In the first of this four-part video series, a panel of expert CISOs discuss the long-term impacts of the SEC’s cyber rules, which went into effect last year and have significant implications of incident disclosure processes. Decipher editor Lindsey O’Donnell-Welch talks to Merritt Baer, CISO at Reco, Neda Pitt, CISO at Belk, and Danielle Snyder, cyber and compliance lead at Raytheon, about what these rules mean for incident disclosures at a broader level, as well as CISO liability.

Apache has issued a fix in OFBiz (Open For Business) that addresses an unauthenticated remote code execution bug.

The high-severity direct request flaw (CVE-2024-45195) impacts Apache OFBiz versions below 18.12.16 for Linux and Windows. The vulnerability could allow attackers with no valid credentials to exploit missing view authorization checks in the web application and ultimately execute arbitrary code. Users can upgrade to version 18.12.16, which fixes the issue.

The vulnerability disclosed this week is a patch bypass that elaborates on three previous disclosures, according to Ryan Emmons, lead security researcher with Rapid7. The three Apache OFBiz vulnerabilities were published over the course of 2024, including CVE-2024-32113, which was disclosed in May, CVE-2024-36104, which was disclosed in June and CVE-2024-38856, which was published in August. Emmons said that all three of the previous flaws stemmed from the same underlying issue: The ability to desynchronize the controller and view map state.

“Based on our analysis, three of these vulnerabilities are, essentially, the same vulnerability with the same root cause,” said Emmons in a Thursday post. “Exploitation is facilitated by bypassing previous patches for CVE-2024-32113, CVE-2024-36104, and CVE-2024-38856; this patch bypass vulnerability is tracked as CVE-2024-45195.”

Some of these vulnerabilities, including CVE-2024-38856 and CVE-2024-32113, have been actively targeted by threat actors and in August, and the Cybersecurity and Infrastructure Security Agency added them to its Known Exploited Vulnerabilities catalog.

Emmons said that remediating the underlying causes behind vulnerabilities can be hard for companies. It is sometimes difficult to determine whether a patch is going to be effective until multiple researchers attempt to bypass it.

“There’s no one-size-fits-all solution; some vulnerabilities can be fixed with small bespoke patches, others require more holistic fixes and patching of reusable techniques,” said Emmons. “When a researcher discloses a vulnerability to an organization, the most apparent aspect is often the documented steps and techniques they used to achieve exploitation. Patching these specific techniques is an important means of remediating vulnerabilities. However, many roads can often lead to the same destination. Since exploitation involves a lot of creativity, different researchers can find very different ways of achieving a similar result.”

The most important thing that companies can do when developing patches to address these issues is to openly communicate with researchers, said Emmons.

“It can be difficult for software producers to be certain that a patch will be 100 percent effective,” said Emmons. “Prompt and open communication with users and researchers creates the best circumstances for successful outcomes.”

Apache OFBiz is an open-source enterprise resource planning and customer relationship management suite. Because the tool is utilized by multiple organizations and houses enterprise data, it is a lucrative target for attackers, and previous vulnerabilities in Apache OFBiz have been exploited.

Several U.S. government agencies issued a new advisory Thursday warning of global cyber operations by threat actors that they affiliated with Unit 29155 of the Russian Main Intelligence Directorate (GRU).

The threat group is categorized under several titles, including UNC2589, Cadet Blizzard, Ember Bear and Frozenvista. In the new advisory, the FBI, CISA and NSA said that the group is linked to the infamous WhisperGate malware campaign that targeted several Ukrainian organizations starting in January 2022. The threat actors have also conducted operations against numerous North Atlantic Treaty Organization (NATO) members in Europe and North America, as well as countries across Europe, Latin America and Central Asia.

“FBI, NSA, and CISA assess Unit 29155 is responsible for attempted coups, sabotage and influence operations, and assassination attempts throughout Europe. Unit 29155 expanded their tradecraft to include offensive cyber operations since at least 2020,” according to the Thursday advisory. “Unit 29155 cyber actors’ objectives appear to include the collection of information for espionage purposes, reputational harm caused by the theft and leakage of sensitive information, and systematic sabotage caused by the destruction of data.”

Unit 29155 has been linked to several overseas operations by Bellingcat’s investigation team, including involvement in the annexation of Crimea in 2014, a failed coup in Montenegro in 2016 and an assassination attempt on former Russian spy Sergei Skripal in the UK in 2018. The threat actors are separate from other known and more established GRU-affiliated cyber groups, such as Unit 26165 and Unit 74455, according to the U.S. government advisory.

The FBI said that it believes Unit 29155 cyber actors to be junior, active-duty GRU officers, which “appear to be gaining cyber experience and enhancing their technical skills” through conducting cyber operations and intrusions. The actors also appear to sometimes rely on non-GRU cybercriminals to conduct their operations, said the FBI.

Both the U.S. government, and the security research community, have been tracking cyber activity related to this threat group for some time. In 2022, for instance, CISA outlined the destructive activity associated with the WhisperGate campaign and the U.S. Cyber Command disclosed indicators of compromise linked to the group’s operations.

In addition to espionage and destructive campaigns, the group has defaced victim websites and used public domains to post exfiltrated victim data, and on Thursday, the FBI revealed it has observed more than 14,000 instances of domain scanning across at least 26 NATO members and several EU countries to date.

The advisory is part of an international effort, called Operation Toy Soldier, to combat the malicious cyber activity by Unit 29155 of the GRU. As part of this effort, the Department of Justice on Thursday also unsealed an indictment against five Russian GRU officers and one civilian, alleging that the hackers conspired to hack, exfiltrate and leak data from the Ukrainian government before the Russian invasion of Ukraine. The individuals indicted are Vladislav Borovkov, Denis Denisenko, Dmitriy Goloshubov, Nikolay Korchagin and Amin Sitgal. The State Department is concurrently offering rewards of up to $10 million for information related to any of these individuals.

In the U.S. government advisory, CISA, the FBI and the NSA stressed that organizations can take a number of measures to protect against the several campaigns linked to the threat group, including prioritizing system updates and patch management, segmenting networks and enabling measures like multi-factor authentication (MFA).

Multiple North Korean threat actors are specifically targeting organizations and individuals in the cryptocurrency industry with both social engineering and exploitation of vulnerabilities, according to new warnings by Microsoft and the FBI.

Government-backed actors in North Korea have been focusing on cryptocurrency theft and laundering for many years and U.S. government officials have laid the blame for many large-scale intrusions at their feet, including the 2014 Sony hack, the Bangladesh Bank heist, and others. Those operations help finance the country’s military and other programs, and recently, some North Korean attackers have been running well-researched social engineering campaigns against people in the cryptocurrency field. In a new advisory, the FBI’s Internet Crime Complaint Center said those campaigns often take the form of fake job offers or investments.

“Teams of North Korean malicious cyber actors identify specific DeFi or cryptocurrency-related businesses to target and attempt to socially engineer dozens of these companies' employees to gain unauthorized access to the company's network. Before initiating contact, the actors scout prospective victims by reviewing social media activity, particularly on professional networking or employment-related platforms,” the advisory says.

“North Korean malicious cyber actors incorporate personal details regarding an intended victim’s background, skills, employment, or business interests to craft customized fictional scenarios designed to be uniquely appealing to the targeted person. North Korean fake scenarios often include offers of new employment or corporate investment. The actors may reference personal information, interests, affiliations, events, personal relationships, professional connections, or details a victim may believe are known to few others.”

These campaigns often involve the use of fake personas or impersonation of real people, along with realistic-looking websites and social media content.

In addition to using social engineering, one North Korean actor has been exploiting a zero day in Chromium to target cryptocurrency organizations and install a rootkit on compromised systems. The flaw that the group, known by Microsoft as Citrine Sleet, targeted is CVE-2024-7971, which is a type confusion bug.

“The observed zero-day exploit attack by Citrine Sleet used the typical stages seen in browser exploit chains. First, the targets were directed to the Citrine Sleet-controlled exploit domain voyagorclub[.]space. While we cannot confirm at this time how the targets were directed, social engineering is a common tactic used by Citrine Sleet. Once a target connected to the domain, the zero-day RCE exploit for CVE-2024-7971 was served,” Microsoft said in an analysis of the attacks.

“After the RCE exploit achieved code execution in the sandboxed Chromium renderer process, shellcode containing a Windows sandbox escape exploit and the FudModule rootkit was downloaded, and then loaded into memory. The sandbox escape exploited CVE-2024-38106, a vulnerability in the Windows kernel that Microsoft fixed on August 13, 2024, before Microsoft discovered this North Korean threat actor activity.”

The FudModule rootkit has been used by other North Korean actors as well, specifically Diamond Sleet.

Researchers have uncovered a new backdoor called KTLVdoor, which targets both Windows and Linux systems and is linked back to Chinese-speaking threat actor Earth Lusca.

Earth Lusca is group that has been active since at least April 2019 and has targeted organizations from various sectors globally, including the U.S., France, Germany and more. The group was observed leveraging the new Go language-based KTLVdoor, which has the capabilities to run commands, manipulate (as well as download or upload) files, provide attackers with system and network data, scan remote ports and use proxies.

“This previously unreported malware is more complex than the usual tools used by the threat actor,” said Cedric Pernet and Jaromir Horejsi with Trend Micro in a Wednesday analysis. “It is highly obfuscated and is being spread in the wild impersonating various system utilities names or similar tools, such as sshd, java, sqlite, bash, edr-agent, and more.”

Researchers didn’t have detailed insights into the campaign that leveraged the backdoor. For example, they couldn’t identify the full number of victims targeted with the backdoor, but said that one victim found is an unnamed trading company based in China. Researchers found that the backdoor is typically distributed as a library (either as SO or DLL). Horejsi said that researchers found a Windows sample of the malware in a malicious archive that was likely sent to victims via email.

The size of the infrastructure behind the malware is “very unusual,” said researchers. They found malware variants communicating with more than 50 command-and-control (C2) servers.

“In APT campaigns, we generally see less C2 servers. During APT operations that run for several months, or even a year, we see about a dozen C2 servers, sometimes a bit more,” said Horejsi. “Seeing [more than] 50 C2 [servers] in such a short period of time is very rare. Yet that is for cyberespionage. For usual cybercrime, we often see much more C2 servers, as they are generally quickly discovered and replaced by attackers. It is not rare to see more than a hundred different C2 servers in some cybercrime campaigns.”

Researchers tied some of the malware samples to Earth Lusca with “high confidence,” but the number of C2 servers could indicate that the infrastructure is being shared with other Chinese-speaking threat actors. Chinese threat actors have previously been seen sharing infrastructure or malware builders, such as the PlugX malware.

“Seeing that all C&C servers were on IP addresses from China-based provider Alibaba, we wonder if the whole appearance of this new malware and the C&C server could not be some early stage of testing new tooling,” said researchers.

The Sony Pictures hack in 2014 by the North Korean Lazarus Group was a seminal event both in Hollywood and in the security community, bringing to light the capabilities and ambitions of North Korean attackers and showing the damage a leak of sensitive data can be. Brian Raftery joins Dennis Fisher to discuss his new Ringer podcast, The Hollywood Hack, that digs deep into the incident, its repercussions in Hollywood, and how it helped set the tone for how companies handle public data leaks.

CC by-SA image from Gnaphron on Flickr.

The Federal Trade Commission (FTC) is requiring security camera firm Verkada to implement a security program after the company was hit with two security incidents between December 2020 and March 2021.

The mandate against the Calif.-based company is part of a settlement for allegations that Verkada failed to use appropriate information security practices leading to the breaches. It’s a mandate that the FTC has previously ordered for companies with complaints related to lax security practices, such as Drizly. In addition to this requirement, the FTC last week also hit Verkada with a $2.95 million fine for violating the CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing) by flooding potential customers with emails that didn’t include an option to unsubscribe.

“When customers invite companies into private spaces to monitor consumers by using their security cameras and other products, they expect those companies to provide basic levels of security, which Verkada failed to do,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection, in a statement in the FTC’s announcement last week. “Companies that fail to secure and protect consumer data can expect to be held responsible.”

Verkada Security Incidents

The complaint stems from two separate security incidents at Verkada. In the first incident in December 2020, a threat actor leveraged a security flaw in a legacy firmware build server (after an employee did not restore original security settings for the server), installed the Mirai malware on the server, and used it to launch denial-of-service attacks against other third-party internet addresses. Verkada did not know that the server was compromised until AWS security uncovered the activity two weeks later, according to the DoJ.

Verkada hired a third-party consulting firm to conduct a security assessment of the company, and that firm flagged several issues, however, the DoJ said that Verkada did not address these known security gaps. Then, in a March 2021 incident that was widely publicized in news reports, a hacker was able to access a Verkada support level account with administrative privileges, and then used a security flaw in the customer support server to gain Super Admin privileges. The hacker was then able to view sensitive video footage from over 150,000 internet-connected cameras, including ones that revealed patients in psychiatric hospitals and women’s health clinics, and access other data like physical addresses, audio recording and customer Wi-Fi credentials.

“This breach occurred as a direct result of Defendant’s failure to take proper precautions during a scheduled server update and allowed the intruder to have unfettered access to Defendant’s entire network,” said the DoJ.

According to the complaint by the Department of Justice, Verkada failed to encrypt customer data and did not have an adequate security policy. It also did not set up “reasonable access management controls” like requiring unique and complex passwords, enforcing controls like MFA and issuing alerts for things like unsuccessful login to administrative accounts. The company also lacked various data protection controls, centralized logging and alerting capabilities, secure network controls and vulnerability management policies.

The complaint also alleged that Verkada was not compliant with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the EU-U.S. Privacy Shield framework, and the Swiss-U.S. Privacy Shield framework, and that the company misled its customers about being compliant with these frameworks. The FTC said that Verkada also misled consumers by not disclosing that certain ratings and reviews for its products were written by employees and a venture capitalist investor.

Verkada’s Response

The FTC has hit several companies with various fines over the years for their security failures that led to breaches, including a $60 million fine against Morgan Stanley, and a $500,000 penalty for online retailer CafePress.

In a post about the settlement, Verkada argued it has strengthened its security posture by achieving SOC 2 Type 1 compliance in 2021 and SOC 2 Type 2 compliance in 2022, and ISO 27001, ISO 27017 and 27018 certifications in 2024. The company said it will comply with the FTC’s mandate to create a security program, which will be assessed in biennial reviews by a third-party company.

“There was no fine imposed related to the security incident, but we have agreed to pay $2.95 million to resolve the FTC’s claims about our past email marketing practices,” according to Verkada’s statement. “We do not agree with the FTC's allegations, but we have accepted the terms of this settlement so that we can move forward with our mission and focus on protecting people and places in a privacy-sensitive way.”

The Russian-based APT29 group was seen using the same iOS and Google Chrome exploits as commercial surveillanceware vendors NSO Group and Intellexa, in an espionage campaign that targeted the Mongolian government.

Researchers that discovered the campaign do not know how the APT attackers acquired the exploit. The exploits were observed in three separate attacks that researchers linked “with moderate confidence” to APT29 in November 2023, February 2024 and July 2024. These campaigns stemmed from watering hole attacks impacting Mongolian government websites, where threat actors compromised the sites and loaded a hidden iframe from an attacker-controlled website.

“In each iteration of the watering hole campaigns, the attackers used exploits that were identical or strikingly similar to exploits previously used by commercial surveillance vendors (CSVs) Intellexa and NSO Group,” according to researchers with Google’s Threat Analysis Group (TAG) in a Thursday analysis. “Although the underlying vulnerabilities had already been addressed, we notified both Apple and our partners at Android and Google Chrome about the campaigns at the time of discovery. We also notified the Mongolian CERT to remediate the infected websites.”

The watering hole iframe in the November 2023 and February 2024 attacks included an exploit for iPhone users running iOS versions 16.6.1 and older, which targeted a WebKit arbitrary code execution bug (CVE-2023-41993). Researchers said that the exploit in the watering hole attack utilized the same trigger code as an exploit used by Intellexa, “strongly suggesting the authors and/or providers are the same.” Intellexa had first exploited this flaw in September 2023 as a zero day.

Then in July 2024, the APT group used an iframe with a Google Chrome exploit chain targeting a type confusion bug (CVE-2024-5274) in V8 and a use after free (CVE-2024-4671) in Google’s Visuals component, in order to deploy an information stealing payload. Again, the trigger code for CVE-2024-5274 used in this campaign was the same as the code used by the NSO Group in a zero-day campaign in May 2024.

Both Intellexa and NSO Group are known for providing law enforcement and intelligence agencies with spyware - the Predator spyware for Intellexa and Pegasus for NSO Group - that have various information stealing, surveillance and remote-access capabilities.

Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, said there are several scenarios that could have played out here.

“One option is that APT29 found the vulnerability themselves, and decided to exploit it,” said Galperin. “The other is that they purchased the vulnerability on the open market. And the third is that they didn’t write an exploit until after the vulnerability had been reported, and therefore didn’t even have to go find it, they just had to write an exploit for it and were able to exploit unpatched systems, which is probably the most likely scenario.”

Overall, researchers with Google’s TAG team said that the activity shows how exploits developed by the commercial surveillance industry are eventually spread to and used by threat actors.

“We do not know how the attackers acquired these exploits,” said Google TAG researchers. “What is clear is that APT actors are using n-day exploits that were originally used as 0-days by CSVs. It should be noted that outside of common exploit usage, the recent watering hole campaigns otherwise differed in their approaches to delivery and second-stage objectives.”

The focus was on Iranian APTs this week, both from private threat intelligence teams and CISA, exposing new operations from UNC757 and other groups targeting government, higher education, and private industry. We also check in on a new report from Google's Threat Analysis Group on APTs using the same exploits for zero days that were developed by private commercial surveillance vendors NSO Group and Intellexa.

A new advisory by CISA and the FBI warned of recent attacks by RansomHub and said that the group and its affiliates have successfully hit over 210 victims since its inception in February.

In the advisory, which disseminated several tactics and known Indicators of Compromise (IoCs) linked to the group, the U.S. government said that RansomHub attacks have impacted entities across many different industries, including the healthcare, water and wastewater, IT, government services, emergency services, food and agriculture, financial services, commercial facilities, critical manufacturing, transportation and communication sectors. These attacks have been observed as recently as this month, said CISA.

“RansomHub is a ransomware-as-a-service variant—formerly known as Cyclops and Knight—that has established itself as an efficient and successful service model (recently attracting high-profile affiliates from other prominent variants such as LockBit and ALPHV),” according to CISA and the FBI in their Thursday advisory.

RansomHub's affiliate model means that various tactics and techniques are used in different attacks. RansomHub affiliates use several different initial access methods, including phishing and password spraying. They have also exploited known vulnerabilities, including ones in Citrix ADC (CVE-2023-3519), Fortinet FortiOS (CVE-2023-27997), Apache ActiveMQ’s OpenWire protocol (CVE-2023-46604), Atlassian Confluence (CVE-2023-22515), Microsoft Windows (CVE-2017-0144) and more.

The U.S. government observed a variety of other tactics, including the use of Windows Management Instrumentation for disabling antivirus products, and in some cases the use of RansomHub specific tools, like one called EDRKillShifter, for disabling endpoint detection and response tools. Affiliates have also used a number of tools like Mimikatz for gathering credentials, as well as Cobalt Strike, Metasploit and more.

The affiliates use a double-extortion model, first encrypting systems and then exfiltrating the data and leaving a ransom demand for victims. After the encryption occurs, a ransom note drops that does not typically include an initial ransom demand. The victim is provided with a client ID and instructed to contact the group through a unique .onion URL, and then given between three to 90 days to pay a ransom.

“Data exfiltration methods depend heavily on the affiliate conducting the network compromise,” said the advisory. “The ransomware binary does not normally include any mechanism for data exfiltration. Data exfiltration has been observed through the usage of tools such as PuTTY, Amazon AWS S3 buckets/tools, HTTP POST requests, WinSCP, Rclone, Cobalt Strike, Metasploit, and other methods.”

The ransomware group, though only six months old, has already claimed to have targeted several high-profile victims. RansomHub in April claimed to be selling sensitive data stolen from Change Healthcare, after the healthcare giant was hit by the BlackCat ransomware group in February.

CISA and the FBI urged network defenders to take a number of steps to mitigate against RansomHub, such as installing updates as soon as they are released, enabling MFA and training employees to recognize and report phishing attempts.

Over the last few months, an Iranian state-sponsored threat actor has been deploying a new custom backdoor in attacks against various entities in the U.S. and United Arab Emirates, including organizations in the government, communications equipment, oil and gas and satellite sectors.

The threat actor, which is called Peach Sandstorm and was first uncovered last year, targets victims in many countries in order to collect intelligence, using password spraying as an initial access vector. Now, researchers with Microsoft said that between April and July, the group has been leveraging the novel backdoor that they call “Tickler” in attacks against several unnamed organizations.

“This activity is consistent with the threat actor’s persistent intelligence gathering objectives and represents the latest evolution of their long-standing cyber operations,” said researchers on Wednesday. “Microsoft assesses that Peach Sandstorm operates on behalf of the Iranian Islamic Revolutionary Guard Corps (IRGC) based on the group’s victimology and operational focus. Microsoft further assesses that Peach Sandstorm’s operations are designed to facilitate intelligence collection in support of Iranian state interests.”

Though it was discovered last year, the threat group's activities go back for years. In 2024, it has continued to target victims with password spraying, where a list of passwords is leveraged against a large number of targeted accounts.

Researchers also observed attackers in the group pretending to be students, developers or talent acquisition managers on LinkedIn, sending targets messages with the goal of gathering intelligence to then use for social engineering attacks against the higher eduction or satellite sectors. These LinkedIn profiles were since taken down from the platform.

After gaining initial access, the threat group was seen signing in to compromised accounts from commercial VPN infrastructure, moving laterally via SMB and, in some cases, taking snapshots via Active Directory, which is a legitimate functionality for taking a read-only copy of the AD database that can be abused for malicious purposes.

Researchers found two samples of the backdoor used in attacks as recently as July, indicating that it is under active development. The malware enables attackers to download additional payloads from the C2 and set up persistence.

For its command-and-control (C2) server, the threat actor uses attacker-controlled Azure subscriptions, which are sometimes created using compromised accounts. Researchers said that they observed multiple other Iranian groups using similar tactics in recent months.

“Microsoft continuously monitors Azure, along with all Microsoft products and services, to ensure compliance with our terms of service,” according to Microsoft. “Microsoft has notified affected organizations and disrupted the fraudulent Azure infrastructure and accounts associated with this activity.”

Iranian threat groups were recently uncovered both behind espionage and ransomware attacks. In a separate advisory released this week, several U.S. government agencies warned of recent activity by UNC757, an Iran-based group that has been linked to ransomware activity and separately associated with the government of Iran.

CISA is warning federal agencies and enterprises that attackers are exploiting a known vulnerability in the Apache OFBiz ERP suite, a bug that Apache released a fix for three weeks ago.

The vulnerability (CVE-2024-38856) affects every version of OFBiz through 18.12.14 and successful exploitation would allow an attacker to execute screen rendering code on affected endpoints. The Apache Software Foundation released an update to address the bug on Aug. 5, but on Tuesday the Cybersecurity and Infrastructure Security Agency issued an advisory and added the flaw to its Known Exploited Vulnerabilities catalog.

CISA did not provide any information on the group or groups exploiting the vulnerability, but the urgency to apply the patch is even greater, given that the bug can be exploited without authentication.

“Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker,” the CISA advisory says.

OFBiz is an open-source ERP framework that is Java-based. The framework is embedded in some third-party apps, including JIRA. In January, researchers at SonicWall discovered that attackers were exploiting a separate OFBiz vulnerability that had been disclosed in December 2023. That flaw was related to an even earlier vulnerability and attackers began attempting to exploit quickie after its disclosure.

CISA is encouraging organizations to upgrade to version 18.12.15 of OFBiz, which contains the patch for CVE-2024-38856.

Several U.S. government agencies are warning of recent attacks by UNC757, an Iran-based group that has been linked to ransomware activity and separately associated with the government of Iran.

UNC757 (also known as Pioneer Kitten) has been around since 2017 and is known for targeting U.S.-based schools, municipal governments, financial institutions and healthcare facilities. A significant percentage of the operations by UNC757 against U.S. firms aim to obtain initial network access, and then collaborate with ransomware affiliates, including BlackCat, RansomHouse and NoEscape, to deploy ransomware or enable encryption operations in exchange for a percentage of the ransom payments.

However, in the Wednesday cybersecurity advisory for network defenders, the FBI, CISA and Department of Defense Cyber Crime Center warned that the group has also been targeting organizations like U.S. defense sector networks in separate campaigns that are “consistent with Iranian state interests,” rather than the interests of its ransomware affiliate contacts. This link to the Iranian government has previously been reported by threat intelligence teams.

“The FBI further assesses these Iran-based cyber actors are associated with the Government of Iran (GOI) and—separate from the ransomware activity—conduct computer network exploitation activity in support of the GOI (such as intrusions enabling the theft of sensitive technical data against organizations in Israel and Azerbaijan),” according to the advisory.

The advisory disclosed several recent Indicators of Compromise linked to UNC757 activity. Many of UNC757’s techniques are similar to those described by an advisory released four years ago by CISA. The group still gains initial access primarily through vulnerabilities in devices like Citrix Netscaler, Ivanti Pulse Secure and F5 BIG-IP. As of July, CISA said the group has scanned for IP addresses hosting Check Point Security Gateways (likely in an attempt to exploit CVE-2024-24919, which was disclosed in May). Attackers also appear to be targeting a vulnerability in Palo Alto Network's PAN-OS software for firewalls (CVE-2024-3400).

After initial exploitation, the group sets up persistence in various ways, including creating local accounts on victim networks, capturing login credentials for compromised (primarily Netscaler) devices, and implementing the daily creation of a Windows service task. The actor also uses administrator credentials to disable security software and lower PowerShell policies to a less secure level.

While the group provides ransomware affiliates with initial access to victim networks, CISA said its involvement goes beyond this purpose, and the actor works closely with affiliates to lock networks and develop extortion strategies for the victims. The actor has also historically conducted hack-and-leak campaigns, including the 2020 Pay2Key campaign, for instance.

“While this technique has traditionally been used to influence victims to pay ransoms, the FBI does not believe the objective of Pay2Key was to obtain ransom payments,” according to CISA’s advisory. “Rather, the FBI assesses Pay2Key was an information operation aimed at undermining the security of Israel-based cyber infrastructure.”

UNC757 also steals sensitive information from victim networks, suggesting its association with the government of Iran, “however, the group’s ransomware activities are likely not sanctioned by the [government of Iran], as the actors have expressed concern for government monitoring of cryptocurrency movement associated with their malicious activity,” according to CISA. This is one of several dual-purpose groups that have emerged over the years, supporting both ransomware and espionage activities, including North Korean Moonstone Sleet.

Organizations can protect themselves by patching the CVEs targeted by the group, including CVE-2024-3400, CVE-2022-1388, CVE-2019-19781, and CVE-2023-3519, as well as validating their security controls against the techniques in the advisory, said CISA.

During an investigation into recent threat actor activity, researchers with Datadog Security Labs found that the attackers were leveraging the Log4j flaw in an attempt to compromise systems and mine for cryptocurrency.

The vulnerability made headlines in 2021, but despite two years of patches being available, and reports of widespread exploitation by heavy hitters like APT41 and Conti, attackers are still finding success in exploiting vulnerable instances. Log4j’s continued prevalence illustrates how many organizations still struggle with managing vulnerabilities across their environments.

According to a Joint Cybersecurity Advisory last year by the U.S. Cybersecurity and Infrastructure Security Agency, the NSA, and several other government agencies globally, Log4j was a top exploited vulnerability in 2022. But Log4j wasn’t the oldest flaw on CISA’s list, which also included a four-year-old vulnerability (CVE-2018-13379) in Fortinet SSL VPNs. Additionally, many of the flaws that were being routinely exploited had been disclosed, with patches available, for several years, including one in Microsoft Exchange Server (CVE-2017-11882), Ivanti Pulse Secure (CVE-2019-11510) and Citrix ADC and Gateway (CVE-2019-19781). Part of the issue here - particularly with Log4j, but also with other flaws - is that organizations have trouble identifying the slew of applications, services and products in their environments in the first place.

“Digital footprints are exploding, there’s more and more vulnerabilities that are occurring out there and I don’t think it’s realistic to patch all the things,” said Rick Holland, CISO with ReliaQuest. “One of the bigger pieces that’s still a problem, and it’s been a problem for 20 years, is the asset context. We have to get to the point where we’re focusing on the most important things, because we can’t just patch all the things.”

Erik Nost, senior analyst with Forrester, said that with the adoption of cloud and SaaS tools, businesses are facing increasingly complex and decentralized environments that’s making visibility even more difficult.

“Within visibility, I believe the biggest challenge is making sense of it all,” said Nost. “We see that IT technology is more decentralized these days, where businesses own these decisions and they’re deploying cloud applications and using low-code types of systems to help make their own customer-facing applications. So the technology through the business is spread out.”

Another hurdle is the ability to keep up with the sheer number of vulnerabilities across different products, and figure out which of these flaws should be prioritized, whether due to active exploitation, severity, or how the product is used in the organization.

The National Vulnerability Database (NVD) has reported that the overall number of disclosed flaws has grown from 25,081 in 2022 to 28,831 in 2023, and the number of bugs added to CISA’s Known Exploited Vulnerability catalog also grew from 91 assigned in 2022 to 121 assigned in 2023. These numbers don’t neccesarily give a full picture - for example, they don’t break down flaws considered “high-severity” versus “low-severity,” and they don’t show if exploited flaws are widely exploited versus targeted. However, they do show the number of vulnerabilities, both those disclosed and those exploited, trending upwards.

Vulnerability management issues are exacerbated by a convoluted third-party risk environment. Threat actors are targeting vulnerabilities in external-facing services or remote access tools with long-tail impacts to downstream customers, partners and other third-party organizations, as made painfully obvious by the MOVEit Transfer vulnerability last year.

“How prevalent a piece of software is, that also plays a big part,” said Ben Nahorney, threat intelligence analyst with Cisco, in a recent video interview. “Think of something like Log4j. It’s a bit of code that all sorts of different products use, so that’s one of the reasons we see so much activity around that, and ultimately, yes, if it’s in everything, attackers will spend more time trying to figure out how to exploit something like that.”

The Common Vulnerability Scoring System (CVSS), Exploit Prediction Scoring System (EPSS), Stakeholder-Specific Vulnerability Categorization (SSVC) system and CISA’s Known Exploited Vulnerability catalog (KEV) represent different tools that can help security teams determine vulnerability severity or how lucrative it may be for attackers looking to launch attacks in the wild.

But even with these tools, CISOs contending with vulnerability management struggle with securing budget, support and resources. Remediation is not easy, and certain businesses might face issues with downtime or critical infrastructure that throw a wrench into how they apply patches. Sometimes companies may even be under the impression that a flaw is fixed, but developers might use an old code repository or aspect in open source that reintroduces the issue.

“There’s the crown jewels component, there’s the low-hanging fruit external component, and then just having the context around the assets so then you can then prioritize what assets you’ll apply your limited resources to - but I think this space is a big challenge for folks, still,” said Holland.

Nost said that vulnerability management is a "data management problem at the end of the day," and organizations can start to tackle prioritization by first “getting your arms around the data.”

Organizations can “start with the data… that you have in the environment, and [understanding] the data that’s giving us visibility into our environment, our assets, what our assets do, what their purpose is, what their value is,” said Nost. “We need to know the control environment that these assets have, and we need visibility into the weaknesses.”

Researchers have discovered Chinese state-sponsored actors exploiting a zero-day vulnerability in Versa Networks’ virtualization and service creation Director platform, in a highly targeted campaign impacting several U.S.-based victims.

The vulnerability, categorized as high severity by the National Vulnerability Database, was found in Versa Director servers (CVE-2024–39717), and was publicly disclosed Aug. 22. The bug stems from the GUI interface for Versa Director, a key component for managing SD-WAN networks, which is used by internet service providers (ISPs) and managed service providers (MSPs). In an Aug. 26 advisory, Versa Networks said the GUI flaw could allow potentially malicious files to be uploaded by users with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges.

Researchers with Lumen Technologies’ Black Lotus Labs first uncovered exploitation activity for the flaw between June 12 and mid-July 2024, impacting five organizations across the ISP, MSP and IT sectors. They assessed with moderate confidence that the threat actor behind the attack is Volt Typhoon, a known sophisticated Chinese APT behind several campaigns this year on U.S. critical infrastructure.

“Given the severity of the vulnerability, the sophistication of the threat actors, the critical role of Versa Director servers in the network, and the potential consequences of a successful compromise, Black Lotus Labs considers this exploitation campaign to be highly significant,” said researchers in a Tuesday analysis.

Versa Networks customers were first warned of the activity in private security advisories sent on July 26 and Aug. 8, which contained a hotfix.

After exploitation of the flaw, threat actors deployed a unique custom webshell called “VersaMem,” which allowed them to inject malicious code on the Tomcat web server. These webshell functionalities occurred in-memory only, making the actor’s activities stealthier, said researchers.

“The VersaMem shell, both in name (“Director_tomcat_memShell”) and in functionality, is custom-tailored to interact with Versa Directors,” said researchers. “On execution, the web shell attaches to the primary Apache Tomcat (Java servlet and web server) process and takes advantage of the Java Instrumentation API and Javassist (Java bytecode manipulation toolkit) to dynamically modify Java code in-memory.”

The malware also had the ability to harvest plaintext user credentials, which could give attackers access to downstream customer networks as an authenticated user, said researchers. For MSPs, which manage platform, software, IT infrastructure and security services, and support functions for customers, this type of access is significant. Because these companies store customer data and support sensitive processes, they are in a unique position where they have trusted network connectivity and privileged access to customer systems, and government agencies like CISA have previously warned that these organizations are considered valuable targets for threat actors.

The vulnerability impacts versions of Versa Director prior to 22.1.4, and Versa Networks recommended that impacted users update to the fixed version, 22.1.4, as soon as possible. The flaw has been flagged in CISA's Known Exploited Vulnerability catalog, and federal agencies have until Sept. 13 to apply patches.

Versa Networks also urged customers to adhere to several guidelines it had published years ago, which recommended best practices for securing various ports, protocols and components for its products.

“Impacted customers failed to implement system hardening and firewall guidelines… leaving a management port exposed on the internet that provided the threat actors with initial access,” according to Versa Networks’ advisory about the vulnerability in its product. “Although the vulnerability is difficult to exploit, it’s rated ‘High’ and affects all Versa SD-WAN customers using Versa Director, that have not implemented the system hardening and firewall guidelines.”

SonicWall has released a fix for an access control vulnerability in a number of its products that could enable an attacker to gain access to sensitive resources or possibly crash the device.

The flaw is in the company’s SonicOS software that runs on its security devices, and it affects SonicWall Firewall Gen 5 and Gen 6 devices, as well some Gen 7 devices that are running version 7.0.1-5035 or older of the software.

“An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash,” the advisory says.

The affected devices include those in the SOHO/TZ series, the NSa series, and the NSsp series, some of which are widely deployed in enterprise environments.

SonicWall released updated software to address the flaw (CVE-2024-40766), and organizations that have deployed affected devices should update as quickly as possible, as edge security devices are frequent targets for attackers.

A recent Qilin ransomware attack targeted credentials that were stored in Google Chrome browsers on a portion of the impacted network’s endpoints. Researchers said the move is an “unusual tactic, and one that could be a bonus multiplier for the chaos already inherent in ransomware situations.”

The incident illustrates the importance of multi-factor authentication - the attacker obtained initial access via compromised credentials for a VPN portal sans MFA - and serves as a warning about the insecure nature of browser-based password managers.

“Organizations and individuals should rely on password managers applications that employ industry best practices for software development, and which are regularly tested by an independent third party,” said Lee Kirkpatrick, Paul Jacobs, Harshal Gosalia and Robert Weiland, researchers with Sophos, in a Thursday breakdown of the incident. “The use of a browser-based password manager has been proven to be insecure time and again.”

Researchers observed the ransomware attack in July against the unnamed victim. After gaining initial access, the attacker stayed quiet for 18 days, potentially indicating that they were an Initial Access Broker, with the aim of infiltrating systems before selling that unauthorized access to other threat groups.

After the pause in activity, the threat group moved laterally to a domain controller using compromised credentials, where they updated the default domain policy to introduce a new logon-based Group Policy Object - a collection of policy settings - with scripts that attempted to harvest Chrome browser credential data for machines connected to the network. Since the scripts were in a logon GPO, they executed on each client machine as it logged in over the course of three days, said researchers.

“The use of a browser-based password manager has been proven to be insecure time and again.”

Christopher Budd, director of Sophos X-Ops, said this “combination of credential harvesting, targeting browsers, and using configuration settings at logon to execute the harvesting technique to gather as many credentials from as many Google Chrome browsers in the organization as possible” was noteworthy.

After exfiltrating the stolen credentials, the attackers then deleted all files and cleared the event logs for the domain controller and infected machines, making it difficult for incident response teams to analyze the extent of the attack. They then encrypted files, executed ransomware and dropped a ransom note.

On top of the threat of ransomware, this type of attack creates headaches for organizations. Not only do all Active Directory passwords need to be changed, but all end users need to change any passwords saved in the Chrome browser, which could be as many as dozens or even hundreds of credentials.

The attack was carried out by Qilin, a two-year-old ransomware group that has often used double extortion tactics to steal victims’ data in addition to encrypting their systems, and then threatening to sell or expose that stolen data to put further pressure on the organization to pay. The ransomware-as-a-service was most recently linked to the high-profile attack against blood testing company Synnovis, leading to appointments being postponed at several London hospitals.

“Predictably, ransomware groups continue to change tactics and expand their repertoire of techniques. The Qilin ransomware group may have decided that, by merely targeting the network assets of their target organizations, they were missing out,” said researchers. “If they, or other attackers, have decided to also mine for endpoint-stored credentials – which could provide a foot in the door at a subsequent target, or troves of information about high-value targets to be exploited by other means – a dark new chapter may have opened in the ongoing story of cybercrime.”

SolarWinds has provided a hotfix for a critical-severity flaw stemming from a hardcoded credential in its Web Help Desk software.

The flaw (CVE-2024-28987), which ranks 9.1 out of 10 on the CVSS scale, could allow remote, unauthenticated attackers to access internal functionality and modify data. It exists in SolarWind’s Web Help Desk, which is essentially a centralized, web-based help desk ticketing system.

SolarWinds did not give further details around the flaw, but said that Web Help Desk 12.8.3 HF1 and all previous versions are impacted, and a fixed version, 12.8.3 HF2, is available. 12.8.3 HF1 was released just last week to fix a critical Java deserialization remote code execution flaw in Web Help Desk, which if exploited could allow an attacker to run commands on the host machine (CVE-2024-28986).

“This hotfix addresses the SolarWinds Web Help Desk Broken Access Control Remote Code Execution vulnerability fixed in WHD 12.8.3 Hotfix 1, as well as fixing the SolarWinds Web Help Desk Hardcoded Credential vulnerability, and restoring the affected product functionality found in WHD 12.8.3 Hotfix 1,” according to SolarWinds’s Thursday security advisory.

The previously disclosed remote code execution bug (CVE-2024-28986) was also added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA’s) known exploited vulnerability catalog on Aug. 15, although no further details around exploitation activity for the bug have been revealed.

Zach Hanley, vulnerability researcher with Horizon3.ai, was credited with finding the hardcoded credential flaw, and on Twitter Hanley said that he reported the vulnerability to SolarWinds on Aug. 15 “after digging into the recent CISA KEV CVE-2024-28986 for WebHelpDesk,” and that more information would be released next month.

SolarWinds is urging customers to install the hotfix for this latest vulnerability, with further details for installation available on its support page. The company has reported several other vulnerabilities over the past year, including a path traversal bug in Serv-U (CVE-2024-28995) that was reportedly being exploited in the wild in June.

UPDATE: Google on Wednesday fixed a zero-day vulnerability in its Chrome browser as part of a security update with 38 security patches overall.

The high-severity flaw (CVE-2024-7971) exists in the V8 Chrome browser engine. Like previous bugs found in V8, CVE-2024-7971 stems from a type confusion issue, which can occur when programs allocate a resource using one type but later access that resource using different, incompatible types. As is typical in its security advisories, Google on Aug. 21 did not give any further public details of the flaw, its impact, or the related exploitation activity, instead giving users the opportunity to upgrade to the fixed version before threat actors learned about its specifics.

As of Aug. 26, a second Chrome flaw disclosed in the security release, CVE-2024-7965, is also being actively exploited, according to Google. The bug is an inappropriate implementation error in V8 (CVE-2024-7965) that was reported by someone under the handle “TheDog” and earned them $11,000 on July 30,

“Google is aware that an exploit for CVE-2024-7971 exists in the wild,” according to the Wednesday advisory. “Chrome 128.0.6613.84 (Linux) 128.0.6613.84/.85( Windows, Mac) contains a number of fixes and improvements.”

The flaw was reported by Microsoft’s Threat Intelligence Center and the Microsoft Security Response Center on Aug. 19.

Outside of the zero-day flaw, Google disclosed six other high-severity flaws in Chrome, including a use-after-free flaw in Google Password Manager (CVE-2024-7964) that earned the anonymous reporter a reward of $36,000 and was reported Aug. 8 and an out-of-bounds memory access flaw in the Skia graphics library (CVE-2024-7966) reported by Renan Rios on July 25, earning $10,000.

Other high-severity flaws included a heap buffer overflow in Fonts (CVE-2024-7967), a use-after-free bug in Autofill (CVE-2024-7968) and a type confusion in V8 (CVE-2024-7969).

The fixed versions of Chrome 128 will roll out over the coming days and weeks, said Google. The zero day is the ninth one that Google has patched in Chrome in the past eight months. Many of these zero-day flaws have been found in V8, including two other type confusion bugs in May, one found by Google’s Threat Analysis Group and the other by Kaspersky researchers.

This article was updated on Aug. 27 with new active explotiation of a second flaw in the Google advisory.