Ivanti Connect Secure zero-days exploited. SonicWall firewall vulnerabilities.

Summary

By the CyberWire staff

At a glance.

Ivanti Connect Secure zero-days exploited.
SonicWall firewall vulnerabilities.
Phemedrone Stealer campaign exploits Windows Defender SmartScreen vulnerability.
GitLab patches password reset flaw.

Ivanti Connect Secure zero-days exploited.

Two recently disclosed zero-days affecting Ivanti Connect Secure VPNs are now undergoing widespread exploitation, according to researchers at Volexity. The vulnerabilities were initially being exploited in limited attacks by the suspected Chinese threat actor UTA0178. Volexity says additional actors now have access to the exploit, and have compromised more than 1,700 devices around the world. The targeting appears to be indiscriminate: “Victims are globally distributed and vary greatly in size, from small businesses to some of the largest organizations in the world, including multiple Fortune 500 companies across multiple industry verticals.”

BleepingComputer notes that more than 16,800 Connect Secure appliances are currently exposed to the internet. Volexity urges organizations to apply the mitigation provided by Ivanti until patches are available.

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. N2K’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

SonicWall firewall vulnerabilities.

Researchers at Bishop Fox warn that over 178,000 SonicWall Firewalls “are affected by two unauthenticated denial-of-service vulnerabilities with the potential for remote code execution.” The researchers note, “The impact of a widespread attack could be severe. In its default configuration, SonicOS restarts after a crash, but after three crashes in a short period of time it boots into maintenance mode and requires administrative action to restore normal functionality. The latest available firmware protects against both vulnerabilities, so be sure to upgrade immediately (and make sure the management interface isn’t exposed to the internet).”

Share your message with our audience of security leaders.

N2K Cyber’s 2024 sponsorship packages are now available. If you're looking to reach the eyes and ears of our influential security professionals, let's talk and see how we can build a program that meets your goals.

Phemedrone Stealer campaign exploits Windows Defender SmartScreen vulnerability.

Trend Micro says a campaign using a new strain of the Phemedrone Stealer is exploiting a Windows Defender SmartScreen Bypass vulnerability (CVE-2023-36025) that was patched in November. The researchers explain, “Once the malicious .url file exploiting CVE-2023-36025 is executed, it connects to an attacker-controlled server to download and execute a control panel item (.cpl) file. Microsoft Windows Defender SmartScreen should warn users with a security prompt before executing the .url file from an untrusted source. However, the attackers craft a Windows shortcut (.url) file to evade the SmartScreen protection prompt by employing a .cpl file as part of a malicious payload delivery mechanism.”

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

GitLab patches password reset flaw.

GitLab has issued a patch for a critical account takeover flaw (CVE-2023-7028) affecting GitLab Community Edition (CE) and Enterprise Edition (EE), SecurityWeek reports. The bug could allow account password reset emails to be delivered to unverified email addresses. GitLab notes, “Users without SSO enforcement are vulnerable. If your configuration allows a username and password to be used in addition to SSO options, then you are impacted. Disabling all password authentication options via Sign-in restrictions settings will mitigate the vulnerability for Self-Managed customers that have an external identity provider configured, as this will disable the ability to perform password reset.”

Notes.

Today's issue includes events affecting China, the Republic of Korea, Ukraine, and the United States.

Attacks, Threats, and Vulnerabilities

Remote Code Execution Vulnerability Found in Opera File Sharing Feature (SecurityWeek) A vulnerability in Opera browser’s file sharing feature My Flow could be exploited for remote code execution.

Email Nightmare: 94% of Firms Hit by Phishing Attacks in 2023 (Infosecurity Magazine) In its latest Email Security Risk Report, Egress found that businesses were 10% more negatively affected by phishing attacks in 2023 than in 2022

Remcos RAT Spreading Through Adult Games in New Attack Wave (The Hacker News) reaking News: Remcos RAT, a stealthy remote access trojan, is now spreading in South Korea disguised as adult-themed games via webhards

Remotely Exploitable ‘PixieFail’ Flaws Found in Tianocore EDK II PXE Implementation (SecurityWeek) Quarkslab finds serious, remotely exploitable vulnerabilities in EDK II, the de-facto open source reference implementation of the UEFI spec.

Detailed Analysis of DarkGate; Investigating new top-trend backdoor malware (Malware Analysis, News and Indicators) Author: Minyeop Choi | BLKSMTH Last Modified : Jan 16, 2024 Photo by Nikola Knezevic on UnsplashExecutive Summary DarkGate is a malware that has been developed since 2017 and sold as Malware-as-a-Service. DarkGate was not widely used until 2021, but continued feature additions and modifications were made, and it is now found to be used in various attacks. DarkGate supports attackers able to do malicious acts to victims listed below. — Remote Code Execution by Reverse Shell or Remote Desktop suc...

Hacker spins up 1 million virtual servers to illegally mine crypto (BleepingComputer) A 29-year-old man in Ukraine was arrested this week for using hacked accounts to create 1 million virtual servers used to mine $2 million in cryptocurrency.

Ransomware tracker: the latest figures [March 2023] (The Record) Hospitals and other healthcare providers have gotten a break from ransomware groups in recent months, but other sectors weren't spared.

Ivanti Connect Secure VPN Exploitation Goes Global (Volexity) On January 10, 2024, Volexity publicly shared details of targeted attacks by UTA0178 exploiting two zero-day vulnerabilities (CVE-2024-21887 and CVE-2023-46805) in Ivanti Connect Secure (ICS) VPN appliances. On the same day, Ivanti published a mitigation that could be applied to ICS VPN appliances to prevent exploitation of these vulnerabilities. Since publication of these details, Volexity has continued to monitor its existing customers for exploitation. Volexity has also been contacted by multiple organizations that saw signs of compromise by way of mismatched file detections. Volexity has been actively working multiple new cases of organizations with compromised ICS VPN appliances.

Over 178K SonicWall firewalls vulnerable to DoS, potential RCE attacks (BleepingComputer) Security researchers have found over 178,000 SonicWall next-generation firewalls (NGFW) with the management interface exposed online are vulnerable to denial-of-service (DoS) and potential remote code execution (RCE) attacks.

CVE-2023-36025 Exploited for Defense Evasion in Phemedrone Stealer Campaign (Trend Micro) This blog delves into the Phemedrone Stealer campaign's exploitation of CVE-2023-36025, the Windows Defender SmartScreen Bypass vulnerability, for its defense evasion and investigates the malware's payload.

Ransomware attack on US Navy shipbuilder leaked information of nearly 17,000 people (The Record) Fincantieri Marine Group submitted a regulatory filing about an incident that caused widespread production issues in April 2023.

Security Patches, Mitigations, and Software Updates

VMware Releases Critical Security Update for VMware Aria Automation - NHS Digital (NHS Digital) Security update addresses a Missing Access Control vulnerability in the VMware Aria Automation platform

GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 (GitLab) Learn more about GitLab Critical Security Release: 16.7.2, 16.6.4, 16.5.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

Marketplace

Thomvest Ventures closes $250M fund to invest across fintech, cybersecurity, AI (allinfosecnews.com) Thomvest Ventures deploys capital in the areas of financial and real estate technology, cybersecurity, cloud and AI/data infrastructure. © 2023 TechCrunch. All rights reserved. For personal use only.

Products, Services, and Solutions

Skopenow Grid detects the earliest signals of critical risks - Help Net Security (Help Net Security) Skopenow Grid equips security, intelligence, and investigative teams worldwide with enhanced proactive threat intelligence capabilities.

Technologies, Techniques, and Standards

Building a Shadow IT Policy: What CEOs, CTOs, and CISOs Need to Know | Bitsight (Bitsight) Create a comprehensive policy that includes detection, reporting, and control measures to manage shadow IT.

Litigation, Investigation, and Law Enforcement

Ukrainian arrested for infecting US cloud provider with cryptomining malware (The Record) Ukrainian authorities and an unspecified U.S. cloud computing provider teamed up to capture a suspect in a $2 million cryptomining operation.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

SANS Classic 2024 (Virtual, Jan 15 - 20, 2024) At SANS Classic 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Insider Threat Program Development, Management & Optimization Live Web Based Training Course (Virtual, Jan 17 - 18, 2024) This highly sought after and very comprehensive 1 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Behavioral Science Professionals, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group.

SANS Cyber Security Mountain: January 2024 (Virtual, Jan 22 - 27, 2024) At SANS Cyber Security Mountain: January 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Insider Threat Program Development, Management & Optimization Training Course (Laurel, Maryland, USA, Jan 30 - 31, 2024) This highly sought after and very comprehensive 2 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Behavioral Science Professionals, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group.

SANS Tysons Corner – NOVA 2024 (Tysons Corner, Virginia, USA, Feb 5 - 10, 2024) At SANS Tysons Corner-NOVA 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 01.16.24