Weekly Threat Digest: 11 - 17 April 2022

For a detailed threat digest, download the pdf file here

Published Vulnerabilities	Interesting Vulnerabilities	Active Threat Groups	Targeted Countries	Targeted Industries	ATT&CK TTPs
765	14	1	2	6	25

The third week of April 2022 witnessed a huge spike on the discovery of 765 vulnerabilities out of which 14 gained the attention of Threat Actors and security researchers worldwide. Among these 14, there were 5 zero-day, 9 of them are undergoing analysis and 2 other vulnerabilities about which the National vulnerability Database (NVD) is awaiting analysis while 1 was not present in the NVD at all. Hive Pro Threat Research Team has curated a list of 14 CVEs that require immediate action.

Further, we also observed a Threat Actor groups being highly active in the last week. OldGremlin, a Russian threat actor group popular for financial crime and gain, was observed targeting Russian agencies Common TTPs which could potentially be exploited by these threat actors or CVEs can be found in the detailed section.

Detailed Report:

Interesting Vulnerabilities:

Vendor	CVEs	Patch Link
	CVE-2022-24521* CVE-2022-26904*	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24521 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26904
	CVE-2022-1364*	https://www.google.com/intl/en/chrome/?standalone=1
	CVE-2022-22954* CVE-2022-22955 CVE-2022-22956 CVE-2022-22957 CVE-2022-22958 CVE-2022-22959 CVE-2022-22960* CVE-2022-22961	https://kb.vmware.com/s/article/88099
	CVE-2018-6882	https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7
	CVE-2022-25165 CVE-2022-25166	https://aws.amazon.com/vpn/client-vpn-download/

*zero-day vulnerability

Active Actors:

Icon	Name	Origin	Motive
	OldGremlin	Russia	Financial crime and gain

Targeted Location:

Targeted Sectors:

Common TTPs:

TA0043: Reconnaissance	TA0042: Resource Development	TA0001: Initial Access	TA0002: Execution	TA0004: Privilege Escalation	TA0005: Defense Evasion	TA0006: Credential Access	TA0011: Command and Control
T1592: Gather Victim Host Information	T1583: Acquire Infrastructure	T1190: Exploit Public-Facing Application	T1059: Command and Scripting Interpreter	T1548: Abuse Elevation Control Mechanism	T1548: Abuse Elevation Control Mechanism	T1555: Credentials from Password Stores	T1071: Application Layer Protocol
T1592.001: Hardware	T1583.002: DNS Server	T1566: Phishing	T1059.007: JavaScript	T1068: Exploitation for Privilege Escalation	T1027: Obfuscated Files or Information	T1555.004: Windows Credential Manager	T1071.004: DNS
T1592.002: Software	T1583.001: Domains	T1566.001: Spearphishing Attachment	T1059.003: Windows Command Shell				T1071.001: Web Protocols
T1590: Gather Victim Network Information	T1587: Develop Capabilities	T1566.002: Spearphishing Link	T1204: User Execution				T1132: Data Encoding
T1590.005: IP Addresses	T1587.001: Malware		T1204.002: Malicious File				T1132.001: Standard Encoding
	T1585: Establish Accounts		T1204.001: Malicious Link				T1568: Dynamic Resolution
	T1585.002: Email Accounts						T1568.002: Domain Generation Algorithms
	T1588: Obtain Capabilities						T1573: Encrypted Channel
	T1588.006: Vulnerabilities						T1573.001: Symmetric Cryptography
							T1572: Protocol Tunneling