Weekly Threat Intelligence Bulletin: 12/18/2020 - 12/24/2020

Breach Disclosure: Ledger

Ledger, a Hardware Cryptocurrency wallet provider experienced a data breach around June 25th, 2020 which impacted the e-commerce and marketing database, used for sending order confirmations and promotional emails. Ledger has acknowledged and addressed the breach, stating that payment information and crypto funds are safe, however, the database did expose email addresses as well as a subset containing first and last names, postal addresses, and phone numbers. The breach affected 1,075,381 accounts, with 272,852 customers PII exposed in the breach.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On July 29, 2020 Ledger released a statement detailing the breach, which was brought to their attention by a security researcher on July 14, 2020. The initial breach vector appears to be through an exposed API key, which has since been deactivated.

Earlier this month, new outlets began reporting that Ledger customers were receiving breach notifications saying that they needed to install a new version of Ledger Live and to reset their PIN. If the attacks had been successful, attackers would have been in full control of the user's cryptocurrency funds.

Initially this data was being sold on various forums and marketplaces, however, after becoming stale, numerous threat actors began listing the database for free.

Figure 1: Ledger advertisement

Figure 2: Ledger advertisement on RaidForums

In addition to the phishing emails, Ledger warned customers that attackers were demanding $500 in ransom to not invade the victims home. In total, there have been 171 phishing sites that have been shut down by Ledger.

Figure 3: Ransom email from attackers targeting Ledger customers

Breaking News: 2020-12-18 - 2020-12-24

RubyGems Packages Laced with Bitcoin-Stealing Malware

RubyGems, an open-source package repository and manager for the Ruby web programming language, has taken two of its software packages offline after they were found to be laced with malware. Two of the software packages named “pretty-color” and “ruby-bitcoin,” were discovered by researchers at Sonatype to be corrupted to steal Bitcoin from unsuspecting web-application users. The gems contained malware that ran itself persistently on infected Windows machines and replaced any Bitcoin or cryptocurrency wallet address it found on the user’s clipboard with the attacker’s.

See the full report here: https://threatpost.com/rubygems-packages-bitcoin-stealing-malware/162360/

Microsoft says it identified 40+ victims of the SolarWinds hack

Microsoft has identified more than 40 of its customers that installed trojanized versions of the SolarWinds Orion platform and where hackers escalated intrusions with additional, second-stage payloads. These intrusions were detected using data collected by Microsoft Defender antivirus product. Reuters reported that hackers accessed Microsoft's internal network, but Microsoft denied that they were able to reach production systems and impact its business customers and end-users.

See the full report here: https://www.zdnet.com/article/microsoft-says-it-identified-40-victims-of-the-solarwinds-hack/

Ransomware masquerades as mobile version of Cyberpunk 2077 - BleepingComputer

A new Android ransomware dubbed "CoderWare" has been discovered that masquerade as a mobile version of the Cyberpunk 2077 game. The game was being distributed from a fake website impersonating the legitimate Google Play Store. The ransomware utilizes a hardcoded key that means a decryptor can be made without paying the ransom. CoderWare ransomware was earlier disguised as a Windows Cyberpunk 2077 installer. The Windows variant was a python compiled executable that encrypts victim's files and appends the ".DEMON" extension to it.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-masquerades-as-mobile-version-of-cyberpunk-2077/

Bouncy Castle crypto authentication bypass vulnerability revealed - BleepingComputer

A severe authentication bypass vulnerability (CVE-2020-28052) has been reported in Bouncy Castle, a popular open-source cryptography library. When exploited, the vulnerability can allow an attacker to gain access to user or administrator accounts due to a cryptographic weakness in the way passwords are checked. Both Bouncy Castle 1.65 and 1.66 are impacted by this flaw but not versions before 1.65. Bouncy Castle has fixed this vulnerability in versions 1.67 and above.

See the full report here: https://www.bleepingcomputer.com/news/security/bouncy-castle-crypto-authentication-bypass-vulnerability-revealed/

WordPress plugin with 5 million installs has a critical vulnerability - BleepingComputer

The team behind a popular WordPress plugin has disclosed a critical file upload vulnerability and issued a patch. The vulnerability (CVE pending) in the WordPress plugin, Contact Form 7, could allow an attacker to bypass Contact Form 7's filename sanitization protections when uploading files. By exploiting the vulnerability, the file can be executed as a script by the attacker to run the code within. Contact Form 7 5.3.2 has been released to fix this vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/wordpress-plugin-with-5-million-installs-has-a-critical-vulnerability/

FBI & Interpol disrupt Joker's Stash, the internet's largest carding marketplace

Officials from the US Federal Bureau of Investigation and Interpol have seized a small number of servers used by Joker's Stash, the internet's largest marketplace for buying & selling stolen cards, temporarily disrupting the site's activity. Seizure banners appeared on four Joker's Stash sites, at jstash[.]bazar, jstash[.]lib, jstash[.]emc, and jstash[.]coin. One of the Joker Stash administrators confirmed the disruptions but also stated that the domains would be restored on new servers in a few days.

See the full report here: https://www.zdnet.com/article/fbi-interpol-disrupt-jokers-stash-the-internets-largest-carding-marketplace/

'SocGholish' Attack Framework Powers Surge in Drive-By Attacks

Security researchers have discovered a framework dubbed "SocGholish" that impersonates legitimate browser, Flash, and Microsoft Teams updates to trick users into executing malicious ZIP files that are automatically placed on victim machines when a visit to an infected compromise triggers a drive-by download. SocGholish attackers host and serve the malicious downloads by leveraging iFrames to serve up compromised websites via a legitimate website.

See the full report here: https://www.darkreading.com/attacks-breaches/socgholish-attack-framework-powers-surge-in-drive-by-attacks/d/d-id/1339762

NSA warns of hackers forging cloud authentication information - BleepingComputer

An advisory from the NSA provides Microsoft Azure administrators guidance to detect and protect against threat actors looking to access resources in the cloud by forging authentication information. The two tactics, techniques, and procedures (TTPs) discussed in the advisory have been in use since at least 2017 and refer to forging Security Assertion Markup Language (SAML) tokens for single sign-on (SSO) authentication to other service providers. The guidance was released in response to ongoing SolarWinds supply-chain attacks that targeted private and government organizations in at least seven countries by Microsoft’s count.

See the full report here: https://www.bleepingcomputer.com/news/security/nsa-warns-of-hackers-forging-cloud-authentication-information/

Stealthy Magecart malware mistakenly leaks list of hacked stores - BleepingComputer

A list of dozens of online stores hacked by a web skimming group was inadvertently leaked by a dropper used to deploy a stealthy remote access trojan (RAT) on compromised e-commerce sites. Researchers at Sansec revealed that the malware was delivered in the form of a 64-bit ELF executable with the help of a PHP-based malware dropper. The RAT dropper contained a list of 41 compromised stores besides the usual malicious code used to parse deployment setups for several Magecart scripts.

See the full report here: https://www.bleepingcomputer.com/news/security/stealthy-magecart-malware-mistakenly-leaks-list-of-hacked-stores/

Apple, Google, Microsoft, and Mozilla ban Kazakhstan's MitM HTTPS certificate

Browser makers Apple, Google, Microsoft, and Mozilla, have banned a root certificate that was being used by the Kazakhstan government to intercept and decrypt HTTPS traffic for residents in the country's capital, the city of Nur-Sultan (formerly Astana). The certificate had been in use since December 6, 2020, when Kazakh officials forced local internet service providers to block Nur-Sultan residents from accessing foreign sites unless they had a specific digital certificate issued by the government installed on their devices. Officials cited that cyberattacks targeting "Kazakhstan's segment of the internet" grew 2.7 times during the current COVID-19 pandemic as the primary reason for launching the exercise.

See the full report here: https://www.zdnet.com/article/apple-google-microsoft-and-mozilla-ban-kazakhstans-mitm-https-certificate/

Google announces switch-off date for Android Things

Google has announced an official expiry date on an ambitious internet of things (IoT) project Android Things. Android Things is an embedded operating system designed to run low-power IoT devices with as little as 32 MB of memory. The company warned that the developers would not be able to create new projects from the platform as of January 2021.

See the full report here: https://www.itpro.co.uk/mobile/google-android/358210/google-announces-switch-off-date-for-android-things

Europol launches new decryption platform for law enforcement - BleepingComputer

Europol and the European Commission have launched a new decryption platform to boost Europol’s ability to gain access to information stored in encrypted media collected during criminal investigations. According to the report, Europol's decryption platform includes both software and hardware tools that can help law enforcement agencies to decrypt information lawfully. Europol stated that this initiative will be available to national law enforcement authorities of all Member States to help keep societies and citizens safe and secure.

See the full report here: https://www.bleepingcomputer.com/news/security/europol-launches-new-decryption-platform-for-law-enforcement/

Google Chrome disables insecure form warnings after complaints - BleepingComputer

On December 15th, Google announced that they are disabling the insecure form warnings feature in Chrome 87 after receiving multiple complaints from users and website administrators. The problem with the feature was that Google Chrome would show the insecure form warning even if the form submissions were secure, but the user was redirected to an HTTP URL after submitting the form. These warnings would then break the redirect chain websites use after submitting a form or logging into the site. Hence, to adjust the bug, Google has disabled the feature, so HTTP redirects after a secure form submission do not generate a warning. The rollback has already been pushed to Google Chrome.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-disables-insecure-form-warnings-after-complaints/

Flavors designer Symrise halts production after Clop ransomware attack

Symrise, a German manufacturer of flavors and fragrances used in products, has reportedly been the victim of a ransomware attack. The Clop ransomware gang has claimed responsibility for the attack on Symrise. The ransomware gang has encrypted 1,000 Symrise’s devices and stolen about 500GB worth of data.

See the full report here: https://www.bleepingcomputer.com/news/security/flavors-designer-symrise-halts-production-after-clop-ransomware-attack/

Major Norway cruise line Hurtigruten hit by 'comprehensive' ransomware cyberattack - USA TODAY

Hurtigruten, a Norway-based public transporter that ferries passengers and cargo between ports in Tromso, has disclosed that it has suffered a ransomware attack that has impacted its IT infrastructure seriously on a global note. Ole Marius Moe Helgesen, the company’s IT head, confirmed the news and said that the IT staff are working 24/7 to solve the issue as soon as possible.

See the full report here: https://www.usatoday.com/story/travel/cruises/2020/12/15/norway-cruise-line-hurtigruten-hit-comprehensive-cyberattack/3901485001/

Ledger users threaten legal action after hacker dumps personal data - Cointelegraph

According to a tweet from network security firm Hudson Rock's Alon Gal, a hacker allegedly behind the breach of personal data from hardware wallet Ledger in June has made all the information they obtained available online. This reportedly includes 1,075,382 email addresses from users subscribed to the Ledger newsletter, and 272,853 hardware wallet orders with information including email addresses, physical addresses, and phone numbers. Following news of the hack, many Ledger users reported being targeted through phishing attempts. Ledger stated that they are continuously working with law enforcement to prosecute hackers and stop the scammers.

See the full report here: https://cointelegraph.com/news/ledger-users-threaten-legal-action-after-hacker-dumps-personal-data

Zero-click iOS zero-day found deployed against Al Jazeera employees

At least 36 Al Jazeera journalists, producers, anchors, and executives, along with a journalist at London-based Al Araby TV, had their iPhones hacked using a no-user-interaction zero-day vulnerability in the iOS iMessage app, according to Citizen Lab. Researchers claim the zero-day was part of an exploit chain named Kismet, created and sold by NSO Group, a well-known vendor of spyware and surveillance products, and the hacking tool was sold to at least four entities, who used it in July and August 2020 to hack the personal iPhones of 36 Al Jazeera reports from all over the globe. The zero-day stopped working with the iOS 14 release. Apple was notified of the attacks; they are investigating the incident.

See the full report here: https://www.zdnet.com/article/zero-click-ios-zero-day-found-deployed-against-al-jazeera-employees/

Google explains the cause of the recent YouTube, Gmail outage

On 14 December 2020, for a duration of 47 minutes, customer-facing Google services that required Google OAuth access were unavailable. The giant explains the cause of the massive outage. Google uses an evolving suite of automation tools to manage the quota of various resources allocated for services. The Google User ID Service maintains a unique identifier for every account and handles authentication credentials for OAuth tokens and cookies. As part of an ongoing migration of the User ID Service to a new quota system, a change was made in October to register the User ID Service with the new quota system. The process incorrectly reported the usage for the User ID Service as 0, which caused errors on authentication lookups.

See the full report here: https://www.bleepingcomputer.com/news/google/google-explains-the-cause-of-the-recent-youtube-gmail-outage/

Microsoft fixes Windows 10 chkdsk bug causing boot failures - BleepingComputer

Microsoft has acknowledged a new issue impacting Windows 10 customers that might cause booting to fail on devices where the chkdsk tool has been used to repair logical file system errors. While Microsoft doesn't say which Windows 10 versions are affected by this new known issue, the bug was acknowledged on the dedicated pages for the KB4592438 and KB4586853 updates issued for Windows 10 versions 2004 and 20H2 in December and November, respectively. A small number of devices that have installed this update have reported that when running chkdsk /f, their file system might get damaged, and the device might not boot. Microsoft has resolved the issue for all non-managed devices.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-10-chkdsk-bug-causing-boot-failures/

EXMO cryptocurrency exchange hacked, loses 5% of total assets - BleepingComputer

British cryptocurrency exchange EXMO has disclosed that unknown attackers compromised its hot wallets and withdrew nearly 5% of its total assets. EXMO has temporarily suspended all withdrawals after detecting suspicious and large withdrawals starting December 21st, at 2:27:02 UTC. EXMO has reported the incident to the London police and is working with their Cybercrime team to investigate the attack. The crypto exchange stated that all losses incurred by users affected in this incident will be covered and refunded completely by EXMO.

See the full report here: https://www.bleepingcomputer.com/news/security/exmo-cryptocurrency-exchange-hacked-loses-5-percent-of-total-assets/

Trucking giant Forward Air hit by new Hades ransomware gang - BleepingComputer

The Tennessee-based trucking and logistics firm Forward Air Corp. was suffered a cyberattack by a new ransomware operation known as Hades. The attack impacted both operational and information technology systems of Forward Air. The company said that its terminals and facilities are all fully functional, but it is still actively responding to the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/trucking-giant-forward-air-hit-by-new-hades-ransomware-gang/

Partial lists of organizations infected with Sunburst malware released online

Security researchers have published a list ranging from 100 to 280 organizations that installed a trojanized version of the SolarWinds Orion platform and had their internal systems infected with the Sunburst malware. The list includes tech companies, local governments, universities, hospitals, banks, and telecom providers.

See the full report here: https://www.zdnet.com/article/partial-lists-of-organizations-infected-with-sunburst-malware-released-online/

Critical bugs in Dell Wyse ThinOS allow thin client take over - BleepingComputer

Security researchers have discovered critical vulnerabilities, tracked as CVE-2020-29492 and CVE-2020-29491 in Dell Wyse thin client models. The researchers found that Thin OS, the operating system used in Dell Wyse thin clients, can be accessed remotely via FTP without any credentials. Organizations should follow the patches and workarounds issued by Dell and the security researchers team to eliminate these vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-bugs-in-dell-wyse-thinos-allow-thin-client-take-over/

SUPERNOVA, a backdoor found while investigating SolarWinds hack

The investigation of the SolarWinds Orion supply-chain attack revealed the existence of another backdoor that was likely used by a separate threat actor. Security experts reported that threat actors behind the SolarWinds attack were also planting a .NET web shell dubbed Supernova. The web shell is a tainted version of a legitimate .NET library, app_web_logoimagehandler.ashx.b6031896.dll, present in the Orion software from SolarWinds, modified in a way that would allow it to evade automated defense mechanisms. Microsoft believes that the SUPERNOVA backdoor is the work of a second advanced persistent threat.

See the full report here: https://securityaffairs.co/wordpress/112512/malware/supernova-backdoor-solarwinds-hack.html?utm_source=rss&utm_medium=rss&utm_campaign=supernova-backdoor-solarwinds-hack

Emotet Campaign Restarts After Seven-Week Hiatus

Seven weeks after the last major Emotet campaign, the cybercriminals behind the downloader have started up their attempts to compromise more systems, according to multiple cybersecurity organizations. The latest campaign could lead to compromised systems and threats to business networks, as most employees continue to work from home. While the latest Emotet campaign started around mid-December, the activity became most apparent in the last few days. Emotet is an advanced Trojan primarily spread via phishing email attachments and links that, once clicked, launch the payload and attempt to proliferate within a network by brute-forcing user credentials and writing to shared drives.

See the full report here: https://www.darkreading.com/threat-intelligence/emotet-campaign-restarts-after-seven-week-hiatus/d/d-id/1339792

DHS warns against using Chinese hardware and digital services

The US Department of Homeland Security has published a "business advisory" warning US companies against using hardware equipment and digital services created or linked to Chinese companies. The DHS stated that Chinese products could contain backdoors, bugdoors, or hidden data collection mechanisms that could be used by Chinese authorities to collect data from western companies and forward the information to local competitors. According to the agency, all equipment and services remotely linked to Chinese companies should be considered a cyber-security and business risk.

See the full report here: https://www.zdnet.com/article/dhs-warns-against-using-chinese-hardware-and-digital-services/

Roanoke College delays spring semester after cyberattack - BleepingComputer

Roanoke College, a private liberal arts college located in Salem, Virginia, has suffered a cyberattack that has impacted its files and data access. The cyber incident occurred on December 12th, which forced them to disconnect their IT systems to stop the spread of the attack. IT is working to restore the contents of personal Z: drives and departmental X: drives.

See the full report here: https://www.bleepingcomputer.com/news/security/roanoke-college-delays-spring-semester-after-cyberattack/

FBI warns of ongoing COVID-19 vaccine related fraud schemes - BleepingComputer

The US federal agencies have issued a warning about scammers exploiting the public's interest in the COVID-19 vaccine to harvest personal information and steal money through multiple ongoing and emerging fraud schemes. Fraudulent activities including offers for early access to vaccines conditioned by payment in advance, requests to pay out to receive a vaccine or to get added to a waiting list, and offers to ship doses of the vaccine in exchange for money transfers, are being exploited to obtain personally identifiable information (PII). It is advisable to first search for vaccine distribution info from the state health department's website to prevent any fraud attempts.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-ongoing-covid-19-vaccine-related-fraud-schemes/

Microsoft and McAfee headline newly-formed 'Ransomware Task Force'

Multiple security firms, tech companies, and non-profits, including Microsoft and McAfee, have collaborated to form a new group named Ransomware Task Force (RTF) that will help to deal with the rising threat of ransomware. The RTF will commission expert papers on the topic, engage stakeholders across industries, identify gaps in current solutions, and then work on a common roadmap to have issues addressed among all members. The end result will be a standardized framework for dealing with ransomware attacks across verticals, one based on an industry consensus rather than individual advice received from lone contractors. The Ransomware Task Force website is planned to launch in January 2021, followed by a two-to-three month sprint to get the task force off the ground.

See the full report here: https://www.zdnet.com/article/microsoft-and-mcafee-headline-newly-formed-ransomware-task-force/

A second hacking group has targeted SolarWinds systems - ZDNet

Security researchers have discovered a second threat actor that has exploited the SolarWinds software to plant malware on corporate and government networks. Named SUPERNOVA, the malware is a webshell dropped in the code of the Orion network and applications monitoring platform and enabled adversaries to run arbitrary code on machines running the trojanized version of the software. Microsoft believes that this malware is unrelated to the original SolarWinds supply chain attack.

See the full report here: https://www.zdnet.com/article/a-second-hacking-group-has-targeted-solarwinds-systems/

City of Ellensburg computer systems fall victim to Ransomware attack - Daily Record-News

The City of Ellensburg suffered a cyberattack that has encrypted almost all of the City's data. At this time, all City departments impacted by the attack, including administrative and financial services, as well as the City's billing system. The City says it is currently working to determine the best and safest method to recover encrypted data. It is unknown at this time how long City systems may be unavailable.

See the full report here: https://www.dailyrecordnews.com/news/city-of-ellensburg-computer-systems-fall-victim-to-ransomware-attack/article_427e54e0-433c-5277-a602-c26031816392.html

Safe-Inet, Insorg VPN services shut down by law enforcement - BleepingComputer

Law enforcement agencies around the world took down and seized the infrastructure supporting Safe-Inet and Insorg VPN and proxy services known for catering cybercriminal activity. The domains associated with the services (insorg.org, safe-inet.net, safe-inet.com) are currently showing the splash page from Europol for domain seizures. Europol and the U.S. Department of Justice stated that these VPN services were used by some of the world’s biggest cybercriminals including ransomware operators, individuals involved in web skimming (MageCart), spearphishing, and account hijacking activities.

See the full report here: https://www.bleepingcomputer.com/news/security/safe-inet-insorg-vpn-services-shut-down-by-law-enforcement/

Windows zero-day with bad patch gets new public exploit code - BleepingComputer

A security researcher at Google Project Zero has discovered that Microsoft’s patch in June did not fix the original vulnerability CVE-2020-0986. An attacker can still trigger CVE-2020-0986 to increase their permissions to kernel level by sending an offset instead of a pointer. Microsoft’s patch was improper because it changed the pointers to offsets. So the function’s parameters could still be controlled to trigger the vulnerability identified as CVE-2020-17008. The company planned to patch the vulnerability in the next patch Tuesday, on January 12, 2021.

See the full report here: https://www.bleepingcomputer.com/news/security/windows-zero-day-with-bad-patch-gets-new-public-exploit-code/

Lazarus Group Hits COVID-19 Vaccine-Maker in Espionage Attack

The Lazarus Group and other sophisticated nation-state actors are actively trying to steal COVID-19 research to speed up their countries’ vaccine-development efforts. According to Kaspersky researchers, Lazarus group recently attacked a pharmaceutical company, as well as a government health ministry related to the COVID-19 response. Although the initial infection vector is unknown, the group uses different malware clusters to gain access to confidential data on vaccine development.

See the full report here: https://threatpost.com/lazarus-covid-19-vaccine-maker-espionage/162591/

PSA: Active Chase phishing scam pretends to be fraud alerts - BleepingComputer

A phishing campaign is targeting Chase where users received fake Chase "Security Notice" scam attempting to steal their banking credentials. These phishing emails state that the recipient's Chase account was blocked after suspicious activity was detected. To "unlock" the account, the recipients are tricked to click on the 'Restore Now' button in the email where they are prompted to enter their login information. Users are advised to immediately delete fraudulent emails and contact the customer service for further assistance.

See the full report here: https://www.bleepingcomputer.com/news/security/psa-active-chase-phishing-scam-pretends-to-be-fraud-alerts/

New Critical Flaws in Treck TCP/IP Stack Affect Millions of IoT Devices

The US Cybersecurity Infrastructure and Security Agency (CISA) has warned of critical vulnerabilities in a low-level TCP/IP software library developed by Treck that, if weaponized, could allow remote attackers to run arbitrary commands and mount denial-of-service (DoS) attacks. The four flaws tracked as CVE-2020-25066, CVE-2020-27337, CVE-2020-27338, and 2020-27336, affect Treck TCP/IP stack version 6.0.1.67 and earlier. Treck recommends users to update the stack to version 6.0.1.68.

See the full report here: https://thehackernews.com/2020/12/new-critical-flaws-in-treck-tcpip-stack.html

QNAP fixes high severity QTS, QES, and QuTS hero vulnerabilities - BleepingComputer

QNAP has released security updates to fix six high-severity security vulnerabilities tracked as CVE-2020-2503, CVE-2020-2504, CVE-2020-2505, CVE-2016-6903, CVE-2020-2499, and CVE-2020-25847 impacting network-attached storage (NAS) devices running the QES, QTS, and QuTS hero operating systems. QNAP has fixed these security issues in QES 2.1.1 Build 20201006 and later, QTS 4.5.1.1495 build 20201123 (and later), and QuTS hero h4.5.1.1491 build 20201119 (and later).

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-fixes-high-severity-qts-qes-and-quts-hero-vulnerabilities/