Volt Typhoon exploits Versa zero-day.

Summary

By the CyberWire staff

At a glance.

Volt Typhoon exploits Versa zero-day.
Linux malware exploits udev rules to evade detection.
Greasy Opal's tools facilitate cyberattacks.

Volt Typhoon exploits Versa zero-day.

Researchers at Lumen Technologies' Black Lotus Labs discovered an actively exploited zero-day flaw (CVE-2024-39717) affecting the SD-WAN management platform Versa Director. Versa has issued a patch for the vulnerability, and users are urged to upgrade to version 22.1.4 or later. The flaw allows threat actors to execute code by uploading Java files disguised as PNG images.

The researchers found a custom-made web shell designed to exploit the vulnerability, which they attribute to the Chinese threat actor Volt Typhoon. Lumen states, "Analysis of our global telemetry identified actor-controlled small-office/home-office (SOHO) devices exploiting this zero-day vulnerability at four U.S. victims and one non-U.S. victim in the Internet service provider (ISP), managed service provider (MSP) and information technology (IT) sectors as early as June 12, 2024. The threat actors gain initial administrative access over an exposed Versa management port intended for high-availability (HA) pairing of Director nodes, which leads to exploitation and the deployment of the VersaMem web shell."

If you're on the front line, we've got your back.

Mark your calendar for mWISE™, the unique cybersecurity conference from Mandiant, now part of Google Cloud. Built by practitioners for practitioners, it runs from September 18–19, 2024 in Denver, Colorado.

What makes mWISE different from other cybersecurity conferences? It’s a targeted event with hands-on learning for frontline practitioners. The intimate setting allows you to make one-on-one connections with leaders in the field. And best of all, it’s focused on learning without the sales pitches.

Linux malware exploits udev rules to evade detection.

Researchers at Stroz Friedberg, a risk management firm owned by Aon Insurance, discovered a stealthy strain of Linux malware dubbed "sedexp" that uses udev rules to maintain persistence. Udev is a device manager for the Linux kernel that handles device nodes in the /dev directory. The sedexp malware exploits udev rules "to execute every time a specific device event occurs, making it stealthy and difficult to detect." The researchers note that this persistence technique is uncommon, stating, "The malware modifies memory to hide any file containing the string "sedexp" from commands like ls or find. In Stroz Friedberg’s investigation, this capability was used to conceal webshells, modified Apache configuration files, and the udev rule itself."

The sedexp malware has been active since at least 2022 but has gone largely unnoticed. It was deployed by a financially motivated threat actor to scrape credit card information.

See what cybercriminals know about your organization and customers

Digital identities go beyond just usernames and passwords, meaning cybercriminals have increased access to sensitive data they can use against you. Last year alone, SpyCloud researchers and data scientists recaptured and analyzed more than 43.7 billion distinct identity records. Use our free tool to see your organization’s darknet footprint, including breach exposures and malware-exfiltrated data that put your business at risk of account takeover and ransomware. Check your exposure now.

Greasy Opal's tools facilitate cyberattacks.

Arkose Labs describes a cyberattack enablement business dubbed "Greasy Opal" that's been operating out of the Czech Republic since 2009. Greasy Opal provides "a low-cost, highly efficient solution for bad actors who seek to bypass enterprises’ and government agencies’ account security measures through bot-led CAPTCHA solving at scale." The researchers add, "Greasy Opal has built a thriving conglomerate of multi-faceted businesses, offering not only CAPTCHA-solving services but also SEO-boosting software and social media automation services that are often used for spam, which could be a precursor for malware delivery. This threat actor group reflects a growing trend of businesses operating in a gray zone, while its products and services have been used for illegal activities downstream."

Arkose Labs notes that the Vietnam-based threat actor Storm-1152 used Greasy Opal's tools to create 750 million fake Microsoft accounts.

D.C.’s Premier Gathering of Cybersecurity Visionary Leaders

N2K CyberWire is proud to partner with DMV Rising 2024 to celebrate the remarkable accomplishments of the DMV's cybersecurity community, and provide a unique opportunity to foster new connections and innovative ideas. Join us on September 12, 2024 to experience firsthand why the DMV region is the beating heart of cyber innovation. Register now to secure your spot.

Notes.

Today's issue includes events affecting China, the Czech Republic, France, and the United States.

Attacks, Threats, and Vulnerabilities

Greasy Opal: Greasing the Skids for Cybercrime (Arkose Labs) In a first, Arkose Labs’ threat research unit ACTIR has revealed the details behind a Cyber Attack Enablement business that it has dubbed Greasy Opal based on its threat research taxonomy.

Arrest of Telegram CEO sparks cyberattacks against French websites (SC Media) Hacktivists retaliated against the French government in a series of DDoS attacks.

US Elections Report (BforeAI) The US elections are set to be held on November 5, 2024, and there have been numerous global threats revolving around this significant event. Cybercriminals

Legislation, Policy, and Regulation

FBI Flawed Data Handling Raises Security Concerns (Infosecurity Magazine) A US Justice Department watchdog has found “significant weaknesses” in the FBI’s physical and online media storage and disposal processes

Litigation, Investigation, and Law Enforcement

Telegram says arrested CEO has ‘nothing to hide’ as France reportedly extends his detention (The Record) Following the recent arrest of Pavel Durov, the founder and owner of the messaging app Telegram, the company issued a statement late on Sunday saying that Durov “has nothing to hide” and that they are “awaiting a prompt resolution” of the situation.

Kentucky prisoners hack state-issued computer tablets to digitally create $1M. How’d they do it? (Union-Bulletin.com) Almost nobody outside of the Kentucky Department of Corrections has heard about how several hundred prison inmates hacked their state-issued, for-profit computer tablets to create more than $1 million that

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

2024 DataTribe Challenge Submission Deadline (Fulton and Virtual, Maryland, USA, Sep 27, 2024) As founders ourselves, we have never liked the feeling of being the entertainment that comes with participating in most pitch competitions. So, in creating the DataTribe Challenge, we have centered it on the North Star of creating a platform that is a valuable use of time for the founders participating. Submit your startup to potentially be selected to be part of a startup competition like no other. The DataTribe Challenge is a unique program to accelerate your cybersecurity startup. Workshop your messaging and meet potential investors and customers. We will pick five finalists to join the program, receive coaching from our team of startup veterans, present at the live event, and benefit from free promotion and press coverage. Finalists share $25,000 in prizes and all will receive the title of DataTribe Challenge Finalist.

HITRUST® Collaborate 2024 (Frisco, Texas, USA, Oct 1 - 3, 2024) HITRUST Collaborate is the most comprehensive information protection and risk management conference for privacy, security, and compliance. The 2.5-day conference includes keynotes, panel discussions, and educational sessions for industry professionals.

Events

SecureWorld Manufacturing & Retail Virtual Conference (Virtual, Aug 28, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

SANS Network Security Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Sep 4 - 9, 2024) At SANS Network Security 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Jailbreak Brewing Company Security Summit (Laurel, Maryland, USA, Sep 6, 2024) Join some of the world's best security researchers as they talk about disinformation; the misleading and deliberate deception in today's connected world, both from the technical and policy sides at the only computer security event held at a production brewery. Attendance is limited to 150 to keep the Security Summit small and encourage conversation between speakers, attendees, and sponsors. Tickets include breakfast, lunch, and an awesome time to chat with fellow security experts. Come participate in the talks, the conversation, and the beer!

DMV Rising 2024 (Washington, DC, Sep 12, 2024) DMV Rising is D.C.'s premier cybersecurity event, bringing together cybersecurity executives to tackle tough problems, share new insights, and explore innovative solutions emerging in D.C., Maryland, and Virginia.

SecureWorld Detroit (Novi, Michigan, USA, Sep 18, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 08.27.24

At a glance.

Volt Typhoon exploits Versa zero-day.

Linux malware exploits udev rules to evade detection.

Greasy Opal's tools facilitate cyberattacks.

Notes.

Attacks, Threats, and Vulnerabilities

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events