Multiple Hacker Groups Exploit 3-Year-Old Vulnerability to Breach U.S. Federal Agency

Several risk actors, including a country-state group, exploited a critical three-yr-aged security flaw in Development Telerik to crack into an unnamed federal entity in the U.S.

The disclosure will come from a joint advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-Point out Facts Sharing and Analysis Center (MS-ISAC).

“Exploitation of this vulnerability allowed malicious actors to productively execute remote code on a federal civilian government department (FCEB) agency’s Microsoft Internet Data Providers (IIS) web server,” the organizations claimed.

The indicators of compromise (IoCs) involved with the electronic crack-in have been discovered from November 2022 by early January 2023.

Tracked as CVE-2019-18935 (CVSS score: 9.8), the issue relates to a .NET deserialization vulnerability influencing Progress Telerik UI for ASP.NET AJAX that, if still left unpatched, could guide to distant code execution.

It is really worth noting here that CVE-2019-18935 has earlier discovered a position among the some of the most frequently exploited vulnerabilities abused by numerous menace actors in 2020 and 2021.

CVE-2019-18935, in conjunction with CVE-2017-11317, has also been weaponized by a risk actor tracked as Praying Mantis (aka TG2021) to infiltrate the networks of general public and private companies in the U.S.

Last month, CISA also added CVE-2017-11357 – another remote code execution bug impacting Telerik UI – to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of energetic exploitation.

Risk actors are explained to have leveraged the flaw to upload and execute destructive dynamic-url library (DLL) files masquerading as PNG images by means of the w3wp.exe system.

The DLL artifacts are intended to obtain procedure details, load further libraries, enumerate information and procedures, and exfiltrate the info back to a remote server.

WEBINARDiscover the Concealed Potential risks of 3rd-Celebration SaaS Applications

Are you aware of the hazards involved with 3rd-celebration application entry to your company’s SaaS applications? Be part of our webinar to find out about the kinds of permissions being granted and how to lessen risk.

RESERVE YOUR SEAT

One more set of assaults, observed as early as August 2021 and most likely mounted by a cybercriminal actor dubbed XE Group, entailed the use of aforementioned evasion strategies to sidestep detection.

These DLL data files dropped and executed reverse (remote) shell utilities for unencrypted communications with a command-and-management domain to drop more payloads, which includes an ASPX web shell for persistent backdoor access.

The web shell is outfitted to “enumerate drives to send out, acquire, and delete documents and to execute incoming commands” and “consists of an interface for very easily searching data files, directories, or drives on the technique, and permits the person to add or obtain documents to any listing.”

To counter this kind of attacks, it is really proposed that businesses enhance their situations of Telerik UI ASP.NET AJAX to the most recent edition, apply network segmentation, and implement phishing-resistant multi-factor authentication for accounts that have privileged obtain.

Observed this write-up attention-grabbing? Observe us on Twitter  and LinkedIn to examine much more special written content we publish.

Some parts of this article are sourced from:
thehackernews.com