Threat Source newsletter (Sept. 23, 2021)
Summary: Cisco Talos found a previously undiscovered Turla backdoor in the wild that the Russian APT installed as a service named "Windows Time Service" to mimic an existing Windows service, and it contacts its command and control server over an HTTPS encrypted channel every five seconds to check for new commands. The same newsletter notes that CISA released an advisory on a recent spike in Conti ransomware attacks, and that Microsoft issued updated patches for the OMIGOD vulnerabilities in Open Management Infrastructure, including CVE-2021-38647, which could allow remote code execution.
What you should know: Turla's backdoor is built to survive cleanup, described as a second-chance foothold that persists even after the primary malware is removed, so a remediation that removes the first implant can leave the actor still on the machine. Separately, CISA's advisory points to a spike in Conti ransomware attacks, a reminder that the ransomware pressure is rising at the same time.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2021-38645CVE-2021-38647CVE-2021-38648CVE-2021-38649
- Related
- Threat Brief: OMI Vulnerabilities (CVE-2021-38645, CVE-2021-38647, CVE-2021-38648 and CVE-2021-38649) Cyber Risks ·CVE-2021-38648: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021