Friday May 16, 2025

Advisory ID:  ngCERT-2025-010008

SUMMARY

ngCERT is aware of a critical Remote Code Execution (RCE) vulnerability in Zimbra Collaboration Suite (ZCS), a widely used email and collaboration platform. The flaw dubbed (CVE-2024-45519), allows unauthenticated attackers to execute arbitrary commands on affected Zimbra installations. Successful exploitation could result to system compromise, data theft, and malware infiltration among other malicious activities. Accordingly, users and systems administrators are advised to take proactive steps to safeguard their systems against exploits by threat actors.

CVE:              CVE-2024-45519

Probability:    High

Damage:        Critical

Platform(s):   Zimbra Collaboration Suite

DESCRIPTION

The Zimbra remote code execution flaw exists in Zimbra's postjournal service, which is used to parse incoming emails over SMTP. Threat actors exploit this weakness by sending specially crafted emails with commands to execute in the carbon copy (CC) field, when the postjournal service processes the email. These emails contain base-64 encoded strings that are executed via the 'sh' shell to build and drop a webshell on the Zimbra server. Once the webshell is installed, it listens for inbound connections containing a specific JSESSIONID cookie field. If the correct cookie is detected, the webshell parses another cookie (JACTION) that contains base64-encoded commands to execute. The webshell also supports downloading and executing files on the compromised server. Once installed, the webshell offers full access to the compromised Zimbra server for data theft or to further spread into the internal network. Some of the vulnerable products and versions include, versions before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1.

CONSEQUENCES

Successful exploitation of the vulnerabilities could lead to:

1. Compromise of entire system.

2. Exfiltration of data.

3. Ransomware infiltration leading to potential financial loss.

4. Service disruption leading to potential Denial of Service (DoS).

SOLUTION/MITIGATION

The following are recommended:

1. Administrators should verify that postjournal is disabled if not required.

2. Ensure that mynetworks is correctly configured to prevent unauthorized access.

3. Apply the latest security updates provided by Zimbra.

 

REFERENCES

Advisory ID:   ngCERT-2025-010006

SUMMARY

ngCERT has observed the emergence of a critical Fortinet OS & FortiProxy Authentication Bypass Vulnerability tagged (CVE-2024-55591). This flaw allows attackers to execute remote code on affected systems, which can result in full system compromise. Exploiting this flaw can lead to data breaches, privilege escalation, and service disruption. Reportedly, the weakness is identified with a CVSSv3 score of 9.6, with records of active exploitation in the wild. In this regard, users are strongly advised to apply the available patches provided by Fortinet, while emplacing necessary measures to safeguard their systems.  

Probability:    High

Damage:        Critical

Platform(s):   Fortinet OS

DESCRIPTION

CVE-2024-55591 vulnerability emanates from an “Authentication Bypass Using an Alternate Path or Channel” issue (CWE-288). It is a remote code execution (RCE) vulnerability that exists due to improper input validation in the Node.js websocket module of FortiOS and FortiProxy products. The vulnerability allows an unauthenticated attacker to send specially crafted input to the Node.js websocket module, triggering a stack-based buffer overflow. This overflow can be exploited to execute arbitrary code on the target device, with the potential for the attacker to gain super-admin privileges over the system. Threat actors could gain unauthorized access to firewall management interfaces, create new user accounts, use those accounts to bypass security (like logging in via SSL VPN) and other multiple modifications to the device configuration which helps attackers establish a path to the internal network. The vulnerability is particularly dangerous because it can be triggered remotely over the network without requiring prior authentication, making it a prime target for attackers seeking to gain unauthorized access to systems. This vulnerability impacts FortiOS versions 7.0.0 to 7.0.16, FortiProxy versions 7.0.0 to 7.0.19, and FortiProxy versions 7.2.0 to 7.2.12.

CONSEQUENCES

Falling prey to these attacks could potentially lead to:

1. System compromise.

2. Unauthorized access to sensitive data.

3. Data exfiltration.

4. Ransomware infiltration leading to potential financial loss.

5. Reputational damage.

6. Service Disruption leading to potential Denial of Service (DoS).

SOLUTION/MITIGATION

ngCERT recommends the following:

1. Ensure that all systems using the affected component are updated to the latest, secure versions. Fortinet has provided tools to assist with upgrading, which can be found on their official site. https://www.fortiguard.com/psirt/FG-IR-24-535 

2. Implement network segmentation and firewalls to restrict access to critical systems from untrusted or external networks.

3. Adopt the Use of intrusion detection systems (IDS) and intrusion prevention systems (IPS) to monitor for abnormal traffic patterns or exploit attempts targeting this vulnerability.

4. Deploy Web Application Firewalls (WAFs) to detect and block any malicious payloads.

5. Implement network segmentation and firewalls to restrict access to critical systems from untrusted or external networks.

6. Ensure comprehensive monitoring to detect abnormal activities and possible indicators of compromise (IoCs) that could reveal attempted or successful attacks.

7. Implement system hardening by ensuring the principle of least privilege is in force, while enabling only necessary services and open ports are accessible.

8. Disable or restrict the use of vulnerable components or services that expose the system to external connections, where possible.

9. Educate staff/users about security best practices, such as recognizing phishing attempts that might lead to an attack on the network.

HYPERLINK

https://tnp.straitstimes.com/news/singapore/scam-website-masquerades-govt-support-scheme-portal

Advisory ID:   ngCERT-2025-010007

SUMMARY

ngCERT is aware of an increase in Android.Vo1d malware infections within the Nigerian cyberspace. Android.vo1d otherwise known as Void is a recent android trojan campaign reported to have infected over 1.3 million Android TV boxes worldwide, including Nigeria. The malware is identified as a sophisticated backdoor capable of secretly downloading and installing malicious applications on infected devices, particularly those running outdated Android operating systems. Android.vo1d poses a major risk to Android TV box users, with implications on system compromise and takeover, as well as data exfiltration among other negative impacts. Consequently, ngCERT strongly advises individuals and organizations to take immediate steps to safeguard their systems and data from this emerging threat.

Probability:    High

Damage:        Critical

Platform(s):   Android TV Boxes

 

DESCRIPTION

Android.Vo1d is a backdoor trojan that installs itself deep in the device’s system files and operates covertly by employing advanced techniques to evade detection while establishing persistence. It achieves this by infiltrating the system storage and modifying critical files like install-recovery.sh and daemonsu files. Thereafter, it creates news files, /system/xbin/wd, /system/xbin/vo1d, /system/bin/debuggerd_real and /system/bin/debuggerd. Attackers cleverly disguises the malware by altering the file name “vold,” a system program, to “vo1d,” substituting the lowercase “l” with the number “1”. This trick allows the malware to evade detection while establishing a foothold in infected systems. Additionally, the backdoor’s components, Android.Vo1d.1, Android.Vo1d.3, and Android.Vo1d.5 work concurrently to ensure continued malicious activity. Particularly, Vo1d.1 manages activities and downloads executables files from the C&C server, Vo1d.3 installs and launches the encrypted Android.Vo1d.5 daemon, while monitoring directories and installing APK files, with Vo1d.5 providing additional functionality. Furthermore, TV boxes running older Android versions are particularly vulnerable, as they often lack critical security updates. Some of these devices include the R4 (Android 7.1.2) and KJ-SMART4KVIP (Android 10.1).

CONSEQUENCES

Falling prey to these attacks could potentially lead to:

  1. System compromise.
  2. Unauthorized access to sensitive data.
  3. Data exfiltration.
  4. Reputational damage.
  5. Service Disruption leading to potential Denial of Service (DoS).

SOLUTION/MITIGATION

ngCERT recommends the following:

  1. Regularly update of TV box firmware from official sources.
  2. Installation of antivirus software to detect potential infections.
  3. Avoid downloading apps or firmware from unofficial sources.
  4. Consider replacing TV boxes running on outdated Android versions with newer and more secure models.

HYPERLINK

dvisory ID: ngCERT-2025-010005

Summary: 

ngCERT has observed a widespread of the Nymaim malware infections across Nigerian cyberspace. The malware originally designed as a ransomware loader has become a multi-functional threat capable of delivering a variety of malicious payloads, such as banking Trojans, ransomware, and remote access tools (RATs). Known for its stealthy and modular design, Nymaim uses advanced techniques to evade detection and maintain persistence on infected systems. By leveraging social engineering, advanced obfuscation, and modularity, Nymaim poses a significant threat to individuals and organizations. Defending against such threats requires a multi-layered approach, including regular software updates, user awareness, and advanced threat detection tools. As Nymaim continues to evolve, staying vigilant and proactive is essential to mitigate its impact.

Damage/Probability: CRITICAL/HIGH

Platform(s): Operating Systems

Description: 

Nymaim malware attack chain reflects a carefully crafted sequence of steps designed to infiltrate systems, evade detection, and achieve the attacker’s objectives. Its initial attack process involves leveraging various entry points to compromise the target’s system. The most common attack vectors include phishing emails, drive-by downloads, compromised websites, execution and payload deployment. Upon execution, Nymaim decrypts and unpacks its malicious code, which is initially stored in an encrypted format. This ensures the payload remains undetected during the initial stages of infection. To maintain access, Nymaim modifies system settings, such as registry keys, to achieve persistence. It may also create scheduled tasks to ensure it runs every time the system starts, even after a reboot. Nymaim connects to a Command-and-Control (C2) server to download additional payloads tailored to the attacker’s objectives.

Consequences: 

Successful exploitation could lead to:
  1. Data Exfiltration
  2. Data Loss
  3. Secondary Payload Deployment
  4. System Disruption
  5. Financial Losses. 

Solution:  

ngCERT recommends the following:

  • Keep all software and operating systems up to date.

  • Regularly monitor network traffic for anomalous behavior.

  • Train employees to identify phishing attempts and suspicious links.

  • Effective use of anti-malware software and firewall system.

  • Encourage reporting of suspicious emails to IT teams promptly.

  • Notify stakeholders and comply with any regulatory requirements in case of a data breach.

References:

Advisory ID: ngCERT-2025-010004

Summary: 

ngCERT is issuing an urgent security alert regarding the infiltration of ViperSoftX malware within Nigerian cyberspace. ViperSoftX is a JavaScript-based Remote Access Trojan (RAT) capable of stealing sensitive information like banking and cryptocurrency details while evading detection and analysis on an infected system. Cybercriminals distribute this malware through infected email attachments, malicious online advertisements, social engineering, and cracked software. When successfully deployed on a system, the Trojan could be used for several malicious activities, leading to system compromise, data exfiltration, financial losses, identity theft, and ransomware attacks. ngCERT advises individuals and organizations to protect their systems and data from ViperSoftX malware immediately.

Damage/Probability: CRITICAL/HIGH

Platform(s): Operating Systems

Description: 

ViperSoftX malware infection begins when cybercriminals lure unsuspecting victims into downloading malicious files from multimedia sites, endpoints of cracked software, eBooks, torrent sites, and malicious emails. Upon execution, ViperSoftX initiates checks to avoid virtual environments and security monitoring, identification of antivirus tools to ascertain the risk of detection, and the running of a PowerShell script to download its core malicious components. Thereafter, the Trojan establishes two-way communication with its C2 servers to receive instructions and exfiltrates sensitive data. Summarily, the attack process involves infection and delivery stage, anti-analysis and security evasion procedures, PowerShell script execution, and rogue browser extension installation such as VenomSoftX, while carrying out cryptocurrency and password management targeting. These are aimed at stealing login credentials, cookies, and autofill data, allowing for a sweeping breach of user accounts and sensitive data. Also, through clipboard hijacking, ViperSoftX copies valid wallet addresses and replaces them with its own, thereby diverting any cryptocurrency transactions away from the victim. It further carries out password manager data extracting, which exposes the entire security framework of the victim’s system to further attacks.

Consequences: 

 Successful exploitation of the vulnerabilities could lead to:

  • System compromise

  • Unauthorized access to sensitive data.

  • Loss and theft of sensitive data.

  • Reputation Damage.

  • Ransomware attacks.

  • Financial loss.

Solution:  

 ngCERT recommends the following: 

  • Refrain from opening attachments in emails received unexpectedly from trustworthy users or unreliable sources.

  • Ensure that the assets/systems operating system, applications, antivirus, and plugins are up to date.

  • Conduct regular system scans and remove detected/potential threats.

  • Maintain regular data backups on external devices or reputable cloud storage providers.

  • Consider implementing stronger security measures, including firewalls, intrusion detection/prevention systems, anti-phishing solutions, endpoint detection and response solutions including anti-malware software.

  • Implement comprehensive security solutions to all necessary devices such as BitLocker, FileVault, and/or device encryption.

  • Enforce a strong password policy and implement regular password changes.c

  • Disable unused services and open ports on your agency's servers and endpoint devices. Only open ports and activate services that are necessary for daily operations.

References:

  1. TINYBANKER “TINBA” MALWARE INFILTRATION
  2. Nymaim Malware Detected in the Wild Across Nigeria
  3. NITDA ADVISORY ON GRANDOREIRO BANKING MALWARE
  4. Andromeda Malware Threat Active in the Wild

Page 2 of 23