US government agencies were told to fix these critical security holes or they would be attacked
- CISA adds CVE-2023-28461 to its catalog of known exploited vulnerabilities
- Federal agencies have until December 16 to resolve the issues
- The bug is being exploited by a Chinese group known as Earth Kasha
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a new critical vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning federal agencies that they have a three-week deadline to apply the available patch, or eliminate it altogether. stop using the affected software.
The agency added a missing authentication vulnerability to KEV that is tracked under CVE-2023-28461, which has a severity score of 9.8 and allows crooks to execute arbitrary code on remote devices.
It was discovered in the secure access gateways of Array Networks AG and vxAG and was resolved in March 2023, with the first clean release of the software being version 9.4.0.484.
Earth Kasha
“The Array AG/vxAG Remote Code Execution Vulnerability is a web security vulnerability that could allow an attacker to browse the file system or perform remote code execution on the SSL VPN gateway using the flags attribute in the HTTP header without authentication,” Array Networks said at the time. “The product could be exploited via a vulnerable URL.”
Federal organizations have until December 16 to patch the software.
CISA did not detail the attacks, but Trend Micro claims that a threat actor known as Earth Kasha took advantage of them.
This Chinese group, also known as MirrorFace, apparently abused Array AG, ProSelf and FortiNet for initial access. The group primarily targets victims in Japan, although they have been observed going after organizations in Taiwan, India and Europe. Pursuing US-based targets isn’t all that common, it seems.
Earth Kasha appears to be connected to the advanced persistent threat of APT10. The group primarily targets sectors such as government, technology, and academia, deploying malware such as LODEINFO, NOOPDOOR, and MirrorStealer to steal credentials, maintain persistence, and exfiltrate sensitive data. Their campaigns often involve credential dumping, DLL side-loading, and encrypted payloads.
Via The hacker news
