Weekly Threat Digest: 18 – 24 April 2022
Weekly Threat Digest: 18 – 24 April 2022
For a detailed threat digest, download the pdf file here
| Published Vulnerabilities | Interesting Vulnerabilities | Active Threat Groups | Targeted Countries | Targeted Industries | ATT&CK TTPs |
| 430 | 5 | 2 | Worldwide | 17 | 46 |
The fourth week of April 2022 witnessed the discovery of 430 vulnerabilities out of which 5 gained the attention of Threat Actors and security researchers worldwide. Among these 5, there was 1 zero-day, and 1 vulnerability that was awaiting analysis on the National Vulnerability Database (NVD). Hive Pro Threat Research Team has curated a list of 5 CVEs that require immediate action.
Further, we also observed Two Threat Actor groups being highly active in the last week. Lazarus, a North Korea threat actor group popular for financial crime and gain, was observed targeting blockchain technology and the cryptocurrency industry using a new malware TraderTraitor and Hive ransomware group was seen using the ProxyShell vulnerabilities to target organizations all around the world. Common TTPs which could potentially be exploited by these threat actors or CVEs can be found in the detailed section.
Detailed Report:
Interesting Vulnerabilities:
| Vendor | CVEs | Patch Link |
 | CVE-2021-34473 CVE-2021-34523 CVE-2021-31207 | https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34473 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34523 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31207 |
 | CVE-2022-0540 | https://www.atlassian.com/software/jira/core/download https://www.atlassian.com/software/jira/update |
 | CVE-2022-29072* | Not Available |
Active Actors:
| Icon | Name | Origin | Motive |
 | Lazarus Group (APT38, BlueNoroff, and Stardust Chollima) | North Korea | Financial crime and gain |
 | Hive Ransomware Group | Unknown | Financial crime and gain |
Targeted Location:
Targeted Sectors:
 |  |  |  |
 |  |  |  |
 |  |  |  |
 |  |  |  |
Common TTPs:
| TA0042: Resource Development | TA0001: Initial Access | TA0002: Execution | TA0003: Persistence | TA0004: Privilege Escalation | TA0005: Defense Evasion | TA0006: Credential Access | TA0007: Discovery | TA0008: Lateral Movement | TA0009: Collection | TA0011: Command and Control | TA0010: Exfiltration | TA0040: Impact |
| T1588: Obtain Capabilities | T1190: Exploit Public-Facing Application | T1059: Command and Scripting Interpreter | T1136: Create Account | T1134: Access Token Manipulation | T1134: Access Token Manipulation | T1110: Brute Force | T1083: File and Directory Discovery | T1570: Lateral Tool Transfer | T1560: Archive Collected Data | T1071: Application Layer Protocol | T1567: Exfiltration Over Web Service | T1486: Data Encrypted for Impact |
| T1588.005: Exploits | T1566: Phishing | T1059.007: JavaScript | T1136.002: Domain Account | T1543: Create or Modify System Process | T1140: Deobfuscate/Decode Files or Information | T1003: OS Credential Dumping | T1135: Network Share Discovery | T1021: Remote Services | T1560.001: Archive via Utility | T1071.001: Web Protocols | T1496: Resource Hijacking | |
| T1588.006: Vulnerabilities | T1566.001: Spearphishing Attachment | T1059.001: PowerShell | T1053: Scheduled Task/Job | T1068: Exploitation for Privilege Escalation | T1562: Impair Defenses | T1003.005: Cached Domain Credentials | T1057: Process Discovery | T1021.001: Remote Desktop Protocol | T1005: Data from Local System | T1105: Ingress Tool Transfer | ||
| T1566.002: Spearphishing Link | T1059.003: Windows Command Shell | T1053.005: Scheduled Task | T1053: Scheduled Task/Job | T1562.001: Disable or Modify Tools | T1018: Remote System Discovery | T1021.002: SMB/Windows Admin Shares | T1113: Screen Capture | |||||
| T1078: Valid Accounts | T1106: Native API | T1078: Valid Accounts | T1053.005: Scheduled Task | T1070: Indicator Removal on Host | T1518: Software Discovery | T1021.006: Windows Remote Management | ||||||
| T1078.002: Domain Accounts | T1053: Scheduled Task/Job | T1078.002: Domain Accounts | T1078: Valid Accounts | T1553: Subvert Trust Controls | T1518.001: Security Software Discovery | |||||||
| T1053.005: Scheduled Task | T1078.002: Domain Accounts | T1078: Valid Accounts | T1049: System Network Connections Discovery | |||||||||
| T1204: User Execution | T1078.002: Domain Accounts | |||||||||||
| T1204.002: Malicious File | ||||||||||||
| T1047: Windows Management Instrumentation |
Threat Advisories:
Bypass Authentication vulnerability in Atlassian Jira Seraph
Hive Ransomware targets organizations with ProxyShell exploit
Lazarus is back, targeting organizations with cryptocurrency thefts via TraderTraitor malware
What will be the consequence of this disputed vulnerability in 7-ZIP?
