Outbreak Alert: ShadowSilk Data Exfiltration Attack

[skharoliwal]

FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence. Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets. The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.
CVE ID	CVE-2024-27956
CVE Title	Improper Neutralization of Special Elements used in an SQL Command...
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	92/100
Epss Score	0.939
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	Yes (ShadowSilk)
Included in CISA KEV List	No
Available working exploit(s)	1
Available working exploit(s)	https://packetstormsecurity.com/files/182408/WordPress-WP-Automatic-SQL-Injection.html
Available POC exploit(s)	16
Available POC exploit(s)	https://github.com/AiGptCode/WordPress-Auto-Admin-Account-and-Reverse-Shell-cve-2024-27956 https://github.com/diego-tella/CVE-2024-27956-RCE https://github.com/truonghuuphuc/CVE-2024-27956 https://github.com/ThatNotEasy/CVE-2024-27956 https://github.com/itzheartzz/MASS-CVE-2024-27956
Darknet Mention(s)	3 (xss)
Telegram Mention(s)	2 (Hunt3r Kill3rs | Охотники-убийцы, Keymous +)
FortiRecon Intelligence Reporting(s)	3 (OSINT), 1 (Technical Intelligence), 7 (FortiGuard Research)
Vendor Advisory:	https://patchstack.com/articles/critical-vulnerabilities-patched-in-wordpress-automatic-plugin?_s_id... https://patchstack.com/database/vulnerability/wp-automatic/wordpress-automatic-plugin-3-92-0-unauthe...

CVE ID	CVE-2018-7602
CVE Title	Drupal Core Remote Code Execution Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	92/100
Epss Score	0.94189
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	Yes (ShadowSilk)
Included in CISA KEV List	Yes
Available working exploit(s)	4
Available working exploit(s)	https://packetstormsecurity.com/files/147407/Drupalgeddon3-Remote-Code-Execution.html https://www.exploit-db.com/exploits/44557 https://packetstormsecurity.com/files/147380/Drupal-drupgeddon3-Remote-Code-Execution.html https://www.exploit-db.com/exploits/44542
Available POC exploit(s)	8
Available POC exploit(s)	https://github.com/CLincat/vulcat https://github.com/1337g/Drupalgedon3 https://github.com/shellord/Drupalgeddon-Mass-Exploiter https://github.com/kastellanos/CVE-2018-7602 https://github.com/cyberharsh/DrupalCVE-2018-7602
Darknet Mention(s)	2 (xss, 90sec)
Telegram Mention(s)	1 (The Archivists Domain)
FortiRecon Intelligence Reporting(s)	2 (OSINT), 1 (FortiGuard Research)
Vendor Advisory:	https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html https://www.drupal.org/sa-core-2018-004 http://www.securitytracker.com/id/1040754 http://www.securityfocus.com/bid/103985 https://www.exploit-db.com/exploits/44542/ https://www.exploit-db.com/exploits/44557/ https://www.debian.org/security/2018/dsa-4180

CVE ID	CVE-2018-7600
CVE Title	Drupal Core Remote Code Execution Vulnerability
NVD Severity	CRITICAL
FortiRecon Severity	CRITICAL
FortiRecon Score	92/100
Epss Score	0.9447
Exploited	Yes
Exploited by Ransomware Group(s)	No
Exploited by APT Group(s)	Yes (Emennet Pasargad, ShadowSilk)
Included in CISA KEV List	Yes
Available working exploit(s)	7
Available working exploit(s)	https://packetstormsecurity.com/files/147392/Drupal-Drupalgeddon-2-Forms-API-Property-Injection.html https://www.exploit-db.com/exploits/44482 https://packetstormsecurity.com/files/147247/Drupalgeddon2-Drupal-Remote-Code-Execution.html https://www.exploit-db.com/exploits/44449 https://www.exploit-db.com/exploits/44448
Available POC exploit(s)	44
Available POC exploit(s)	https://github.com/dreadlocked/Drupalgeddon2 https://github.com/a2u/CVE-2018-7600 https://github.com/pimps/CVE-2018-7600 https://github.com/g0rx/CVE-2018-7600-Drupal-RCE https://github.com/firefart/CVE-2018-7600
Darknet Mention(s)	9 (raidforums, xss, antichat, 90sec)
Telegram Mention(s)	2 (ANTICHAT Channel)
FortiRecon Intelligence Reporting(s)	1 (FortiGuard Research), 7 (OSINT), 5 (Technical Intelligence)
Vendor Advisory:	https://www.debian.org/security/2018/dsa-4156 https://www.exploit-db.com/exploits/44448/ https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html https://greysec.net/showthread.php?tid=2912&pid=10561 http://www.securitytracker.com/id/1040598 https://twitter.com/arancaytar/status/979090719003627521 https://twitter.com/RicterZ/status/979567469726613504 https://www.exploit-db.com/exploits/44449/ https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/ https://groups.drupal.org/security/faq-2018-002 https://www.exploit-db.com/exploits/44482/ https://twitter.com/RicterZ/status/984495201354854401 http://www.securityfocus.com/bid/103534 https://github.com/a2u/CVE-2018-7600 https://research.checkpoint.com/uncovering-drupalgeddon-2/ https://www.drupal.org/sa-core-2018-002 https://github.com/g0rx/CVE-2018-7600-Drupal-RCE https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714 https://www.synology.com/support/security/Synology_SA_18_17