China Targets Dell Flaw, New Ivanti Exploitation, and Cyber Shenanigans on The Pitt!

It's a fun, you know, quick one hour discussion, 3 old men talking about Star Wars. What else could you want? In other podcast news, I recorded an episode this week that'll probably go up early next week with Todd Beardsley from Run 0. Todd is an OG security researcher. He's been around the community for a really long time. Again, I mean that in the nicest possible way because I'm an old man, but Todd, you probably know his name from his time at Rapid 7 doing all kinds of cool security research. He was also part of the Benesploit project for a very long time.

So he's got all of that background. And I had him on to talk about some cool research that he did. He put out a report on Sissa's known Exploited Vulnerability catalog, and not just like what is it and how to use it, but he dug really deep into it. Before he was at run 0, Todd worked at Syssa and he essentially ran the Kev there. So he knows it in a very deep way.

So he he put out this paper called Kevology and also released a web app called the Kev Collider that lets you sort of dig in and remix and filter all of the content in the Kev catalog and, you know, sort of tailor it to your own specific uses. So that was a really fun episode. We also talked about this completely bananas podcast that Todd does on his own that you will have to tune in to hear about.

It's one of the funniest things I've ever come across in my life. Again, complimentary. So that'll be up early next week. So keep an eye out for that. All right, let's dig into this week's news. Couple of stories for you to to check out this week 1 is some research that came out of Google's Threat Intelligence group, also known as Mandiant, sort of, you know, same thing. They put out an analysis of some exploit activity that a China Nexus group that they call UNC 6201. It has been exploiting a vulnerability in Dell recover point for virtual machines, which is essentially like a utility to to back up or recover hypervisor stuff. And this group has been exploiting this vulnerability and the bug itself is really

bad. It's a hard coded credential bug and Dell put out an advisory earlier this week on February 17th about the bug and the Google Threat Intelligence group. Researchers said that this Chinese Nexus group has been exploiting the bug as part of its intrusions and using it for lateral movement. The one thing they did say is that they don't know what the initial access vector is for these intrusions, but this group, UNC 6201, is known for targeting edge appliances like VPN concentrators for initial access.

So that gives you some good insight into how they might be getting into this. And they also said, and I'll quote here from their analysis, there are notable overlaps between UNK 6201 and UNK 5221, which has been used synonymously with the actors publicly reported as Silk Typhoon, although Google Threat Intelligence Group does not currently consider the two clusters to be the same. So this is, you know, this gets into that attribution fuzzy area of we know this is a China Nexus group.

It has some similarities with another group that we track, but we can't or won't say that they're the same group. We don't think that they are, but they probably share some tactics or some tools or some some intelligence, which is extremely common, especially in the Chinese Nexus groups because a lot of them have similar tasking and may even share personnel in some some cases. So this this vulnerability which is CBE 202622769 is a 10 out of 10 CVSS for, you know, take that for whatever you want. And it's in the recover point for virtual machines as I mentioned.

And it's one that you, if you use that specific utility in Dell machines or Dell appliances, it's something that you absolutely need to pay attention to. Dell said in its advisory which came out as I mentioned on February 17th, this is considered critical as an unauthenticated remote attacker with knowledge of the hard coded credentials could potentially exploit this vulnerability leading to unauthorized access to the underlining OS.

And root level persistence, that's as bad as that gets. Root level persistence is not what you want. So again, this story is up on the on the site right now. You should go and have a look at this if this is a a utility that you use in your organization. The Google researchers said that they also have seen this threat actor deploying A newly identified backdoor that they call Grimbolt. I don't like that name. Sounds bad. Along with other known malware families such as Sleigh Style and Brickstorm. If Brickstorm rings a bell, there's a good reason for that. Mandiant has seen that going back about a year. It's been used by lots of other threat actors to for persistence, especially in US organizations, including some cloud providers and other technology companies. I know it sounds like a Lego

controller or something along those lines, but it's a pretty serious problem. So if you're not familiar with Brickstorm, we have some information on it on the site as well. You can we've written about it in the past. You can go have a look at that. But for Dell shops, this is this is 1 you definitely want to pay attention to. All right, in other exploitation news, you guys are not going to believe this. I'm telling you, you won't you won't believe it. There is news of a critical vulnerabilities in an Avanti appliance being exploited, two bugs actually.

So these are bugs that Avanti disclosed at the end of January and they're in the endpoint Manager mobile product and Palo Alto's Unit 42 research team put it out an advisory this week. Like very detailed analysis of some exploit activity that is hitting a bunch of sectors in the US, Germany, Australia and Canada so far, including state and local government, healthcare organizations, manufacturing, professional and legal services and tech organizations. So kind of the the pool of targets that you would expect for advanced threat actors to be going after in cyber espionage campaigns looking to steal interesting information, that's what you get.

So they've seen some pretty widespread exploitation of it's two separate vulnerabilities again, the the first one is CB20261281. It's a critical RCE bug in Avanti's EPMM, and it's in a legacy bash script. But it these two bugs together give an attacker like pretty much complete control. Again, not what you want.

I would if this is a product that your organization uses. Again, this is something you want to take very seriously. This is not targeted exploitation. Palo Alto researchers said. This is pretty widespread. There's tons of detailed information in there in their research report, which I would encourage everybody to go and check out. This is something that's been going on for a couple of weeks, it sounds like, or at least about 10 days. So it's something that probably will continue to go on be or excuse me, continue to, to, to happen because these two vulnerabilities are very serious. And I'll just, I'll quote from Palo Alto's report here. It says these vulnerabilities allow unauthenticated attackers to remotely execute arbitrary code on target servers, granting them full control over mobile

device management infrastructure without user interaction or credentials. That's kind of, you know, the Holy Grail for attackers, especially for an MDM fleet. If you have complete control over the MDM infrastructure and can issue commands to user mobile devices, you are in a really scary position inside an organization. So that's something that I would encourage you all to go and check out if you use that specific tool.

You know, it's been a rough go for a lot of these edge device manufacturers, as we've talked about many times on this podcast. So go have a look at this one. If that's something that you use. It's extremely serious, as I mentioned. So the last thing I wanted to mention before, before we get out of here is I don't know how many people are paying attention to this show, the Pit that's on HBO and HBO Max or whatever the hell it's called now. It's a medical show.

I'm sure you know, you've probably heard about it. It's, it's pretty gnarly in terms of like the, the grossness and medical content. You know, it takes place over 112 to 15 hour shift in an emergency room in Pittsburgh. And you know, it's, it's got a lot of ties to the old show, ER, including Noah Wiley, the main character or main actor is one of the producers and writers on the show. Anyway, that's irrelevant. The the relevant part is the episode that went up this week right at the end, and I'm going to spoil it for you. If you're not caught up, you, you want to shut this off whatever.

I won't take it personally, but there's this hospital's emergency room has been getting overflow patients from another hospital because that other hospital was having some sort of undisclosed incident. So they couldn't treat patients and they were diverting them to the Pitt trauma center. We didn't know why we found out this this this week in this episode again, spoilers that it was because they had a network outage due to a ransomware incident.

And the ransomware actors also just hit another hospital in Pittsburgh. So the CEO of the pit, this Pittsburgh trauma center comes into the ER and tells everybody, hey, this is what's happened. This is why we're seeing all these diverted patients. And to make sure that it doesn't happen to us, we are going to shut down our entire network, everything electronic health records, everything, mobile devices. We're shutting off our Internet here in this hospital as a way to make sure that we don't get hit with ransomware. So anybody listening to this podcast probably has some questions about that strategy.

That's kind of where the episode ends. So we don't really know. We see them, We see everything go offline at the very end of the episode, which is a pretty interesting tactic to address a potential ransomware threat. If you have paid attention to any ransomware incidents, you might know that a lot of times ransomware actors will gain initial access to a network, say a hospital, and not deploy ransomware for quite a long time, days or weeks or even potentially months. They'll just sit there and do some reconnaissance, do a little research on the organization, see what their financial picture might be, what kind of ransom might, might make sense for this organization, what kind of information they can gain from the network before they actually detonate the ransomware, all that kind of stuff.

So if there's a ransomware actor that has access to these other two hospitals and has already deployed the ransomware, the chances are really high that that actor probably in this fictional universe is already inside the pits network. So taking it offline probably isn't the ideal way to deal with that. I've got a couple of friends that are in this in the, you know, ransomware IR world.

I'm going, I haven't asked them yet, but I'm going to what their thoughts are on this strategy and what they think of this tactic and how effective it might be, especially in terms of this specific hospital emergency department. That is, this is all taking place on the 4th of July and they have like obviously a full, a full emergency department. They have overflow, they have people with heat stroke. They have all kinds of issues going on.

So their ability to actually provide care to these people is probably pretty degraded if they're just running around with, you know, pen and paper and looking things up in medical textbooks and, you know, passing notes to each other like it's 1952. So I'm, I'm really eager to see how this plays out in the next few weeks. This just kind of struck me as pretty odd and, you know, funny in like the weird way when I was watching it.

You know, I I said to my wife when we were watching, I started laughing when this happened and she was like, is that what they should be doing? I was like, I don't, I don't really think so. It's not really the advice. I don't think. So maybe we'll come back next week and talk about what people have said about the response. But my friend Rich Mogul, who I mentioned earlier who was on the Star Wars episode, you know, long time security pro and is also an emergency medicine EMT. So he's done all kinds of like, you know, disaster medicine, like mountain rescue stuff, all this kind of stuff. So we talked about actually doing a podcast episode on this season of the Pit after it wraps up. So I might have to have him on earlier than that depending on how this ransomware storyline plays out. But it should be entertaining to see how this all goes. But I just wanted to mention

that I thought it was really interesting to see this play out on a on a really well made show and a show that, you know, is very apparently very accurate with its medical depictions. I'm going to guess that they had some pretty good consultation on the technical side when they decided to play out the storyline. Could be somebody we know. I'll look it up. But if you're not watching the pit, sorry about that. If you are, let me know what you think about this storyline. I'd love to hear from you again.

You can always reach us at my e-mail is Dennis at decipher dot SC and you can find us on Twitter, blue sky YouTube at Decipher SEC Decipher SEC have a great weekend talk to you soon.