DeepData malware framework exploits Fortinet zero-day.

Summary

By the CyberWire staff

At a glance.

DeepData malware framework exploits Fortinet zero-day.
Palo Alto Networks warns of PAN-OS zero-day exploitation.
CISA director Jen Easterly will depart in January.

DeepData malware framework exploits Fortinet zero-day.

Volexity warns that the DeepData malware framework is exploiting a zero-day credential disclosure vulnerability affecting Fortinet’s Windows VPN client (FortiClient). Volexity reported the flaw to Fortinet in July 2024, but it remains unpatched.

Volexity says the DeepData framework was developed by a Chinese state-sponsored threat actor tracked as "BrazenBamboo," though this threat actor isn't necessarily an operator of the malware. The researchers write, "DEEPDATA supports a wide range of functionality to extract data from victims’ systems. The observed functionality of several plugins is commonly seen and includes items typically stolen from victim systems. However, Volexity noted the FortiClient plugin was uncommon and investigated it further. Volexity found the FortiClient plugin was included through a library with the filename msenvico.dll. This plugin was found to exploit a zero-day vulnerability in the Fortinet VPN client on Windows that allows it to extract the credentials for the user from memory of the client’s process."

How CISOs are tackling the realities of AI adoption

How are security leaders navigating AI adoption? Hear from leading CISOs in the latest Tines report, CISO Perspectives: Separating the Reality of AI from the Hype.

What to expect:

Top challenges CISOs are facing in AI adoption
Key opportunities AI presents for security teams
Strategies for handling the added pressure AI brings

Get the report to learn why 74% of CISOs believe AI will introduce more benefits than risks to the SOC.

Palo Alto Networks warns of PAN-OS zero-day exploitation.

Palo Alto Networks has confirmed that threat actors are exploiting a recently discovered vulnerability affecting its PAN-OS firewall management interface, the Record reports. The vulnerability (CVE-2024-0012) has been assigned a CVSS score of 9.3, and the company urges customers to apply mitigations as soon as possible.

Palo Alto stated, "An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474." The company added that it's "observed threat activity that exploits this vulnerability against a limited number of management web interfaces that are exposed to internet traffic coming from outside the network."

Survey Your Security Perimeter with a Free Security Assessment

By getting started with a free identity security assessment, Cisco can help you find and secure the gaps in your identity infrastructure and provide insights for improving your identity posture. Outcomes of the assessment include:

A complete view of your identity security posture
A detailed view of all identities and devices logging into your network
An analysis of your multi-factor authentication usage and adoption
A snapshot of your total number of inactive accounts

Request Your Free Identity Security Assessment Today

CISA director Jen Easterly will depart in January.

Nextgov reports that Jen Easterly, director of the US Cybersecurity and Infrastructure Security Agency (CISA), will leave the agency when President-elect Trump is inaugurated on January 20th. Also departing are Deputy Director Nitin Natarajan, Executive Assistant Director for Cybersecurity Jeff Greene, and Executive Assistant Director for Infrastructure Security David Mussington.

A CISA spokesperson told Meritalk, "All appointees of the Biden administration will vacate their positions by the time the new administration takes office at noon on January 20th. At CISA, we are fully committed to a seamless transition."

Dropzone AI Named a Gartner Cool Vendor for the Modern SOC.

Dropzone AI has been recognized as a Gartner Cool Vendor, validating its role in transforming SOCs. With an AI SOC Analyst that autonomously investigates alerts 24/7, Dropzone AI helps security teams stay ahead by reducing alert fatigue and providing decision-ready insights. Discover how we're leading SOC innovation.

Notes.

Today's issue includes events affecting China, India, and the United States.

Attacks, Threats, and Vulnerabilities

Gendered Harms of Data Weaponization: Historical Patterns, New Battlefields, and the Implications for Democracy and National Security (New America) Data weaponization exploiting gender can trap victims in a harmful cycle that undermines individual rights and leads to global insecurity.

Security Alert: Fake Accounts Threaten Black Friday Gaming Sales (DataDome) As Black Friday 2024 nears, online retailers are preparing for a surge in demand, particularly for deals, discounts, and bundles on popular gaming consoles like the PS5, Xbox, and Nintendo Switch, along with their accessories.

Marketplace

NetSPI Names Caroline Japic as Chief Marketing Officer to Drive Next Phase of Growth and Expand Proactive Security Vision (PR Newswire) /PRNewswire/ -- NetSPI, the leader in proactive cybersecurity solutions, today announced that Caroline Japic has joined the company as Chief Marketing Officer....

Products, Services, and Solutions

Secure by Design: AWS enhances centralized security controls as MFA requirements expand | Amazon Web Services (Amazon Web Services) At Amazon Web Services (AWS), we’ve built our services with secure by design principles from day one, including features that set a high bar for our customers’ default security posture. Strong authentication is a foundational component in overall account security, and the use of multi-factor authentication (MFA) is one of the simplest and most effective […]

Legislation, Policy, and Regulation

DHS Releases Secure AI Framework for Critical Infrastructure (Dark Reading) The voluntary recommendations from the Department of Homeland Security cover how artificial intelligence should be used in the power grid, water system, air travel network, healthcare, and other pieces of critical infrastructure.

Litigation, Investigation, and Law Enforcement

Indian police arrest suspect in $230 million WazirX crypto exchange hack (The Record) Delhi police arrested a man suspected of helping to initiate an intrusion into WazirX, one of the country's largest cryptocurrency exchanges.

Teen swatter-for-hire admits to hundreds of hoax calls (The Register) PLUS: Cost of Halliburton hack disclosed; Time to dump old D-Link NAS; More UN cybercrime convention concerns; and more

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

SANS Holiday Hack Cybersecurity Challenge 2024: Snow-maggedon (Vienna, Nov 7 - Dec 2, 2024) Whether you're a first-time player or a seasoned participant, this year’s Holiday Hack brings exciting new features you won’t want to miss! We’ve introduced a new dynamic for this year: challenges will be gradually released in sync with the story, keeping the experience fresh and immersive. See challenges release dates and new features included.

CYBERSAT24 (Reston, Virginia, USA, Nov 18 - 20, 2024) CyberSat Summit has been at the forefront of the satellite industry’s burgeoning cybersecurity landscape since the event’s launch in 2017. Initially run as a single annual event, it morphed into two separate events in recent years – CyberLEO and CyberSatGov. This was done in response to changing market conditions, most notably the huge growth of LEO satellites and the corresponding rise of commercial interest in space. While CyberSatGov and CyberLEO were successful independently, the continued demand for LEO architectures and the ever-increasing collaboration between government and industry meant that these conversations needed to happen under one roof. As a result, 2024 will feature a single CyberSat event in November, where for the first time in its 7-year history, we will nearly double the event’s content offerings to include two concurrent tracks – one track titled “Space Infrastructure” and the second track titled “Space Data & Technology.” The “Space Infrastructure” track will continue CyberSat’s legacy focus on the overall satellite cybersecurity ecosystem and the protection of tangible assets like ground systems and satellite components, while the new “Space Data & Technology” track will focus on emerging technologies and the protection of space’s intangible assets like data. Keynotes, and a handful of general sessions, will contain talks that apply to all attendees.

CYBERSAT24 (Reston, Virginia, USA, Nov 18 - 20, 2024) CyberSat is the only space security event that successfully unites satellite, space, cyber, and government to educate on threat vectors and to thwart next-generation attacks.

CYBERWARCON (Arlington + Virtual, Virginia, USA, Nov 22, 2024) CYBERWARCON is a one-day conference in Arlington, VA focused on the specter of destruction, disruption, and malicious influence on our society through cyber capabilities. CYBERWARCON is not a hacker conference, or an ICS conference, or an international policy conference. The central purpose of this conference is to identify and explore threats. Participants and attendees come from a spectrum of backgrounds including the military and government, academia, the media, and the private sector.

AWS re:Invent (Las Vegas, Nevada, USA, Dec 2 - 6, 2024) AWS re:Invent offers learning sessions on many topics in a variety of formats and at various levels so you can expand your knowledge and grow your skills at a pace that is right for you. Select a topic from the list to learn more about these opportunities at re:Invent.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 11.18.24

At a glance.

DeepData malware framework exploits Fortinet zero-day.

Palo Alto Networks warns of PAN-OS zero-day exploitation.

CISA director Jen Easterly will depart in January.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Products, Services, and Solutions

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Events