CISA Releases Malware Analysis Reports of Pulse Secure Exploits

Threat Watch

Threat Watch CISA Releases Malware Analysis Reports of Pulse Secure Exploits

CISA Releases Malware Analysis Reports of Pulse Secure Exploits

On July 21^st, the US Cybersecurity and Infrastructure Security Agency (CISA) released thirteen malware analysis reports covering webshells and utilities used by threat actors after exploiting vulnerabilities in Pulse Connect Secure, including CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, and CVE-2021-2289. “Since at least June 2020, Pulse Secure devices . . . have been the target of attacks from threat actors,” according to CISA, and the released reports cover the initial finding from some of these incidents. Most of the initial findings are webshells, but others are utilities that will install a script to steal the credentials of users who log in successfully in the case of MAR-10337580-2.v1. Others would attempt to use creative means to maintain persistence through a malicious replacement of the “umount” system utility, in the case of MAR-10337580-1.v1.

ANALYST NOTES

With the continued exploitation of Pulse Secure devices, it is becoming more important to include application and system logs from these devices when measuring one’s threat landscape. If patching is not possible, then including logs from Pulse Secure devices and shipping them to the centralized log store can be invaluable to a Security Operations Center to detect exploitation early in the process. Building detections around available exploits can put organizations ahead of low-skilled attackers who merely just take the publicly-available proof-of-concept code and use it to exploit exposed devices. However, the best way to prevent these attacks is to implement patches that effectively mitigate the vulnerabilities.

https://us-cert.cisa.gov/ncas/current-activity/2021/07/21/malware-targeting-pulse-secure-devices

https://www.bleepingcomputer.com/news/security/cisa-warns-of-stealthy-malware-found-on-hacked-pulse-secure-devices/

Using Microsoft Sentinel to Detect Confluence CVE-2022-26134 Exploitation

Russia may be Pressing Arrested Cyber Criminals into Service

Get To Know Bob Meindl, Our New CEO!

How Ransomware Capabilities Are Evolving and What You Can Do to Keep Your Organization Secure

Threat Watch