Researchers are warning of a sharp increase in exploit attempts using a critical remote code execution vulnerability in Realtek Jungle SDK since August 2022. According to Palo Alto Networks Unit 42, the ongoing campaign has seen 134 million exploit attempts as of December 2022, with 97% of the attacks occurring in the past four months. Close to 50% of the attacks originated from the U.S., followed by Vietnam, Russia, The Netherlands, France, and Germany. Additionally, 95% of the attacks from Russia targeted organizations in Australia. Many of the attacks attempted to deliver malware to vulnerable IoT devices, Unit 42 researchers said in a report, adding that threat groups are using this vulnerability to carry out large-scale attacks on smart devices around the world. The vulnerability in question is CVE-2021-35394, a set of buffer overflows and an arbitrary command injection bug that can be weaponized to execute arbitrary code with the highest level of privilege and take over affected appliances. The vulnerability affects a wide range of devices from D-Link, LG, Belkin, Belkin, ASUS, and NETGEAR. Unit 42 said it discovered three different kinds of payloads distributed as a result of in-the-wild exploitation of the flaw. Also delivered through the abuse of CVE-2021-35394 are known botnets like Mirai, Gafgyt, and Mozi, as well as a new Golang-based distributed denial-of-service botnet called RedGoBot. First observed in September 2022, the RedGoBot campaign involves dropping a shell script designed to download a number of botnet clients tailored to different CPU architectures. The malware, once launched, is capable of running operating system commands and mounting DDoS attacks. The findings once again emphasize the importance of updating software in a timely fashion to avoid exposure to potential threats. The surge of attacks leveraging CVE-2021-35394 shows that threat actors are very interested in supply chain vulnerabilities, which can be difficult for the average user to identify and remediate, the researchers concluded. These issues can make it difficult for the affected user to identify the specific downstream products that are being exploited.
This Cyber News was published on thehackernews.com. Publication date: Mon, 30 Jan 2023 11:34:02 +0000