Spring Data Bad SpEL, Hive Gets Rust-ed, Cozy Bear Leverages BRc4, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 06 July, 2022
Episode 259 - 06 July 2022
Spring Data Bad SpEL- https://portswigger.net/daily-swig/spring-data-mongodb-hit-by-another-critical-spel-injection-flaw
Hive Gets Rust-ed -
https://thehackernews.com/2022/07/hive-ransomware-upgrades-to-rust-for.html
Silent Shadow Fix -
https://www.bleepingcomputer.com/news/microsoft/microsoft-quietly-fixes-shadowcoerce-windows-ntlm-relay-bug/
Google to Delete Sensitive Tracking- https://www.infosecurity-magazine.com/news/british-army-social-media-accounts/
Cozy Bear Leverages BRc4 -
https://thehackernews.com/2022/07/hackers-abusing-brc4-red-team.html
Hi, I’m Paul Torgersen. It’s Wednesday July 6th 2022, and this is a look at the information security news from overnight.
From PortSwigger.net
A critical SpEL injection vulnerability has been patched in Spring Data MongoDB. The 9.8 severity bug could be exploited to achieve remote code execution. First.org has ranked the flaw among the top 10 CVEs likely to be used in the wild over the last 30 days. The ease-of-exploitation and the number of proof of concepts available will likely make this vulnerability very popular. Get your patch on kids.
From TheHackerNews.com:
The operators of the Hive ransomware have completely rewritten the malware, moving from the Go language to Rust. This gains them the benefit of memory safety and deeper control over low-level resources as well as making use of a wide range of cryptographic libraries. It also makes it more difficult to reverse engineer. These changes continue to show Hive as one of the fastest evolving ransomware families out there.
From ZDNet.com:
Four more Android apps have been removed from the Google Play store after it was discovered they were being used to deliver the Joker malware to smartphones. The apps, which have over 100,000 downloads between them are: Smart SMS Messages, Blood Pressure Monitor, Voice Language Translator and Quick Text SMS. They join at least 11 other apps that have been removed recently for the same issue. Details in the article.
From BleepingComputer.com
Microsoft has confirmed that they silently patched the ShadowCoerce vulnerability as part of their June 2022 updates. They say the vuln was mitigated along with CVE-2022-30154 because they both affect the same component. The question is, why have they not yet publicly provided any details, or even assigned a CVE ID. Strange actions for a vulnerability of this magnitude. No clarification yet from Redmond.
And last today, from TheHackerNews.com
Malicious actors have been observed abusing Brute Ratel C4, a relatively new and quite sophisticated toolkit designed to avoid detection by EDR and AV capabilities. BRc4 is a customized command-and-control center for red team and adversary simulation. Evidently the bad guys thought it was ready for prime time. The bad guys in this case probably being APT29, or Cozy Bear. You may remember them from the SolarWinds supply chain attack last year.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.