Flash Notice: Windows Zero-Day Actively Exploited by Ransomware Group

April 12, 2023

overview

A zero-day vulnerability (CVE-2023-28252) was found in the Windows Common Log File System (CLFS) and is being actively exploited. The vulnerability allows attackers to gain SYSTEM privileges on target Windows systems and deploy Nokoyawa ransomware payloads.

CISA's Known Exploited Vulnerabilities catalog now includes CVE-2023-28252, which impacts all versions of supported Windows servers and clients. This vulnerability can be exploited by attackers in low complexity attacks that do not require user interaction.

Although Microsoft has patched the zero-day, security researchers from Kasperky’s Global Research and Analysis Team (GReAT) found that CVE-2023-28252 was being exploited in Nokoyawa ransomware attacks. Kaspersky reports that the Nokoyawa ransomware group has been using additional exploits to target the CLFS driver since June 2022. These exploits have similar but distinct characteristics and are all believed to originate from a single exploit developer. So far, Nokoyawa has used at least five additional CLFS exploits to target industries such as energy, manufacturing, healthcare, software development, and retail and wholesale.

Over the years, zero-day vulnerabilities have been primarily leveraged by Advanced Persistent Threat (APT) actors. However, several cybercriminal groups are increasingly using zero-day exploits in their attacks. This means that organizations should be vigilant and uphold robust cyber security hygiene to strengthen their defenses against these malicious actors.

avertium's recommendations

Patching information for CVE-2023-28252 can be found in Microsoft’s advisory.

INDICATORS OF COMPROMISE (IoCs)

At this time, there are no known IoCs associated with CVE-2023-28252. Avertium’s threat hunters remain vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.

How Avertium is Protecting Our CUSTOMERS

Expanding endpoints, cloud computing environments, and accelerated digital transformation have decimated the perimeter in an ever-expanding attack surface. Avertium offers Attack Surface Management, so you’ll have no more blind spots, weak links, or fire drills.
Fusion MXDR is the first MDR offering that fuse together all aspects of security operations into a living, breathing, threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is greater than the sum of its parts.
Avertium offers Vulnerability Management to provide a deeper understanding and control over organizational information security risks. If your enterprise is facing challenges with the scope, resources, or skills required to implement a vulnerability management program with your team, outsourced solutions can help you bridge the gap.