In today’s rapidly evolving digital landscape, organizations face an ever-increasing number of cyber threats. As highlighted by recent industry reports, traditional network operations solutions often fall short in providing the necessary visibility and control to manage and mitigate these threats effectively. This gap underscores the critical importance of comprehensive attack surface management (ASM) solutions.

Why Network Operation Solutions Fall Short

Limited Visibility and Context

Traditional network management tools are primarily designed to monitor and maintain network performance. While they excel at identifying performance bottlenecks and ensuring operational uptime, they often lack the ability to provide a complete and continuous view of an organization’s attack surface. This limitation becomes especially pronounced in complex, multi-cloud environments where assets are dispersed across various platforms and locations.

Incomplete Asset Inventories

Effective attack surface management begins with a comprehensive and up-to-date inventory of all digital assets. This includes not only the assets themselves but also their locations, the software they run, access permissions, and associated security controls. Traditional tools frequently struggle to maintain such detailed inventories, particularly in dynamic environments where assets and configurations are continually changing.

Inadequate Risk Prioritization

Identifying vulnerabilities is only the first step in securing an organization’s digital environment. The real challenge lies in prioritizing these vulnerabilities based on their potential impact. Traditional network management solutions often lack the advanced analytics required to assess and prioritize risks effectively. This can lead to inefficient use of resources and leave critical vulnerabilities unaddressed.

Performance Over Security

Many network operations solutions are primarily focused on ensuring network performance and availability. While these are important aspects of IT management, they do not address the dynamic and evolving nature of cyber threats. Effective cybersecurity requires a proactive approach that includes continuous monitoring, risk assessment, and the implementation of robust security measures.

The RedSeal Advantage

At RedSeal, we understand the complexities and challenges associated with managing an organization’s attack surface. Our platform provides the comprehensive visibility and contextual intelligence needed to secure your digital environment effectively.

Comprehensive Network Visualization

RedSeal offers detailed network visualization, allowing organizations to see their entire network, including cloud and on-premises environments. This holistic view is crucial for identifying and managing all assets, understanding access paths, and ensuring that security controls are properly implemented.

Continuous Monitoring and Risk Assessment

Our platform continuously monitors the network for changes and potential vulnerabilities. By maintaining an up-to-date inventory of all assets and their configurations, RedSeal keeps organizations ahead of evolving threats. Advanced analytics enable the prioritization of vulnerabilities based on their potential impact, ensuring that resources are used efficiently to address the most critical risks first.

Proactive Security Measures

At RedSeal, we proactively implement and maintain robust security measures for customers, including network segmentation, access control, and the continuous monitoring of security policies. This proactive stance reduces the attack surface and mitigates the risk of cyberattacks.

Continuous Compliance

RedSeal safeguards a full range of critical compliance and governance requirements with over 125 built-in integrations, ensuring adherence to external requirements, internal policies, and best practices.

In the face of increasingly sophisticated cyber threats, traditional network operations solutions are often inadequate for comprehensive attack surface management. RedSeal is the advanced and critical platform needed to visualize, monitor, and secure your entire digital environment effectively. By leveraging RedSeal’s platform, an organization’s cybersecurity posture is significantly enhance, attack path surfaces are reduced, and critical assets are protected against cyber threat.

[/av_textblock]

Welcome to this week’s cybersecurity roundup, focusing on key developments in digital security. Start your week with the latest headlines from around the globe to keep you informed and ready to defend against evolving cyber threats.

We begin with a follow-up to last week’s blog on AT&T’s breach, which exposed metadata that cybercriminals could use for impersonation. NATO has announced a new cyber defense center in Belgium to combat state-sponsored threats. Microsoft is phasing out Android use for employees in China due to security concerns, and CISA has added a Cisco command injection vulnerability to its Known Exploited Vulnerabilities catalog, highlighting ongoing zero-day risks. Additionally, the U.S. Senate is introducing legislation to streamline cybersecurity regulations.

1. The personal security implications of the AT&T breach

The phone carrier’s data breach, which was announced on Friday, contained records of the phone numbers that were called to or texted to by customers between May 1, 2022 and October 31, 2022. The stolen data does not include any content of calls or texts, nor their time or date. In some instances cell site information was stolen, which might assist threat actors to triangulate customers’ locations as well as the people they interacted with, through the numbers themselves. According to Rachel Tobac, a social engineering expert and founder of cybersecurity firm SocialProof Security, quoted in TechCrunch, this type of data, referred to as metadata, “makes it easier for cybercriminals to impersonate people you trust, making it easier for them to craft more believable social engineering or phishing attacks against AT&T customers.” She continues, “the attackers know exactly who you’re likely to pick up a call from, who you’re likely to text back, how long you communicate with that person, and even potentially where you were located during that conversation due to the metadata that was stolen.” (TechCrunch)

Read our latest blog on network modeling to discover what RedSeal can do to bolster your cybersecurity efforts.

2. NATO will build a cyber defense center in Belgium

NATO members have agreed to establish the NATO Integrated Cyber Defence Centre (NICC) at the Supreme Headquarters Allied Powers Europe (SHAPE) in Belgium. Announced during NATO’s 75th-anniversary summit in Washington DC, the NICC aims to enhance resilience and respond to digital threats. The center will house civilian and military experts from member states and utilize advanced technology to improve situational awareness and collective cyber defense. Its primary role is to inform military commanders about offensive cyber threats and vulnerabilities, including those affecting civilian critical infrastructure. NATO has been bolstering its cyber capabilities, conducting defense exercises and developing rapid response strategies. The NICC and similar initiatives respond to rising threats from countries like Russia and China, emphasizing the alliance’s commitment to cybersecurity. (Infosecurity Magazine)

3. Microsoft is phasing out Android use for employees in China

Starting in September, Microsoft employees in China will be required to use iPhones for work, cutting off Android devices. An internal memo revealed that this move is part of Microsoft’s Secure Future Initiative, aiming to ensure all staff use Microsoft Authenticator and Identity Pass apps. The decision stems from the fragmented Android app market in China, where Google Play is unavailable, and local platforms by Huawei and Xiaomi prevail. Consequently, Microsoft has decided to block these devices from accessing its corporate resources. Affected employees will receive an iPhone 15 as a one-time replacement. The change is driven by security concerns, following multiple state-sponsored cyberattacks, including a significant breach linked to Russia earlier this year. Microsoft’s Executive Vice President, Charlie Bell, emphasized the company’s commitment to prioritizing security, pledging a major overhaul to address cloud vulnerabilities and enhance credential protection. (Bloomberg)

4. CISA adds a Cisco command injection vulnerability to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco NX-OS Command Injection Vulnerability, CVE-2024-20399, to its Known Exploited Vulnerabilities catalog. This zero-day vulnerability, exploited by the China-linked group Velvet Ant, allows authenticated, local attackers with administrator credentials to execute arbitrary commands as root on affected devices. Cisco addressed the flaw, which affects several Nexus series switches, and recommended using the Cisco Software Checker to identify vulnerable devices. Federal agencies must fix this vulnerability by July 23, 2024. (Securityaffairs)

5. Top threats facing NATO ahead of major milestone 

Ahead of NATO’s 75th anniversary, analysts at Mandiant have outlined the greatest threats facing the organization and its allied countries. According to Mandiant Intelligence chief analyst John Hultquist, the primary adversaries remain Russia and China. The main threat actors identified include Russia’s APT29, COLDRIVER, and APT44, focusing on espionage, disinformation, and disruptive cyberattacks. China’s espionage efforts have become more stealthy, targeting government, military, and economic entities within NATO using sophisticated techniques like zero-day exploits and operational relay box (ORB) networks. Disinformation and hacktivism are increasing, with groups exploiting geopolitical tensions to undermine NATO’s stability and security. (Security Week)

6. Senate takes aim at ‘overly burdensome’ cybersecurity regs

The Senate has introduced new bi-partisan legislation called the “Streamlining Federal Cybersecurity Regulations Act.” The bill would create a committee tasked with harmonizing the “overly burdensome, inconsistent, or contradictory” cybersecurity requirements currently imposed on companies by federal regulatory agencies. The committee would include the national cyber director, the heads of each federal regulatory agency and other government leaders. The new bill comes a month after assistant national cyber director for cyber policy and programs, Nicholas Leiserson, warned lawmakers of increasing “fragmentation” of cybersecurity regulations. (CyberScoop)

7. Chinese threat actors exploit N-day vulns in mere hours

U.S. agencies including CISA, the FBI and NSA, as well as international law enforcement have issued a joint advisory warning that Chinese state-sponsored actor, APT40, is targeting newly discovered software vulnerabilities within hours. Rather than using techniques that require user interaction, the group is exploiting vulnerable, public-facing infrastructure to obtain valid credentials. The speed at which ATP40 is operating is setting up a “patching race” condition for organizations. This highlights the need for security teams to promptly patch internet-facing vulnerabilities and monitor for advisories from trusted sources.(Dark Reading)

8. Microsoft patches two zero-days

Microsoft yesterday issued patches for 142 vulnerabilities, including two actively exploited zero-days, Help Net Security reports. One of the zero-days (CVE-2024-38112) is a spoofing vulnerability in the Windows MSHTML Platform that can be triggered with a malicious HTML file. Researchers at Check Point found that threat actors have been exploiting the flaw since at least January 2023. Check Point explains, “Specifically, the attackers used special Windows Internet Shortcut files (.url extension name), which, when clicked, would call the retired Internet Explorer (IE) to visit the attacker-controlled URL. An additional trick on IE is used to hide the malicious .hta extension name. By opening the URL with IE instead of the modern and much more secure Chrome/Edge browser on Windows, the attacker gained significant advantages in exploiting the victim’s computer, although the computer is running the modern Windows 10/11 operating system.” (Help Net Security)

9. Australia targets government tech under foreign control

Australia’s Department of Home Affairs issued new instructions to all government agencies, ordering them to review their tech stacks for Foreign Ownership, Control or Influence risks. The agencies have until June 2025 to report these risks. A separate order requires developing a security risk management plan for any internet-facing services or systems that can be “directly accessed by untrusted or unknown entities.” A third order mandates government agencies using threat intelligence platforms to connect to a centralized sharing platform run by the Australian Signals Directorate. (The Record)

10. New group targets Veeam vulnerability

Researchers at Group-IB discovered a ransomware group known as EstateRansomware began exploiting a known flaw in Veeam Backup & Replication in early April 2024. Veeam patched this flaw in March 2023. The group gained initial access through Fortinet VPN appliances using dormant accounts. From there the attacks access a failover server. Once obtaining access, EstateRansomware created a rogue user account and established a command shell. Before dropping its ransomware payload, the group disabled Windows Defender. The Russian FIN7 cybercrime group exploited the same flaw last year. (The Hacker News)

11. Google expands security services

It’s always a good idea to keep abreast of changes to Google security services. Google introduced its  Advanced Protection Program back in 2017, designed to provide extra security for targeted users like journalists and politicians. Since launch, this required two physical security keys to set up, with users having to provide a password and one of those keys to log in. Now Google allows setting up the service with a single passkey using phone-based biometrics. The company also announced it will make its “Dark Web reports” available to all Google accounts later this month. Google previously limited these reports to Google One subscribers. As such, the reports will no longer show up in the Google One app, moving instead to general account settings. (The Verge, 9to5Google)

12. A massive phishing campaign is exploiting Microsoft SharePoint servers

A massive phishing campaign is exploiting Microsoft SharePoint servers to host malicious PDFs with phishing links. The attack, observed by malware hunting service ANY.RUN, has surged, with over 500 detections in the last 24 hours. This campaign uses trusted SharePoint services, making it hard to detect malicious intent. The phishing flow involves an email link directing to a SharePoint PDF, a CAPTCHA prompt, and a fake Microsoft login page. Users should verify email sources, check URLs, and enable multi-factor authentication. Indicators of phishing include unexpected SharePoint notifications, mismatched file types, urgent requests, and suspicious login pages. (Cyber Security News)

13. Germany strips Huawei and ZTE from 5G infrastructure

The German government has agreed with major telecom companies to phase out critical Huawei and ZTE components from their 5G infrastructure over the next five years. Interior Minister Nancy Faeser announced that Deutsche Telekom, Vodafone, and Telefonica would discontinue using Chinese-made components in core 5G network parts by the end of 2026 and from antennas, transmission lines, and towers by the end of 2029. This decision aims to protect Germany’s economy and communication systems from potential cybersecurity risks. Despite no specific evidence against Huawei, the move aligns Germany with other European countries and the US, which have already restricted Huawei and ZTE equipment. (NYT)

14. CDK Global reportedly pays $25M ransom following cyberattack

Following up on the story regarding CDK Global, the maker of specialized software for car dealerships, The Register reports that the company paid the $25 million ransom in bitcoin, to the group that runs BlackSuit ransomware. The consulting firm Anderson Economic Group suggests that the total financial damage to dealers in the first two weeks of the shutdown is just over $600 million, or 24 times the ransom. The problems for CDK and its customers are not yet over, with certain parts of the network still offline as restoration and rebuilding continues. (The Register and Anderson Economic Group)

15. CISA breaks into a U.S. federal agency, goes unnoticed for five months

As part of a red teaming exercise, named by CISA as SILENTSHIELD assessments, specialists exploiting an unpatched vulnerability in the Oracle Solaris enclave of an unnamed federal civilian executive branch agency, leading to what it said was a full compromise. The intrusion was made in January 2023, and for the following five months of the assessment, the target organization “failed to detect or remediate any of the SILENTSHIELD activity, raising concerns over its ability to spot genuine malicious activity.” As reported in The Register, “After gaining access to the Solaris enclave, the red team discovered they couldn’t pivot into the Windows part of the network because missing credentials blocked their path, despite enjoying months of access to sensitive web apps and databases. Undeterred, CISA managed to make its way into the Windows network after carrying out phishing attacks on unidentified members of the target agency, one of which was successful.” (The Register)

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

1. Update on the TeamViewer network breach

The remote access software company is now attributing Wednesday’s attack on its corporate networks as being the work of Russian state-sponsored hacking group Midnight Blizzard, also known as Cozy Bear and APT29. They clarify that “TeamViewer’s internal corporate IT environment is completely independent from the product environment”. According to The Record, the hack was traced back to the credentials of a standard employee account within the company’s corporate IT environment. (BleepingComputer, The Record)

2. U.S. businesses struggle to obtain cyber insurance

At the hearing before the House Homeland Security Committee’s cyber-focused subcommittee, representatives from companies and associations described the difficulties they are experiencing, trying to obtain insurance against breaches, finding them hard to come by and with terms that are very difficult to understand, especially in terms of exclusions and definitions of breaches as “acts of war.” This has only led to increasing insurance premiums, which has caused some clients calling for a “so-called backstop for the market in which the federal government would step in and guarantee large-scale insurance losses. (Cyberscoop)

3. Microsoft expands scope of mail compromise warning

The hack to Microsoft’s internal email systems, which was revealed in January of this year, was initially described as having affected “a very small percentage of Microsoft corporate email accounts.” Now, however, Microsoft has started alerting organizations and individuals, specifically more than a dozen state agencies and public universities in Texas, that emails between themselves and Microsoft were accessed. This is according to reporting by Bloomberg. This hack is also being attributed to Midnight Blizzard. (Bloomberg, Yahoo News)

4. Hackers exploit critical D-Link DIR-859 router flaw to steal passwords

A critical vulnerability affecting all D-Link DIR-859 WiFi routers is currently being exploited by hackers “to collect account information from the device, including passwords.” The flaw has a CVE number and a 9.8 severity score. According to BleepingComputer, the D-Link DIR-859 WiFi router model reached end-of-life (EoL) and no longer receives any updates, [but] the vendor did still release a security advisory explaining that the flaw exists in the “fatlady.php” file of the device, affects all firmware versions, and allows attackers to leak session data, achieve privilege escalation, and gain full control via the admin panel.” (BleepingComputer)

5. 14 million Linux systems threatened by ‘RegreSSHion’ vulnerability

Researchers at Qualys have uncovered a critical vulnerability, “regreSSHion” (CVE-2024-6387), which some experts are comparing to the notorious Log4Shell in terms of potential severity. This flaw, with a CVSS score of 8.1, affects glibc-based Linux systems running sshd in its default configuration. Exploiting this vulnerability could allow attackers to completely take over systems, install malware, manipulate data, and create backdoors for persistent access. The vulnerability poses a severe threat, enabling unauthorized remote code execution with root privileges, leaving over 14 million servers potentially vulnerable. (Bleeping Computer), (Security Week), (Dark Reading)

Read about how RedSeal responds to the “regreSSHion” vulnerability and helps fortify your network security HERE.

6. Critical patch issued for Juniper routers

It’s going to be a perfect 10 on the CVSS scale for a critical vulnerability (CVE-2024-2973) impacting Juniper Networks routers. The company released patches outside of their usual schedule, indicating the severity of the flaw. According to Juniper, the issue affects all Session Smart routers and conductors running in high-availability redundant configurations. This vulnerability allows for a network-based attack to bypass authentication and take over the device. (Juniper), (Dark Reading), (The Register)

7. Chinese hackers exploit zero-day in Cisco Devices

State-backed Chinese hackers, known as Velvet Ant, exploited a newly identified zero-day vulnerability (CVE-2024-20399) in Cisco NX-OS software used in Nexus-series switches. The discovery was made by Sygnia during a forensic investigation where  the hackers gained administrator-level access to deploy custom malware for remote control of compromised devices. Cisco has issued software updates to address the vulnerability, with no available workarounds. (Bleeping Computer) , (The Record)

8. CDK Global gives update on restoration timeline

An update to a story we’ve been following for the last two weeks: CDK Global says all car dealerships using their platform will be back online by this Thursday, July 4th. The software-as-a-service provider’s platform, which is used by over 15,000 car dealerships around North America, experienced not one but two attacks last month, forcing the company to take all IT systems offline. According to Bleeping Computer, the BlackSuit ransomware gang was tied to this attack. (Bleeping Computer)

9. Chinese threat actor exploits Cisco zero-day

A China-aligned cyberespionage actor dubbed “Velvet Ant” exploited a zero-day vulnerability (CVE-2024-20399) affecting a wide range of Cisco Nexus devices, according to researchers at Sygnia. The flaw is a command injection vulnerability in the Cisco NX-OS Software CLI that can “allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device.” Cisco has issued patches for the flaw. Sygnia says Velvet Ant’s “exploitation led to the execution of a previously unknown custom malware that allowed the threat group to remotely connect to compromised Cisco Nexus devices, upload additional files, and execute code on the devices.” (Sygnia)

10. Google fixes 25 Android flaws, including critical privilege escalation bug

Google has released patches for 25 security vulnerabilities in the Android operating system, including a critical-severity flaw in the Framework component. The critical bug (tracked as CVE-2024-31320), impacts Android versions 12 and 12L and allows an attacker to escalate privileges on a vulnerable device. That flaw, along with fixes for seven other high-severity issues, were released by Google on Monday. This coming Friday, Google plans to release updates that resolve an additional 17 vulnerabilities in Kernel, Arm, Imagination Technologies, MediaTek, and Qualcomm components. (SecurityWeek)

11. French authorities seize nearly $6M in illicit online platform takedown

In a coordinated international effort, French authorities have seized servers and proceeds worth millions belonging to the “Coco” chat website. Authorities said the site facilitated child pornography, other sexual exploitation, drug dealing and violent acts including homicides. The website is owned by a Bulgarian company and had over 850,000 users in France alone as of 2023. Child rights activists have been lobbying against the site they referred to as a “predators den” since 2013. The Coco site has been replaced with a seizure notice from the French national police. (The Cyber Express)

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

1. A hacker leaks contact details of over 33,000 Accenture employees

A hacker named “888” has leaked contact details of 33,000 current and former Accenture employees, obtained through a third-party breach. The data, posted on Breach Forums, includes full names and email addresses but no passwords. Accenture, a global IT and consulting firm based in Dublin, operates in over 120 countries. Hackread.com confirmed the authenticity of the leaked information. “888” is known for previous leaks involving major corporations. Accenture employees are advised to be vigilant against phishing and identity theft scams. (Hack Read)

2. IntelBroker claims to have leaked source code from Apple

Notorious hacker IntelBroker, responsible for previous high-profile breaches, has allegedly leaked source code for several of Apple’s internal tools on a dark web forum. IntelBroker claims the June 2024 breach of Apple.com exposed tools including AppleConnect-SSO, an employee authentication system, and two other lesser-known tools. AppleConnect-SSO is crucial for employee access to internal systems, akin to an Apple ID. The breach appears to affect only internal systems, not customer data. IntelBroker, known for targeting major organizations like AMD, Zscaler, and AT&T, has posted this information on BreachForums. The authenticity of the data is uncertain, but IntelBroker’s reputation lends credibility. The FBI is reportedly investigating the incident. (9to5Mac)

3. UEFI vulnerability found on Intel CPUs

A report from Eclypsium details a flaw in Phoenix SecureCore UEFI firmware used by Intel motherboards going back to 2016 across desktop and mobile systems. Delightfully dubbed “UEFIcanhazbufferoverflow,” the flaw comes from an unsafe variable in the TPM that creates a buffer overflow that could be used to execute arbitrary code. There’s no indication this flaw saw exploitation in the wild. Eclypsium disclosed the vulnerability, which Phoenix Technologies patched in April, but given the span of vulnerable devices, many likely remain unpatched. (The Hacker News)

4. Hacking campaign threatens French diplomats

France’s cybersecurity agency ANSSI issued an alert identifying the Russian-linked threat actor Nobelium as targeting numerous French organizations, ranging from the Ministry of Culture to Foreign Affairs. The agency detailed numerous efforts by Nobelium to disrupt the country’s foreign missions, from attempting to install Cobalt Strike on its network to compromising a diplomat’s email to spread misinformation. Overall Nobelium seems focused on capturing strategic intelligence. ANSSI warned these attacks could facilitate future operations by the group, and characterized the attacks as a national security concern. (The Record)

5. Biden administration bans Kaspersky products in the US

The Biden administration will ban Kaspersky from selling its products in the US beginning July 20th, Axios reports. Current Kaspersky customers will stop receiving security updates on September 29th. The US Commerce Department’s Bureau of Industry and Security said in a statement, “Today’s Final Determination and Entity Listing are the result of a lengthy and thorough investigation, which found that the company’s continued operations in the United States presented a national security risk—due to the Russian Government’s offensive cyber capabilities and capacity to influence or direct Kaspersky’s operations—that could not be addressed through mitigation measures short of a total prohibition. Individuals and businesses that utilize Kaspersky software are strongly encouraged to expeditiously transition to new vendors to limit exposure of personal or other sensitive data to malign actors due to a potential lack of cybersecurity coverage.” (BIS)

6. SneakyChef targets government entities with SugarGh0st RAT

Cisco Talos describes a campaign by the suspected Chinese threat actor “SneakyChef” that used the SugarGh0st RAT to target government entities in Angola, India, Kazakhstan, Latvia, Saudi Arabia, and Turkmenistan. The malware was delivered via phishing emails with well-crafted decoy documents that impersonated various government organizations. The researchers note, “The threat actor is using an SFX RAR as the initial vector in this attack. When a victim runs the executable, the SFX script executes to drop a decoy document, DLL loader, encrypted SugarGh0st, and a malicious VB script into the victim’s user profile temporary folder and executes the malicious VB script.(Talos)

7. Patch alert: SolarWinds Serv-U vulnerability under active attack

A high severity flaw impacting SolarWinds Serv-U file transfer software is being actively exploited by malicious actors in the wild. The vulnerability, that has a CVSS score of 8.6, affects a directory transversal bug that could allow attackers to read sensitive files on the host machine. It was patched earlier this month as Serv-U 15.4.2. Cybersecurity firm Rapid7 describes the vulnerability as “trivial to exploit”. It allows access to any arbitrary file on disk, assuming the path is known and that it’s not locked. (The Hacker News)

8. US Treasury Department sanctions twelve Kaspersky executives

The US Treasury Department’s Office of Foreign Assets Control (OFAC) has sanctioned twelve Kaspersky Lab executives “for operating in the technology sector of the Russian Federation economy.” The sanctions did not include the company’s CEO and co-founder Eugene Kaspersky. The US Commerce Department last week barred Kaspersky from selling its products in the United States over the company’s alleged “cooperation with Russian military and intelligence authorities in support of the Russian government’s cyber intelligence objectives.” (US Treasury)

9. Lockbit claims U.S. Federal Reserve breach

The LockBit ransomware gang has claimed responsibility for an attack against the US Federal Reserve, SecurityAffairs reports. The group claims to have stolen “33 terabytes of juicy banking information containing Americans’ banking secrets,” and says it will leak the data if the banking system refuses to negotiate a ransom. The Federal Reserve hasn’t commented on the alleged breach, and there’s no proof so far that LockBit’s claims are legitimate. (Security Affairs)

10. SEC reports pile in following CDK Global attack

We’re continuing to learn more about the impact from a ransomware attack on CDK Global last week. On Monday, we reported that the BlackSuit ransomware gang has claimed responsibility for the attack, and now we are learning multiple car dealers have reported disruptions to the SEC. Some of those companies include Lithia Motors, Group 1 Automotive, Penske, and Sonic Automotive, who in their SEC filings have said they’ve had to implement incident response plans and that most of them have severed all connections to CDK as a precautionary measure. According to Bloomberg, CDK is planning to pay the ransom, the amount of which has not been disclosed. (The Record)

11. Push notification fatigue causes breach

Another example of how hackers don’t need to recreate the wheel—old tactics work just fine. Following up on a story we first reported on last week, the Los Angeles County Department of Health Services (DHS) suffered a data breach back in April that compromised sensitive information, including individuals’ names, Social Security numbers, and medical information. We have now learned hackers were able to get in using a ‘push notification spamming’ method or push notification fatigue. This method overwhelms the user with MFA prompts until they approve the login attempt. The breach allowed access to 23 DHS employees and compromised more than 6,000 individuals. (Security Week)

12. CISA warns chemical facilities of potential breach

The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that its Chemical Security Assessment Tool (CSAT) environment was breached via a vulnerable Ivanti Connect Secure appliance on January 23rd, 2024, BleepingComputer reports. The agency stated, “While CISA’s investigation found no evidence of exfiltration of data, this intrusion may have resulted in the potential unauthorized access of Top-Screen surveys, Security Vulnerability Assessments, Site Security Plans, Personnel Surety Program (PSP) submissions, and CSAT user accounts.” CISA hasn’t specified which vulnerability was exploited, but the agency references a CISA advisory outlining three actively exploited Ivanti vulnerabilities that were disclosed before the breach. BleepingComputer notes that one of the vulnerabilities (CVE-2024-21888) was disclosed the day before CISA’s Ivanti appliance was breached. (Bleepingcomputer, CISA)

13. Julian Assange to plead guilty and return to Australia

On Wednesday, WikiLeaks founder Julian Assange is scheduled to plead guilty to a single criminal charge in a District Court on Mariana Island, a US territory in the western Pacific Ocean. In 2010, Assange released around 750,000 classified or sensitive documents on WikiLeaks, representing one of the largest leaks of state secrets in US history. Initially, the US filed 18 charges carrying a maximum penalty of 175 years in prison. Assange is expected to admit to unlawfully obtaining and disseminating classified information relating to U.S. national defense. The plea deal will end a long extradition battle with the United States government and reportedly allows Assange to avoid further jail time. Assange is then expected to reunite with his wife in his home country of Australia. (Ars Technica)

14. Fresh MOVEit bug under attack just hours after disclosure

A new high-severity vulnerability in Progress Software’s MOVEit Transfer software (CVE-2024-5806) is being actively exploited just hours after it was made public. Researchers determined that attackers could exploit the bug in two ways. The first mehtod uses a “forced authentication” attack with a malicious SMB server and a valid username. In the second scenario, a threat actor could impersonate any user on the system by uploading their own SSH public key to the server without logging in, then use that key to authenticate. Admins should move to patched versions as soon as possible. MOVEit Transfer was infamously targeted last year in a rash of Cl0p ransomware attacks that affected at least 160 victims, including British Airways, the state of Maine, Siemens, and UCLA. (Dark Reading)

15. New Microsoft Management Console attack found in wild

Threat actors are using a new attack technique, dubbed GrimResource, that allows them to gain full code execution of Microsoft Management Console. Researchers at Elastic Security Labs uncovered the new technique after a sample was uploaded to VirusTotal on June 6.  GrimResource leverages specially crafted MSC files to execute arbitrary javascript code in Microsoft Management Console (mmc.exe). The attack takes advantage of an old XSS flaw present in the apds.dll library. While the attack leverages obfuscation techniques to evade ActiveX security warnings, there is hope. The researchers have published detection rules and guidance to help organizations identify signs of the new attack. (The Cyber Express)

16. New Medusa trojan variant emerges

Last week, researchers at Cleafy published an analysis which revealed new fraud campaigns featuring an updated version of the Medusa (TangleBot) banking Trojan. The campaigns target Android users to install the malware known for its remote access Trojan (RAT) capabilities, including keylogging, screen control and SMS reading/writing. However the updated Medusa samples use a more lightweight permission set and new features like full-screen overlay displays and remote uninstallation of applications. Medusa was first discovered in 2020 and targeted Turkish financial institutions. However the new campaigns have expanded their scope to include targets in France, Italy, the United States, Canada, Spain, and the United Kingdom.(Bleeping Computer and Infosecurity Magazine)

Welcome to our latest cybersecurity roundup. This week, SolarWinds patched critical vulnerabilities discovered by NATO, while the FCC proposed enhancements to BGP security. Microsoft announced that its Recall feature will be opt-in due to security concerns, and The New York Times suffered a source code leak. Additionally, Cisco Talos found serious vulnerabilities in AutomationDirect’s PLCs, and Frontier Communications warned 750,000 customers of a data breach. Read all these stories and more below.

1. SolarWinds fixes flaws unearthed by NATO

SolarWinds has patched multiple high-severity vulnerabilities in its platform, including a path traversal flaw and a command injection bug, both of which could lead to command execution and privilege escalation. These vulnerabilities were reported by NATO’s Cyber Security Centre and could be exploited by authenticated local users or those with admin-level access to execute arbitrary commands. Users are advised to update to SolarWinds Platform version 2023.1 to mitigate these risks​. (SecurityWeek)

2. FCC’s plan to strengthen BGP protocol

The FCC has proposed requiring broadband providers to enhance Border Gateway Protocol (BGP) security and submit quarterly progress reports. This initiative aims to mitigate BGP-related risks, including data theft and espionage, by implementing Resource Public Key Infrastructure (RPKI) measures. The proposal highlights the need for robust security in internet routing to protect national security and public safety. (SecurityWeek)

3. Microsoft resets Recall plans

Following up on a story that dogged the industry last week, Microsoft announced on Friday that its new feature Recall will not be released as active by default, but will instead be an opt-in feature. The feature, which had been designed as a visual timeline, capturing screenshots of users, screens every five seconds to be analyzed and parsed was immediately decried by security experts for its potential as a gaping security lapse, with WIRED’s Andy Greenberg going so far as to call it “unrequested, pre-installed spyware.” Microsoft has responded by pointing out Recall’s security features and how a user remains in total control of its functionality. Researcher Kevin Beaumont whose warnings were instrumental in getting Microsoft to change course on the product did add later, “There are obviously going to be devils in the details…but there’s some good elements here. Microsoft needs to commit to not trying to sneak users to enable it in the future.” (The Hacker News)

4. New York Times source code is leaked online

Internal source code and data from The New York Times were leaked on the 4chan message board after being stolen from GitHub repositories in January 2024. An anonymous user posted a torrent of a 273GB archive containing the stolen data, which includes source code, IT documentation, and infrastructure tools. The leak was discovered by VX-Underground and confirmed by The Times to BleepingComputer. The breach occurred due to exposed credentials for a third-party code platform. The Times stated there was no unauthorized access to its internal systems or impact on operations. This incident follows another leak on 4chan of Disney’s internal documents, though it is unclear if the same person is responsible for both breaches. (Bleepingcompter)

5. Cisco Talos finds 15 serious vulnerabilities in PLCs

Cisco’s Talos unit found 15 vulnerabilities in AutomationDirect’s Productivity series PLCs, classified as ‘high’ or ‘critical’ severity. These flaws can enable remote code execution or denial-of-service attacks, risking costly industrial disruptions. Although typically not exposed to the internet, about 50 devices might be online, as shown by a Shodan search. AutomationDirect released updates and recommendations to address these issues. The US cybersecurity agency CISA informed organizations of these vulnerabilities in late May. (SecurityWeek)

6. Frontier Communications warns 750,000 customers of a data breach

Frontier Communications is warning 750,000 customers of a data breach following an April cyberattack by the RansomHub ransomware group. The breach exposed personal information, including full names and Social Security Numbers, but not financial information. The company has informed regulatory authorities and implemented additional security measures. Affected customers are advised to enroll in free credit monitoring and identity theft services provided by Kroll. RansomHub has threatened to leak 5GB of stolen data if Frontier does not respond by June 14. (Bleepingcomputer)

7. Cyber assistance coming to rural hospitals

Both Microsoft and Google announced programs to offer cybersecurity services to these organizations. The Biden administration announced that Google will offer free endpoint security advice to non-profits and rural hospitals, as well as launch a pilot for these hospitals to develop a better package of security security services. Microsoft separately announced a program to provide “non-profit pricing” and discounts on cybersecurity services up to 75%, as well as a free year of access to its security suite, and free Windows 10 security updates. The White House said there are at least 1,800 rural hospitals in the US that would quality. (The Record)

8. The world’s largest law firm faces class action over the MOVEit hack

Kirkland & Ellis, the world’s largest law firm by revenue, is facing a proposed class action over a data breach linked to the MOVEit Transfer file management software hack in May 2023. The lawsuit accuses Kirkland and other companies, including Humana and Progress Software, of failing to protect personal information. The breach affected millions and led to numerous lawsuits, now centralized in Massachusetts federal court under U.S. District Judge Allison Burroughs. Kirkland represented Trilogy Home Healthcare in its acquisition by Humana’s CenterWell Home Health, transferring files with private information using MOVEit. The lawsuit, filed on behalf of at least 4,700 people, claims Kirkland delayed notifying Trilogy of the breach until October, with customers informed in March 2024. The ransomware gang cl0p claimed responsibility for the hack. (Reuters)

9. SAP releases high priority patches

SAP announced the release of ten new and two updated security notes for its June 2024 Security Patch Day. This includes two high-priority patches: a cross-site scripting (XSS) vulnerability in Financial Consolidation (CVE-2024-37177, CVSS score 8.1), and a denial-of-service (DoS) vulnerability in SAP NetWeaver AS Java (CVE-2024-34688, CVSS score 7.5). The XSS flaw can manipulate website content, severely impacting confidentiality and integrity, while the DoS issue allows attackers to disrupt service by exploiting unrestricted access to Meta Model Repository services. Eight medium-severity vulnerabilities affect various SAP products, leading to potential DoS conditions, file uploads, information disclosure, or data tampering. Two low-severity issues in BusinessObjects Business Intelligence Platform and Central Finance Infrastructure Components were also addressed. Organizations are urged to update their systems promptly. (SecurityWeek)

10. Chinese hackers breached 20,000 FortiGate systems

Dutch authorities (MIVD) disclosed back in February that Chinese hackers exploited a critical code execution flaw in FortiOS/FortiProxy (CVE-2022-42475) to infect 14,000 devices between 2022 and 2023. The Coathanger remote access trojan (RAT) malware was used in the attacks and was also found on a Dutch Ministry of Defence’s research and development (R&D) network. Dutch authorities indicate that since February, the number of compromised FortiGate devices has ballooned to 20,000. They believe Chinese hackers still have access to many victims because the Coathanger malware survives firmware upgrades and is difficult to detect as it intercepts system calls to avoid revealing its presence. (Bleeping Computer)

11. Dutch military intelligence warns of the Chinese Coathanger RAT

The Dutch military intelligence and security service (MIVD) has issued a warning about an extensive Chinese cyber-espionage campaign. According to the National Cyber Security Centre (NCSC), state-sponsored hackers exploited a vulnerability in FortiGate devices (CVE-2022-42475) for two months before it was disclosed. This zero-day attack infected 14,000 devices, targeting Western governments, international organizations, and defense companies. The MIVD and the Dutch signals intelligence service (AIVD) revealed that the hackers breached the Dutch Ministry of Defence’s network, deploying the COATHANGER remote access trojan (RAT). The ongoing investigation shows the hackers accessed at least 20,000 FortiGate systems globally in 2022 and 2023. Identifying and removing the COATHANGER malware remains challenging, and many systems likely remain compromised. (The Record)

12. Life360 faces extortion attempt after Tile data breach

Life360, the parent company of Tile, a bluetooth tracking device reported an extortion attempt following a data breach in Tile’s customer support platform. The breach reportedly exposed personal information including names, addresses, email addresses, and phone numbers but did not compromise sensitive information like credit card numbers or location data primarily because that data is not stored on the customer support platform. 404 Media reports the hacker used stolen credentials of a former Tile employee to gain access to the systems. Life360 confirms the hackers have tried to extort the company to get their data back but has not released how many customers are impacted. (404 Media), (Bleeping Computer)

13. Hackers target Toronto school board

In a letter to parents, the Toronto School Board (TDSB) announced they discovered an attack on their technology testing environment. It should be noted that these test environments are separate from the board’s official networks. TDSB is the largest in Canada, managing 582 schools and more than 230,000 students. A representative from the school board says systems are operational and they are currently investigating if there was any impact on the network or if any personal information was taken. (The Record), (School Board Letter)