Weekly Threat Digest: 7 – 13 March 2022

For a detailed threat digest, download the pdf file here

The second week of March 2022 witnessed the discovery of 538 vulnerabilities out of which 16 gained the attention of Threat Actors and security researchers worldwide. Among these 16, there were 3 zero-days and 5 other vulnerabilities about which the National vulnerability Database (NVD) is awaiting analysis, while 6 of them are undergoing analysis, and 3 were not present in the NVD at all. Hive Pro Threat Research Team has curated a list of 16 CVEs that require immediate action.

Further, we also observed 3 Threat Actor groups being highly active in the last week. APT41, a well-known Chinese threat actor group popular for espionage and financial gain, was observed targeting US state government networks using the famous Log4j vulnerability (CVE-2021-44228) and the USAHerds program (CVE-2021- 44207). Additionally, a famous Initial Access Broker (IAB) was also prominent targeting organizations from the US, UK, and India. Another threat actor from China, Mustang Panda, was observed targeting European diplomats using a revised version of the PlugX backdoor. Common TTPs which could potentially be exploited by these threat actors or CVEs can be found in the detailed section.

Detailed Report:

Interesting Vulnerabilities:

Vendor	CVEs	Patch Link
	CVE-2022-23187 CVE-2022-24094 CVE-2022-24095 CVE-2022-24096 CVE-2022-24097	https://helpx.adobe.com/security/products/illustrator/apsb22-15.html https://helpx.adobe.com/security/products/after_effects/apsb22-17.html
	CVE-2022-26384 CVE-2022-26383 CVE-2022-26387 CVE-2022-26381	https://cdn.stubdownloader.services.mozilla.com/builds/firefox-stub/en-US /win/bb09da6defac4081f06e02ac17730b9b6f1e13 db4315d371a03b167a2f4b3155/Firefox%20Installer.exe
	CVE-2022-24512* CVE-2022-21990* CVE-2022-24459* CVE-2022-23277 CVE-2022-22006 CVE-2022-24501	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24512 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21990 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24459 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23277 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22006 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24501
	CVE-2022-0847	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ snapshot/linux9d2231c5d74e13b2a0546fee6737ee4446017903.tar.gz

Active Actors:

Icon	Name	Origin	Motive
	APT41 (Double Dragon, TG-2633, Bronze Atlas, Red Kelpie, Blackfly, Earth Baku, SparklingGoblin, Grayfly)	China	Espionage and financial gain
	Prophet Spider	Unknown	Crypto mining, ransomware, and extortion.
	Mustang Panda (Bronze President, TEMP.Hex, HoneyMyte, Red Lich, RedDelta, TA416)	China	Information theft and espionage

Targeted Location:

Targeted Sectors:

Common TTPs:

Threat Advisories:

Dirty Pipe: A privilege escalation vulnerability in Linux Kernel

Microsoft addressed three zero-day vulnerabilities March 2022 Patch Tuesday UpdateMozilla release

Security Advisories for multiple vulnerabilities affecting Firefox and Firefox ESR

Multiple security vulnerabilities in Adobe After Effects and Illustrator

Chinese state-sponsored threat group APT41 targets U.S. critical organizations using two Zero-Days

RangnarLocker Ransomware hits Critical Infrastructure Compromising 50+ Organizations

Prophet Spider exploits Log4j and Citrix vulnerabilities to deploy webshells

Mustang Panda targets European diplomats using enhanced PlugX backdoor