Week of August 28, 2023: QakBot Takedown and Infamous Chisel Malware Exposed

Security leaders tracked the CISA-FBI disclosure of QakBot's command-and-control infrastructure following an August 25 law-enforcement takedown, a joint US-UK report on Sandworm's Infamous Chisel malware targeting Ukrainian military Android devices, and a disclosed SIM-swapping breach at Kroll that exposed FTX, BlockFi, and Genesis client data. The same stretch brought critical patches from VMware, a working exploit chain for Juniper firewalls, active ransomware exploitation of Citrix NetScaler appliances, and a CISA warning on hurricane-themed phishing scams.

Kroll SIM-Swap Attack Exposed FTX, BlockFi, Genesis Client Data

On August 28, 2023, financial and risk advisory firm Kroll disclosed that a SIM-swapping attack against a Kroll employee's T-Mobile account, carried out on August 19, 2023, gave a threat actor access to files containing personal information of bankruptcy claimants tied to FTX, BlockFi, and Genesis. Exposed data included names, addresses, email addresses, and account balances or claims. Kroll notified affected individuals and warned that phishing emails targeting FTX account holders followed the breach, while stating no other Kroll systems were affected. (Help Net Security)

CISA and FBI Detail QakBot Infrastructure After Takedown

On August 30, 2023, CISA and the FBI published a joint cybersecurity advisory, AA23-242A, disseminating indicators of compromise for QakBot infrastructure following a coordinated disruption operation the FBI and international partners executed on August 25, 2023. The advisory detailed QakBot's three-tier command-and-control structure, noted that 853 supernodes across 63 countries had been identified as of mid-June 2023, and cautioned that the botnet takedown did not remove ransomware or other malware QakBot had already installed on victim machines. (CISA)

US, UK, and Allies Expose Infamous Chisel Malware Targeting Ukrainian Military Androids

On August 31, 2023, CISA, the FBI, NSA, and cyber agencies from the UK, Australia, Canada, and New Zealand published a joint malware analysis report on Infamous Chisel, mobile malware that targeted Android devices used by the Ukrainian military. The agencies attributed the campaign to Sandworm, linked to the Russian GRU's Main Centre for Special Technologies. Infamous Chisel provided network backdoor access via Tor and SSH, and could scan files, monitor network traffic, and periodically exfiltrate sensitive information from compromised devices, according to the report. (CISA)

VMware Fixes Critical Authentication-Bypass Bug in Aria Operations for Networks

On August 30, 2023, VMware patched a critical vulnerability, CVE-2023-34039, and a high-severity vulnerability, CVE-2023-20890, in its Aria Operations for Networks monitoring tool. CVE-2023-34039 resulted from a lack of unique cryptographic key generation and could let an attacker with network access bypass SSH authentication to reach the product's command-line interface. CVE-2023-20890 could let an authenticated administrator write files to arbitrary locations, resulting in remote code execution. VMware reported no indication of in-the-wild exploitation and urged customers running affected 6.x versions to update to version 6.11.0. (Help Net Security)

Proof-of-Concept Exploit Published for Unauthenticated RCE Chain in Juniper Firewalls

On August 28, 2023, researchers published technical details and a working proof-of-concept exploit chaining four Juniper Networks Junos OS vulnerabilities affecting SRX firewalls and EX switches, tracked as CVE-2023-36846, CVE-2023-36847, CVE-2023-36844, and CVE-2023-36845. The flaws allowed unauthenticated file uploads through the J-Web interface and manipulation of PHP environment variables to achieve remote code execution. Juniper had issued an out-of-cycle bulletin earlier in August with no evidence of active exploitation, but a follow-up update on August 29, 2023 said the Shadowserver Foundation had already observed exploitation attempts against exposed devices. (Help Net Security)

Ransomware Actor Tied to Citrix NetScaler Exploitation Campaign

On August 29, 2023, researchers reported that a ransomware-focused threat actor had been exploiting unpatched, internet-facing Citrix NetScaler systems via CVE-2023-3519 to gain initial access into enterprise networks. The campaign, tracked since mid-August 2023, involved obfuscated PowerShell scripts, randomly named PHP webshells, and infrastructure hosted on BlueVPS ASN 62005. Analysts linked the tactics to a separate mid-summer intrusion that did not involve the Citrix flaw but shared the same command-and-control IP address and similar tooling, and urged organizations to check systems patched for CVE-2023-3519 for signs of prior compromise. (Help Net Security)

CISA Warns of Hurricane-Themed Phishing and Social Engineering Scams

On August 31, 2023, CISA issued an alert urging users and administrators to remain vigilant for malicious cyber activity following natural disasters such as hurricanes, noting that threat actors were targeting disaster victims and concerned citizens through phishing emails, malicious websites, and social engineering that impersonated trustworthy organizations including disaster-relief charities. The agency advised caution with disaster-related email subject lines, attachments, and hyperlinks, as well as skepticism toward related social media posts and text messages, pointing security teams to FTC and CFPB resources for further guidance. (CISA)