Brief #45: NHS Ransomware, XZ Utils Backdoor, PyPI Malware Flood

Week 13 already? Time flies!

In this week's cybersecurity roundup, we cover critical vulnerabilities in XZ Utils and Microsoft Edge, thousands of exposed Exchange servers in Germany, an NHS ransomware attack, and a flood of malicious PyPI packages.

🌐 This Week in Cybersecurity

UK's NHS Suffers Ransomware Attack, Patient Data Leaked

Ransomware Group Publishes Patient Data: A known ransomware group has published clinical data relating to a small number of patients from NHS Dumfries and Galloway. This follows a recent cyber attack on the health board's IT systems where hackers accessed a significant amount of data, including patient and staff information.
Services Running Normally, Investigation Ongoing: Despite the attack, patient-facing services at NHS Dumfries and Galloway continue to function normally. The health board is working with Police Scotland, the National Cyber Security Centre, the Scottish Government, and other agencies to investigate the incident, assess the full extent of the data breach, and prevent further data sharing.
Patients Contacted, Advised to Stay Vigilant: NHS Dumfries and Galloway will contact patients whose data has been leaked. All patients and staff are advised to be on guard for anyone trying to access their systems or claiming to have their personal information. Any such incidents should be reported to Police Scotland immediately.

Critical Backdoor Discovered in XZ Utils Affecting Most Unix Distributions

Severity: A highly critical backdoor (CVE-2024-3094) with a CVSS score of 10.0 was found in XZ Utils versions 5.6.0 and 5.6.1, allowing potential unauthorized remote access.
Impact: The malicious code, introduced through obfuscated commits, interferes with the sshd daemon via systemd. Under certain circumstances, it could enable threat actors to break sshd authentication and gain full remote system access. Fedora 41, Fedora Rawhide, and some Debian testing/unstable versions were impacted.
Detection: OSS Security has shared a script to detect vulnerable versions on the system. Scroll down to detect.sh.
Mitigation: Red Hat and Debian have reverted to the safe 5.4.x XZ Utils versions in their repositories. CISA advises all users to downgrade to an uncompromised version (e.g., 5.4.6 Stable) immediately and monitor for suspicious activity. The backdoored XZ Utils GitHub repo has been disabled.

🛠️ Security Tools

RedEye - A visual analytic tool that supports both Red and Blue Team operations, facilitating advanced analysis.

SharpEDRChecker - Checks for the presence of defensive products like AVs, EDRs, and logging tools in running processes, DLLs, services, and drivers.

AzureC2Relay - An Azure Function that validates and relays Cobalt Strike beacon traffic, aligning with the Cobalt Strike Malleable C2 profile.

🚀 Startup Watch

StealthMole, an AI-powered dark web intelligence startup, has raised $7 million in Series A funding to expand its R&D centers and support more commercial uses of its technology in monitoring cyber threats and detecting cybercrime.

Coro, an Israeli cybersecurity startup, has raised $100 million in a Series D funding round, bringing its total funding to $255 million over the past two years.

Symmetry Systems, a data store and object security provider, has raised $15 million in a Series A funding round led by ForgePoint Capital and Prefix Capital. The company's DataGuard solution offers unified visibility and access control over data assets across hybrid cloud environments, helping organizations manage data risks and maintain compliance.

📚 Recommended Reads

The Oligo research team has recently discovered an active attack campaign targeting a vulnerability in Ray, a widely used open-source AI framework. Thousands of companies and servers running AI infrastructure are exposed to the attack through a critical vulnerability that is under dispute and thus has no patch.

Super interesting write-up and in-depth analysis of the Lucee CFML server, uncovering critical vulnerabilities that could lead to remote code execution and potential supply chain attacks. Through their persistent efforts, the authors successfully achieved RCE on Apple's production server running Lucee, responsibly disclosed the findings, and worked with the Lucee team to implement necessary fixes, underscoring the importance of collaborative security research.

Unsaflok is a series of critical security vulnerabilities in dormakaba's Saflok electronic RFID locks, impacting over 3 million hotel doors in 131 countries and allowing attackers to unlock all rooms using a single pair of forged keycards.

If this sparked your interest, I'd love to hear from you in the comments. Stay tuned for more and consider following me on LinkedIn and X.

Nikoloz

Brief #45: NHS Ransomware, XZ Utils Backdoor, PyPI Malware Flood

🌐 This Week in Cybersecurity

UK's NHS Suffers Ransomware Attack, Patient Data Leaked

Critical Backdoor Discovered in XZ Utils Affecting Most Unix Distributions

PyPI Temporarily Suspends New Projects and Users After Flood of Malicious Package Uploads

Thousands of Microsoft Exchange Servers in Germany Vulnerable to Critical Flaws

Microsoft Edge Vulnerability Allowed Silent Extension Installation

🛠️ Security Tools

🚀 Startup Watch

📚 Recommended Reads

Query this dataset from your own AI.