and vulnerabilities emerging from every corner.

The problems began in March, when Microsoft announced it’d discovered what it believed to be the Chinese hacking group, Hafnium, executing a sophisticated attack using a chain of four previously undisclosed zero-day flaws targeting on-premise Exchange servers. Hafnium gained access using these vulnerabilities and stolen passwords, before creating a web shell around the compromised servers. This allowed them to exfiltrate email data remotely.

It’s estimated a total of 30,000 servers were compromised across the world, including 7,000 in the UK. Patches were soon released for large organisations before a one-click patch was issued for smaller businesses without dedicated IT teams.

Unfortunately, this was shortly followed by a series of additional zero-days, including three the NSA disclosed in April, before ProxyToken was unleashed in August. This flaw, again

hastily patched, could have been abused to steal personal information and perform configuration actions on target mailboxes. Zero Day Initiative experts said, at the time, this could have allowed a hacker to gather and exfiltrate all email addresses in a person’s inbox, which would then be harnessed in phishing campaigns. The ProxyLogon exploit was subsequently at the centre of various attacks, with Epsilon Red targeted servers in June. At least ten groups have since abused the Hafnium exploit chain, with Qakbot and SquirrelWaffle malspam most recently spreading via unpatched servers.

Facebook’s first major snafu of the year

Facebook, once more, endured a crisis-laden year, with a humongous data scandal setting the tone for a rocky few months that eventually led to the damaging revelations detailed by whistleblower Frances Haugen.

On 3 April, somebody uploaded a database containing the personal information of 533 million users to a publicly accessible popular deep web hacking forum. This represented a fifth of Facebook’s user base, mainly based in the UK, US, and India. The leak included phone numbers, full names, previous locations, birth dates, relationship statuses, biographies, and, in some cases, email addresses. Experts, at the time, said the information would likely be used for social engineering campaigns, hacking, and marketing purposes.

Facebook initially explained the hackers scraped data from its servers by exploiting a misconfiguration in its contact importer. This, however, was actually part of a vulnerability the firm had patched in 2019; it knew the data had been compromised but the situation was out of its hands. The unknown hacker then, last year, created the database using this stolen information and established a business on Telegram whereby users paid a small fee to query the database and find phone numbers linked to Facebook profiles. Despite this endeavour, the hacker changed tack and dumped it all online in April.

Colonial’s Pipeline runs dry

The double-extortion ransomware siege on Colonial Pipeline was among the most widely-reported attacks of 2021 due to the sheer scale of impact it had on US infrastructure.

The firm managing the 5,500-mile pipeline between Texas and New York, tasked with delivering 45% of the East Coast’s fuel, was brought to its knees for six days, with supplies cut off, in May. Russian-linked DarkSide took credit, having previously sold information about its attacks to stock traders the previous month.

DarkSide also threatened to leak information from the 100GB of data it stole before locking down the company’s systems. For consumers, limited fuel supply meant US residents had to physically compete with one another for resources, as a hoarding craze took hold.

Before long, Colonial Pipeline went against cyber security best practice and paid the ransom, reported to be $4.4 million (roughly £3.3 million). The Department of Justice (DoJ) eventually recovered most of this sum, but the fear of future attacks catalysed a shift in focus for policymakers. Stricter rules around securing pipelines from cyber attacks were swiftly introduced, and the incident prompted the Biden administration to promote ransomware to ‘terrorism’ status. The attack was so bad that even DarkSide was forced to change its operation, namely introducing a moderation process following a massive backlash.

Kaseya supply chain attack cripples millions of devices

The summer months were marred with yet another mass-scale cyber attack, this time on Kaseya’s VSA product, a tool Managed Service Providers (MSPs) use to monitor their clients’ IT needs. The culprit, REvil, targeted a zero-day flaw in VSA specifically due to functionality that allowed IT managers to push updates to clients without intervention.

Ironically, Kaseya had been working with Dutch security firm DIVD CSIRT at the time to patch the flaw REvil eventually exploited; this was a race against the clock the researchers unfortunately lost. Kaseya first announced 50 customers were affected but, in reality, the ransomware hit more than 1,000 victims and crippled more than a million devices. This isn’t to mention REvil’s gargantuan reported ransom demand of $70 million (roughly £52 million) for supplying the universal decryptor.

What followed was a total shut down of VSA servers, with researchers eventually patching the three zero-day flaws that facilitated the attack. Opportunistic cyber criminals, though, persisted by capitalising on the mayhem with specialised phishing campaigns purporting to supply system-fixing updates from Kaseya. Weeks later, Kaseya obtained a decryptor through a third party, insisting no payment was made.

Curiously, REvil shut down days after the attack; its servers and website were rendered offline. The group, however, returned in September by reopening its ‘Happy Blog’ – a site on which victims who refuse to pay are named and ‘shamed’ – before vanishing again in light of a Europol-led sting operation.

PrintNightmare: A comedy of errors

The aptly-named PrintNightmare fiasco arose at the start of July after a devastating misunderstanding led to a reputable cyber security vendor, Sangfor, inadvertently publishing a working exploit for an unpatched vulnerability.

Microsoft had initially patched a privilege escalation vulnerability in its Print Spooler component on 8 June as part of its routine Patch Tuesday wave of updates. The firm, however, two weeks later upgraded the severity of the bug to remote code execution (RCE). The vulnerability in question allowed attackers to install applications, view, change or delete data, or create new accounts with full privileges on targeted devices.

Sangfor researchers, meanwhile, were conducting their own research into Print Spooler vulnerabilities, ahead of a presentation at the Black Hat cyber security conference in August. When Microsoft upgraded the severity of the now-patched PrintSpooler flaw, the researchers published a proof-of-concept exploit for an RCE flaw ahead of time, mistakenly believing this to be the same vulnerability that Microsoft had patched in June.

By the time Sangfor realised this mistake and took its report down, the exploitation was already being distributed across the hacking community.

Microsoft promptly issued a patch, but this ultimately proved unsuccessful, after another researcher published a workaround. Then, the firm released a working patch on its second attempt on 13 July, alongside fixes for 117 other flaws.

Emotet buried by Europol – then rises from the ashes

Emotet was undoubtedly one of the most devastating strains of malware ever authored; at its peak, it provided an access point for up to 70% of malware strains in global circulation. The infamous banking Trojan’s significance and effectiveness was incontrovertible, but Christmas came late for security teams in January as a coordinated law enforcement effort, led by Europol, took it down for good.

That was, at least, the line they touted at the time. Europol officers, alongside colleagues from the UK, US, and France, seized several hundred servers comprising Emotet’s infrastructure. It was a huge relief, given the malware was, as of a month earlier, affecting up to 100,000 users per day. German authorities later used the seized Emotet servers to uninstall the Trojan from infected devices – a dagger to the heart.

This brief period of bliss lasted just six months, however, with researchers discovering a retooled iteration of Emotet re-emerging in the wild. Back with better-protected code and infrastructure, security experts are now, once again, on high alert, warning staff of the telltale signs of Emotet-infected emails. Whether this resurgent strain becomes as prolific as its predecessor remains to be seen, but it’s certainly a comeback that’s sent shockwaves through the security community.

Log4Shell is a genuine nightmare before Christmas

Discovered just weeks before the year’s end as a glitch in Minecraft, of all places, chatter continues to run rife in the infosec community about just how dangerous the flaw known as Log4Shell could be.

Log4Shell is a zero-day vulnerability in the popular log4j 2 library, a logger that’s almost ubiquitous in global Java apps and enterprise products. Apache frameworks, including Apache Struts2, Apache Solr, Apache Druid, and Apache Fline, are thought to be particularly vulnerable. There are, however, products being found to be vulnerable with each day that passes since its 9 December discovery.

While the vast majority of products written in Java are thought to be vulnerable to the RCE tracked as CVE-2021-44228, the true breadth of the attack surface is still yet to be confirmed and isn’t likely to be fully realised for months, according to experts. Attackers, however, can certainly utilise a long-known exploitation method known as Java Naming and Directory Interface (JNDI) injection to achieve RCE.

There are currently no known major exploitations of the vulnerability, but early evidence points to Mirai botnets being launched using vulnerable infrastructure, with other attacks likely. To that effect, Check Point researchers observed more than 800,000 attack attempts using the vulnerability within 72 hours of disclosure. With patches available, it’s set to be a turbulent and anxious few weeks for cyber security professionals across the globe as the industry watches the prospective horrors unfold.

The scale of the threat associated with the recently discovered Log4Shell vulnerability has been quantified for the first time, with nearly 1 million attack attempts launched in just 72 hours following the critical vulnerability's disclosure on 9 December.

Experts from Check Point Research published observations from early vulnerability scans on Tuesday, which revealed attempts to exploit systems vulnerable to Log4Shell increased from 40,000 in the immediate 12-hour period following disclosure, to 830,000 attempts after just three days.

Researchers said the vulnerability "is clearly one of the most serious vulnerabilities on the internet in recent years, and the potential for damage is incalculable". The security community is still scrambling to fully understand the attack surface for Log4Shell, the RCE vulnerability in the log4j Java logging component revealed last week.

"The number of combinations of how to exploit it give the attacker many alternatives to bypass newly introduced protections," researchers said. "It means that one layer of protection is not enough, and only multi-layered security posture would provide a resilient protection. Three days after the outbreak, we are summing up what we see until now, which is clearly a cyber pandemic that hasn’t seen its peak yet."

The industry has banded together to share quick fixes and easy ways to remediate issues in the enterprise, but research has shown attackers are finding new ways to exploit the vulnerability.

Check Point Research said it has seen a steady increase in exploit evolutions over the course of 72 hours since Log4Shell's discovery, with more than 60 different methods already in use.

Findings from their investigation are said to resemble a cyber pandemic, in which attacks spread quickly and evolve continually to break through attempted fixes.

Who is most vulnerable to Log4Shell?

The investigation also looked at corporate exposure to Log4Shell and concluded that a global average of 40% of all networks across the world could be vulnerable to log4j flaws.

Australia and New Zealand were found to be the most exposed at 46.2% of all corporate networks, with Europe close behind with 42.2%. Asia and North America are the least exposed at 37.7% and 36.4% respectively.

Value-added resellers and the education sectors were found to be particularly vulnerable compared to other industries, with around half of all organisations across the two sectors thought to be affected.

Unlike with the COVID-19 pandemic, the retail and hospitality sectors are thought to be the least affected, with around a quarter of organisations exposed to log4j-based attacks.

There is significant pressure felt by security teams across the globe to fully patch the vulnerability. Upgrading to the latest version of the log4j library, version 2.15.0, is so far the best mitigation against the flaw.

Also this week, the US' Cybersecurity and Infrastructure Security Agency (CISA) told all federal agencies they had until 24 December to patch systems and protect them from Log4Shell.

It follows a recent increase in focus on patch management across the US public sector, led by CISA, after the agency issued deadlines to all federal departments in November to patch a 300-strong list of major cyber security vulnerabilities. The first deadline passed weeks later but CISA declined to confirm to IT Pro if all federal agencies had met the requirements in time.

Check Point Research said it thinks the vulnerability in the log4j library "will stay with us for years to come" due to the complexity in patching it and the ease in which attackers can exploit it.

Log4Shell, the critical vulnerability disclosed in the Apache Log4j logging library in December 2021, remains one of the most impactful and persistent security flaws in modern software history, even now.

Assigned the identifier CVE‑2021‑44228 and a maximum CVSS score of 10, the flaw enabled remote code execution by exploiting how Log4j handled Java Naming and Directory Interface (JNDI) lookups, letting attackers inject arbitrary code into affected systems with minimal effort.

Following the initial disclosure, threat actors globally began scanning and exploiting the flaw at scale, with some estimates suggesting more than 100 attempted attacks per minute at its peak.

Apache responded quickly with a series of patches, but the vulnerability's presence in countless Java applications – including those embedded deep within software supply chains – has made complete eradication elusive.

Several years on, Log4Shell continues to pose a serious risk. Nearly 4,000 organizations remain vulnerable due to outdated components, unpatched systems, and inadequate dependency management, highlighting systemic issues in software maintenance and long-term remediation.

How big is the problem?

In 2025, Log4Shell remains a significant security concern. A December 2023 report by Veracode found that nearly 3,900 organizations were still using vulnerable Log4j versions across more than 38,000 applications.

Of those, 2.8% were running versions directly affected by the original Log4Shell flaw, and 3.8% were using 2.17.0, which contains a separate critical vulnerability (CVE‑2021‑44832). Notably, 32% of applications relied on Log4j 1.x, which has been deprecated since 2015 and is affected by several unresolved vulnerabilities.

Runtime telemetry from Contrast Security in late 2024 adds further context: 12% of Java applications still use vulnerable Log4j builds, with some seeing over 4,000 exploit probes each month, and unprotected apps faced, on average, more than two successful exploit attempts per month.

In December 2025, Sonatype found 14% of Log4j downloads in the UK were still vulnerable, with 13% worldwide found to contain the vulnerability despite the commonality of the safe variant.

Why are organizations still vulnerable?

Despite the availability of patches and intense scrutiny following the initial disclosure, many organizations remain exposed to Log4Shell due to a mix of technical, operational, and structural challenges.

One of the most persistent issues is dependency sprawl. Log4j is often embedded deep within software supply chains, making it difficult for IT teams to detect and remediate vulnerable instances.

Even when organizations are aware of the issue, patching can be complicated by compatibility concerns, legacy codebases, or the risk of disrupting production systems.

Developer behavior is also a contributing factor. A Veracode study found that 79% of developers never update a third-party component after its initial inclusion. This inertia, combined with inconsistent dependency management practices, allows vulnerable versions of Log4j to persist across environments for years.

Ongoing exploitation and real-world risk

While exposure alone is concerning, the continued exploitation of Log4Shell highlights the urgency of the issue. In short, threat actors have not moved on.

The continued presence of vulnerable Log4j instances across enterprise systems has kept Log4Shell a viable attack vector. Its widespread use in Java applications, particularly those with complex dependency trees, means attackers can still rely on it to breach environments with minimal effort.

Rather than large-scale campaigns, exploitation has become more targeted and opportunistic. Threat actors increasingly use Log4Shell to gain initial access before pivoting to broader objectives, such as lateral movement, credential harvesting, or data exfiltration.

In some cases, the vulnerability has been used to deploy crypto‑mining tools or maintain long-term persistence through web shells and backdoors.

Security researchers have observed that some attackers are specifically scanning for older Log4j 1.x deployments, knowing these are often overlooked in patching efforts and more likely to reside in legacy systems.

National security agencies, including CISA, continue to classify Log4Shell as a top-tier threat due to its ease of use and long tail of exploitation. Its persistence in attacker playbooks underscores the broader risks of unpatched software and the limitations of reactive security models.

A case study in failed remediation

Log4Shell has become a defining example of how even widely publicised vulnerabilities can persist for years when underlying remediation processes break down.

Despite near-universal awareness and the availability of patches within days of disclosure, long-term exposure has remained common across industries, geographies, and system types.

Part of the challenge lies in the structure of modern software development. Applications frequently rely on dozens or even hundreds of third-party components, many of which are nested deep within dependency trees.

Logging utility Log4j was often pulled in automatically by other libraries. As a result, many organizations were unaware they were using it at all. This lack of visibility has been a recurring theme in vulnerability management failures.

More fundamentally, Log4Shell has exposed the fragility of existing patching practices. Many organizations lack effective mechanisms to track, test, and update dependencies at scale.

Security teams are often overburdened, and patch cycles prioritise immediate operational concerns over longer-term risk reduction. As a result, even critical flaws with simple fixes can remain unresolved for months or even years.

Log4Shell’s persistence serves as a warning: disclosure and awareness alone are not enough. Without structural improvements in dependency management, vulnerability monitoring, and patch governance, similar risks will continue to resurface.

What organizations should do?

While many security teams addressed Log4Shell shortly after its disclosure, the continued presence of vulnerable systems shows that one-off responses are not enough. Organizations must treat it not just as a vulnerability, but as a broader lesson in sustainable security hygiene.

Visibility is the priority. Teams should use software composition analysis (SCA) tools and maintain a software bill of materials (SBOM) to identify where Log4j – or any other vulnerable component – exists in their environments, including indirect dependencies and container images.

Where Log4j is still in use, remediation should follow quickly. For Log4j 2.x, this means upgrading to version 2.17.1 or later. For Log4j 1.x, migrating to a supported logging framework is essential, even if it requires significant code changes. Mitigations alone are not sufficient.

Defensive layers also matter. Runtime protections – such as egress filtering, EDR, and intrusion prevention – can detect or block exploitation attempts. These should be backed by effective logging and alerting.

Finally, organizations must improve long-term dependency management. Automated update pipelines, regular auditing, and security checks in CI/CD workflows reduce the risk of repeat incidents.

While Log4Shell emerged in 2021, its legacy demands systemic change, not just patching.

Mozilla is shipping a security technology with Firefox 95 that it hopes will stop zero-day attacks targeting users of the browser.

Called RLBox, the new feature will take a more granular approach to sandboxing, a security approach that runs website code in its own walled-off section of memory to avoid malicious components affecting the rest of the system.

In a blog post announcing the feature, Mozilla distinguished engineer Bobby Holley highlighted a problem with existing browser sandboxing technology, which isolates web site processes in individual sandboxes, and is vulnerable to chained attacks.

Malware developers can compromise the process first, and then escape the sandbox, it warns. It also limits the extent to which code can be separated into different sandboxed processes because of the memory overhead involved.

Developed in conjunction with the University of California San Diego and the University of Texas, RLBox complements process-based isolation with a new approach. It compiles code as native code via WebAssembly, which is a portable compilation format.

This makes each separately compiled piece of native code safer, because it can't access memory outside of a specified region and can't make any unexpected jumps. The new approach makes it possible to run different pieces of trusted and untrusted code in the same process without them affecting each other.

"RLBox is a big win for us on several fronts: it protects our users from accidental defects as well as supply-chain attacks, and it reduces the need for us to scramble when such issues are disclosed upstream," said Holley.

RLBox is a stand-alone project that Mozilla first trialed on macOS and Linux users last year. It is now deploying it across all Firefox platforms, including mobile systems.

Mozilla will begin with RLBox support for the Graphite font rendering system, the Hunspell spell checker, and the Ogg multimedia container format in Firefox 95. It will follow this up in Firefox 96 with support for the Expat XML parser and Woff2, the font compression technology used in the browser.

"Going forward, we can treat these modules as untrusted code, and — assuming we did it right — even a zero-day vulnerability in any of them should pose no threat to Firefox," Holley said. He also hoped that other browsers would adopt the open-source technology.

Mozilla has updated its bug bounty program to reward researchers for escaping the sandbox technology without exploiting vulnerabilities in an isolated component.