US and Canadian government agencies find that new variants of the malware are increasingly being utilized by exploiting an RCE bug.

Dark Reading Staff, Dark Reading

July 7, 2023

1 Min Read
code on a computer screen with the word malware on top of and across it.
Source: EyeEm via Alamy Stock Photo

The Cybersecurity and Infrastructure Security Agency (CISA) this week is warning that a bevy of Truebot malware variants are increasingly being utilized by threat actors against various organizations in the US and Canada.

CISA, alongside the Federal Bureau of Investigation (FBI), Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Canadian Center for Cyber Security (CCCS), noted that cyber threat actors are using phishing campaigns with malicious hyperlinks to deliver Truebot variants to a variety of targets, or are using a known remote code execution (RCE) vulnerability in Netwrix Auditor — otherwise listed as CVE-2022-31199.

Truebot, alternatively known as Silence.Downloader, is a botnet used by malicious cybergroups such as Cl0p ransomware cybergang to gather information from the victims they target. Older variants of Truebot were mainly distributed by threat actors by phishing email attacks in the form of malicious attachments. Newer versions of the malware allow these threat actors to gain initial access by exploiting the RCE bug.

CISA, the FBI, MS-ISAC, and CCCS all urge organizations to apply vendor patches to update to the 10.5 version of Netwrix Auditor, and to use the outlined guidance in the joint advisory.

"Any organization identifying indicators of compromise (IoCs) within their environment should urgently apply the incident responses and mitigation measures detailed in this CSA and report the intrusion to CISA or the FBI," stated the aforementioned organizations. 

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights