CISA requires Federal agencies to patch Fortinet flaw by October 30th.

Summary

By the CyberWire staff

At a glance.

CISA requires Federal agencies to patch Fortinet flaw by October 30th.
Cybercriminals exploit the US presidential election.
Splunk patches RCE vulnerabilities.

CISA requires Federal agencies to patch Fortinet flaw by October 30th.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Fortinet flaw (CVE-2024-23113) to its Known Exploited Vulnerabilities (KEV) Catalog, ordering Federal agencies to patch the flaw by October 30th. Fortinet fixed the flaw in February, but many devices remain unpatched. CyberScoop notes that, as of Sunday, more than 86,000 IP addresses were vulnerable.

The flaw is a format string vulnerability affecting Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb, which can allow "a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests." The vulnerability was assigned a CVSS score of 9.8.

Cobalt: The Only “Outperformer” in GigaOm’s Pentesting Report

For the second year in a row, Cobalt has been named the only “outperformer” in GigaOm’s independent report on Pentesting as a Service. Recognized for its streamlined approach, free retesting, and swift test launches, Cobalt leads the pack. Download the full report to see why Cobalt stands out as the category leader.

Cybercriminals exploit the US presidential election.

Fortinet has published a report on criminal activity surrounding the upcoming US presidential election, warning that "[t]hreat actors are selling affordable phishing kits on the darknet designed to target voters and donors by impersonating the presidential candidates and their campaigns." The researchers have also observed over a thousand potentially malicious domains that have been registered since the beginning of 2024 which could be used in election-themed phishing attacks.

Fortinet notes, "The top two most-used hosting providers for these election-themed websites are AMAZON-02 and CLOUDFLARENET. The reliance on major hosting platforms such as Amazon Web Services (AWS) and Cloudflare suggests that threat actors are leveraging these reputable services to enhance the legitimacy and resilience of their malicious domains. A notable concentration of domains is associated with a limited number of IP addresses, indicating a centralized approach by threat actors to efficiently manage multiple malicious domains to execute large-scale cyber campaigns."

Unlock your free security questionnaire—limited-time offer.

Customer security questionnaires can be time-consuming, pulling your focus away from scaling your business. At BARR Advisory, we handle your vendor due diligence and much more, so you can focus on what matters most: adding value for your customers. Whether it’s internal audits or penetration testing, our expert team covers every aspect of your security program. Let us handle the details so you can concentrate on the big picture. Claim your complimentary security questionnaire now.

Splunk patches RCE vulnerabilities.

Splunk yesterday issued patches for eleven vulnerabilities affecting Splunk Enterprise, including two high-severity flaws that could lead to remote code execution (RCE), SecurityWeek reports. The most serious flaw (CVE-2024-45733) affects Splunk Enterprise for Windows, and can allow a low-privileged user to perform RCE due to an insecure session storage configuration. A second RCE flaw could allow a low-privileged user to execute code by writing a malicious DLL.

Notes.

Today's issue includes events affecting , and the Democratic People's Republic of Korea the United States.

Attacks, Threats, and Vulnerabilities

ESET Research: Telekopye scammer network targets Booking.com and Airbnb (ESET Newsroom) ESET researchers discovered that the organized scammer network Telekopye has expanded its operations to target users of popular accommodation booking platforms like Booking.com and Airbnb.

DTEX i³ Issues Threat Advisory to Combat DPRK IT Worker Infiltration (DTEX Systems) DTEX i³ Threat Advisory provides recommendations for combating DPRK IT worker infiltration through insider risk management.

Fortinet FortiGuard Labs Observes Darknet Activity Targeting the 2024 United States Presidential Election (Fortinet) Phishing scams aimed at voters, malicious domain registrations impersonating candidates, and other threat activity designed to exploit unassuming victims take center stage as the U.S. election approaches.

Trends

Coalition Report Finds Severity of Ransomware Attacks Increased 68% in First Half of 2024 (BusinessWire) 2024 Cyber Claims Report: Mid-year Update Also Examines Impacts of Risk Aggregation Events

Comcast Business 2024 Cybersecurity Threat Report: Artificial Intelligence Drives New Era of Cyber Threats and Defenses (BusinessWire) Cybercriminals leveraging Artificial Intelligence (AI) to create more convincing deepfakes and phishing attacks, as well as employing open-source tools to generate malicious code

Keeper Security Research Reveals AI is Driving a New Generation of Advanced Cyber Attacks (PR Newswire) /PRNewswire/ -- The rise and continued advancement of Artificial Intelligence (AI) is transforming cybersecurity, introducing new complexities in threat...

Marketplace

CMMC Rule is Final: What Does it Mean for You? (Redspin) The CMMC rule is now final. Discover what it means for DoD contractors and how it will impact their ability to accept contracts.

Cybersecurity Funding Declines in Q3 2024: Pinpoint Search Group Report Suggests VC Funding Stabilization (PR Newswire) /PRNewswire/ -- Pinpoint Search Group, a leading cybersecurity recruitment firm in the U.S., has released the findings of its Q3 2024 cybersecurity funding...

Sonar Acquires Structure101 to Strengthen Code Quality Offering (Sonar) Press Release - Sonar Acquires Structure101 to Strengthen Code Quality Offering

Core4ce Acquires Azimuth Corporation to Strengthen Defense and Intelligence Community Operations (BusinessWire) Together, companies will offer enhanced national security solutions in ISR, AI/ML, threat protection, and warfighter support

watchTowr Raises $19 Million to Redefine External Attack Surface Management Worldwide (BusinessWire) Peak XV, Formerly Sequoia India & Southeast Asia, Leads Round; Former Cloudflare Chief Revenue Officer Chris Merritt Joins Board of Directors

Gartner Says Generative AI will Require 80% of Engineering Workforce to Upskill Through 2027 (Gartner) Longer Term, Organizations Will Require AI Engineers to Build AI-Empowered Applications

ColorTokens Appoints Former MD Anderson CTO Chuck Suitor as Strategic Advisor for Healthcare (PR Newswire) /PRNewswire/ -- ColorTokens Inc., the leading enterprise microsegmentation company, announced today that Chuck Suitor has joined its Board of Advisors to help...

Products, Services, and Solutions

Bitdefender Launches Scam Copilot, a Powerful Scam Defense Platform for its Digital Life Protection Solutions (Bitdefender)

Corelight Integrates SentinelOne Singularity Platform Data to Accelerate SOC Transformation (PR Newswire) /PRNewswire/ -- Corelight, the fastest growing provider of network detection and response (NDR) solutions, today announced a partnership with SentinelOne™,...

Illumio CloudSecure Achieves AWS Security Competency Status (Illumio) Illumio achieves Amazon Web Services (AWS) Security Competency status for Illumio CloudSecure

Nametag Unveils Deepfake Defense™ to Combat AI-Powered Impersonation Threats, Expands Integration Partnership with Okta (GlobeNewswire News Room) Nametag unveils Deepfake Defense™ to combat AI-powered impersonation threats, expands integration partnership with Okta....

Postman’s 2024 State of the API Report Finds API-First Approach Yields Tangible Results (BusinessWire) Nearly three quarters of API professionals now embrace API-first software development for faster production

Normalyze selected as Cool Vendor by Gartner for cutting-edge approach to securing AI pipelines (Normalyze) Company recognized for capabilities to secure organizations data assets in AI use cases. Los Altos, CA – [October 9, 2024] – Normalyze, the pioneer of Data Security Posture Management (DSPM) solutions, today announced its recognition as a Cool Vendor in the 2024 Gartner Cool Vendors™ in Data Security. We believe the recognition highlights Normalyze’s […]

Trulioo Launches Fraud Intelligence Capabililty (Trulioo) Trulioo announced the launch of Fraud Intelligence, a new capability delivering best-in-class predictive risk insights across more than 195 countries.

Managing Expectations and Job Satisfaction for IT Security Leaders (BlackFog) BlackFog research shows where job-related stress has the highest impact on security leaders’ performance.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

ISC2 Security Congress 2024 (Las Vegas and Virtual, Nevada, USA, Oct 14 - 16, 2024) Join thousands of cybersecurity experts from across the globe as we lead the charge against emerging threats and protect what matters most in today's digital landscape.

SecureWorld New York City (New York, New York, USA, Oct 15, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld Government & Education Virtual Conference (Virtual, Oct 16, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

SOC Analyst Appreciation Day: Success Secrets from Security Leaders (Virtual, Oct 16, 2024) SOC analysts are too often overworked and underappreciated, leading to burnout and turnover. Devo established SOC Analyst Appreciation Day™ to pay some long-overdue kudos to SOC analysts and to encourage organizations to improve their job satisfaction and mental well-being.

SINETNew York 2024 (New York, New York, USA, Oct 16, 2024) SINET events provide exclusive opportunities to engage directly with a select network of influential thought leaders, solution providers, researchers and investors from the global security community. SINET invites you to become an event sponsor and receive the unique advantage of showcasing your company’s offering directly to high level decision makers and influencers from the security profession.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 10.15.24

At a glance.

CISA requires Federal agencies to patch Fortinet flaw by October 30th.

Cybercriminals exploit the US presidential election.

Splunk patches RCE vulnerabilities.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Marketplace

Products, Services, and Solutions

Events