Friday April 04, 2025

Advisory ID: NCC-CSIRT-2025-001

Summary

The Mirai malware is actively spreading in Nigeria’s cyberspace, targeting IoT devices with weak security settings. Once infected, these devices become part of a botnet used for large-scale DDoS attacks and other malicious activities. Organizations and individuals using IoT devices must take immediate steps to secure their infrastructure.

CVEs:                  CVE-2016-10401, CVE-2017-17215, CVE-2018-10088, CVE-2019-9580, CVE-2024-45163

Probability:        High

Impact:              Severe – Potential for large-scale botnet attacks, DDoS campaigns, and system compromise

Product (s):        IoT Devices, Routers, DVRs, IP Cameras, Networked Devices

Version (s):         Various firmware versions vulnerable to default or weak credentials

Platform (s):       Linux-based IoT devices and embedded systems

 

Summary

The NCC-CSIRT has identified that the Mirai malware is active in Nigeria’s cyberspace, targeting IoT devices with weak security settings. Once infected, these devices become part of a botnet used for large-scale DDoS attacks and other malicious activities. Organizations and individuals using IoT devices must take immediate steps to secure their infrastructure.

Threat Type (s): Botnet, Malware, Distributed Denial-of-Service (DDoS), Credential Exploitation

Consequences

  • Devices compromised and controlled by attackers.
  • Participation in large-scale DDoS attacks affecting critical services.
  • Unauthorized access to sensitive networks and data.
  • Potential for further malware propagation within affected networks.

Description

Mirai is a self-propagating malware that infects IoT devices by exploiting weak/default credentials and unpatched vulnerabilities. Once infected, the device joins a botnet controlled by threat actors to launch massive DDoS attacks or other malicious activities. The malware continuously scans for additional vulnerable devices, increasing its attack surface. Reports indicate a rise in Mirai-related incidents in Nigeria, highlighting the urgent need for preventive measures.

Solution

  • Change default credentials: Immediately update factory-set usernames and passwords on all IoT devices.
  • Apply firmware updates: Ensure devices are running the latest firmware with security patches.
  • Disable unnecessary services: Turn off remote management features that are not required.
  • Implement network segmentation: Isolate IoT devices from critical networks to limit exposure.
  • Use strong authentication: Enable multi-factor authentication (MFA) where possible.
  • Monitor network traffic: Regularly check for unusual outbound traffic that may indicate botnet activity.

References

https://www.cisa.gov/news-events/alerts/2016/10/14/heightened-ddos-threat-posed-mirai-and other-botnets

https://www.quorumcyber.com/wp-content/uploads/2023/06/Quorum-Cyber-_Mirai-Botnet-Report.pdf

https://darktrace.com/fr/blog/mirai-malware-infects-cctv-camera

https://nvd.nist.gov/vuln/detail/cve-2024-45163

Advisory ID:  ngCERT-2025-010008

SUMMARY

ngCERT is aware of a critical Remote Code Execution (RCE) vulnerability in Zimbra Collaboration Suite (ZCS), a widely used email and collaboration platform. The flaw dubbed (CVE-2024-45519), allows unauthenticated attackers to execute arbitrary commands on affected Zimbra installations. Successful exploitation could result to system compromise, data theft, and malware infiltration among other malicious activities. Accordingly, users and systems administrators are advised to take proactive steps to safeguard their systems against exploits by threat actors.

CVE:              CVE-2024-45519

Probability:    High

Damage:        Critical

Platform(s):   Zimbra Collaboration Suite

DESCRIPTION

The Zimbra remote code execution flaw exists in Zimbra's postjournal service, which is used to parse incoming emails over SMTP. Threat actors exploit this weakness by sending specially crafted emails with commands to execute in the carbon copy (CC) field, when the postjournal service processes the email. These emails contain base-64 encoded strings that are executed via the 'sh' shell to build and drop a webshell on the Zimbra server. Once the webshell is installed, it listens for inbound connections containing a specific JSESSIONID cookie field. If the correct cookie is detected, the webshell parses another cookie (JACTION) that contains base64-encoded commands to execute. The webshell also supports downloading and executing files on the compromised server. Once installed, the webshell offers full access to the compromised Zimbra server for data theft or to further spread into the internal network. Some of the vulnerable products and versions include, versions before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1.

CONSEQUENCES

Successful exploitation of the vulnerabilities could lead to:

1. Compromise of entire system.

2. Exfiltration of data.

3. Ransomware infiltration leading to potential financial loss.

4. Service disruption leading to potential Denial of Service (DoS).

SOLUTION/MITIGATION

The following are recommended:

1. Administrators should verify that postjournal is disabled if not required.

2. Ensure that mynetworks is correctly configured to prevent unauthorized access.

3. Apply the latest security updates provided by Zimbra.

 

REFERENCES

Advisory ID:   ngCERT-2025-010006

SUMMARY

ngCERT has observed the emergence of a critical Fortinet OS & FortiProxy Authentication Bypass Vulnerability tagged (CVE-2024-55591). This flaw allows attackers to execute remote code on affected systems, which can result in full system compromise. Exploiting this flaw can lead to data breaches, privilege escalation, and service disruption. Reportedly, the weakness is identified with a CVSSv3 score of 9.6, with records of active exploitation in the wild. In this regard, users are strongly advised to apply the available patches provided by Fortinet, while emplacing necessary measures to safeguard their systems.  

Probability:    High

Damage:        Critical

Platform(s):   Fortinet OS

DESCRIPTION

CVE-2024-55591 vulnerability emanates from an “Authentication Bypass Using an Alternate Path or Channel” issue (CWE-288). It is a remote code execution (RCE) vulnerability that exists due to improper input validation in the Node.js websocket module of FortiOS and FortiProxy products. The vulnerability allows an unauthenticated attacker to send specially crafted input to the Node.js websocket module, triggering a stack-based buffer overflow. This overflow can be exploited to execute arbitrary code on the target device, with the potential for the attacker to gain super-admin privileges over the system. Threat actors could gain unauthorized access to firewall management interfaces, create new user accounts, use those accounts to bypass security (like logging in via SSL VPN) and other multiple modifications to the device configuration which helps attackers establish a path to the internal network. The vulnerability is particularly dangerous because it can be triggered remotely over the network without requiring prior authentication, making it a prime target for attackers seeking to gain unauthorized access to systems. This vulnerability impacts FortiOS versions 7.0.0 to 7.0.16, FortiProxy versions 7.0.0 to 7.0.19, and FortiProxy versions 7.2.0 to 7.2.12.

CONSEQUENCES

Falling prey to these attacks could potentially lead to:

1. System compromise.

2. Unauthorized access to sensitive data.

3. Data exfiltration.

4. Ransomware infiltration leading to potential financial loss.

5. Reputational damage.

6. Service Disruption leading to potential Denial of Service (DoS).

SOLUTION/MITIGATION

ngCERT recommends the following:

1. Ensure that all systems using the affected component are updated to the latest, secure versions. Fortinet has provided tools to assist with upgrading, which can be found on their official site. https://www.fortiguard.com/psirt/FG-IR-24-535 

2. Implement network segmentation and firewalls to restrict access to critical systems from untrusted or external networks.

3. Adopt the Use of intrusion detection systems (IDS) and intrusion prevention systems (IPS) to monitor for abnormal traffic patterns or exploit attempts targeting this vulnerability.

4. Deploy Web Application Firewalls (WAFs) to detect and block any malicious payloads.

5. Implement network segmentation and firewalls to restrict access to critical systems from untrusted or external networks.

6. Ensure comprehensive monitoring to detect abnormal activities and possible indicators of compromise (IoCs) that could reveal attempted or successful attacks.

7. Implement system hardening by ensuring the principle of least privilege is in force, while enabling only necessary services and open ports are accessible.

8. Disable or restrict the use of vulnerable components or services that expose the system to external connections, where possible.

9. Educate staff/users about security best practices, such as recognizing phishing attempts that might lead to an attack on the network.

HYPERLINK

https://tnp.straitstimes.com/news/singapore/scam-website-masquerades-govt-support-scheme-portal

Advisory ID:   ngCERT-2025-010007

SUMMARY

ngCERT is aware of an increase in Android.Vo1d malware infections within the Nigerian cyberspace. Android.vo1d otherwise known as Void is a recent android trojan campaign reported to have infected over 1.3 million Android TV boxes worldwide, including Nigeria. The malware is identified as a sophisticated backdoor capable of secretly downloading and installing malicious applications on infected devices, particularly those running outdated Android operating systems. Android.vo1d poses a major risk to Android TV box users, with implications on system compromise and takeover, as well as data exfiltration among other negative impacts. Consequently, ngCERT strongly advises individuals and organizations to take immediate steps to safeguard their systems and data from this emerging threat.

Probability:    High

Damage:        Critical

Platform(s):   Android TV Boxes

 

DESCRIPTION

Android.Vo1d is a backdoor trojan that installs itself deep in the device’s system files and operates covertly by employing advanced techniques to evade detection while establishing persistence. It achieves this by infiltrating the system storage and modifying critical files like install-recovery.sh and daemonsu files. Thereafter, it creates news files, /system/xbin/wd, /system/xbin/vo1d, /system/bin/debuggerd_real and /system/bin/debuggerd. Attackers cleverly disguises the malware by altering the file name “vold,” a system program, to “vo1d,” substituting the lowercase “l” with the number “1”. This trick allows the malware to evade detection while establishing a foothold in infected systems. Additionally, the backdoor’s components, Android.Vo1d.1, Android.Vo1d.3, and Android.Vo1d.5 work concurrently to ensure continued malicious activity. Particularly, Vo1d.1 manages activities and downloads executables files from the C&C server, Vo1d.3 installs and launches the encrypted Android.Vo1d.5 daemon, while monitoring directories and installing APK files, with Vo1d.5 providing additional functionality. Furthermore, TV boxes running older Android versions are particularly vulnerable, as they often lack critical security updates. Some of these devices include the R4 (Android 7.1.2) and KJ-SMART4KVIP (Android 10.1).

CONSEQUENCES

Falling prey to these attacks could potentially lead to:

  1. System compromise.
  2. Unauthorized access to sensitive data.
  3. Data exfiltration.
  4. Reputational damage.
  5. Service Disruption leading to potential Denial of Service (DoS).

SOLUTION/MITIGATION

ngCERT recommends the following:

  1. Regularly update of TV box firmware from official sources.
  2. Installation of antivirus software to detect potential infections.
  3. Avoid downloading apps or firmware from unofficial sources.
  4. Consider replacing TV boxes running on outdated Android versions with newer and more secure models.

HYPERLINK

dvisory ID: ngCERT-2025-010005

Summary: 

ngCERT has observed a widespread of the Nymaim malware infections across Nigerian cyberspace. The malware originally designed as a ransomware loader has become a multi-functional threat capable of delivering a variety of malicious payloads, such as banking Trojans, ransomware, and remote access tools (RATs). Known for its stealthy and modular design, Nymaim uses advanced techniques to evade detection and maintain persistence on infected systems. By leveraging social engineering, advanced obfuscation, and modularity, Nymaim poses a significant threat to individuals and organizations. Defending against such threats requires a multi-layered approach, including regular software updates, user awareness, and advanced threat detection tools. As Nymaim continues to evolve, staying vigilant and proactive is essential to mitigate its impact.

Damage/Probability: CRITICAL/HIGH

Platform(s): Operating Systems

Description: 

Nymaim malware attack chain reflects a carefully crafted sequence of steps designed to infiltrate systems, evade detection, and achieve the attacker’s objectives. Its initial attack process involves leveraging various entry points to compromise the target’s system. The most common attack vectors include phishing emails, drive-by downloads, compromised websites, execution and payload deployment. Upon execution, Nymaim decrypts and unpacks its malicious code, which is initially stored in an encrypted format. This ensures the payload remains undetected during the initial stages of infection. To maintain access, Nymaim modifies system settings, such as registry keys, to achieve persistence. It may also create scheduled tasks to ensure it runs every time the system starts, even after a reboot. Nymaim connects to a Command-and-Control (C2) server to download additional payloads tailored to the attacker’s objectives.

Consequences: 

Successful exploitation could lead to:
  1. Data Exfiltration
  2. Data Loss
  3. Secondary Payload Deployment
  4. System Disruption
  5. Financial Losses. 

Solution:  

ngCERT recommends the following:

  • Keep all software and operating systems up to date.

  • Regularly monitor network traffic for anomalous behavior.

  • Train employees to identify phishing attempts and suspicious links.

  • Effective use of anti-malware software and firewall system.

  • Encourage reporting of suspicious emails to IT teams promptly.

  • Notify stakeholders and comply with any regulatory requirements in case of a data breach.

References:

  1. ngCERT SECURITY ADVISORY ON VIPERSOFTX MALWARE INFILTRATION
  2. TINYBANKER “TINBA” MALWARE INFILTRATION
  3. Nymaim Malware Detected in the Wild Across Nigeria
  4. NITDA ADVISORY ON GRANDOREIRO BANKING MALWARE

Page 1 of 22