EclecticIQ

Our Ecosystem

An ecosystem supporting our customers' intelligence-led proactive cybersecurity needs with collaborative partner programs delivering world-class joint solutions. 

Partner Program

Partner with EclecticIQ to bring valuable and innovative security solutions and services to end users. Open to all partner types, including technology developers, service providers, resellers, and community.

Our Partnerships

We partner with the world's premier technology and solution providers to support all phases of your cybersecurity needs. Explore all our partners' solutions and offerings to build and extend your cyber defense ecosystem.

EclecticIQ Resources

We are committed to increasing the knowledge and capabilities of the cybersecurity community through our research & analysis efforts and open source projects.

Browse Resources

Learn more about our technology, solutions and services, and stay updated on the cyber threat landscape with our research reports, webinars and other information.

Open Source Projects

We are proud to be an active member in the open source community and to help develop and advance progress of security technology. Learn more about contributions or go directly to our GitHub page.

Our Ecosystem

An ecosystem supporting our customers' intelligence-led proactive cybersecurity needs with collaborative partner programs delivering world-class joint solutions. 

Partner Program

Partner with EclecticIQ to bring valuable and innovative security solutions and services to end users. Open to all partner types, including technology developers, service providers, resellers, and community.

Our Partnerships

We partner with the world's premier technology and solution providers to support all phases of your cybersecurity needs. Explore all our partners' solutions and offerings to build and extend your cyber defense ecosystem.

EclecticIQ Resources

We are committed to increasing the knowledge and capabilities of the cybersecurity community through our research & analysis efforts and open source projects.

Browse Resources

Learn more about our technology, solutions and services, and stay updated on the cyber threat landscape with our research reports, webinars and other information.

Open Source Projects

We are proud to be an active member in the open source community and to help develop and advance progress of security technology. Learn more about contributions or go directly to our GitHub page.

Our Ecosystem

An ecosystem supporting our customers' intelligence-led proactive cybersecurity needs with collaborative partner programs delivering world-class joint solutions. 

Partner Program

Partner with EclecticIQ to bring valuable and innovative security solutions and services to end users. Open to all partner types, including technology developers, service providers, resellers, and community.

Our Partnerships

We partner with the world's premier technology and solution providers to support all phases of your cybersecurity needs. Explore all our partners' solutions and offerings to build and extend your cyber defense ecosystem.

EclecticIQ Resources

We are committed to increasing the knowledge and capabilities of the cybersecurity community through our research & analysis efforts and open source projects.

Browse Resources

Learn more about our technology, solutions and services, and stay updated on the cyber threat landscape with our research reports, webinars and other information.

Open Source Projects

We are proud to be an active member in the open source community and to help develop and advance progress of security technology. Learn more about contributions or go directly to our GitHub page.

Our Ecosystem

An ecosystem supporting our customers' intelligence-led proactive cybersecurity needs with collaborative partner programs delivering world-class joint solutions. 

Partner Program

Partner with EclecticIQ to bring valuable and innovative security solutions and services to end users. Open to all partner types, including technology developers, service providers, resellers, and community.

Our Partnerships

We partner with the world's premier technology and solution providers to support all phases of your cybersecurity needs. Explore all our partners' solutions and offerings to build and extend your cyber defense ecosystem.

EclecticIQ Resources

We are committed to increasing the knowledge and capabilities of the cybersecurity community through our research & analysis efforts and open source projects.

Browse Resources

Learn more about our technology, solutions and services, and stay updated on the cyber threat landscape with our research reports, webinars and other information.

Open Source Projects

We are proud to be an active member in the open source community and to help develop and advance progress of security technology. Learn more about contributions or go directly to our GitHub page.

Norwegian Cyber Attack, Virustotal Data Leak and AI powered BEC

This issue of the Analyst Prompt addresses a cyberattack against the Norwegian government, recently disclosed vulnerabilities in Citrix and ColdFusion, a data leak from Virustotal and the use of AI for Business Email Compromise.

Ippolito Forni August 9, 2023

tap 14 - 2023

Norwegian Government Responds to Significant Cyberattack on 12 Departments     

On July 24, 2023, the Department of Security and Service Organization (DSS) reported a cyberattack on the Information and Communications Technology (ICT) platform of 12 Norwegian departments. An unknown actor exploited a previously unknown vulnerability in the software of one of their suppliers. The vulnerability has now been closed, but it is too early to determine who is behind the attack and its extent. As a result of the security measures, employees in the 12 departments no longer have access to DSS's joint services on mobile, including email, but they can still work as usual on their computers at the office or at home. [1

The DSS, in collaboration with the National Security Authority and the police, has implemented several measures to manage the attack. The situation is being closely monitored and the government's work continues as usual. The Minister of Municipalities and Districts will inform the  Norwegian Parliaments extended foreign and defense committee about the case. Additional security measures may be necessary and will be evaluated continuously.    

Citrix Urges Immediate Action on Critical Vulnerabilities in NetScaler Products    

Citrix's July 18th security bulletin addresses multiple vulnerabilities discovered in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). [2] The vulnerabilities are critical and affect the following supported versions: 

  • NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.13
  • NetScaler ADC and NetScaler Gateway 13.0 before 13.0-91.13
  • NetScaler ADC 13.1-FIPS before 13.1-37.159
  • NetScaler ADC 12.1-FIPS before 12.1-55.297
  • NetScaler ADC 12.1-NDcPP before 12.1-55.297 

     
    The vulnerabilities include: 
  • CVE-2023-3466: Reflected Cross-Site Scripting (XSS) affecting Citrix ADC and Citrix Gateway.
  • CVE-2023-3467: Privilege Escalation to root administrator (nsroot) affecting Citrix ADC and Citrix Gateway.
  • CVE-2023-3519: Unauthenticated remote code execution affecting Citrix ADC and Citrix Gateway. 

Citrix has observed exploits of CVE-2023-3519 on unmitigated appliances and strongly urges affected customers to install the relevant updated versions as soon as possible. The bulletin only applies to customer-managed NetScaler ADC and NetScaler Gateway. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication do not need to take any action.  

Google's Virustotal: Data Leak Reveals User Information     

In late June, a file that was never meant to be public surfaced on the internet setting off alarms among the cybersecurity community. [3] The file contained a list of 5,600 names, including employees of the U.S. National Security Agency (NSA) and German intelligence agencies. These individuals had all registered with Virustotal, presumably to use its services for their professional tasks. The fact that such a file exists and was leaked is a stark reminder of the potential risks associated with the use of online platforms, even those designed to enhance security. 

Virustotal, despite being relatively unknown to most regular online users, holds a high level of importance among hacking experts and cybersecurity professionals. Its ability to analyze files and URLs for viruses, worms, trojans, and other kinds of malicious content makes it an invaluable tool in the cybersecurity arsenal. However, the data leak incident underscores the platform's significance in a different light. It highlights the potential risks associated with its use, especially considering the sensitive nature of its user base.   

Adobe Addresses Critical Vulnerabilities in ColdFusion: Security Bulletin APSB23-47     

The Adobe Security Bulletin APSB23-47, published on July 19, 2023, addresses security updates for Adobe ColdFusion versions 2023, 2021, and 2018. These updates aim to resolve critical and moderate vulnerabilities that could lead to arbitrary code execution and security feature bypass. Adobe has noted that CVE-2023-38205 has been exploited in limited attacks targeting Adobe ColdFusion. 

The vulnerabilities include: 

  • Deserialization of Untrusted Data (CWE-502) leading to Arbitrary code execution (Critical Severity, CVSS base score 9.8, CVE-2023-38204)
  • Improper Access Control (CWE-284) leading to Security feature bypass (Critical Severity, CVSS base score 7.5, CVE-2023-38205)
  • Improper Access Control (CWE-284) leading to Security feature bypass (Moderate Severity, CVSS base score 5.3, CVE-2023-38206) 

The affected versions are: 

  • ColdFusion 2023: Update 2 and earlier versions
  • ColdFusion 2021: Update 8 and earlier versions
  • ColdFusion 2018: Update 18 and earlier versions 

Adobe also recommends updating your ColdFusion JDK/JRE LTS version to the latest update release and applying the security configuration settings as outlined on the ColdFusion Security page. Applying the ColdFusion update without a corresponding JDK update will not secure the server. [4

Understanding the Threat of AI-Driven Business Email Compromise Attacks: The Case of WormGPT      

The progression of AI technologies, such as OpenAI’s ChatGPT, has introduced a new vector for BEC attacks. Cybercriminals can use such technology to automate the creation of highly convincing fake emails, personalized to the recipient, thus increasing the chances of success for the attack.   

A July report from SlashNext discusses the emerging use of generative AI, specifically OpenAI’s ChatGPT and a cybercrime tool called WormGPT, in Business Email Compromise (BEC) attacks. [5

WormGPT is an AI module based on the GPTJ language model, developed in 2021. It presents itself as a blackhat alternative to GPT models, designed specifically for malicious activities. WormGPT was allegedly trained on a diverse array of data sources, particularly concentrating on malware-related data. The tool has features like unlimited character support, chat memory retention, and code formatting capabilities. 

The benefits of using generative AI for BEC attacks include exceptional grammar –a common detrimental mistake among BEC cybercriminals- and a lowered entry threshold, making it an accessible tool for a broader spectrum of cybercriminals. 

To safeguard against AI-driven BEC attacks, the report [5] suggests strategies like BEC-specific training and enhanced email verification measures. Companies should develop extensive, regularly updated training programs aimed at countering BEC attacks, especially those enhanced by AI. Organizations should also enforce stringent email verification processes. 

In conclusion, the growth of AI, while beneficial, brings progressive new attack vectors. Implementing strong preventative measures is crucial.    

Structured Data

Find the Analyst Prompt and earlier editions in our public TAXII collection for easy use in your security stack: TAXII v1 Discovery services.

Please refer to our support page for guidance on how to access the feeds.

About EclecticIQ Intelligence and Research

EclecticIQ is a global provider of threat intelligence, hunting and response technology and services. Headquartered in Amsterdam, the EclecticIQ Intelligence and Research team is made up of experts from Europe and the U.S. with decades of experience in cyber security and intelligence in industry and government.

We would love to hear from you. Please send us your feedback by emailing us at research@eclecticiq.com or fill in the EclecticIQ Audience Interest Survey to drive our research toward your priority area.

You might also be interested in:

FIN8 Group Using Modified Sardonic Malware for Deployment of BlackCat Ransomware

Spearphishing Campaign Targets Zimbra Webmail Portals of Government Organizations

Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure

Appendix

[1] “Departementer utsatt for dataangrep,” DSS - Sammen for fellesskapet, Jul. 24, 2023. https://www.dss.dep.no/aktuelle-saker/departementer-utsatt-for-dataangrep/ (accessed Jul. 28, 2023). 

[2] “Citrix ADC and Citrix Gateway Security Bulletin for CVE-2023-3519, CVE-2023-3466, CVE-2023-3467.” https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467 (accessed Jul. 24, 2023). 

[3] M. H. M. R. H. Tanriverdi, “Datenleck bei kritischer Google-Plattform, die bei Hackern beliebt ist,” DER STANDARD, Jul. 17, 2023. https://www.derstandard.de/story/3000000178997/datenleck-bei-kritischer-google-plattform-die-bei-hackern-beliebt-ist (accessed Jul. 24, 2023). 

[4] “Adobe Security Bulletin.” https://helpx.adobe.com/content/help/en/security/products/coldfusion/apsb23-47.html (accessed Jul. 24, 2023). 

[5] “WormGPT - The Generative AI Tool Cybercriminals Are Using to Launch BEC Attacks | SlashNext,” SlashNext |, Jul. 13, 2023. https://slashnext.com/blog/wormgpt-the-generative-ai-tool-cybercriminals-are-using-to-launch-business-email-compromise-attacks/ (accessed Jul. 24, 2023). 

Receive all our latest updates

Subscribe to receive the latest EclecticIQ news, event invites, and Threat Intelligence blog posts.

Explore all topics

© 2014 – 2024 EclecticIQ B.V.
EclecticIQ. Intelligence, Automation, Collaboration.
Get demo