Forest Global Training Partners

Cyber Risks · Cisco Talos

Threat Source newsletter (Aug. 4, 2022) — Black Hat 2022 preview

Summary: Cisco Talos reported a new attack framework called Manjusaka, advertised as an imitation of Cobalt Strike, with a fully functional command-and-control written in GoLang and a Simplified Chinese user interface that is freely available and can generate new implants with custom configurations. Talos released Snort rule 60275 and ClamAV signature Win.Trojan.Manjusaka-9956281-1 to detect it, and also noted CISA added CVE-2022-26138, a hardcoded password vulnerability in Atlassian's Questions for Confluence app, to its Known Exploited Vulnerabilities list, giving federal agencies three weeks to patch.

Bottom line: A free, fully functional Cobalt Strike imitation with an easy implant generator lowers the bar for any actor to stand up command-and-control, and CISA's confirmation that the Confluence hardcoded-password flaw is being actively exploited leaves on-premises Confluence Server and Data Center data exposed to anyone who reaches it.

Read the original at Cisco Talos ↗

Topics
Malware
Related