Weekly Threat Digest: 21-27 February 2022

The last week of February 2022 witnessed 2 highly exploited vulnerabilities which were published by National Vulnerability Database (NVD) on 13th January 2022. These vulnerabilities came into highlight after Cybersecurity and Infrastructure Security Agency (CISA) added them to the known exploited vulnerabilities catalog.

The Hive Pro Threat Research team has also spotted two Threat Actor groups that have been extremely active in the last week. APT10, a well-known Chinese threat actor group famously known for information theft and espionage, has been detected targeting 28 different countries with the latest attack on Taiwanese financial institutions. Furthermore, a highly complex and innovative ransomware group known as UNC2596 targeted 50+ companies in 11 different countries. Common TTPs which could potentially be exploited by these threat actors or CVEs can be found in the detailed section.

Detailed Report:

Interesting Vulnerabilities:

Vendor	CVEs	Patch Link
	CVE-2022-23131 CVE-2022-23134	https://support.zabbix.com/browse/ZBX-20384 https://support.zabbix.com/browse/ZBX-20350

Active Actors:

Icon	Name	Origin	Motive
	APT10 (Stone Panda, APT 10, menuPass, Red Apollo, CVNX, Potassium, Hogfish, Happyyongzi, Cicada, Bronze Riverside, CTG-5938, ATK 41, TA429, ITG01)	China	Information theft and espionage
	UNC2596	Unknown	ecrime

Targeted Locations:

Targeted Sectors:

Common TTPs:

Threat Advisories:

Chinese APT group targets financial institutions in the campaign “Operation Cache Panda”

Zabbix affected by two actively exploited vulnerabilities