TL;DR
- Zero-Day Vulnerability Exploited to Launch Largest DDoS Attacks in History
- FBI and CISA Share AvosLocker Ransomware Attack Details and Defense Tips
- ShellBot Uses Hex IPs to Evade Detection in Attacks on Linux SSH Servers
- Microsoft Phases Out VBScript: What It Means for Cybersecurity
- Curl Vulnerabilities: A Mixed Bag of Risks and Hype
Zero-Day Vulnerability Exploited to Launch Largest DDoS Attacks in History
- Unprecedented Scale: The HTTP/2 Rapid Reset attack has set new records for DDoS attacks, peaking at 398 million requests per second (RPS) on Google's network. Cloudflare reported an attack three times larger than their previous record, reaching 201 million RPS.
- Exploitation Technique: Attackers abuse the HTTP/2 feature called "stream cancellation." They send a request and then immediately cancel it, overwhelming servers. This method is highly efficient, requiring only a small botnet to launch massive attacks.
- Industry Response: Cloudflare, Google, and AWS have implemented additional mitigations. They've also coordinated disclosure to web server vendors, who are working on patches. The vulnerability is tracked as CVE-2023-4487 with a high severity rating.
- Mitigation and Risk: Any server or application running the standard implementation of HTTP/2 is at risk. Immediate action is recommended: apply vendor patches and consider using DDoS mitigation services.
FBI and CISA Share AvosLocker Ransomware Attack Details and Defense Tips
- Tactics and Tools: AvosLocker uses a mix of open-source and legitimate software for attacks. Notable utilities include AnyDesk for remote access, Cobalt Strike for command and control, and Mimikatz for credential theft.
- Stealth and Movement: The ransomware employs "living-off-the-land" tactics, using native Windows tools like PSExec and custom PowerShell scripts for lateral movement and privilege escalation.
- Double Extortion: AvosLocker not only encrypts files but also exfiltrates them, adding a layer of extortion. The group uses custom web shells and batch scripts to disable security measures.
- Defensive Measures: The FBI and CISA recommend network segmentation, limiting remote desktop services, and implementing multi-factor authentication as key defensive strategies.