Sophos Firewall zero-day bug exploited weeks before fix

Date:
Mon, 20 Jun 2022 16:33:42 +0000

Description:
Chinese APT employs high-severity vulnerability against a number of companies

FULL STORY ======================================================================

A vulnerability in the Sophos Firewall, first discovered in late March and patched soon afterwards, was being exploited by a Chinese advanced persistent threat (APT), in the weeks before the patch was released, reports have revealed.

Researchers from cybersecurity firm Volexity, the threat actor, known as DriftingCloud, exploited the CVE-2022-1040 since early March, against a
number of unnamed entities. It used it to bypass authentication, and run arbitrary code on the victims endpoints. The flaw affects the User Portal and Webadmin of Sophos Firewall, and the threat actors managed to install
webshell backdoors and other malware.

At the moment of discovery, the compromise was still active, and the threat actor was still moving around the network, giving the researchers a unique insight into the operation of an APT. The conclusion of that observation is that the group was sophisticated and that it made a valiant effort to remain undetected.

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022 . Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/10.99. Stage two malware

Among other things, the group blended its traffic by accessing the installed webshell through requests to the legitimate file login.jps, BleepingComputer reported.

At first glance, this might appear to be a brute-force login attempt instead of an interaction with a backdoor. The only real elements that appeared out
of the ordinary in the log files were the referrer values and the response status codes, Volexity explained in its writeup.

After accessing the target network, the threat actor moved to install three distinct malware families - PupyRAT, Pantegana, and Sliver. All three are
used for remote access, and are publicly available. Read ,ore

Sophos Firewall vulnerability gave hackers the keys to the kingdom

Sophos warns customers it was hit by data breach

Sophos agrees to $3.9bn acquisition

The fix for CVE-2022-1040 has been available for months now, and users are advised to patch up immediately, given that its severity score is 9.8.

Its been a busy quarter for the Sophos team, which recently fixed two high severity vulnerabilities in Sophos Unified Threat Management appliances: CVE-2022-0386 and CVE-2022-0652.

Sophos is a UK-based cybersecurity and network security software developer, focused mostly on security software for organizations with up to 5,000 employees. It was founded in 1985, but pivoted towards cybersecurity in the late 1990s.

In 2019, it was acquired by US-based private equity firm, Thoma Bravo, for approximately $3.9 billion ($7.40 per share).

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/sophos-firewall-zero-day-bug-exploited-weeks-be fore-fix/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)