ZeroFox Daily Intelligence Brief - February 16, 2023

ZeroFox Daily Intelligence Brief - February 16, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Hyundai, Kia Patch Bug Allowing Car Thefts with a USB Cable
• Hackers Start Using Havoc Post-Exploitation Framework in Attacks
• Citrix Fixes Severe Flaws in Workspace, Virtual Apps, and Desktops
• North Korea's APT37 Targeting Southern Counterpart with New M2RAT Malware

Hyundai, Kia Patch Bug Allowing Car Thefts with a USB Cable

Since July 2022, a viral TikTok “challenge” has encouraged people to try hot-wiring Hyundai and Kia vehicles, leading to a massive surge in vehicle thefts of the two South Korean brands. Exploitation of the bug that allows hot-wiring has led to at least 14 confirmed car crashes and eight fatalities. The U.S. Department of Transportation reported that 3.8 million Hyundai and 4.5 million Kia vehicles are affected by this vulnerability.

The two automobile manufacturers have released emergency anti-theft software upgrades for vehicles without push-button ignitions and immobilizing anti-theft devices. In addition to releasing the software update, the two companies are working to provide steering wheel locks to over 25,000 vehicle owners across the United States.

Recommendations:

• Vehicles owners should contact Hyundai (toll-free at 800-633-5151) or Kia (toll-free at 800-333-4542) for information on the free software updates. Patches have been rolled out for 2017-2020 Elantra, 2015-2019 Sonata, and 2020-2021 Venue cars and will be rolled out for other models soon.
• Owners of the vulnerable vehicles should contact local law enforcement to check whether a wheel lock is available for their vehicle model.
• Follow ZeroFox Intelligence for further updates and advisories.

Hackers Start Using Havoc Post-Exploitation Framework in Attacks

Cobalt Strike is the most common tool used by threat actors for post-exploitation abuse, like dropping “beacons” to be used for delivering additional malware. However, with security teams becoming quite adept at spotting and defending against Cobalt Strike toolkits, hackers are trying out alternatives. One such alternative spotted in the wild is an open-source command and control (C2) framework called Havoc.

This framework reportedly evades security setups and can bypass Microsoft Defender on up-to-date Windows 11 devices using techniques such as sleep obfuscation, return address stack spoofing, and indirect syscalls.

Recommendations:

• Keep your software and systems updated and be wary of downloads from untrusted sources or unsolicited messages, which may contain malicious software.
• Follow ZeroFox Intelligence for updates on new types of malware, their indicators of compromise (IOCs), and ways to protect your systems against them.

Citrix Fixes Severe Flaws in Workspace, Virtual Apps, and Desktops

Popular virtualization solutions provider Citrix has fixed several high-severity security bugs in its products. The bugs, tracked as CVE-2023-24486, CVE-2023-24484, CVE-2023-24485, and CVE-2023-24483, affect Citrix Workspace Apps, Virtual Apps, and Desktops. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory to American users of Citrix, warning them that threat actors could exploit these bugs to take control of vulnerable systems.

Recommendations:

• Users and system administrators should review Citrix security bulletins CTX477618, CTX477617, and CTX477616 for more information and to apply the necessary updates.
• No mitigation methods or workarounds are available for these security flaws, so applying patches is the only way to secure Citrix systems.

North Korea's APT37 Targeting Southern Counterpart with New M2RAT Malware

An advanced persistent threat (APT) group known as APT37 that is connected to North Korea's Ministry of State Security (MSS) has been observed targeting South Korean entities using a now-patched flaw (CVE-2017-8291) in the Hangul word processing application.

APT37, which is also known as Reaper, RedEyes, Ricochet Chollima, and ScarCruft, installs a new malware dubbed M2RAT on the victim’s system that functions as a backdoor and can perform malicious actions such as keylogging, screen capture, process execution, and information theft. The same Hangul flaw was exploited in 2017 by the notorious Lazarus group to attack South Korean cryptocurrency exchanges and users.

Recommendations:

• Deploy all available patches to guard your system against attacks.
• System administrators should set up appropriate intrusion detection mechanisms and effective password policies to guard organizational networks.