Cyber News Roundup for July 29, 2024

/by

In this week’s cybersecurity news, the U.S. government is probing CrowdStrike following a massive outage that disrupted critical services and led to numerous Delta Air Lines flight cancellations. In Ukraine, Russian-linked malware caused a heating outage in Lviv. Security awareness and compliance training and testing organization, KnowBe4, discovered a North Korean operative posing as an IT worker, while Check Point identified a malicious network on GitHub. Meta cracked down on Nigerian scammers targeting U.S. victims. U.S. intelligence agencies warned of foreign investment risks, and Israel intervened in a lawsuit to protect state secrets involving NSO Group.

 

U.S. government looking for answers amidst CrowdStrike aftermath

In the wake of the defective CrowdStrike update that disrupted airlines, banks, hospitals and other critical services last Friday, U.S. House leaders are calling on CrowdStrike CEO George Kurtz to testify to Congress about the company’s role in the widespread outage. Republicans who lead the House Homeland Security committee said Monday, “While we appreciate CrowdStrike’s response and coordination with stakeholders, we cannot ignore the magnitude of this incident, which some have claimed is the largest IT outage in history.”

Meanwhile on Tuesday the U.S. Transportation Department said it was opening an investigation into Delta Air Lines after the carrier canceled more than 5,000 flights since Friday due to the CrowdStrike incident. While other carriers have been able to resume normal operations, Delta canceled 30% or more of its flights daily through Monday and axed or delayed over 1,000 more flights as of mid-day on Tuesday. Transportation secretary, Pete Buttigieg, said the department “will leverage the full extent” of its investigative and enforcement power “to ensure the rights of Delta’s passengers are upheld.” (SecurityWeek and The Guardian)

 

Hackers shut down heat in Ukrainian city

Ukraine’s Cyber Security Situation Center (CSSC) announced that Windows-based malware, dubbed FrostyGoop, has been linked to a heating outage in Lviv, Ukraine back in January. The Russian-linked malware was used to attack a municipal district energy company and cut off heat to over 600 apartment buildings for two days during sub-zero temperatures. FrostyGoop is designed to target Modbus TCP communications, a standard industrial control systems (ICS) protocol. An investigation showed that attackers likely gained access to the network nine months earlier by exploiting a vulnerability in an Internet-exposed Mikrotik router. From there, attackers were able to access four management servers and the district’s heating system controllers which were not properly segmented. (Bleeping Computer and TechCrunch)

 

KnowBe4 hires fake North Korean IT worker

On Tuesday, security awareness training firm KnowBe4 said a North Korean operative posing as a software engineer slipped past its hiring background checks. The new hire spent the first 25 minutes on the job using their new Mac to download malware, manipulate session history files, and execute unauthorized software on company systems. KnowBe4 said its security team quickly detected the suspicious activity and contained the infected workstation. The worker’s identity was revealed as an AI deepfake and is one of hundreds of cases of North Korean nation-state operatives posing as an IT worker to infiltrate US companies. (SecurityWeek)

 

Stargazer Goblin hosts malicious code repositories on GitHub

A secret network of around 3,000 “ghost” accounts on GitHub has been manipulating the platform to promote malware and phishing links, as revealed by research from cybersecurity firm Check Point. Operating since at least June last year, a cybercriminal group, dubbed “Stargazer Goblin” by Check Point, has been hosting malicious code repositories on GitHub, the world’s largest open-source code site. Antonis Terefos, a malware reverse engineer at Check Point, discovered that these fake accounts “star,” “fork,” and “watch” malicious repositories to make them appear popular and legitimate. This tactic leverages GitHub’s community tools to boost the visibility and credibility of harmful pages. The network’s activities are coordinated through a cybercrime-linked Telegram channel and criminal marketplaces.

The “Stargazers Ghost Network” spreads malicious repositories offering fake downloads for social media, gaming, and cryptocurrency tools, targeting Windows users. They claim to provide tools like VPNs or licensed software but instead deliver malware The operator behind this network charges other hackers to distribute their malicious content, a service Check Point terms “distribution as a service.” GitHub has responded by disabling user accounts violating their policies against supporting unlawful activities. With over 100 million users and 420 million repositories, GitHub continues to face challenges from cybercriminals exploiting its platform for malicious purposes. (Wired)

 

Meta cracks down on the Nigerian Yahoo Boys

Meta has banned 63,000 accounts linked to Nigerian cybercriminals known as the Yahoo Boys, targeting users in the U.S. with sextortion scams. These scammers, primarily targeting adult men, coerced victims into sharing explicit images, then threatened to release them unless paid in gift cards, mobile payments, wire transfers, or cryptocurrency. Some attempts targeted minors, reported to NCMEC. Meta’s crackdown follows FBI warnings about the growing threat of financial extortion targeting children. A smaller network of 2,500 accounts, linked to 20 individuals in Nigeria, was also uncovered. These scammers used fake accounts and shared resources for scamming, including scripts and guides. Meta designated the Yahoo Boys as a banned entity under its strict Dangerous Organizations and Individuals policy. The company is improving detection tactics and sharing information with other tech companies through the Tech Coalition’s Lantern program. (The Record)

 

US warns venture firms about foreign investments

The US National Counterintelligence and Security Center issued a joint bulletin with several other US intelligence agencies, warning tech startups and venture firms about foreign investment fronts. These investors look to use early-stage investments as a way to gather data and technology to eventually undermine US businesses. The bulletin warned firms to be on the lookout for funding from complex ownership “incorporated in offshore locations lacking transparency.” The NCSC also weaned that startups with these investors could impact government contracts down the road.  (Bloomberg)

 

Israel’s secret shield in spyware saga

Israel has intervened in the ongoing lawsuit between WhatsApp and NSO Group to prevent the disclosure of state secrets. WhatsApp alleges that NSO Group’s Pegasus spyware targeted 1,400 users, including activists and journalists. NSO claims it acted on behalf of foreign governments, seeking immunity, but this defense has been rejected by U.S. courts. The U.S. Supreme Court recently allowed WhatsApp’s lawsuit to proceed, marking a significant step towards accountability. Despite this, Israel’s involvement aims to protect sensitive national security information from being exposed during the legal proceedings. (Forbidden Stories)

 

Columbus, Ohio suffers cyber incident

The city is working to restore its systems following a cyberattack that forced it to sever its connection to the internet. Officials stated that “while its 911 and employee payroll systems remain operational, several resident-facing IT services are dealing with outages that may take time to restore. City employees were unable to send or receive emails, and the 911 service, although operational, had its staff working with pen and paper. No comments were made as to whether a ransom is involved. (The Record)

 

Ukraine launches cyberattack on Russian ATMs

Updating a story we covered on Thursday, the attack, which started on July 23, and described as unprecedented in its scope, affected debit and credit cards of at least 10 major Russian banking organizations, freezing customer credit and debit cards, bank payment systems and mobile applications, causing outages in personal offices, and preventing payments for services like public transport. The attack also disrupted services from Russian mobile and internet popular online messengers and major Russian social networks. The Kyiv Post also states that nation-state hackers gained access to the databases of major banks. (Security Affairs)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

RedSeal: The Key to Comprehensive Attack Surface Management

/by

In today’s rapidly evolving digital landscape, organizations face an ever-increasing number of cyber threats. As highlighted by recent industry reports, traditional network operations solutions often fall short in providing the necessary visibility and control to manage and mitigate these threats effectively. This gap underscores the critical importance of comprehensive attack surface management (ASM) solutions.

Why Network Operation Solutions Fall Short

Limited Visibility and Context

Traditional network management tools are primarily designed to monitor and maintain network performance. While they excel at identifying performance bottlenecks and ensuring operational uptime, they often lack the ability to provide a complete and continuous view of an organization’s attack surface. This limitation becomes especially pronounced in complex, multi-cloud environments where assets are dispersed across various platforms and locations.

Incomplete Asset Inventories

Effective attack surface management begins with a comprehensive and up-to-date inventory of all digital assets. This includes not only the assets themselves but also their locations, the software they run, access permissions, and associated security controls. Traditional tools frequently struggle to maintain such detailed inventories, particularly in dynamic environments where assets and configurations are continually changing.

Inadequate Risk Prioritization

Identifying vulnerabilities is only the first step in securing an organization’s digital environment. The real challenge lies in prioritizing these vulnerabilities based on their potential impact. Traditional network management solutions often lack the advanced analytics required to assess and prioritize risks effectively. This can lead to inefficient use of resources and leave critical vulnerabilities unaddressed.

Performance Over Security

Many network operations solutions are primarily focused on ensuring network performance and availability. While these are important aspects of IT management, they do not address the dynamic and evolving nature of cyber threats. Effective cybersecurity requires a proactive approach that includes continuous monitoring, risk assessment, and the implementation of robust security measures.

The RedSeal Advantage

At RedSeal, we understand the complexities and challenges associated with managing an organization’s attack surface. Our platform provides the comprehensive visibility and contextual intelligence needed to secure your digital environment effectively.

Comprehensive Network Visualization

RedSeal offers detailed network visualization, allowing organizations to see their entire network, including cloud and on-premises environments. This holistic view is crucial for identifying and managing all assets, understanding access paths, and ensuring that security controls are properly implemented.

Continuous Monitoring and Risk Assessment

Our platform continuously monitors the network for changes and potential vulnerabilities. By maintaining an up-to-date inventory of all assets and their configurations, RedSeal keeps organizations ahead of evolving threats. Advanced analytics enable the prioritization of vulnerabilities based on their potential impact, ensuring that resources are used efficiently to address the most critical risks first.

Proactive Security Measures

At RedSeal, we proactively implement and maintain robust security measures for customers, including network segmentation, access control, and the continuous monitoring of security policies. This proactive stance reduces the attack surface and mitigates the risk of cyberattacks.

Continuous Compliance

RedSeal safeguards a full range of critical compliance and governance requirements with over 125 built-in integrations, ensuring adherence to external requirements, internal policies, and best practices.

In the face of increasingly sophisticated cyber threats, traditional network operations solutions are often inadequate for comprehensive attack surface management. RedSeal is the advanced and critical platform needed to visualize, monitor, and secure your entire digital environment effectively. By leveraging RedSeal’s platform, an organization’s cybersecurity posture is significantly enhanced, attack path surfaces are reduced, and critical assets are protected against cyber threat.

Cyber News Roundup for July 22, 2024

/by

Welcome to this week’s cybersecurity roundup. Key developments include Microsoft’s confirmation of a faulty CrowdStrike update impacting cloud PCs, CISA’s addition of major vulnerabilities to its KEV catalog, and the arrest of a teenage hacker linked to the MGM ransomware attack. Rite Aid disclosed a ransomware incident, and Alphabet is in talks to acquire Wiz for $23 billion. Additionally, Kaspersky is shutting down US operations, and a critical GeoServer flaw is under attack. Ransomware costs for critical infrastructure are spiking, North Korean malware targets Macs, and the GhostEmperor threat group resurfaces.

Start your week in the know!

 

Microsoft confirms CrowdStrike update also hit cloud Windows PCs

The faulty CrowdStrike update that continues to reverberate around the world also resulted in a number of Windows 365 Cloud PCs getting stuck in reboot loops, rendering them unusable. The standard fix suggested by Microsoft for rebooting Windows devices into Safe Mode or the Recovery Environment and manually removing the problematic kernel driver, does not apply to Windows 365 Cloud PCs being virtual machines running in the cloud. Instead, Microsoft recommends restarting the affected VMs as many as 15 times via the Azure Portal, or restoring from an Azure Backup before the time of the outage with the risk of possibly losing data created after the backup, or using the Azure CLI or Azure Shell to repair the OS disks offline. They also suggest reaching out to CrowdStrike itself. (BleepingComputer)

 

CISA adds some big names to its KEV catalog

The vulnerabilities in question are Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability, the SolarWinds Serv-U Path Traversal Vulnerability, and the VMware vCenter Server Incorrect Default File Permissions Vulnerability. CISA has ordered all Federal agencies to fix these vulnerabilities by August 7, and experts recommend that private organizations review the catalog as well. A link to a summary of the vulnerabilities is available in the show notes. (Security Affairs and CISA KEV catalog)

 

Teenage MGM hacker arrested in England

Police in the UK apprehended the 17-year old, who has not been named, for his “alleged role in the cybercriminal group that brought MGM Resorts casinos to a standstill last year in a ransomware attack.” The arrest was made as part of an ongoing FBI investigation into the incident that occurred last September and which has been attributed to the Scattered Spider gang, also known as Octo Tempest and 0ktapus. It should be noted that in reviewing this hack “MGM Resorts praised its own response to the incident, saying that its refusal to pay a ransom and decision to shut down all of its systems, as well as its coordination with law enforcement — had sent the message to criminals that “it’s not worth it.” (The Record)

 

Rite Aid discloses ransomware attack

US pharmacy giant Rite Aid sustained a ransomware attack last month that led to a breach of some customer data, BleepingComputer reports. The company said in a statement, “Rite Aid experienced a limited cybersecurity incident in June, and we are finalizing our investigation. We take our obligation to safeguard personal information very seriously, and this incident has been a top priority. Together with our third-party cybersecurity partner experts, we have restored our systems and are fully operational. We are sending notices to impacted consumers.” Rite Aid didn’t disclose what type of customer data was affected, but said it didn’t involve health or financial information. BleepingComputer notes that the RansomHub gang claimed responsibility for the attack and stole 10 GB of customer information, including “name, address, dl_id number, dob, [and] riteaid rewards number.” (Bleepingcomputer)

 

Alphabet in talks to acquire Wiz

The Wall Street Journal’s sources say Alphabet remains in advanced talks on the deal, reportedly valued at about $23 billion. If it goes through, it would become Alphabet’s biggest acquisition and dwarf its 2022 acquisition of Mandiant for $5.4 billion. The Wiz acquisition would significantly build out its cloud security offerings. It’s unclear what kind of regulatory hurdles the deal will see. In recent years big tech deals have seen unprecedented levels of antitrust scrutiny. But Google Cloud’s market share remains behind Amazon and Microsoft. Keep in mind, that these are just talks, so it’s not a done deal yet. (WSJ)

 

AT&T allegedly paid hacker to delete data

We may be getting some more details behind the recent AT&T data breach, which saw call records on millions of customers stolen through Snowflake cloud storage. A threat actor in the ShinyHunters hacking group told WIRED that AT&T paid a 5.7 bitcoin ransom, worth over $300,000, related to the attack back in May, in exchange for deleting the data. These transactions were confirmed by the crypto-tracing firm TRM Labs, and by the security researcher Reddington, who acted as a go-between in the deal. Reddington said an American hacker living in Turkey contacted him about the stolen data in mid-April 2024. 404 Media previously identified this individual as John Binns, and not the same threat actor that received payment from AT&T. Reddington notified Mandiant about the breach, which told AT&T. This timeline lines up with AT&T SEC filings. Binns was indicted on 12 counts related to a 2021 hack of T-Mobile back in May, allegedly arrested in Turkey. (Wired, 404 Media)

 

PoC turnaround time getting shorter

Cloudflare’s Application Security report documented how quickly threat actors can weaponize a proof-of-concept exploit. It observed one instance where an attacker deployed a PoC-based exploit for an authentication bypass flaw in JetBrains TeamCity 22 minutes after Rapid7 released it. This came less than six hours after Jetbrains released an update to resolve the patch and 5 hours after publicly disclosing the CVE. Cloudflare said this increased time pressure “led us to combine the human written signatures with an ML-based approach to achieve the best balance between low false positives and speed of response.” (Bleeping Computer)

 

Kaspersky Lab is shutting down US operations

Kaspersky Lab, a Russian cybersecurity firm, is shutting down its U.S. operations and laying off employees after the U.S. Commerce Department banned the sale of Kaspersky software starting July 20. The ban follows national security concerns that Kaspersky or the Russian government could exploit the software to spy on American customers. Kaspersky confirmed the shutdown, citing the ban’s impact on its U.S. business viability. The closure affects fewer than 50 U.S. employees, who will receive severance packages. The U.S. had previously banned Kaspersky software from federal and military systems due to security concerns. Despite denying any misuse of its software, Kaspersky faced allegations of extracting NSA hacking tools from an employee’s computer. U.S. officials stress the ban protects Americans from potential exploitation by foreign adversaries. (Zero Day)

 

CISA warns critical GeoServer flaw is under attack

​CISA said a 9.8 severity remote code execution flaw in GeoServer’s GeoTools plugin (CVE-2024-36401) is being actively exploited in the wild. GeoServer is an open-source server that allows users to share, process, and modify geospatial data. GeoServer disclosed the vulnerability on June 30th and said the flaw is caused by the GeoTools plugin unsafely evaluating property names. The project maintainers patched the flaw (in GeoServer versions 2.23.6, 2.24.4, and 2.25.2) and also offered workarounds but warned that the workarounds may break some GeoServer functionality. CISA now requires federal agencies to patch servers by August 5, 2024. (Bleeping Computer and SecurityWeek)

 

Cloud security and PowerShell expertise emerge as key SOC analyst skills

According to a survey conducted by the SANS Institute, a series of hard skills have emerged as key to success of analysts working in enterprise security operations centers (SOCs). These include a knowledge of cloud security issues, PowerShell expertise, and the ability to automate repetitive tasks and systems management functions. The SANS survey polled 400 respondents from small, medium, and large companies globally. The responses showed that many SOCs continue to struggle with a lack of automation and orchestration of key functions, high-staffing requirements, a shortage of skilled staff, and a lack of visibility. They also reported a pervasive silo mentality among security, incident response, and operations teams. On the positive side, SOC analyst retention improved with 30% of respondents indicating the average tenure is between three and five years, compared to the one-to-three year tenures reported in previous SANS surveys. (Dark Reading)

 

Critical infrastructure ransomware costs spike

A new report from Sophos found that the median ransom payment for attacks on critical national infrastructure organizations shot up from $62,500 in 2023 to over $2.5 million in 2024, while the average payment increased 6 times on the year to $3.225 million. Since this data only comes from victims willing to disclose payment details, it doesn’t give a comprehensive picture. Interestingly, average payments for IT and telecom victims saw a much lower payment at $330,000 compared to lower education and government organizations, which paid an average of $6.6 million. Attacks also showed more signs of sophistication, with the organizations able to recover within a week down from 50% to 41% in 2024, while those taking over a month rose from 36% in 2023 to 55%. (The Register)

 

North Korean malware comes to Macs

Security researcher Patrick Wardle found an updated variant of the North Korean-link infostealers BeaverTail that runs on macOS. This came spoofed as a DMG file for the legitimate Miro Talk video calling service. Palo Alto researchers originally found the Windows version of BeaverTail last November, used as part of a campaign targeting software developers with fake job interview requests. BeaverTail collects browser and crypto wallet data and can serve to install a Python backdoor to gain persistence. Wardle said that while these attacks are not very technically sophisticated, the operators often see success with social media lures. (The Hacker News)

 

The GhostEmpreror’s new groove

Kaspersky Lab first published details about the Chinese-linked threat group GhostEmperor in 2021. Since then, the group has been quiet. That changed with a new report from Sygnia, which found GhostEmperor attacking one of its clients in late 2023. Sygnia’s director of incident response research Amir Sadon said it went public with details to try to find out if the groups dark period was simply from inactivity or a lack of visibility. GhostEmperor uses a sophisticated kernel-level rootkit, a potential sign of state-sponsored activity. In 2021 it conducted supply-chain attacks against organizations in Southeast Asia.  (The Record)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

Cyber News Roundup for July 15, 2024

/by

Welcome to this week’s cybersecurity roundup, focusing on key developments in digital security. Start your week with the latest headlines from around the globe to keep you informed and ready to defend against evolving cyber threats.

We begin with a follow-up to last week’s blog on AT&T’s breach, which exposed metadata that cybercriminals could use for impersonation. NATO has announced a new cyber defense center in Belgium to combat state-sponsored threats. Microsoft is phasing out Android use for employees in China due to security concerns, and CISA has added a Cisco command injection vulnerability to its Known Exploited Vulnerabilities catalog, highlighting ongoing zero-day risks. Additionally, the U.S. Senate is introducing legislation to streamline cybersecurity regulations.

 

1. The personal security implications of the AT&T breach

The phone carrier’s data breach, which was announced on Friday, contained records of the phone numbers that were called to or texted to by customers between May 1, 2022 and October 31, 2022. The stolen data does not include any content of calls or texts, nor their time or date. In some instances cell site information was stolen, which might assist threat actors to triangulate customers’ locations as well as the people they interacted with, through the numbers themselves. According to Rachel Tobac, a social engineering expert and founder of cybersecurity firm SocialProof Security, quoted in TechCrunch, this type of data, referred to as metadata, “makes it easier for cybercriminals to impersonate people you trust, making it easier for them to craft more believable social engineering or phishing attacks against AT&T customers.” She continues, “the attackers know exactly who you’re likely to pick up a call from, who you’re likely to text back, how long you communicate with that person, and even potentially where you were located during that conversation due to the metadata that was stolen.” (TechCrunch)

Read our latest blog on network modeling to discover what RedSeal can do to bolster your cybersecurity efforts.

 

2. NATO will build a cyber defense center in Belgium

NATO members have agreed to establish the NATO Integrated Cyber Defence Centre (NICC) at the Supreme Headquarters Allied Powers Europe (SHAPE) in Belgium. Announced during NATO’s 75th-anniversary summit in Washington DC, the NICC aims to enhance resilience and respond to digital threats. The center will house civilian and military experts from member states and utilize advanced technology to improve situational awareness and collective cyber defense. Its primary role is to inform military commanders about offensive cyber threats and vulnerabilities, including those affecting civilian critical infrastructure. NATO has been bolstering its cyber capabilities, conducting defense exercises and developing rapid response strategies. The NICC and similar initiatives respond to rising threats from countries like Russia and China, emphasizing the alliance’s commitment to cybersecurity. (Infosecurity Magazine)

 

3. Microsoft is phasing out Android use for employees in China

Starting in September, Microsoft employees in China will be required to use iPhones for work, cutting off Android devices. An internal memo revealed that this move is part of Microsoft’s Secure Future Initiative, aiming to ensure all staff use Microsoft Authenticator and Identity Pass apps. The decision stems from the fragmented Android app market in China, where Google Play is unavailable, and local platforms by Huawei and Xiaomi prevail. Consequently, Microsoft has decided to block these devices from accessing its corporate resources. Affected employees will receive an iPhone 15 as a one-time replacement. The change is driven by security concerns, following multiple state-sponsored cyberattacks, including a significant breach linked to Russia earlier this year. Microsoft’s Executive Vice President, Charlie Bell, emphasized the company’s commitment to prioritizing security, pledging a major overhaul to address cloud vulnerabilities and enhance credential protection. (Bloomberg)

 

4. CISA adds a Cisco command injection vulnerability to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco NX-OS Command Injection Vulnerability, CVE-2024-20399, to its Known Exploited Vulnerabilities catalog. This zero-day vulnerability, exploited by the China-linked group Velvet Ant, allows authenticated, local attackers with administrator credentials to execute arbitrary commands as root on affected devices. Cisco addressed the flaw, which affects several Nexus series switches, and recommended using the Cisco Software Checker to identify vulnerable devices. Federal agencies must fix this vulnerability by July 23, 2024. (Securityaffairs)

 

5. Top threats facing NATO ahead of major milestone 

Ahead of NATO’s 75th anniversary, analysts at Mandiant have outlined the greatest threats facing the organization and its allied countries. According to Mandiant Intelligence chief analyst John Hultquist, the primary adversaries remain Russia and China. The main threat actors identified include Russia’s APT29, COLDRIVER, and APT44, focusing on espionage, disinformation, and disruptive cyberattacks. China’s espionage efforts have become more stealthy, targeting government, military, and economic entities within NATO using sophisticated techniques like zero-day exploits and operational relay box (ORB) networks. Disinformation and hacktivism are increasing, with groups exploiting geopolitical tensions to undermine NATO’s stability and security. (Security Week)

 

6. Senate takes aim at ‘overly burdensome’ cybersecurity regs

The Senate has introduced new bi-partisan legislation called the “Streamlining Federal Cybersecurity Regulations Act.” The bill would create a committee tasked with harmonizing the “overly burdensome, inconsistent, or contradictory” cybersecurity requirements currently imposed on companies by federal regulatory agencies. The committee would include the national cyber director, the heads of each federal regulatory agency and other government leaders. The new bill comes a month after assistant national cyber director for cyber policy and programs, Nicholas Leiserson, warned lawmakers of increasing “fragmentation” of cybersecurity regulations. (CyberScoop)

 

7. Chinese threat actors exploit N-day vulns in mere hours

U.S. agencies including CISA, the FBI and NSA, as well as international law enforcement have issued a joint advisory warning that Chinese state-sponsored actor, APT40, is targeting newly discovered software vulnerabilities within hours. Rather than using techniques that require user interaction, the group is exploiting vulnerable, public-facing infrastructure to obtain valid credentials. The speed at which ATP40 is operating is setting up a “patching race” condition for organizations. This highlights the need for security teams to promptly patch internet-facing vulnerabilities and monitor for advisories from trusted sources.(Dark Reading)

 

8. Microsoft patches two zero-days

Microsoft yesterday issued patches for 142 vulnerabilities, including two actively exploited zero-days, Help Net Security reports. One of the zero-days (CVE-2024-38112) is a spoofing vulnerability in the Windows MSHTML Platform that can be triggered with a malicious HTML file. Researchers at Check Point found that threat actors have been exploiting the flaw since at least January 2023. Check Point explains, “Specifically, the attackers used special Windows Internet Shortcut files (.url extension name), which, when clicked, would call the retired Internet Explorer (IE) to visit the attacker-controlled URL. An additional trick on IE is used to hide the malicious .hta extension name. By opening the URL with IE instead of the modern and much more secure Chrome/Edge browser on Windows, the attacker gained significant advantages in exploiting the victim’s computer, although the computer is running the modern Windows 10/11 operating system.” (Help Net Security)

 

9. Australia targets government tech under foreign control

Australia’s Department of Home Affairs issued new instructions to all government agencies, ordering them to review their tech stacks for Foreign Ownership, Control or Influence risks. The agencies have until June 2025 to report these risks. A separate order requires developing a security risk management plan for any internet-facing services or systems that can be “directly accessed by untrusted or unknown entities.” A third order mandates government agencies using threat intelligence platforms to connect to a centralized sharing platform run by the Australian Signals Directorate. (The Record)

 

10. New group targets Veeam vulnerability

Researchers at Group-IB discovered a ransomware group known as EstateRansomware began exploiting a known flaw in Veeam Backup & Replication in early April 2024. Veeam patched this flaw in March 2023. The group gained initial access through Fortinet VPN appliances using dormant accounts. From there the attacks access a failover server. Once obtaining access, EstateRansomware created a rogue user account and established a command shell. Before dropping its ransomware payload, the group disabled Windows Defender. The Russian FIN7 cybercrime group exploited the same flaw last year. (The Hacker News)

 

11. Google expands security services

It’s always a good idea to keep abreast of changes to Google security services. Google introduced its  Advanced Protection Program back in 2017, designed to provide extra security for targeted users like journalists and politicians. Since launch, this required two physical security keys to set up, with users having to provide a password and one of those keys to log in. Now Google allows setting up the service with a single passkey using phone-based biometrics. The company also announced it will make its “Dark Web reports” available to all Google accounts later this month. Google previously limited these reports to Google One subscribers. As such, the reports will no longer show up in the Google One app, moving instead to general account settings. (The Verge, 9to5Google)

 

12. A massive phishing campaign is exploiting Microsoft SharePoint servers

A massive phishing campaign is exploiting Microsoft SharePoint servers to host malicious PDFs with phishing links. The attack, observed by malware hunting service ANY.RUN, has surged, with over 500 detections in the last 24 hours. This campaign uses trusted SharePoint services, making it hard to detect malicious intent. The phishing flow involves an email link directing to a SharePoint PDF, a CAPTCHA prompt, and a fake Microsoft login page. Users should verify email sources, check URLs, and enable multi-factor authentication. Indicators of phishing include unexpected SharePoint notifications, mismatched file types, urgent requests, and suspicious login pages. (Cyber Security News)

13. Germany strips Huawei and ZTE from 5G infrastructure

The German government has agreed with major telecom companies to phase out critical Huawei and ZTE components from their 5G infrastructure over the next five years. Interior Minister Nancy Faeser announced that Deutsche Telekom, Vodafone, and Telefonica would discontinue using Chinese-made components in core 5G network parts by the end of 2026 and from antennas, transmission lines, and towers by the end of 2029. This decision aims to protect Germany’s economy and communication systems from potential cybersecurity risks. Despite no specific evidence against Huawei, the move aligns Germany with other European countries and the US, which have already restricted Huawei and ZTE equipment. (NYT)

 

14. CDK Global reportedly pays $25M ransom following cyberattack

Following up on the story regarding CDK Global, the maker of specialized software for car dealerships, The Register reports that the company paid the $25 million ransom in bitcoin, to the group that runs BlackSuit ransomware. The consulting firm Anderson Economic Group suggests that the total financial damage to dealers in the first two weeks of the shutdown is just over $600 million, or 24 times the ransom. The problems for CDK and its customers are not yet over, with certain parts of the network still offline as restoration and rebuilding continues. (The Register and Anderson Economic Group)

 

15. CISA breaks into a U.S. federal agency, goes unnoticed for five months

As part of a red teaming exercise, named by CISA as SILENTSHIELD assessments, specialists exploiting an unpatched vulnerability in the Oracle Solaris enclave of an unnamed federal civilian executive branch agency, leading to what it said was a full compromise. The intrusion was made in January 2023, and for the following five months of the assessment, the target organization “failed to detect or remediate any of the SILENTSHIELD activity, raising concerns over its ability to spot genuine malicious activity.” As reported in The Register, “After gaining access to the Solaris enclave, the red team discovered they couldn’t pivot into the Windows part of the network because missing credentials blocked their path, despite enjoying months of access to sensitive web apps and databases. Undeterred, CISA managed to make its way into the Windows network after carrying out phishing attacks on unidentified members of the target agency, one of which was successful.” (The Register)

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

Network Modeling: Mapping the Cyber Battlefield to Avoid Devastating Breaches

/by

This morning’s news rings loud – “Nearly all AT&T customers’ call and text records exposed in massive breach”. Fresh off the heels of an unrelated data leak on third-party platform Snowflake impacting 73 million current and former customers, AT&T is seeing immediate financial damage as shares fell 1% following today’s news.

In today’s fast-changing world of cybersecurity, such breaches highlight the critical importance of robust network modeling. Network modeling involves creating a detailed representation of a network’s structure, behaviors, and interactions, enabling cybersecurity professionals to predict potential vulnerabilities and devise strategies to mitigate them. As the frequency and scale of cyber threats continue to grow, adopting advanced network modeling techniques has become essential for protecting important data and maintaining the integrity of network systems.

The importance of network modeling

Network modeling offers an organized way to understand and handle the complexities of a network. As cyber threats become more advanced, it’s essential to have a clear and complete picture of how a network operates. Network modeling serves as a blueprint, allowing cybersecurity teams to:

  1. Identify vulnerabilities: By simulating various network scenarios, professionals can pinpoint weak spots and potential entry points for cyber attackers.
  2. Optimize security measures: Effective network modeling helps in deploying security resources more efficiently, ensuring robust protection against threats.
  3. Enhance incident response: In the event of a cyber attack, a well-modeled network facilitates quicker detection and response, minimizing damage and downtime.
  4. Compliance and auditing: Detailed network models assist in maintaining regulatory compliance and provide a clear audit trail for security assessments.

Knowing what’s on your network and how it’s all connected is the fundamental first step in staying secure and compliant. It can be hard to see the bigger picture, and you don’t know what you don’t know. RedSeal reveals—and makes sense of—it all.

Take for example, the 2023 Real Estate Wealth Network (REWN) data breach. Cybersecurity Researcher, Jeremiah Fowler, discovered and reported the non-password protected database, New York-based Real Estate Wealth Network, that held 1.5 billion records containing real estate ownership data of millions of people, including celebrities, politicians. The exposure of home addresses online poses potential risks such as threats to their personal safety or an invasion of their privacy.

In other password news, the infamous SolarWinds Supply Chain Attack  was facilitated by poor password practices. An intern’s weak password, “solarwinds123,” was accessible via a misconfigured GitHub repository, allowing attackers to insert malicious code into the SolarWinds software updates​.

Password protection is merely the tip of the iceberg when it comes to comprehensive cybersecurity. A robust security strategy must encompass multiple layers of defense, including multi-factor authentication (MFA), encryption, regular software updates, network monitoring, and incident response planning. These additional measures help mitigate risks by ensuring that even if passwords are compromised, other security controls can prevent unauthorized access and protect sensitive data. Network modeling plays a crucial role in this layered approach by identifying vulnerabilities and guiding the implementation of best practices across the entire infrastructure.

 What can you do with RedSeal?

  • Build an accurate and comprehensive model of your connected network—a network digital twin
  • Bring private cloud, public cloud, and physical resources into one consolidated view
  • Present the logical layout of assets and groupings in a clear, visual topology
  • Map the physical location of assets and their Layer 2 connectivity
  • See all available traffic paths among assets, subnets, and internet exposure points
  • Discover network inconsistencies as well as assets and connections previously unknown or unaccounted for
  • Gain visibility of IPv6 usage and connectivity

As cyber threats grow more advanced, network modeling becomes an increasingly vital tool for cybersecurity experts. Through a detailed and dynamic view of network operations, organizations are better able to identify vulnerabilities, optimize security measures, and enhance their overall cybersecurity posture. As technology continues to advance, the role of network modeling in safeguarding digital assets will only become more critical.

The RedSeal advantage

  • Maintain a single source of truth for your hybrid network that all teams can trust
  • Know the unknowns—the good, the bad, and the ugly—about your network
  • Gain the network understanding you need to be more proactive and strategic about security and compliance

Reach out to RedSeal or schedule a demo today to learn how to bolster your cybersecurity efforts and make the strategic move that promises long-term benefits and peace of mind.

Cyber News Roundup for July 5, 2024

/by

Welcome to this week’s cybersecurity roundup, where we sift through the latest developments in digital security to bring you crucial updates from around the globe. This week’s headlines highlight a range of pressing issues, from the sophisticated cyberattacks targeting major players like TeamViewer and Microsoft, to critical vulnerabilities affecting widely used devices and systems.

Read about the fallout from TeamViewer’s breach, now attributed to the Russian state-sponsored hacking group Midnight Blizzard, and Microsoft’s expanded warnings about compromised email systems. Stay informed about the critical D-Link router flaw exploited by hackers, the newly discovered ‘RegreSSHion’ vulnerability threatening millions of Linux systems, and the urgent patch issued for Juniper routers. We also cover the exploitation of a zero-day vulnerability in Cisco devices by Chinese hackers and the latest updates on CDK Global’s restoration timeline following a ransomware attack.

Join us as we navigate these stories, delve into emerging threats, and explore innovative defense strategies to help you stay ahead in an ever-evolving digital landscape.

 

1. Update on the TeamViewer network breach

The remote access software company is now attributing Wednesday’s attack on its corporate networks as being the work of Russian state-sponsored hacking group Midnight Blizzard, also known as Cozy Bear and APT29. They clarify that “TeamViewer’s internal corporate IT environment is completely independent from the product environment”. According to The Record, the hack was traced back to the credentials of a standard employee account within the company’s corporate IT environment. (BleepingComputer, The Record)

 

2. U.S. businesses struggle to obtain cyber insurance

At the hearing before the House Homeland Security Committee’s cyber-focused subcommittee, representatives from companies and associations described the difficulties they are experiencing, trying to obtain insurance against breaches, finding them hard to come by and with terms that are very difficult to understand, especially in terms of exclusions and definitions of breaches as “acts of war.” This has only led to increasing insurance premiums, which has caused some clients calling for a “so-called backstop for the market in which the federal government would step in and guarantee large-scale insurance losses. (Cyberscoop)

 

3. Microsoft expands scope of mail compromise warning

The hack to Microsoft’s internal email systems, which was revealed in January of this year, was initially described as having affected “a very small percentage of Microsoft corporate email accounts.” Now, however, Microsoft has started alerting organizations and individuals, specifically more than a dozen state agencies and public universities in Texas, that emails between themselves and Microsoft were accessed. This is according to reporting by Bloomberg. This hack is also being attributed to Midnight Blizzard. (Bloomberg, Yahoo News)

 

4. Hackers exploit critical D-Link DIR-859 router flaw to steal passwords

A critical vulnerability affecting all D-Link DIR-859 WiFi routers is currently being exploited by hackers “to collect account information from the device, including passwords.” The flaw has a CVE number and a 9.8 severity score. According to BleepingComputer, the D-Link DIR-859 WiFi router model reached end-of-life (EoL) and no longer receives any updates, [but] the vendor did still release a security advisory explaining that the flaw exists in the “fatlady.php” file of the device, affects all firmware versions, and allows attackers to leak session data, achieve privilege escalation, and gain full control via the admin panel.” (BleepingComputer)

 

5. 14 million Linux systems threatened by ‘RegreSSHion’ vulnerability

Researchers at Qualys have uncovered a critical vulnerability, “regreSSHion” (CVE-2024-6387), which some experts are comparing to the notorious Log4Shell in terms of potential severity. This flaw, with a CVSS score of 8.1, affects glibc-based Linux systems running sshd in its default configuration. Exploiting this vulnerability could allow attackers to completely take over systems, install malware, manipulate data, and create backdoors for persistent access. The vulnerability poses a severe threat, enabling unauthorized remote code execution with root privileges, leaving over 14 million servers potentially vulnerable. (Bleeping Computer), (Security Week), (Dark Reading)

Read about how RedSeal responds to the “regreSSHion” vulnerability and helps fortify your network security HERE.

 

6. Critical patch issued for Juniper routers

It’s going to be a perfect 10 on the CVSS scale for a critical vulnerability (CVE-2024-2973) impacting Juniper Networks routers. The company released patches outside of their usual schedule, indicating the severity of the flaw. According to Juniper, the issue affects all Session Smart routers and conductors running in high-availability redundant configurations. This vulnerability allows for a network-based attack to bypass authentication and take over the device. (Juniper), (Dark Reading), (The Register)

 

7. Chinese hackers exploit zero-day in Cisco Devices

State-backed Chinese hackers, known as Velvet Ant, exploited a newly identified zero-day vulnerability (CVE-2024-20399) in Cisco NX-OS software used in Nexus-series switches. The discovery was made by Sygnia during a forensic investigation where  the hackers gained administrator-level access to deploy custom malware for remote control of compromised devices. Cisco has issued software updates to address the vulnerability, with no available workarounds. (Bleeping Computer) , (The Record)

 

8. CDK Global gives update on restoration timeline

An update to a story we’ve been following for the last two weeks: CDK Global says all car dealerships using their platform will be back online by this Thursday, July 4th. The software-as-a-service provider’s platform, which is used by over 15,000 car dealerships around North America, experienced not one but two attacks last month, forcing the company to take all IT systems offline. According to Bleeping Computer, the BlackSuit ransomware gang was tied to this attack. (Bleeping Computer)

 

9. Chinese threat actor exploits Cisco zero-day

A China-aligned cyberespionage actor dubbed “Velvet Ant” exploited a zero-day vulnerability (CVE-2024-20399) affecting a wide range of Cisco Nexus devices, according to researchers at Sygnia. The flaw is a command injection vulnerability in the Cisco NX-OS Software CLI that can “allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device.” Cisco has issued patches for the flaw. Sygnia says Velvet Ant’s “exploitation led to the execution of a previously unknown custom malware that allowed the threat group to remotely connect to compromised Cisco Nexus devices, upload additional files, and execute code on the devices.” (Sygnia)

 

10. Google fixes 25 Android flaws, including critical privilege escalation bug

Google has released patches for 25 security vulnerabilities in the Android operating system, including a critical-severity flaw in the Framework component. The critical bug (tracked as CVE-2024-31320), impacts Android versions 12 and 12L and allows an attacker to escalate privileges on a vulnerable device. That flaw, along with fixes for seven other high-severity issues, were released by Google on Monday. This coming Friday, Google plans to release updates that resolve an additional 17 vulnerabilities in Kernel, Arm, Imagination Technologies, MediaTek, and Qualcomm components. (SecurityWeek)

 

11. French authorities seize nearly $6M in illicit online platform takedown

In a coordinated international effort, French authorities have seized servers and proceeds worth millions belonging to the “Coco” chat website. Authorities said the site facilitated child pornography, other sexual exploitation, drug dealing and violent acts including homicides. The website is owned by a Bulgarian company and had over 850,000 users in France alone as of 2023. Child rights activists have been lobbying against the site they referred to as a “predators den” since 2013. The Coco site has been replaced with a seizure notice from the French national police. (The Cyber Express)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

Fortifying Network Security: How RedSeal Responds to the Regresshion Vulnerability

/by

Based on the recent discovery of a significant security vulnerability known as “Regresshion,” which affects millions of Linux systems running OpenSSH, organizations are urgently reassessing their cybersecurity postures. The Regresshion vulnerability can potentially allow attackers to gain unauthorized root access to affected systems, making it a critical threat to handle promptly. This context offers a perfect scenario to illustrate how RedSeal’s network modeling and risk analysis platform can be pivotal in mitigating such threats.

How RedSeal Can Help Mitigate Risks Like Regresshion

Identifying and Mapping Vulnerable Assets

RedSeal’s network modeling capability can automatically identify and map all network assets, including those running vulnerable versions of OpenSSH. By providing a comprehensive view of all assets, RedSeal helps security teams quickly pinpoint which parts of the network are at risk due to the Regresshion vulnerability.

Prioritizing Vulnerabilities Based on Network Context

Once vulnerable assets are identified through external vulnerability scanners, RedSeal’s risk analysis capabilities come into play. RedSeal integrates the identified vulnerabilities into its network model to prioritize them based on the network context. This means understanding which vulnerabilities are most likely to be exploited and which could have the most severe impact on the network. For instance, a vulnerable server in a less critical part of the network might receive a lower priority compared to one that houses sensitive data or supports critical operations.

Enhancing Incident Response with Detailed Network Insights

In the event of an exploitation attempt, RedSeal’s detailed network insights allow incident response teams to respond more effectively. By understanding the pathways attackers might use to move laterally across the network from a compromised OpenSSH server, RedSeal helps in implementing targeted containment strategies, thereby minimizing the potential impact of an attack.

Supporting Compliance and Reporting

With the increasing scrutiny on cybersecurity practices, compliance with industry standards and regulations becomes more crucial. RedSeal not only aids in identifying and mitigating risks but also supports compliance reporting by providing proof of due diligence and proactive risk management in handling known vulnerabilities like Regresshion.

Streamlining Remediation Efforts

Finally, by integrating with other security tools, RedSeal can automate some aspects of the remediation process. For instance, upon identifying vulnerable systems, RedSeal can trigger patch management tools to apply necessary updates or patches, streamlining the remediation efforts and reducing the window of opportunity for attackers.

Conclusion

In the wake of the Regresshion vulnerability, organizations are reminded of the importance of having robust, dynamic cybersecurity solutions that can adapt to emerging threats. RedSeal’s network modeling and risk analysis capabilities provide an essential layer of intelligence that enhances security operations, from prevention through to response and recovery. By leveraging RedSeal, organizations can ensure they are better equipped to handle sophisticated threats, protecting their critical assets from potentially catastrophic breaches.

Reach out to RedSeal or schedule a demo today.