Week of October 17, 2022: Daixin Team Ransomware Advisory and Apache Commons Text Flaw

The week of October 17, 2022 saw CISA, the FBI, and HHS issue a joint advisory on the Daixin Team ransomware group targeting U.S. healthcare organizations, alongside CISA's addition of two actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog. Security teams also tracked Oracle's 366-vulnerability Critical Patch Update, a Cisco Identity Services Engine fix, a newly disclosed Apache Commons Text flaw drawing Log4Shell comparisons, and a data breach disclosed by online wine retailer iDealwine.

CISA, FBI, HHS Warn on Daixin Team Ransomware Targeting Healthcare

CISA, the FBI, and the Department of Health and Human Services published a joint advisory on October 21, 2022 describing the Daixin Team, a ransomware and data-extortion group that has targeted U.S. healthcare organizations since June 2022. The advisory detailed how the group gained initial access through virtual private network servers, moved laterally using SSH and RDP, and encrypted VMware ESXi servers with ransomware based on leaked Babuk Locker source code. It also described exfiltration of patient data using tools such as Rclone and Ngrok, and urged healthcare organizations to apply multifactor authentication and patch VPN systems. (CISA)

CISA Adds Two Vulnerabilities to Known Exploited Vulnerabilities Catalog

On October 20, 2022, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The addition falls under Binding Operational Directive 22-01, which requires federal civilian executive branch agencies to remediate catalog entries by set deadlines to reduce exposure to active threats. CISA reiterated that although the directive applies only to federal agencies, all organizations should prioritize timely remediation of catalog vulnerabilities as part of routine vulnerability management, given that these flaw types remain a frequent attack vector for malicious cyber actors targeting enterprise networks. (CISA)

Cisco Patches Identity Services Engine Vulnerabilities

Cisco released a security update on October 21, 2022 addressing vulnerabilities in its Identity Services Engine (ISE) platform. CISA said a remote attacker could exploit some of the flaws to take control of an affected system and pointed administrators to Cisco's advisory covering both high- and low-severity issues. CISA encouraged users and administrators running ISE, which many enterprises rely on for network access control, to review the Cisco advisory identified as cisco-sa-ise-path-trav-Dz5dpzyM and apply the necessary updates without delay. (CISA)

Oracle Ships October 2022 Critical Patch Update Covering 366 Flaws

Oracle released its quarterly Critical Patch Update on October 19, 2022, addressing 366 vulnerabilities spread across its product portfolio. CISA flagged that a remote attacker could exploit some of the issues to take control of an affected system and encouraged administrators to review Oracle's bulletin and apply the necessary mitigations promptly. The scale of the update underscored the breadth of Oracle's footprint across enterprise database, middleware, and application environments that security teams needed to prioritize for patching that week. (CISA)

CISA Updates Zimbra Collaboration Suite Advisory With New Malware Report

CISA and the Multi-State Information Sharing & Analysis Center updated joint advisory AA22-228A on October 19, 2022, adding a new Malware Analysis Report covering threat actors exploiting multiple CVEs against Zimbra Collaboration Suite. The original advisory had been released on August 16, 2022, and the update gave defenders fresh technical detail tied to ongoing exploitation of the email and collaboration platform. CISA again urged organizations running Zimbra to review the advisory and apply the recommended mitigations to reduce exposure to continued targeting of the product. (CISA)

Apache Commons Text Flaw Disclosed, Draws Log4Shell Comparisons

Security researchers spent the days around October 19, 2022 examining CVE-2022-42889, a newly patched vulnerability in the Apache Commons Text library that allows arbitrary code execution through variable interpolation lookups such as script, dns, and url. Proof-of-concept exploits appeared online, and the flaw was informally dubbed Text4Shell, prompting comparisons to Log4Shell. Researchers from Rapid7 and Sophos concluded exploitation would be rarer than Log4Shell because fewer applications pass untrusted input to the vulnerable component, and recommended organizations upgrade to Commons Text version 1.10.0. (Help Net Security)

Fine Wine Retailer iDealwine Discloses Data Breach

French online wine retailer iDealwine disclosed a data breach that occurred over the weekend before October 19, 2022, taking its e-shop offline and emailing affected customers. The company said names, addresses, phone numbers, and email addresses may have been exposed, while encrypted passwords and payment data, which it does not store, were not compromised. iDealwine said it notified data privacy regulators in France and the UK and engaged outside experts, though it had not disclosed how many customers were affected or whether ransomware was involved. (Help Net Security)