DDoS attack brings down Microsoft services. Ransomware gangs are exploiting VMware ESXi flaws.

Summary

By the CyberWire staff

At a glance.

DDoS attack brings down Microsoft services.
Ransomware gangs are exploiting VMware ESXi flaws.
CISA warns of actively exploited ServiceNow vulnerabilities.

DDoS attack brings down Microsoft services.

Microsoft sustained a DDoS attack yesterday that disrupted a range of Azure services, as well as Microsoft 365 and Microsoft Purview services, BleepingComputer reports. Notably, Microsoft's DDoS mitigation mechanisms actually exacerbated the attack. The company stated, "While the initial trigger event was a Distributed Denial-of-Service (DDoS) attack, which activated our DDoS protection mechanisms, initial investigations suggest that an error in the implementation of our defenses amplified the impact of the attack rather than mitigating it." The company hasn't offered details on how this occurred, but says it will publish a post-incident review within two weeks.

If you're on the front line, we've got your back.

Mark your calendar for mWISE™, the unique cybersecurity conference from Mandiant, now part of Google Cloud. Built by practitioners for practitioners, it runs from September 18–19, 2024 in Denver, Colorado.

What makes mWISE different from other cybersecurity conferences? It’s a targeted event with hands-on learning for frontline practitioners. The intimate setting allows you to make one-on-one connections with leaders in the field. And best of all, it’s focused on learning without the sales pitches.

Ransomware gangs are exploiting VMware ESXi flaws.

Microsoft has warned that several ransomware actors are exploiting a vulnerability (CVE-2024-37085) in ESXi hypervisors that can be used to obtain full administrative permissions. VMware has issued patches for the flaw. Microsoft stated, "Microsoft security researchers identified a new post-compromise technique utilized by ransomware operators like Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest in numerous attacks. In several cases, the use of this technique has led to Akira and Black Basta ransomware deployments. The technique includes running the following commands, which results in the creation of a group named 'ESX Admins' in the domain and adding a user to it."

The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, ordering Federal Civilian Executive Branch (FCEB) agencies to apply patches by August 20th.

87% of executives use personal devices with zero security.

What’s the easiest way for cybercriminals to get around your company’s defenses? By attacking executives at home. Once executives leave your network, they become easy targets for hijacking, credential theft, and reputational harm. Close the at-home security gap with BlackCloak Concierge Cybersecurity & Privacy™. Award-winning day-and-night protection for executives and their families. Learn more

CISA warns of actively exploited ServiceNow vulnerabilities.

CISA has also added two critical ServiceNow vulnerabilities (CVE-2024-4879 and CVE-2024-5217) to its KEV Catalog, requiring FCEB agencies to patch the flaws by August 19th, the Record reports. ServiceNow issued patches for the vulnerabilities in May and June, and threat actors have been attempting to exploit them since a proof-of-concept exploit was released earlier this month.

According to Resecurity, the vulnerabilities "enable unauthenticated remote attackers to execute arbitrary code within the Now Platform, potentially leading to compromise, data theft, and disruption of business operations."

D.C.’s Premier Gathering of Cybersecurity Visionary Leaders

N2K CyberWire is proud to partner with DMV Rising 2024 to celebrate the remarkable accomplishments of the DMV's cybersecurity community, and provide a unique opportunity to foster new connections and innovative ideas. Join us on September 12, 2024 to experience firsthand why the DMV region is the beating heart of cyber innovation. Register now to secure your spot.

Notes.

Today's issue includes events affecting , and France the United States.

Attacks, Threats, and Vulnerabilities

Research Update: Threat Actors Behind the DEV#POPPER Campaign Have Retooled and are Continuing to Target Software Developers via Social Engineering (Securonix) Threat actors have been known to exploit large-scale IT operational issues. Because of this, we’ve witnessed a large uptick in eCrime-related scam operations, phishing attacks, and malware being leveraged in the wake of the CrowdStrike induced outage.

Threat Spotlight: How company size affects the email threats targeting your business (Barracuda) It takes less than a minute for someone to fall for a phishing scam. According to the 2024 Data Breach Investigations Report, the median time for a recipient to click on a malicious link after opening the email is 21 seconds, followed by 28 seconds to enter the requested data.

Gold rush for data: Paris 2024 Olympic apps are eavesdropping on users (Cyber News) Apps for the Paris Olympic Games 2024 are tracking users, extracting private data, and peddling it to advertisers and big tech. Moreover, their overreaching capabilities exceed what’s being declared.

Trends

How fintech’s meteoric rise has resulted in society trading security for convenience. (The CyberWire) Financial technology (fintech) has revolutionized the financial world for businesses and individuals alike by digitizing and accelerating financial services. However, while fintech offers unparalleled convenience, it also raises significant security and regulatory concerns.

Marketplace

Axiad Raises $25M in Private Equity Round from Invictus Growth Partners (PR Newswire) /PRNewswire/ -- Axiad, an identity-first enabler of the zero-trust enterprise, today announced it has raised $25 million in funding from Invictus Growth...

Products, Services, and Solutions

DTEX inTERCEPT Now Available in the AWS Marketplace - DTEX Systems Inc (DTEX Systems Inc) AWS Marketplace features DTEX System’s insider threat management capabilities for proactive threat mitigation

Savvy Security’s Zero-Touch Integrations Deliver Comprehensive SaaS Visibility for Better Identity Security (Yahoo Finance) Patent-pending approach eliminates manual app configurations to streamline processes and close gaps in IAM visibility Savvy Security Zero-Touch Integrations Savvy's patent-pending Zero-Touch Integrations leverage already-established client-side sessions to eliminate the need for manual server-side configuration steps to integrate and manage SaaS apps. TEL AVIV, Israel, July 31, 2024 (GLOBE NEWSWIRE) -- Savvy Security, an identity-first software-as-a-service (SaaS) security platform provider, tod

Cyera Embeds Human and Non-Human Identity Module into Data Security Platform (BusinessWire) Cyera’s Identity Module ensures secure data access from employees, third-parties, and non-human identities like services, AI tools, and applications making data safely accessible to the business.

BARR Advisory Expands Cybersecurity Consulting Practice with Security Engineering (BARR Advisory) The expansion empowers the firm to offer a more comprehensive suite of security and compliance solutions.

DataBee™, From Comcast Technology Solutions, Introduces a Gen AI Powered Chatbot to Tackle the Challenge of Finding and Validating Asset Owners (BusinessWire) DataBee™, from Comcast Technology Solutions (CTS), today announced a new generative AI-based chatbot called BeeKeeper AI™, which automatically finds and validates asset owners, closing security and compliance gaps caused by unknown or orphaned assets.

Legislation, Policy, and Regulation

Senate passes landmark bill protecting children’s online safety and privacy (The Record) The legislation broadens online privacy and safety protections for children under age 17 by banning companies from targeting advertising to them, requiring consent for the collection of their data and limiting teens’ exposure to harmful online content.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Unpacking the 2024 Ransomware Landscape: Insights and Strategies from ThreatLabz (Virtual, Aug 22, 2024) This live discussion on the latest findings from the Zscaler ThreatLabz 2024 Ransomware Report highlights the most targeted industries and regions, the dynamics behind a ransom payout, emerging ransomware families, and predictions for 2025. Register now.

SecureWorld Manufacturing & Retail Virtual Conference (Virtual, Aug 28, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

SANS Network Security Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Sep 4 - 9, 2024) At SANS Network Security 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Jailbreak Brewing Company Security Summit (Laurel, Maryland, USA, Sep 6, 2024) Join some of the world's best security researchers as they talk about disinformation; the misleading and deliberate deception in today's connected world, both from the technical and policy sides at the only computer security event held at a production brewery. Attendance is limited to 150 to keep the Security Summit small and encourage conversation between speakers, attendees, and sponsors. Tickets include breakfast, lunch, and an awesome time to chat with fellow security experts. Come participate in the talks, the conversation, and the beer!

DMV Rising 2024 (Washington, DC, Sep 12, 2024) DMV Rising is D.C.'s premier cybersecurity event, bringing together cybersecurity executives to tackle tough problems, share new insights, and explore innovative solutions emerging in D.C., Maryland, and Virginia.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 07.31.24