Threat Intelligence Bulletin: 02/18/2022

Kraken Completes Its Rebrand to Anubis: A Quick Update

In a blog post dated February 16, 2022, ZeroFox Research detailed Kraken, a new botnet targeting Windows that we discovered in October 2021. The botnet is still undergoing active development, experimenting with new features, and attempting to find a brand for itself. After our publication, ZeroFox learned that the botnet has undergone a rebranding to more closely align with its administration dashboard. Sometime between January 4, 2022, and January 7, 2022, the operator(s) began using the names “Anubis” and “Pepega” for the project internally.

Standing Intelligence Requirements

MAL

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Ensure antivirus and intrusion detection software is up to date with all patches and rule sets.
Enable two-factor authentication for all organizational accounts to help mitigate phishing and credential stuffing attacks.
Maintain regularly scheduled backup routines, including off-site storage and integrity checks.
Avoid opening unsolicited attachments and never click suspicious links.
Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
Review network logs for potential signs of compromise and data egress.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.
If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account.

Details

ZeroFox Research has been following the development of this previously unknown botnet since October 2021. Originally named “Kraken,” builds discovered between January 4, 2022, and January 7, 2022, reveal that the internal name has changed.

On the left, a build from January 4, 2022; on the right, a January 7, 2022, build.

Figure 1. On the left, a build from January 4, 2022; on the right, a January 7, 2022, build.
Source: ZeroFox Research

As seen in Figure 1, the Golang project path has changed from “C:\Users\666\Desktop\Bobabubs\kraken_2022” to “\root\anubis”, which more closely aligns with the dashboard after it received its own rebrand. The source code also appears to have been merged into one main file with most of the function names being obfuscated, as opposed to the previously separated but clear functionality. Another notable change made is to the main source file. The name “pepega” may be in reference to a Twitch emote of the same name, which is itself a variation of the meme “Pepe the Frog.”

Anubis Dashboard No Longer Available

Shortly after our publication, ZeroFox Research also observed that the Anubis dashboard is no longer available. Attempting to view the dashboard now results in a “404 page not found” message being displayed. Although the dashboard is no longer viewable, the server itself continues to host the current version of Anubis and all uploaded payloads to be sent by the operator(s).

New Exfiltration Targets

In addition to the previously-added cryptocurrency wallets, Anubis now appears to be targeting specific Chromium-based browsers. Builds obtained by ZeroFox Research since February 17, 2022, have added the following paths targeting the Brave, Google Chrome, and Microsoft Edge browsers:

\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cookies
\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Multiple Chromium-based web browser paths appearing in the latest Anubis build

Figure 2. Multiple Chromium-based web browser paths appearing in the latest Anubis build
Source: ZeroFox Research

Until recently, Anubis relied entirely on secondary payloads such as Redline to steal data from victims. If this trend of feature additions continues, Anubis may become capable of doing the job itself, ending its reliance on third-party infostealers.

Conclusion

The additional capability to target a victim's browser data seems limited to just cookie data currently. Whether Anubis decides to collect more data (such as saved credentials and browser history) or even target more browsers based on the Chromium source currently remains to be seen. Though the pace of Anubis’ development has slowed down since its initial discovery, the various changes its operator(s) are making indicate they are still deciding what the future of this botnet holds. ZeroFox will continue to monitor this emerging botnet as it evolves.

MITRE ATT&CK

ID	Description
T1027.002	Obfuscated Files or Information: Software Packing
T1033	System Owner/User Discovery
T1047	Windows Management Instrumentation
T1059.001	Command and Scripting Interpreter: PowerShell
T1059.003	Command and Scripting Interpreter: Windows Command Shell
T1082	System Information Discovery
T1113	Screen Capture
T1132.001	Data Encoding: Standard Encoding
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1571	Non-Standard Port

IOCs

SHA256 Hashes

5d99125b0d97ba0abfcf9916c1a05081c1cc117eb2afaaab39a6f95a60e42ab3

Russia-Ukraine Conflict Updates

TLP: WHITE

ZeroFox Intelligence teams continue to monitor the events unfolding between Russia and Ukraine. While the situation is evolving rapidly—and the attack on Ukraine continues to widen—ZeroFox Intelligence teams have outlined various geopolitical, cyber, physical, supply chain, and sanction impacts in this report as they currently stand.

Recommendations

Implement contingency plans for personnel and operations in Ukraine.
Leverage threat intelligence services and maintain situational awareness as events in Ukraine unfold at a rapid pace.
Consider signing up for CISA notifications to receive timely information on current security issues, vulnerabilities, and high-impact activities.
Diversify and map supply chains that include components from Russia and/or Ukraine.
Back up critical data regularly, including password-protected backup copies offline.
Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, or the cloud). Ensure proper network segmentation.
Patch disclosed vulnerabilities with updated software versions as quickly as practical.
Disable PowerShell wherever possible to limit the possibility of operators employing lateral movement modules.
Never download email attachments from unknown senders or click links from untrusted sources. Provide user training programs to fight against phishing or social engineering attacks used to obtain critical information that can lead to system compromise.
Log and monitor outbound network traffic, alerting on any suspicious activity.

Standing Intelligence Requirements

GEO MAL

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Analyst Commentary

Geopolitical Impacts

In the early hours of February 24, 2022, Russian President Vladimir Putin announced a military operation in Ukraine during a televised address. The televised address was likely filmed on February 21, 2022, as Putin was wearing the same clothes as he did during his initial announcement on recognizing the independence of two eastern regions of Ukraine, Donetsk and Luhansk. During his address, Putin cited the United States and NATO’s rejection of Russian demands that NATO cease expansion eastward and pledge not to admit Ukraine as a member. He also accused Ukraine of staging a genocide against Russian people in the east of Ukraine and engaging in “Nazism.”

For weeks, Russian officials have preempted accusations of military aggression by alleging that Ukraine is being “provoked” into war and that Russia would have no choice but to respond. Putin has consistently primed his domestic audience with statements about the historical necessity of reuniting the eastern Slavic peoples, including a July 2021 essay about the historical “oneness” of Russians and Ukrainians that was mandatory reading for the Russian armed forces. The most telling factor is that it now appears that Russia cannot achieve its objectives without the use of force. Given the Russian posturing of the past year, Ukraine’s western tilt has accelerated, not reversed. A reorientation of Ukraine will likely require a new, pro-Russian government in Kyiv or a military operation that forces the United States and NATO to accede to Russian demands in order to save Ukraine from destruction. An occupation of the Donbas, the creation of a land bridge to Crimea, or a cyberattack will not alone prevent Ukrainian President Zelensky from turning to the West for aid.

Russia’s military escalation in Ukraine is unlikely to end in the coming days; a full-scale military occupation of the capital Kyiv is likely required to achieve its demands, which could take weeks. Occupation of Kyiv gives Russia the highest odds of crippling the Ukrainian government and wringing concessions from the West. While Ukraine has the capacity to give Russian President Vladimir most of what he has publicly stated that he wants—a revised Constitution that permanently bans Ukraine from NATO membership; to make any military alliances with the West illegal; and a new pro-Russia government to replace the one overthrown in the 2014 Maidan revolution—it is unlikely to do so willingly. However, Ukraine cannot guarantee that Georgia will never again seek to join NATO, nor that NATO will agree to never station troops on the territory of its eastern European members. Notably, it also cannot erase President Putin’s belief that Ukraine’s creation was the Soviet Union’s greatest historical mistake.

It remains possible that the relatively unified Western response will end the military invasion and reopen the path to diplomacy. Ukraine took necessary steps on February 23, 2022, by identifying these acts as Russian aggression, urging greater international support, calling up its military reservists, and declaring a state of emergency. However, Western sanctions and public condemnations, while vocal, were likely steps that Russia anticipated. Actions that would require genuine European sacrifice, such as halting the import of all Russian natural gas, would demand a level of unity and resolve that has not yet been demonstrated. Nevertheless, the United States and the European Union (EU) have stated that they are preparing additional measures.

Figure 1. Which E.U. Countries import the most Russion gas
Source: The New York Times

Western sanctions are expected to be announced over the coming days, and they will likely increase the already announced sanctions targeting the financial and energy sectors of Russia. Russia's ruble has plummeted since the invasion, continuing its downward trend since the initial Ukrainian invasion in 2014. For now, the initial sanctions being proposed are mild, with the EU reportedly carving out exceptions for items like Italian designer clothes. To date, the United States and Europe have not removed Russia from the SWIFT international banking system and have not canceled energy contracts. If Europe did cancel all energy contracts with the Russian state, that would be a sign they are willing to endure hardships to get Putin to back down. Predictably, eastern EU nations like Poland and Lithuania are calling for the harshest sanctions on Russia as they have the most to fear from a Ukrainian refugee crisis and other forms of conflict spillover. The more risk-averse nations when it comes to sanctions are those with close economic and trade ties with Russia—like Italy, Austria, and France, which have the most money tied up in Russian banks. Germany is Russia’s largest trading partner aside from China.

Despite the EU’s reluctance to worsen the ongoing energy and inflationary pressures on their economies, it must reconcile that with what inadequate action will do over the long term. There are increasing concerns that the more powerful economy of China will view Western inaction in Ukraine as an invitation to invade Taiwan. States that are weaker than Russia may similarly take their chances to wage smaller wars to increase their power.

Physical Security Impacts

Russian military strikes began across eastern areas of Ukraine and have since been reported in Dnipro, Kyiv, Kharkiv, Kramatorsk, Mariupol, Odesa, and Zaporizhzhia. The initial operations appear to be targeting military infrastructure—likely to weaken Ukraine's military response. Belarusian soldiers are also reportedly crossing into Ukraine near Senkivka, and Russian soldiers are reportedly crossing the border from Crimea; others are attempting to enter the capital Kyiv according to Andriy Zagorodnyuk, Ukraine’s former defense minister.

Figure 2. Attacks that have been reported across Ukraine
Source: CNN

Now that the Russian army that was surrounding Ukraine on three sides with nearly 200,000 soldiers has advanced on several Ukrainian positions, daily life will come to a halt—with many seeking shelter or attempting to leave the larger cities. Militarily, Kyiv remains the ultimate Russian target and presents the biggest threat to civilian and economic interests. A military threat to Kyiv’s security is the most obvious route to achieving President Putin’s objectives. However, the size of the current Russian contingent, while large, would make an advance toward the city very difficult and fraught with immense and unpredictable risk. In the short term, the more likely target of a ground-based advance is the remaining territory in the Donetsk and Luhansk oblasts. President Putin hinted at this scenario by acknowledging the separatists’ claims on the entirety of those regions. The occupation of the eastern port city Mariupol would be a strategic victory for Russia and allow its forces to regroup in advance of renewed diplomacy or later military operations. Cities on the Russian frontier, like Kharkiv and Odesa, also appear to be in immediate danger and are seeing some of the heaviest fighting. ZeroFox assesses that the most likely target of a large-scale land invasion is Kyiv, with the objective of forcing a change of leadership, changes to the constitution, and/or ironclad NATO guarantees. Russia would not need to actually take Kyiv and risk the complications of an occupation—it could instead attempt to advance quickly from the northeast or northwest to threaten the city and its occupants until its demands are met. The military build-up in Belarus also gives Russia the option of approaching Kyiv from west of the Dnieper river.

The Russian military could also target other major population centers to pressure Kyiv and NATO. Kharkiv, Ukraine’s second largest city by population and the closest major metro area to Russia’s border, is highly vulnerable to an invasion from western Russia. Odesa is another potential target, as control of the city and its ports would allow Russia to cut off Ukraine from the Black Sea. Control of the Black Sea alone may not be enough to win concessions, but it could be coordinated with incursions elsewhere to ensure the city is not logistically isolated. Alternatively, a landing in the south could operate as a decoy for an operation in Ukraine’s north or northeast. Any military operation is likely to be preceded by destructive cyberattacks targeting the Ukrainian public sector and critical infrastructure and the use of short-range ballistic missiles to destroy military installations.

While the early attacks were air and missile-based to destabilize Ukraine’s modest air defenses and neutralize as many military assets as possible, Russia’s main military superiority is in its ground forces. Early evidence suggests Russia is using air and missile attacks to pave the way for its ground forces to mop up easy targets— perhaps to isolate the capital Kyiv and cut it off from vital supply lines. Unverified Ukrainian reporting claims five Russian planes have been shot down, inflicting casualties. Ukrainian President Zelensky said weapons would be distributed to anyone in Ukraine who wanted them.

In response to the ongoing situation, Ukraine has declared martial law for 30 days. Martial law prohibits large gatherings and gives authorities the ability to impose curfews and close borders. Civilian aviation has been suspended over Ukraine, and there are reports of telecommunications outages. Ukraine's military has been built up considerably since 2014, but its military budget is still one tenth of Russia's. Russia's posturing over recent months has arguably hardened Ukraine's resolve and increased their ties to the West. Retalitary military actions from Ukraine are forthcoming, but its ability to handle a Russian invasion from multiple fronts is likely inadequate. One of the first battle grounds is the Chernobyl nuclear power plant, which has reportedly been captured by Russian forces. Russia likely believes control of the nuclear reactor will dissuade NATO from coming to Ukraine’s assistance.

NATO said it had activated defense plans and would boost the alliance’s “deterrence and defense” by increasing land, sea, and air forces on its eastern flank near Ukraine's border and putting more than 100 warplanes on high alert. Ukraine is not a NATO member, and no Western countries have committed to fighting alongside them, although they have provided Ukraine weapons in the run-up to the conflict. This is the first time NATO is activating its defense plans, which were first revealed after Russia's 2014 invasion and annexation of Crimea. NATO members are at less risk from Russia’s current posture, but Russia’s inevitable military expansion in Belarus will increase the threat to the Baltic countries in coming years. In addition, a war in Ukraine would likely bring greater U.S. commitment to the defense of the Eastern NATO members—particularly the Baltics.

Cyber Impacts

ZeroFox anticipates upcoming and sustained cyberattacks targeting the Ukrainian infrastructure—and assets in Ukraine and abroad—in support of the on-the-ground military actions against strategic assets. Ukraine has already faced multiple cyberattacks in the form of DDoS attacks, defacements, and destructive wiper malware attacks since the recent conflict with Russia started—including one on February 23, 2022, that targeted the website of the country's parliament as well as several banks and government agencies. Wiper malware attacks observed in Ukraine in 2022, presumably originating from Russia, have also targeted companies outside of Ukraine that had contracts with the Ukrainian government, and ongoing attacks against international companies are likely. The observed wiper malware was designed to overwrite files on systems to render them inoperable. The EU announced on February 22, 2022, that it will send its Cyber Rapid Response Team to Ukraine to assist with potential cyber threats from Russia. The team consists of cybersecurity experts from Croatia, Estonia, Lithuania, the Netherlands, Poland, and Romania, and this will be its first deployment.

Russia’s ongoing weaponization of false narratives in cyberspace will continue at a rapid pace and will include disinformation spread via SMS. ZeroFox has observed conflicting rhetoric across social media and news channels. Social media platforms have been on high alert for Russian disinformation that would violate their policies but have less control over private messaging and text messaging, where some propaganda efforts have moved to avoid detection. Much of the disinformation posted in the Russian media is intended for a domestic audience, ensuring support in the conflict.

ZeroFox has also observed sporadic actors claiming to leak personal information of U.S. military personnel in underground forums, likely as a retaliatory action for the United States’ support of Ukraine. As the situation unfolds, ZeroFox anticipates ongoing activities in the dark web in support for both Ukraine and Russia.

Supply Chain Impacts

The escalation of tensions between the West and Russia, and Russia and Ukraine, have had immediate supply chain impacts. Russia is the world’s third-largest oil producer, and prices immediately jumped five percent after the military escalation. Russia is also the world’s third-largest wheat producer and fifth-largest corn producer; both are invaluable food commodities, and their prices have also increased. Belarus predictably sided with Russia and canceled its potash contracts with the West. Potash is important for fertilizer production, and the latest geopolitical tensions will only increase the already-high fertilizer prices. Concrete Western sanctions are only just coming out, but Germany suspending the Nord Stream 2 pipeline will worsen natural gas prices for the long term. Expected U.S. sanctions will also limit Russian access to EU and U.S. markets and target their financial sectors—and will have immediate consequences for Russia’s economy and currency, which has been dropping in value for years. The EU economy will be impacted to a larger degree by sanctions than the U.S. economy will.

Oil prices rose along with gold, wheat, and corn on energy supply worries as the Russia-Ukraine crisis escalated after Russia recognized two breakaway regions of Ukraine and ordered troops into the two territories. Brent, the global benchmark for two-thirds of the world's oil, climbed 3.91 percent to USD 99.12 per barrel while West Texas Intermediate, the gauge that tracks U.S. crude, rose 4.86 percent to USD 95.50 a barrel. Gold, a haven against rising inflation, hit an eight-month high at more than USD 1,900 per ounce. A full-scale Russian invasion will likely see it spike to USD 130.

Russia accounted for about 12 percent of global crude oil exports in 2020 and about 10 percent of total oil product exports. It supplies 25 percent of the world's natural gas exports and is also a major producer of industrial metals. The country exports agricultural commodities as well, accounting for about 17 percent of global wheat exports between 2020 and 2021 and more than 10 percent of feed grains such as barley. It is also a dominant supplier of the sunflower seeds used in vegetable oil production.

Impact of Ukraine Crisis on Food Prices

Tensions between Russia and Ukraine are likely to force wheat, corn, and sunflower oil buyers to seek alternative supplies, which will see prices rise. The two countries account for around 30 percent of global wheat exports, 20 percent of world corn supplies, and 80 percent of world sunflower oil exports.

After the military escalation, wheat jumped more than two percent, corn hit a seven-month high, and soybeans also increased in price. Even before these geopolitical tensions, all three key food and feed ingredients have increased around 40 percent from 2021 lows, lifted by a decline in global production and robust demand. Around 70 percent of Russian wheat exports went to buyers in the Middle East and Africa in 2021; they are largely neutral but will still be impacted by shipping companies that want to avoid Black Sea waters. A lack of supplies from the Black Sea region could lift demand for bread-making ingredients from the U.S. and Canada, which is good for producers of those items but bad for consumers.

Anticipated Sanctions

The United States and the United Kingdom (UK) have taken the lead in warning that Russia would face major sanctions for violating Ukraine’s sovereignty, but their willingness to take truly damaging action remains unclear—especially as it would worsen already existing economic problems in the West, such as inflation and high energy prices. UK Prime Minister Boris Johnson called the possibility of excluding Russia from the global payments system SWIFT a “potent weapon,” but U.S. officials have expressed skepticism about the idea—and London’s close ties to Russian finance make its implementation unlikely in all but extreme scenarios. When the idea was proposed after Russia’s occupation of Crimea in 2014, former Russian Finance Minister Alexey Kudrin said that cutting the country off from SWIFT could cause GDP to contract by up to five percent.

Russia has taken actions to lessen the impact of other sanctions by reducing the debt held by foreign investors, building up large wealth reserves, and developing closer ties to Chinese financial mechanisms. On January 30, 2022, U.S. Senator Robert Menendez said that a proposed sanctions package currently being negotiated by the U.S. Senate would target Russian banks and their sovereign debt, indicating that Russian leadership has prepared to absorb a certain level of sanctions. U.S. President Biden has also said his administration would consider personal sanctions against President Putin. Putin, however, is prohibited from holding foreign assets, and, according to presidential spokesman Dmitry Peskov, personal sanctions would risk permanently damaging U.S.-Russia relations.

The willingness of the EU to introduce punishing sanctions due to a Russian action is uncertain. Western leaders could attempt to penalize countries for buying gas from Russia state-owned companies or ban Russia from transactions involving U.S. dollars, but they have received pushback on both fronts. Despite current issues with Nord Stream 2 certification, Germany has attempted to decouple energy-related business from its geopolitical relations with Russia. It has, for example, sought an exemption for the energy industry if sanctions include a restriction on dollar clearing. Central Europe has fought hard for Nord Stream 2 against stiff Ukrainian resistance and may not willingly destroy the project. Energy is also much more fungible than money; in the event of sanctions targeting the energy sector, Russia could simply reward its adversaries, like China, with more energy sales and punish its enemies (like the EU) by exacerbating the energy price issue.

The West, led by the United States, has the capacity to introduce serious measures to damage the Russian economy in the wake of aggressive military action and has less economic ties to Russia than the EU. However, the appetite to do so— particularly in Europe—is not clear, as their own economies are more vulnerable to Russian sanctions. For example, European energy prices have been over 200 percent more expensive at times this winter, and increased sanctions on Russia would only worsen that problem. In addition to oil and gas, Russia also produces food commodities like wheat; sanctions will likely contribute to global wheat prices rising, which will worsen overall food price inflation. Nevertheless, the United States, EU, and UK have agreed on a basic sanctions package that can be upgraded or downgraded as necessary. The EU, led by Germany, also put the Nord Stream 2 on pause. In the immediate aftermath of Russia’s recognition of Donetsk and Luhansk, the price of oil jumped five percent as did the cost of wheat, corn, and soybeans. Neither Russia nor Ukraine are major producers of corn or soybeans, so their price increase demonstrates the delicate state of food commodities, which were already fetching high prices and a shortage of supply.

Russia has increased interest rates and taken other austerity measures in anticipation of sanctions, but measures targeting Russia’s Sberbank, Gazprombank, the Russian Direct Investment Fund, and the country’s other major financial institutions would undoubtedly be damaging. When Russia first invaded Ukraine in 2014, Ukraine's hryvnia and Russia's ruble dropped nearly 70 percent and 50 percent, respectively. The currencies have continued to weaken since then, with the ruble declining in value at a rate of 5.7 percent per year and the hryvnia falling 2.4 percent. Expect the ruble to drop between 10 and11 percent and the hryvnia as much as 17 percent in the coming months as the United States raises interest rates and the conflict drags on. Inflation is considered a major political issue in Russia, and the consumer prices index increased by 8.4 percent in 2021. Food prices rose by nearly 11 percent. Despite the seriousness with which Putin takes inflationary pressures, this alone will not deter Russian action.

Russia has spent the last few years working to insulate themselves from Western sanctions, mainly by increasing its reliance on China. Trade between the two countries has increased by 167 percent since 2010, with the most significant growth in the past few years after the initial invasion in 2014. The increase in trade was aided by a series of energy mega projects, such as the USD 55 billion Power of Siberia-1 natural gas pipeline, the USD 25 billion Eastern Siberia-Pacific Ocean Pipeline, and the USD 13 billion Amur gas processing plant. Turnover between China and Russia reached a record USD 146.88 billion in 2021, up 35.8 percent from the previous year, according to recent data from China's General Administration of Customs.

Tensions between Russia and the West over Ukraine, which could bring new sanctions against Russia, is likely to tighten Russia’s economic reliance on China. Russia and China have vowed to raise their trade turnover to USD 200 billion by 2024, which appears achievable.

Figure 3. Graph showing China-Russia trade over the last several years
Source: Nikkei Asia

The United States has suggested that a Russian invasion of Ukraine will lead to new economic sanctions—particularly on Russian energy exports, because Russia relies on Europe to buy its gas just as Europe relies on Russia to supply it. However, this is unlikely to be that damaging, as Russia is a single dominant supplier to many countries and can easily target gas supplies to its allies and cut them off to its adversaries to negate any energy sanctions.

Europe and Russia’s much closer economic relationship than that of the United Statesand Russia has also led to disagreements in the West on how they should react. Details on sanctions are light because the West does not want to tip Russia off. Efforts to target Russia’s internet infrastructure have not been widely reported but could cause potential damage in the short-term—especially to Russia's ability to conduct cyberattacks in Ukraine, which typically go along with military interventions. However, Russia has been building the RuNet for a while, presumably with the sense that depending on overseas servers/internet architecture is a vulnerability.

Please note that this information is current as of the ZeroFox Intelligence collection conclusion at 12:00 PM EST on February 24, 2022.

Microsoft Patch Tuesday 01/12/2022 Notes

This advisory addresses and summarizes the vulnerabilities published by Microsoft this Patch Tuesday and highlights the most notable vulnerabilities that may impact our customers.

Standing Intelligence Requirements

Vulnerability

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit: https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

Keep up to date with the most recent vulnerabilities impacting you in our Vulnerabilities tab. Contact your account manager for more information.
Be sure to apply patches promptly to mitigate these and other vulnerabilities.

Details

Highlights: Microsoft's Patch Tuesday update for January 2022 contained 97 vulnerabilities in total, with:

6 vulnerabilities rated as Critical
64 vulnerabilities rated as High
26 vulnerabilities rated as Medium

Most notable vulnerabilities

Microsoft has listed six zero-day vulnerabilities, CVE-2021-22947, CVE-2021-36976, CVE-2022-21874, CVE-2022-21919, CVE-2022-21839, CVE-2022-21836, which are fixed in the January Patch Tuesday security update. Among the vulnerabilities, none of the zero-days are listed as being actively exploited, though two (CVE-2022-21919 and CVE-2022-21836) have public exploit code available.

Out of the critical bugs, a remote code execution (RCE) issue in the HTTP protocol stack is the most severe – with a severity rating of 9.8 on the 10 point scale. This critical bug, CVE-2022-21907, is a wormable bug, i.e., an exploit that could self-propagate through a network with no user interaction.

CVE-2021-22947

CVE-2021-22947 is a Privilege Escalation vulnerability in the Open Source Curl library. This vulnerability is caused by a flaw when connecting to an IMAP, POP3, SMTP or FTP server to exchange data securely using STARTTLS to upgrade the connection to TLS level. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.