Week of September 26, 2022: Exchange Zero-Days Surface, Sophos Firewall RCE Exploited

Security leaders faced newly disclosed Microsoft Exchange Server zero-days added to CISA's Known Exploited Vulnerabilities Catalog alongside an actively exploited Sophos Firewall remote-code-execution flaw, forcing rapid mitigation work ahead of patches. Ransomware operators experimented with a data-corruption tactic layered onto the ALPHV/BlackCat toolkit, while CISA, VMware, and MITRE issued fresh guidance on ESXi malware, Zimbra exploitation, and a new 5G threat-modeling framework for defenders.

Microsoft Discloses Exchange Server Zero-Days Under Active Attack

Microsoft published customer guidance for two zero-day vulnerabilities, tracked as CVE-2022-41040 and CVE-2022-41082, affecting on-premises Exchange Server 2013, 2016, and 2019, noting that limited targeted attacks were already using them to gain access to systems. Microsoft Exchange Online remained unaffected. An attacker exploiting the flaws could take control of an affected system. CISA urged administrators to apply the mitigations Microsoft outlined while patches were being finalized, pointing organizations to both the customer guidance and a companion analysis of attacks using the two CVEs. (CISA)

CISA Adds Three Actively Exploited Flaws to KEV Catalog

CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog on September 30, 2022, citing evidence of active exploitation. The addition required Federal Civilian Executive Branch agencies to remediate the flaws by set deadlines under Binding Operational Directive 22-01, which established the catalog as a living list of CVEs carrying significant risk to the federal enterprise. CISA said such vulnerabilities are a frequent attack vector for malicious actors and urged all organizations, not just federal agencies, to prioritize remediation within their own vulnerability management practices. (CISA)

Sophos Patches Exploited Firewall RCE Flaw

Sophos patched an actively exploited remote code execution vulnerability, CVE-2022-3236, affecting the User Portal and Webadmin components of its Firewall product line. The company pushed the fix automatically to customers with the hotfix-installation feature enabled, covering Sophos Firewall v19.0 MR1 (19.0.1) and older, with remediated versions including v18.5 MR5 (18.5.5), v19.0 MR2 (19.0.2), and v19.5 GA. The flaw followed an earlier zero-day, CVE-2022-1040, in the same component. CVE-2022-3236 was added to CISA's Known Exploited Vulnerabilities Catalog, requiring federal civilian agencies to remediate it. (Help Net Security)

Ransomware Affiliates Tested Data-Corruption Tool Alongside ALPHV

Researchers from Symantec, Cyderes, and Stairwell identified a new version of the Exmatter data exfiltration tool, used alongside the multi-platform ALPHV (BlackCat) ransomware, that adds a data-corruption capability. The tool copies specific file types to attacker-controlled servers, then corrupts the originals by overwriting portions of one file with data from another before the ransomware itself runs. Researchers described the corruption module, built around a class called Eraser, as still under development and potentially unreliable, noting some files could be overwritten multiple times while others might never be processed. (Help Net Security)

VMware Issues Guidance on ESXi-Targeting Malware

VMware published guidance addressing three malware artifacts, dubbed VirtualPITA, VirtualPIE, and VirtualGATE, used to exploit and maintain persistent access on ESXi hypervisor instances. VirtualPITA runs on ESXi and Linux, VirtualPIE targets ESXi, and VirtualGATE targets Windows systems. CISA urged organizations running VMware ESXi to review VMware's guidance on protecting vSphere from specialized malware and its knowledge base article on unsigned vSphere Installation Bundles, along with vSphere security configuration guides, to apply mitigation and threat-hunting measures. (CISA)

CISA Updates Zimbra Exploitation Advisory With New Indicators

CISA and the Multi-State Information Sharing and Analysis Center updated joint advisory AA22-228A, covering threat actors exploiting multiple CVEs against Zimbra Collaboration Suite, first issued August 16, 2022. The update added further malware analysis reports and indicators of compromise tied to the ongoing exploitation. Separate CISA malware analysis reports released the same week detailed webshells, including a Godzilla webshell variant, recovered from compromised Zimbra servers, along with a script capable of executing shell commands supplied by an attacker. (CISA)

MITRE and DoD Launch FiGHT Framework for 5G Threat Modeling

MITRE and the Department of Defense announced the launch of FiGHT, the 5G Hierarchy of Threats adversarial threat model, intended to let organizations assess the confidentiality, integrity, and availability of 5G networks along with the devices and applications using them. Derived from MITRE ATT&CK and drawn from academic research and other frameworks, FiGHT models observed adversary behaviors in telecommunications environments and is meant to help stakeholders decide where to direct cyber investment as they build and deploy 5G systems. (Help Net Security)