UnFortune 500: most often hacked in Russia and CIS
Virtually every modern cyber incident involves unauthorized access to confidential data. Financially motivated attackers resell such data or demand ransom for release, espionage actors are interested in actual files and developments, while hacktivists pursue publicity of their attacks.
BI.ZONE Brand Protection has analyzed the publications on underground resources from 2024, including Telegram channels, hosting data from attacks on organizations in Russia and other CIS countries. The results were disappointing: at least 500 entities were compromised. The campaigns were not specific to any particular industry: there were victims in practically every sector.
Criminals published successful intrusions online and, in most cases, they targeted commerce, which amounted to 40% of all compromises. Other popular targets included finance (7%), education, and entertainment (6% each).
The data was published by both financially motivated attackers and hacktivists. Most leaks appeared on Telegram and X. In 2024, these sources recorded three times more such publications than the darknet. Even some large organizations were among the victims.
June
Large supermarket chain: a database with 500,000 entries
September
- Major software developer: 10 TB of exposed data
- Large insurance company: 70,000 unique phone numbers and 100,000 unique email addresses
October
- One of the largest restaurant chains: databases with more than 5 million entries
- Major Russian retailer: over 1 million customers’ data
According to the research, in 86% of cases attackers published data stolen from compromised public‑facing web applications. This was predominantly information about the application users, such as their online orders.
After gaining access to the public web application, the attackers installed gs‑netcat on the compromised server to ensure persistent access. Sometimes, the attackers would load additional web shells. They also used legitimate tools such as Adminer, phpMiniAdmin, and mysqldump to extract data from databases. The compromised information was often posted in Telegram channels or underground forums.
Everything that ends up on the Internet sooner or later comes into the attackers’ crosshairs. Usually, they begin by scanning public‑facing services for vulnerabilities. Such activity on the perimeter is one of the key indicators of a potential future compromise. If left undetected, the consequences can be irreversible. Preventive measures, such as continuous penetration testing (CPT), are effective for detecting these kinds of threats. This is one of the most reliable ways to identify and eliminate vulnerabilities before attackers find them.
BI.ZONE CPT has compiled a list of the 10 most common vulnerabilities in publicly available applications:
- Outdated PHP. This includes all vulnerabilities related to unpatched PHP, such as CVE-2024-4577 and CVE-2019-11043. Both vulnerabilities allow an attacker to execute commands on the server, gain persistence in the system, elevate local privileges, and attack the internal network.
42% of all PHP‑based websites remain outdated and vulnerable to critical attacks
- Publically available administrative web application interfaces. These vulnerabilities are of particular interest to attackers as they allow for bruteforce attacks
and credential stuffing and further modification of the app configuration or command execution on the server. 12% of all websites have insecure administrative interfaces, which is a popular loophole for password brute forcing - Outdated Bitrix (the region’s most popular CMS). This group includes all vulnerabilities related to unpatched Bitrix. The most critical ones are CVE-2022-27228 and BDU:2023-05857 inside the modules vote, html_editor (no CVE/BDU number), and landing. Exploiting them allows unauthorized attackers to execute commands, escalate privileges, and move into the internal network.
1 in 3 websites based on Bitrix contains vulnerabilities due to a lack of updates
- Published application debug metrics. This category includes applications in debug mode and published debug metrics (Actuator, kubelet, pprof). As a result of exploitation, attackers obtain information ranging from technical application metrics to environment variables, and sometimes, gain the ability to download server heap dumps. Depending on the application, once the sensitive information has been obtained, attackers can execute commands on the server or access the administrative interfaces of the enterprise applications.
6% of applications unintentionally disclose technical metrics and environment variables, making it easier for attackers to achieve their goals
- Directory listing. This vulnerability provides direct access to files on the web server and enables attackers to access restricted information, including application configuration files.
7% of web applications allow access to private folders and files
- Outdated Confluence. Includes all vulnerabilities related to unpatched Confluence. The most interesting ones are CVE-2023-22527 and CVE-2023-22522. They allow unauthorized attackers to execute commands on the server. Since Confluence contains more than the company’s knowledge base, but also credentials to closed network segments and applications, this system is often one of the primary targets for exploitation.
20% of all Confluence installations contain vulnerabilities that enable command execution on the server
- Outdated GitLab. Includes all vulnerabilities related to unpatched GitLab. For example, CVE-2022-2884 allows authenticated attackers to execute commands on the server. In the context of GitLab, this is a very serious vulnerability making it possible to infiltrate a company’s software directly and move on to its customers. Vulnerabilities involving authentication are more often exploited in GitLab than in other products, as GitLab has a registration option that administrators tend to forget about.
22% of GitLab installations are vulnerable to exploits that attackers use aggressively
- User enumeration. This leads to the disclosure of user IDs. The vulnerability enables targeted attacks such as brute force or credential stuffing.
21% of applications with the authorization feature allow for users’ information to be disclosed through brute‑force attacks
- Cross-site scripting (XSS). These vulnerabilities rely on users interacting with threat actors. The consequences of exploiting such security gaps include everything from unwanted website activity on behalf of the user to remote code execution on the server if the XSS occurs on the admin interface.
4–11% of all applications are susceptible to XSS attacks
- S3 listing. This can result in the disclosure of information and files in S3 storage. Thus, attackers can obtain confidential technical and user data.
16% of applications with S3 storage expose sensitive content, including sensitive files
Malicious actors continue to target Russian organizations, and the exploitation of public‑facing applications remains one of the most popular methods for gaining initial access. In this context, it is critical to quickly identify vulnerabilities and misconfiguration leveraged in real‑world attacks.
Understanding adversary behavior post‑exploitation is also crucial. While it may not prevent the initial breach, it is essential for enabling early detection and limiting the damage. Likewise, it is necessary to continuously monitor the web for any publications of enterprise‑related data and respond quickly to mitigate the consequences.
The above tasks can be streamlined with the following BI.ZONE solutions:
- BI.ZONE Brand Protection identifies information threats outside the company perimeter.
- BI.ZONE CPT maps out the company’s perimeter gaps and potential penetration scenarios.
- BI.ZONE Threat Intelligence helps to figure out potential threat actors and their motives.