Security News > 2023 > July > CISA: Netwrix Auditor RCE bug exploited in Truebot malware attacks

CISA and the FBI warned today of new Truebot malware variants deployed on networks compromised using a critical remote code execution vulnerability in the Netwrix Auditor software in attacks targeting organizations across the United States and Canada.

The bug impacts the Netwrix Auditor server and the agents installed on monitored network systems and enables unauthorized attackers to execute malicious code with the SYSTEM user's privileges.

TrueBot is a malware downloader linked to the Russian-speaking Silence cybercrime group and used by TA505 hackers to deploy Clop ransomware on compromised networks since December 2022.

"Previous Truebot malware variants were primarily delivered by cyber threat actors via malicious phishing email attachments; however, newer versions allow cyber threat actors to also gain initial access through exploiting CVE-2022-31199," the two federal agencies said in a joint report with MS-ISAC and the Canadian Centre for Cyber Security.

Based on the nature of Truebot operations observed so far, the primary goal of threat actors behind Truebot is to steal sensitive information from compromised systems for financial gain.

If they detect any indicators of compromise within their organization's network, they should immediately implement mitigation and incident response measures outlined in the advisory and report the incident to CISA or the FBI. If your organization uses Netwrix's IT system auditing software, you should apply patches to address the CVE-2022-31199 vulnerability and update Netwrix Auditor to version 10.5.

News URL

https://www.bleepingcomputer.com/news/security/cisa-netwrix-auditor-rce-bug-exploited-in-truebot-malware-attacks/