Weekly Intelligence Bulletin – Week 3

Following Citrix’s advisory last month of a critical remote code execution vulnerability, QuoINT is aware of widespread scanning activity for vulnerable systems and exploitation attempts in the wild.

In the first Patch Tuesday of 2020, Microsoft addressed 49 security fixes across multiple products. Of the vulnerabilities patched this month, eight are listed as ‘critical’ Remote Code Execution (RCE) and 41 as important in severity. Also included in the patch release is a severe Windows CryptoAPI spoofing vulnerability, which has public public proof-of-concept (PoC) exploits available.

Current Threat

Industry Impacted: Financials

Researchers at SentinelOne reported about PowerTrick, a new tool allegedly linked to the TrickBot cybercrime enterprise. The malware was observed to drop different types of second stage samples, including more_eggs. QuoINT analyzed the more_eggs sample and, based on its configuration, attributed it to the FIN6 threat actor group.

Geopolitics

Industry impacted: Government

The UK, France, and Germany formally accused Iran of violating the Iranian nuclear deal and triggered the deal’s dispute mechanism, which could lead to new sanctions. Iran’s president threatened the safety of European soldiers in the Middle East.