Week of February 26, 2024

Attackers exploited a critical authentication bypass vulnerability (CVE-2024-1709) in ConnectWise ScreenConnect to deploy Play ransomware and attempt a LockBit supply chain attack via an MSP. The vulnerability allows unauthenticated creation of administrative users, granting full system control. Multiple ransomware strains were observed in the wild within days of disclosure.

A new tool named Aladdin was released that bypasses Windows Defender Application Control (WDAC) and AppLocker by exploiting a .NET remoting deserialization issue in addinprocess.exe. It combines a known bypass for a 2019 Microsoft patch with a technique to execute arbitrary code, allowing red teamers to run payloads on systems with application control enabled.

A public proof-of-concept script automates bypassing Mobile Device Management (MDM) enrollment during macOS setup by creating a local admin account and blocking MDM domains from Recovery Mode. The script works up to macOS Tahoe 26.3 and could allow users to evade enterprise device management controls.

A weakness in Elastic Agent allows a local administrator to enroll a new agent over an existing installation using the force flag, bypassing Agent Tamper Protection that requires an uninstall token for removal. This could let an attacker replace a protected agent with one under their control, undermining endpoint security.

A new open-source tool named dll_unhook, written in Rust, has been released on GitHub. It uses in-memory disassembly to detect and revert DLL modifications made by EDR/AV software, allowing execution of original code. The project is a proof-of-concept for bypassing endpoint security hooks.

The CACTUS ransomware group exploited CVE-2023-38035 in Ivanti MobileIron Sentry within 24 hours of its disclosure to compromise two separate companies simultaneously. The attack involved data exfiltration, encryption of workstations, and subsequent encryption of virtual machines including domain controllers on both ESXi and Hyper-V hosts. Some machines protected by Bitdefender remained unharmed, while the primary security software from an undisclosed vendor was bypassed.

CSx4Ldr is a Cobalt Strike plugin that generates beacons designed to evade antivirus detection, specifically bypassing Windows Defender. It is a proof-of-concept tool intended for red team operations and security research.

A local privilege escalation vulnerability (CVE-2023-7016) exists in Thales SafeNet Authentication Client prior to version 10.8 R10 on Windows. The flaw allows a low-privileged local attacker to execute arbitrary code with SYSTEM privileges, potentially leading to full system compromise. The vulnerability is due to improper privilege management (CWE-269) in the client's Windows components.