CISA requires US Federal agencies to patch Citrix Netscaler flaw within a week. VF ransomware attack affected data belonging to 35 million customers.

Summary

By the CyberWire staff

At a glance.

CISA requires US Federal agencies to patch Citrix Netscaler flaw within a week.
VF ransomware attack affected data belonging to 35 million customers.
UK councils disrupted by cyberattacks.
Kansas State University sustains cyberattack.

CISA requires US Federal agencies to patch Citrix Netscaler flaw within a week.

The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered Federal agencies to patch a Citrix NetScaler vulnerability (CVE-2023-6548) by next Wednesday (January 24th), the Record reports. The flaw involves "Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway [that] allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface."

A second vulnerability affecting NetScaler ADC and NetScaler Gateway (CVE-2023-6549) must be patched by US Federal agencies by February 7th.

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. N2K’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

VF ransomware attack affected data belonging to 35 million customers.

US apparel giant VF Corporation (owner of Dickies, The North Face, Smartwool, Timberland, and Vans) has disclosed that the ransomware attack it sustained last month resulted in the theft of data belonging to 35.5 million customers, SecurityWeek reports. It's unclear what type of information was stolen, but the company said in a Form 8-K filing with the Securities and Exchange Commission (SEC), "VF does not collect or retain in its IT systems any consumer social security numbers, bank account information or payment card information as part of its direct-to-consumer practices, and, while the investigation remains ongoing, VF has not detected any evidence to date that any consumer passwords were acquired by the threat actor."

Share your message with our audience of security leaders.

N2K Cyber’s 2024 sponsorship packages are now available. If you're looking to reach the eyes and ears of our influential security professionals, let's talk and see how we can build a program that meets your goals.

UK councils disrupted by cyberattacks.

Three local councils in the UK county of Kent have been hit by cyberattacks, the BBC reports. The Canterbury City Council, Dover District Council, and Thanet District Council have limited access to online systems while they investigate the incidents. Canterbury City Council said in a statement, "Our teams are taking a precautionary approach while we work hard to investigate the problem and to minimise any disruption to our services. Our email system and website have been available throughout although some parts of the website may not quite work as intended." The UK's National Cyber Security Centre (NCSC) is assisting in the investigations.

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

Kansas State University sustains cyberattack.

Kansas State University has disclosed a cyber incident that disrupted its IT services, SecurityAffairs reports. The university stated, "K-State has been experiencing a disruption to certain network systems, including VPN, K-State Today emails, and videos on Canvas, or Mediasite. Upon detection, university IT took immediate steps to investigate the disruption, isolating the areas of concern. We are able to confirm that these disruptions are the result of a recent cybersecurity incident, and as such, we want you to know that these impacted systems were taken offline and will remain offline for the immediate future as the investigation continues. This will also include select shared drives and printers, as well as university listservs."

Notes.

Today's issue includes events affecting Iran, the United Kingdom, and the United States.

Attacks, Threats, and Vulnerabilities

Four-in-ten employees sacked over email security breaches as firms tackle “truly staggering” increase in attacks (ITPro) Lax email security practices are prompting cyber leaders to take drastic action against staff who are duped by cyber criminals

Kansas State University suffered a serious cybersecurity incident (Security Affairs) Kansas State University (K-State) suffered a cybersecurity incident that has disrupted part of its network and services.

Cyber attacks on Kent councils disrupt online services (BBC) Three councils say they are working with the National Cyber Security Centre after the attacks.

PixieFail Bugs in UEFI Open Source Implementation Threaten Computers (Security Boulevard) A collection of security vulnerabilities found within the de facto open source implementation of the UEFI specification could expose systems to a range of

Ransomware Deployment Attempts Via TeamViewer (Huntress) Huntress analysts continue to observe access to endpoints via legacy TeamViewer installations, and/or compromised TeamViewer credentials.

Security Patches, Mitigations, and Software Updates

CISA pushes federal agencies to patch Citrix RCE within a week (BleepingComputer) Today, CISA ordered U.S. federal agencies to secure their systems against three recently patched Citrix NetScaler and Google Chrome zero-days actively exploited in attacks.

Trends

Cyber Insurance in the Age of Ransomware: Protection or Provocation? - SOCRadar® Cyber Intelligence Inc. (SOCRadar® Cyber Intelligence Inc.) Ransomware attacks may have led to the rise of cyber insurance, a specialized coverage designed to mitigate financial risks from cyber...

Marketplace

Conversant Group hires General Counsel and VP/Corporate Controller (AI-TechPark - AI, ML, IoT, Cybersecurity News & Trend Analysis, Interviews) Conversant Group™, today announced the hiring of Ron Zollman as general counsel and Harold Solis as vice president, corporate controller for the Conversant family of companies

Legislation, Policy, and Regulation

Cyber Safety Review Board needs stronger authorities, more independence, experts say (CyberScoop) The CSRB needs to become more transparent regarding its membership and the cases it takes on, experts told Congress.

Litigation, Investigation, and Law Enforcement

US govt wants BreachForums admin sentenced to 15 years in prison (BleepingComputer) The United States government has recommended that Conor Brian Fitzpatrick, the creator and lead administrator of the now-defunct BreachForums hacking forums, receive a sentence of 15 years in prison.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Improve Spear Phishing Detection With AI (Virtual, Jan 30 - 31, 2024) Phishing remains one of the costliest attack vectors. Spear phishing, a more targeted form of phishing, is very convincing and poses a great risk to organizations. As threat actors crank up the volume of spear phishing attacks, companies are increasingly embracing AI for cybersecurity. Join this webinar to learn how NVIDIA’s AI technologies, along with ecosystem partners, can help organizations build powerful solutions to defend against cyber threats.

Events

SANS Classic 2024 (Virtual, Jan 15 - 20, 2024) At SANS Classic 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Cyber Security Mountain: January 2024 (Virtual, Jan 22 - 27, 2024) At SANS Cyber Security Mountain: January 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Insider Threat Program Development, Management & Optimization Training Course (Laurel, Maryland, USA, Jan 30 - 31, 2024) This highly sought after and very comprehensive 2 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Behavioral Science Professionals, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group.

SANS Tysons Corner – NOVA 2024 (Tysons Corner, Virginia, USA, Feb 5 - 10, 2024) At SANS Tysons Corner-NOVA 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 01.19.24