Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

trendmicro.com · 19 Nov 2024 · Licence: not cleared; local research copy only

CVEs this report names

7 CVEs

CVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Citrix · NetScaler ADC and NetScaler GatewayKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1574Hijack Execution Flow+2 more · 6 reports
99.7%Top 0.05%
89.9priority
CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
Fortinet · FortiOS and FortiProxy SSL-VPNKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1574Hijack Execution Flow+1 more · 1 report
85.7%Top 0.28%
83.7priority
CVE-2013-3900Microsoft WinVerifyTrust function Remote Code Execution
Microsoft · WinVerifyTrust functionKEVPublic exploitMedium · 5.5T1204.002Malicious File T1553.002Code Signing1 report
44.6%Top 1.2%
80.5priority
CVE-2023-28461Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability
Array Networks · AG/vxAG ArrayOSKEVRansomwareCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more · 1 report
68.1%Top 0.68%
78.6priority
CVE-2023-45727North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability
North Grid · ProselfKEVHigh · 7.5T1190Exploit Public-Facing Application T1005Data from Local System1 report
4.8%Top 8%
65.5priority
CVE-2023-3466Reflected Cross-Site Scripting (XSS)
Citrix · NetScaler ADC High · 8.31 report
2.6%Top 15%
64.1priority
CVE-2023-3467Privilege Escalation to root administrator (nsroot)
Citrix · NetScaler ADC High · 8.01 report
1.3%Top 29%
60.9priority

Where it names them

CVE-2023-3519

LAC reported the multiple campaigns, abusing Array AG (CVE-2023-28461) and Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.

Original ↗

CVE-2023-27997

We observed that vulnerabilities of enterprise products, such as Array AG (CVE-2023-28461), Proself (CVE-2023-45727) and FortiOS/FortiProxy (CVE-2023-27997), were abused in the wild.

Original ↗

Furthermore, Volt Typhoon, which is a state-sponsored actor based in China documented by Microsoft, was reportedly carrying out the exploit against FortiOS/FortiProxy (CVE-2023-27997), which was also used in the LODEINFO Campaign #2 in 2023.

Original ↗

The vulnerability of CVE-2023-27997 was 0-day at the time of usage in both campaigns by Volt Typhoon and Earth Kasha, leading us to the assumption that the 0-day vulnerability was possibly shared or there might be a third-party entity, such as access brokers, specialized in facilitating Initial Access.

Original ↗

CVE-2013-3900

The encrypted payload is embedded in the legitimate digital signature by abusing MS13-098/CVE-2013-3900.

Original ↗

CVE-2023-28461

We observed that vulnerabilities of enterprise products, such as Array AG (CVE-2023-28461), Proself (CVE-2023-45727) and FortiOS/FortiProxy (CVE-2023-27997), were abused in the wild.

Original ↗

LAC reported the multiple campaigns, abusing Array AG (CVE-2023-28461) and Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.

Original ↗

CVE-2023-45727

We observed that vulnerabilities of enterprise products, such as Array AG (CVE-2023-28461), Proself (CVE-2023-45727) and FortiOS/FortiProxy (CVE-2023-27997), were abused in the wild.

Original ↗

CVE-2023-3466

LAC reported the multiple campaigns, abusing Array AG (CVE-2023-28461) and Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.

Original ↗

CVE-2023-3467

LAC reported the multiple campaigns, abusing Array AG (CVE-2023-28461) and Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.

Original ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.