eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
CISA Known Exploited Vulnerabilities Catalog
Bottom Line: CISA added four new vulnerabilities to the Known Exploited Vulnerabilities catalog, including a recently disclosed critical Fortinet vulnerability. Organizations are strongly recommended to apply security patches for all known exploited vulnerabilities, especially those in Internet-facing applications.
On March 25th and 26th, the Cybersecurity and Infrastructure Security Agency (CISA) announced updates to the Known Exploited Vulnerabilities catalog; the two updates included a total of four vulnerabilities that are now confirmed to be exploited in real-world attacks. Newly added vulnerabilities impact Fortinet, Ivanti, eMerge, and SharePoint.
- CVE-2023-48788 (CVSS: 9.8) - Fortinet FortiClient EMS SQL Injection Vulnerability
- Exploitation would allow an unauthenticated remote threat actor to execute code or commands through specially crafted requests, enabling initial access into organizations.
- CVE-2021-44529 (CVSS: 9.8) - Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
- An unauthenticated threat actor may exploit this vulnerability to execute arbitrary code with limited permissions.
- CVE-2019-7256 (CVSS: 10) - Nice Linear eMerge E3-Series OS Command Injection Vulnerability
- This vulnerability may be exploited by a remote and unauthenticated threat actor to allow for code execution.
- CVE-2023-24955 (CVSS: 7.2) - Microsoft SharePoint Server Remote Code Execution vulnerability
- Exploitation would allow an authenticated attacker with Site Owner privileges to execute code remotely.
CISA has not provided any additional details on real-world exploitation of these vulnerabilities, although they did confirm that exploitation has not been observed leading to ransomware at this time. As exploitation has been confirmed, it is critical that organizations apply the relevant security patches immediately.
eSentire Threat Intelligence Analysis:
The active exploitation of these vulnerabilities signifies a trend of attackers targeting foundational components of IT infrastructure. This situation stresses the importance of vulnerability management and the adoption of multi-layered security strategies to mitigate potential breaches.
In a public security advisory published on March 14th, 2024, eSentire’s Threat Intelligence team assessed that “exploitation of CVE-2023-48788 will occur in the near future, raising the criticality of quickly addressing this vulnerability.” Shortly afterwards, on March 24th, eSentire observed multiple incidents involving the exploitation of CVE-2023-48788. In incidents identified by eSentire, threat actors exploited CVE-2023-48788 for initial access into victim networks. After access was established, threat actors deployed persistence mechanisms, including reverse webshells and the ScreenConnect Remote Monitoring and Management (RMM) tool. Attacks were disrupted before threat actors completed their action on
objectives, as such, final payloads have not been identified. For more details on the observed attacks, see our security advisory published on March 26th titled “Widespread Exploitation of Fortinet Vulnerability (CVE-2023-48788).”
These vulnerabilities impact a wide range of software, from security solutions like Fortinet's FortiClient EMS to infrastructure management and access control systems. The diversity of affected products highlights the widespread impact and necessity for comprehensive security measures.
Organizations are urged to regularly review CISA’s Known Exploited Vulnerabilities catalog and address all added vulnerabilities. The catalog should be referred to, to help prioritize vulnerability patching requirements, as known exploited vulnerabilities need to be addressed immediately. Managed vulnerability services can greatly assist organizations in identifying vulnerabilities across their infrastructure and prioritizing their patching based on exploitation, criticality, and probability of impact.
eSentire Managed Vulnerability Service (MVS) has plugins in place to identify products vulnerable to CVE- 2023-24955 and CVE-2023-48788.
Attackers Exploit Ray Framework
Bottom Line: Researchers have identified the first known case of threat actors exploiting a vulnerability in an open-source Artificial Intelligence (AI) framework. As security patches will not be made available for CVE-2023-48022, it is critical that organizations refer to official documentation and configure the instance per developer guidelines.
Oligo Security recently discovered an active campaign exploiting a disputed vulnerability in Ray, an open-source Artificial Intelligence (AI) framework. This campaign, known as ShadowRay, has compromised thousands of Ray servers globally over the past 7 months, impacting sectors such as education, cryptocurrency, and biopharma.
Anyscale, the developers and maintainers of Ray, describe Ray as “a unified framework for scaling AI and Python applications. Ray consists of a core distributed runtime and a set of AI Libraries for accelerating ML workloads.” Ray is utilized by some of the largest organizations worldwide including OpenAI, Amazon, Uber, Netflix, and LinkedIn. OpenAI states "At OpenAI, we are tackling some of the world’s most complex and demanding computational problems. Ray powers our solutions to the thorniest of these problems and allows us to iterate at scale much faster than we could before. As an example, we use Ray to train our largest models, including ChatGPT."
In late 2023, five vulnerabilities in Ray were disclosed to Anyscale; shortly afterwards they released a blog post to address the vulnerabilities. Four of the vulnerabilities were patched in Ray version 2.8.1, however, the fifth vulnerability, CVE-2023-48022 (CVSS: 9.8) dubbed “ShadowRay”, was not considered a risk, as such it was not addressed in the patch and it remains disputed. CVE-2023-48022 arises from Ray's lack of authorization in its Jobs API, allowing unauthorized job invocations on exposed servers. The reason Anyscale does not consider this vulnerability to carry any risk is because Ray is expected to be operating in a secure environment. Their security best practices state that “[s]ecurity and isolation must be enforced outside of the Ray Cluster. Ray expects to run in a safe network environment and to act upon trusted code. Developers and platform providers must maintain the following invariants to ensure the safe operation of Ray Clusters.” However, many boilerplate repositories, intended to help companies deploy Ray to their cloud environment, remain vulnerable to both the patched vulnerabilities as well as ShadowRay. This is because Ray’s Dashboard always binds on 0.0.0.0 (all network interfaces), along with port forwarding on 0.0.0.0, this possibly exposes the machine to the internet by default.
After gaining initial access to systems by exploiting CVE-2023-48022, the Oligo Security team observed a range of post-compromise activities executed by threat actors on the breached Ray servers including deploying cryptocurrency miners, stealing sensitive information, and establishing long-term persistence. AI training requires a large amount of computational power, because of this, one of the most immediate and financially motivated uses of compromised high-powered computing resources was for cryptocurrency mining. Attackers deployed crypto miners, including XMRig, to leverage the computational power of GPUs found in the compromised servers for mining activities. Sensitive data contained within AI production workloads, environment variables, and configuration files were at risk. Attackers could potentially exfiltrate proprietary AI models, datasets, third-party tokens, and credentials, posing a significant risk to the intellectual property and operational security of the impacted organizations. To maintain long-term access to compromised systems, attackers deployed reverse shells and used other techniques to establish persistent footholds.
To mitigate the risk posed by the ShadowRay vulnerability, organizations are advised to review the full list of mitigations and best practices outlined by Oligo and Ray. In summary, always run Ray within a secure environment, implement firewall rules or security groups to prevent unauthorized access, consider adding authorization layers to the Ray dashboard if it must be network exposed, and continuously monitor production environments for anomalies, even within Ray deployments.
eSentire Threat Intelligence Analysis:
The discovery of the ShadowRay campaign highlights a critical security concern within modern AI infrastructure, underscoring the need for heightened awareness and protective measures against such vulnerabilities, especially those that remain under dispute and unpatched.
The ShadowRay campaign's duration, with active exploitation lasting at least 7 months as identified by Oligo Security, highlights a concerning trend in the lifecycle of cyber threats and vulnerabilities. The fact that this campaign may have begun exploiting the CVE-2023-48022 vulnerability in Ray before its public disclosure raises significant concerns about the detection and management of vulnerabilities and the potential for preemptive exploitation by threat actors. This potential for exploitation prior to public disclosure emphasizes the importance of robust and proactive security measures, including threat hunting, anomaly detection, and the implementation of a strong security posture that does not solely rely on public vulnerability disclosures.
Despite CVE-2023-48022 being under dispute and thus lacking a patch, its exploitation underscores the critical risks to organizations using Ray for AI infrastructure. The fact that the vulnerability remains disputed significantly limits awareness and understanding of the threat it poses. This dispute creates potential blind spot for security teams and developers who rely on vulnerability databases and scanning tools to identify and mitigate potential threats within their environments. Vulnerabilities tagged as "disputed" often do not appear in standard security scans or are deprioritized, leading to a lack of visibility and underestimation of the risk. The disputed status of CVE-2023-48022 essentially means that many organizations using Ray may be unaware of the vulnerability's existence or its potential impact, leaving them exposed to exploitation.
Shadow vulnerabilities, highlighted by the disputed CVE-2023-48022 in the Ray AI framework and exploited by the ShadowRay campaign, pose a subtle yet particularly dangerous risk in the cybersecurity landscape. These vulnerabilities, which may not be fully recognized, disputed, or adequately addressed by developers and maintainers, create significant blind spots for security teams. The inherent danger of shadow vulnerabilities lies in their ability to evade standard detection mechanisms, such as vulnerability scanners and static analysis tools, which typically rely on acknowledged and documented vulnerabilities. By acknowledging and addressing the risks posed by these overlooked vulnerabilities, organizations can better protect themselves against sophisticated cyber threats and safeguard their critical assets in an increasingly hostile digital environment.
Violent Extremists Dox Executives
Bottom Line: Recorded Future has identified an increase in violent extremists targeting high-profile US- based individuals for doxing. This activity is expected to increase during times of heightened socio-political tensions, such as the upcoming US elections, underscoring the importance of ongoing monitoring of leaks and underground sources for sensitive information.
According to a new report from Recorded Future’s Insikt Group, Domestic Violent Extremists (DVEs) in the United States are increasingly targeting executives and senior leaders, in both the public and private sector. DEV activity outlined in this report is related to doxing. Doxing is the act of gathering, correlating, and releasing personally identifiable information, such as email, location, and phone numbers, for a specific person. The publication of this information is meant to deter high-profile individual activity, and may result in physical, financial, and reputational impact.
According to the report, there was a surge in doxing activity in 2023, specifically impacting the United States. As of January 2024, over 11 million US citizens reported being doxed. There are a variety of reasons that threat actors dox their victims. In the past, doxing was common between rival threat actor groups. Recorded Future states, “DVEs almost certainly dox targets to enable additional physical and cyber threat operations against the victim.” Various ransomware and extortion groups, including BianLian, are reported to dox executives, during or after negotiations, in an attempt to elicit an extortion payment.
The Recorded Future report contains three examples of recent real-world incidents of DVE doxing. Outlined incidents include a white supremacist targeting a political opponent, an anarchist doxing a mayoral advisory council, and a white supremacist doxing an executive and their family over an advertising campaign. Threat actors employed a variety of different means to gather information on victims, such as social media posts, people search websites, Open-Source Intelligence (OSINT) tools, and government directories. Data compilations were posted across Telegram, anarchist websites, and websites dedicated to doxing.
To identify and respond to these incidents, organizations need visibility into both the open-web and dark web sources. Dark web and leak monitoring services can assist organizations in identify data relating to high-priority and high-visibility executives and employees, that are most likely to be targeted in doxing attacks.
eSentire Threat Intelligence Analysis:
Doxing is a popular tool used by extremists, cybercriminals, and hacktivists. Individuals doxed by DVEs or other actors are at an increased risk to physical threats, including harassment, stalking, protests, physical surveillance, targeted cyberattacks, and assault. In addition to physical risks, these attacks may result in reputational and financial damages due to “negative sentiment campaigns.” While it is confirmed that doxing incidents rose in 2023, this trend is expected to continue through 2024, with an increase in activity associated with major events such as “the Israel-Hamas conflict, the 2024 US presidential election, and private sector engagement with social justice issues."
There are a number of recommendations to help organizations prevent and respond to doxing incidents. First, in order to respond to an incident, organizations need to be able to identify when information is posted online; Dark Web Monitoring Services, like those provided by eSentire, can aid organizations in discovering these postings. It is important for executives and other high-profile individuals to maintain cyber-hygiene, regularly reviewing their online presence, and securing social media accounts. Going a step further, organizations can seed misinformation via alternative identities. This tactic involves placing fake information for high-profile individuals, that will distract doxers from their actual details. This may be taken a step further by organizations creating fake users with visible profiles and pictures in public places; doxes related to the fake profiles may act as an early warning system that threat actors are targeting the organization.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
