Subj : SonicWall is being attacked by some very persistent malware
To   : All
From : TechnologyDaily
Date : Fri Mar 10 2023 16:30:03

SonicWall is being attacked by some very persistent malware

Date:
Fri, 10 Mar 2023 16:08:10 +0000

Description:
The malware is believed to have survived firmware updates, and might have 
infected the devices years ago.

FULL STORY
======================================================================

SonicWall devices are being attacked by some very persistent malware that is 
capable of surviving through multiple firmware updates, experts have claimed. 

Cybersecurity researchers from Mandiant and SonicWall recently discovered a 
custom-built malware, designed specifically for SonicWall Secure Mobile 
Access (SMA) appliances, most likely designed by a Chinese threat actor 
dubbed UNC4540. 

Its features show a deep understanding of the devices it was built for, and 
the malware is designed for espionage, the researchers claim, as its capable 
of stealing user passwords, as well as providing shell access. Establishing 
remote access 

The overall behavior of the suite of malicious bash scripts shows a detailed 
understanding of the appliance and is well tailored to the system to provide 
stability and persistence," Mandiant said. 

The main module can steal hashed credentials of all users that are logged 
into the compromised endpoints, copy them into a text file and ship them out 
to be decrypted elsewhere. Another module establish a reverse shell for easy 
remote access. Also, the researchers found a module that adds a small patch 
to a legitimate SonicWall binary whose purpose they still werent able to 
determine. 

The researchers also couldnt determine which vulnerability the attackers used 
to compromise these devices with malware, but theyre suspecting the malware 
was deployed years ago and successfully lived through multiple firmware 
updates. They believe the initial compromise could have been done back in 
2021. 

> These are the top endpoint protection services at the moment 


 > 2023 could be the biggest ever year for cybercrime 


 > Ransomware attacks are down this year - but that's not really a great 
thing 

To protect your devices against unknown threats such as this one, the best 
course of action is to apply the latest security updates. SonicWalls latest 
version for targeted appliances is 10.2.1.7, the publication says, adding 
that the patch includes File Integrity Monitoring (FIM) and anomalous process 
identification, two features which should detect and stop this threat. 

"In recent years Chinese attackers have deployed multiple zero-day exploits 
and malware for a variety of internet facing network appliances as a route to 
full enterprise intrusion, and the instance reported here is part of a recent 
pattern that Mandiant expects to continue in the near term," Mandiant 
concluded. These are the best firewalls right now 

Via: BleepingComputer



======================================================================
Link to news story:
https://www.techradar.com/news/sonicwall-is-being-attacked-by-some-very-persis
tent-malware


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.