Cybersecurity Agencies Warn of TrueBot Malware Campaign ... - HIPAA Journal

Posted By Steve Alder on Jul 7, 2023

A joint cybersecurity advisory has been issued by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Canadian Centre for Cyber Security (CCCS) warning about a TrueBot malware campaign targeting organizations in the United States and Canada.

TrueBot is a downloader/botnet malware that establishes a connection with its command-and-control server, collects information on compromised systems, and is used for launching more extensive attacks on compromised networks. TrueBot is used by multiple threat actors including FIN11 and the Silence group. FIN11 has been using TrueBot malware to deploy Clop ransomware on victims’ networks. FIN11 installs TrueBot, then uses the malware to deliver the FlawedGrace Remote Access Trojan (RAT), which is used to escalate privileges and maintain persistence. FIN11 has also been observed deploying Cobalt Strike beacons.

TrueBot is usually installed via phishing attacks using malicious attachments; however, newer versions of the malware are also being delivered by exploiting a remote code execution vulnerability in the Netwrix Auditor application – CVE-2022-31199. Successful exploitation of the vulnerability allows a malicious actor to execute arbitrary code with SYSTEM privileges, allowing the deployment of TrueBot malware at scale within a compromised environment. The cybersecurity authorities report that phishing emails with malicious hyperlinks are being used in addition to the exploitation of the Netwrix Auditor vulnerability to deliver TrueBot malware.

Immediate patching of the CVE-2022-31199 vulnerability is strongly recommended if the Netwrix IT system auditing software is in use. To protect against phishing attacks, email security solutions are recommended along with phishing-resistant multifactor authentication. Organizations are also encouraged to search for the published Indicators of Compromise (IoCs) detailed in the alert and to immediately apply the recommended incident responses and mitigation measures if the IoCs are detected.