Week of January 30, 2023: Ukraine Wiper Surge and Critical OAuth, QNAP, Jira Flaws

Security leaders tracked a fresh wave of Sandworm-linked wiper malware against Ukrainian organizations, a verified-OAuth phishing campaign that infiltrated Office 365 accounts in the UK and Ireland, and critical vulnerabilities disclosed in OpenEMR, QNAP NAS devices, Cisco industrial gear and Atlassian's Jira Service Management. CISA also published its 2022 Year in Review and a new Industrial Control Systems advisory, giving CISOs fresh patching priorities and a benchmark on the agency's strategic direction heading into 2023.

Sandworm-Linked Wipers Hit Ukrainian Targets

ESET researchers disclosed a new wiper malware named SwiftSlicer, attributed to the Sandworm threat group, deployed via Active Directory group policy objects against a Ukrainian organization. Separately, Ukraine's CERT-UA confirmed that an earlier attack on the National News Agency of Ukraine, Ukrinform, used multiple wiper families including CaddyWiper, ZeroWipe, AwfulShred and BidSwipe alongside the legitimate SDelete utility in an attempt to destroy systems running Windows, Linux and FreeBSD. CISOs overseeing infrastructure with exposure to the region took note of the expanding wiper toolset. (Help Net Security)

Critical OpenEMR Flaws Exposed Patient Records

Researcher Dennis Brinkrolf publicly documented three chainable vulnerabilities in OpenEMR, the open-source electronic health record platform used by more than 100,000 medical providers, that could let an unauthenticated attacker read arbitrary files, including credentials and backups, and ultimately achieve code execution on a vulnerable server. The OpenEMR Foundation had already patched the flaws in version 7.0.0 after Brinkrolf's private report in November 2022, but the public disclosure during this period gave healthcare CISOs a concrete reason to confirm upgrades across their environments. (Help Net Security)

Verified OAuth Apps Used to Breach O365 Accounts

Microsoft disclosed that attackers used three rogue third-party OAuth applications, carrying a "Publisher identity verified" badge, to target Office 365 accounts primarily at organizations in the UK and Ireland, including financial and marketing staff and executives. The apps impersonated single sign-on and meeting tools and had fraudulently obtained the trusted badge through Microsoft's Cloud Partner Program. Microsoft disabled the applications and notified affected customers, and urged organizations to restrict user consent to apps with verified publishers and low-risk permissions. (Help Net Security)

QNAP Patches Critical NAS Vulnerability

QNAP Systems fixed CVE-2022-27596, a critical SQL injection vulnerability affecting the QTS and QuTS hero operating systems on its network-attached storage devices, that could let remote attackers access, modify or delete data without needing credentials. QNAP said there was no public exploit or evidence of in-the-wild abuse at the time it shipped fixes in QTS 5.0.1.2234 and QuTS hero h5.0.1.2248 builds. A follow-up update citing Censys found at least 29,968 internet-facing QNAP NAS devices remained potentially exposed, prompting administrators to prioritize the patch. (Help Net Security)

Cisco Patches Persistent Code-Injection Flaw in Industrial Gear

Cisco released patches for CVE-2023-20076, a high-severity command injection vulnerability in the IOx application hosting environment used across its 800 Series Industrial ISRs, IC3000 Industrial Compute Gateways, IOS XE devices and Catalyst access points. Trellix researchers who found the flaw in a Cisco ISR 4431 router warned that exploitation bypasses Cisco's usual persistence protections, letting malicious code survive a reboot or firmware update until the device is factory reset. No workarounds existed, and Cisco said fixes for two remaining device families would follow later in the month. (Help Net Security)

Atlassian Fixes Critical Jira Service Management Auth Bypass

Atlassian released patches for CVE-2023-22501, a critical authentication vulnerability in Jira Service Management Server and Data Center versions 5.3.0 through 5.5.0, that could let an attacker with write access to a user directory impersonate another user through intercepted signup tokens. Atlassian said it had no visibility into whether the flaw had been exploited on customer instances and advised administrators to upgrade immediately, then audit accounts for password changes and unusual activity even on internet-isolated deployments. (Help Net Security)

CISA Publishes 2022 Year in Review

CISA released its 2022 Year in Review, with Director Jen Easterly highlighting the agency's growth in capability and capacity over the year and its collaboration with industry and government partners to reduce risk to the nation's cyber and physical infrastructure. The report was organized around the four goals of CISA's first Strategic Plan: Cyber Defense, Risk Reduction and Resilience, Operational Collaboration, and Agency Unification, giving CISOs a benchmark for how the agency positioned its priorities heading into 2023. (CISA)

CISA Issues ICS Advisory for Delta Electronics DOPSoft

CISA published an Industrial Control Systems advisory covering Delta Electronics DOPSoft, offering technical detail and mitigations for a vulnerability affecting software used in industrial environments. The release was part of CISA's routine weekly ICS advisory output, giving asset owners and operators in manufacturing and critical infrastructure sectors specific guidance to review and apply ahead of potential exploitation attempts against affected deployments. (CISA)