Greetings from week 14!
In this week's cybersecurity roundup I cover critical incidents and developments, from the discovery of severe HTTP/2 vulnerabilities to the emergence of new malware strains like Latrodectus and JSOutProx, as well as insights from the US Cyber Safety Board's report on a preventable Microsoft Exchange Online intrusion.
🌐 This Week in Cybersecurity
New JSOutProx Malware Targets Financial Institutions in APAC and MENA
- Sophisticated Attack Framework: JSOutProx, first identified in 2019, is a complex malware that utilizes both JavaScript and .NET to interact with a core module on the victim's machine, enabling it to load various plugins for additional malicious activities.
- Abuse of GitHub and GitLab: The recent campaign, detected in February 2024, involved the actors hosting malicious payloads on GitHub and GitLab repositories, disguising them as PDF files to evade detection. The repositories were quickly removed and recreated to manage multiple payloads and targets.
- Expanded Targeting: While previously attributed to SOLAR SPIDER's phishing campaigns targeting financial institutions across Africa, the Middle East, South Asia, and Southeast Asia, the new version of JSOutProx has broadened its scope to the APAC and MENA regions, intensifying the cybercriminal footprint.
- Main Features: The JSOutProx malware features complex obfuscation and a modular plugin architecture, enabling it to execute various malicious actions such as shell command execution, file manipulation, persistence, and remote control. The malware's unique use of the Cookie header field in its C2 communications and the targeting of government and financial organizations in multiple countries suggest that it may have been developed by actors from China or those affiliated with it.
US Cyber Safety Board Releases Report on Preventable Microsoft Exchange Online Intrusion by China-Linked Hackers
- Intrusion Details: In July 2023, Microsoft reported an intrusion into its Exchange Online system by Storm-0558, a hacking group affiliated with the People's Republic of China. The CSRB conducted a 7-month independent review of the incident.
- Key Findings: The CSRB found that the intrusion was preventable and stemmed from Microsoft's deprioritization of enterprise security investments and rigorous risk management. The report recommends Microsoft develop a public plan with timelines for making fundamental, security-focused reforms.
- Recommendations for Cloud Providers: The CSRB recommends cloud service providers implement modern control mechanisms, baseline security practices, default audit logging standards, emerging digital identity standards, and transparent incident/vulnerability disclosure practices. Providers should also develop more effective victim notification and support.
- Recommendations for Government: The report advises updating the FedRAMP authorization program, establishing a process for discretionary special reviews of Cloud Service Offerings after high-impact incidents, and having NIST incorporate feedback on observed cloud security threats and incidents into its standards and frameworks.
HTTP/2 CONTINUATION Flood Vulnerabilities Enable Severe DoS Attacks
- New HTTP/2 vulnerabilities discovered: Researcher Barket Nowotarski identified "CONTINUATION Flood" vulnerabilities in various HTTP/2 implementations that can lead to denial of service (DoS) attacks.
- Improper handling of CONTINUATION frames: Many HTTP/2 implementations do not properly limit or check CONTINUATION frames, which are used for stitching fragmented header blocks. Attackers can send an extremely long string of frames without setting the 'END_HEADERS' flag, causing server crashes due to out-of-memory conditions or CPU resource exhaustion.
- Severe impact across multiple implementations: Several HTTP/2 implementations are affected, including Node.js, Envoy, Tempesta FW, amphp/http, Go's net/http and net/http2 packages, Apache Httpd, Apache Traffic Server, and Envoy. The vulnerabilities can cause memory leaks, excessive memory consumption, and CPU exhaustion, potentially crashing servers with a single TCP connection in some cases.