Microsoft patches an actively exploited vulnerability. Chinese APT abuses Visual Studio Code Tunnels for C2 purposes.

Summary

By the CyberWire staff

At a glance.

Microsoft patches an actively exploited vulnerability.
Chinese APT abuses Visual Studio Code Tunnels for C2 purposes.
Europol operation seizes DDoS booters.

Microsoft patches an actively exploited vulnerability.

Microsoft yesterday issued patches for seventy-one Windows vulnerabilities, including an actively exploited zero-day affecting the Windows Common Log File System (CLFS) driver, KrebsOnSecurity reports. The zero-day, tracked as CVE-2024-49138, is an elevation-of-privilege flaw that can allow an authenticated attacker to gain SYSTEM privileges. CrowdStrike discovered and reported the vulnerability. Microsoft's Patch Tuesday also fixed sixteen critical remote code execution vulnerabilities.

BleepingComputer has a roundup of Patch Tuesday updates from other vendors, including a critical zero-day affecting Cleo's managed file transfer software.

Cobalt Named “Outperformer” for Third Consecutive Year in GigaOm’s Radar Report for PTaaS

Penetration Testing as a Service (PTaaS) is crucial in today's rapidly evolving threat landscape, where traditional point-in-time security assessments are no longer sufficient. GigaOm’s third annual Radar report for PTaaS examines 13 of the top PTaaS solutions, providing an overview of the market to help decision makers evaluate these solutions and make informed investment decisions.

Download the report to learn:

How the evolving technology and threat landscape are driving new security needs for pentesting
Key considerations for choosing a PTaaS provider based on your organization’s evolving security challenges
Why Cobalt is a Leader in Penetration Testing as a Service.

Chinese APT abuses Visual Studio Code Tunnels for C2 purposes.

SentinelOne has published a report on a Chinese cyberespionage campaign that targeted "large business-to-business IT service providers in Southern Europe" from late June to mid-July 2024. The threat actor used SQL injection against Internet-facing web and database servers to gain initial access. The campaign was detected and disrupted during its early stages.

Notably, the operation abused Visual Studio Code Remote Tunnels for command-and-control purposes. The researchers explain, "Originally designed to enable remote development, this technology provides full endpoint access, including command execution and filesystem manipulation. Additionally, Visual Studio Code tunneling involves executables signed by Microsoft and Microsoft Azure network infrastructure, both of which are often not closely monitored and are typically allowed by application controls and firewall rules. As a result, this technique may be challenging to detect and could evade security defenses. Combined with the full endpoint access it provides, this makes Visual Studio Code tunneling an attractive and powerful capability for threat actors to exploit."

Build a Stronger Identity Security Program to Protect Your Organization

In our eBook, Building an Identity Security Program, we provide a step-by-step guide to creating a resilient identity security framework. You'll learn how to integrate identity security into your overall security strategy, protect against threats like MFA attacks, and secure access across your entire organization. Don’t leave your organization vulnerable to identity-based attacks. Arm yourself with the knowledge and tools to defend your business. Download the eBook.

Europol operation seizes DDoS booters.

A law enforcement operation coordinated by Europol has seized 27 of the most popular platforms used to launch DDoS attacks. The operation, dubbed "PowerOFF," also resulted in the arrest of three administrators of these services. Europol stated, "Known as ‘booter’ and ‘stresser’ websites, these platforms enabled cybercriminals and hacktivists to flood targets with illegal traffic, rendering websites and other web-based services inaccessible. This multifaceted operation, coordinated by Europol and involving 15 countries, targeted all levels of those engaged in this crime."

Dropzone AI Named a Gartner Cool Vendor for the Modern SOC.

Dropzone AI has been recognized as a Gartner Cool Vendor, validating its role in transforming SOCs. With an AI SOC Analyst that autonomously investigates alerts 24/7, Dropzone AI helps security teams stay ahead by reducing alert fatigue and providing decision-ready insights. Discover how we're leading SOC innovation.

Notes.

Today's issue includes events affecting China, France, Germany, and the United States.

Dateline

Why cybersecurity leaders trust the MITRE ATT&CK Evaluations. (N2K Networks) This is a sponsored story produced in collaboration with Cynet.

Attacks, Threats, and Vulnerabilities

Operation Digital Eye | Chinese APT Compromises Critical Digital Infrastructure via Visual Studio Code Tunnels (SentinelOne) Threat actors abused Visual Studio Code and Microsoft Azure infrastructure to target large business-to-business IT service providers in Southern Europe.

Avast researchers detect a surge in fake e-shops following holidays (Avast) We kick off the new year with expectations of sales, but beware: a dangerous wave of fake e-shops is spreading on the internet.

Security Patches, Mitigations, and Software Updates

Patch Tuesday, December 2024 Edition (KrebsOnSecurity) Microsoft today released updates to plug at least 70 security holes in Windows and Windows software, including one vulnerability that is already being exploited in active attacks. The zero-day seeing exploitation involves CVE-2024-49138, a security weakness in the Windows Common…

OTICS Patch Tuesday: Security Advisories Released by Siemens, Schneider, CISA, Others (SecurityWeek) December 2024 ICS Patch Tuesday brings advisories from CISA, as well as several major industrial automation companies.

Microsoft Fixes 71 CVEs Including Actively Exploited Zero-Day (Infosecurity Magazine) Microsoft has patched dozens of vulnerabilities in December, including one zero-day being exploited in the wild

Trends

61% of Global Businesses are Scaling Back AI Investment as a Result of Trust Issues (GlobeNewswire News Room) Qlik study reveals that despite 88% of businesses knowing AI is fundamental to success, factors including a lack of trust, a lack of skills and data...

NetRise Releases Supply Chain Visibility & Risk Study, Edition 2: Containers, Revealing Significant Visibility and Risk Challenges within Common Containers (NetRise) The report is based on an in-depth analysis of 100 networking devices across five key classes: routers, switches, firewalls, VPN gateways, and wireless access points.

NetApp’s 2024 Data Complexity Report Reveals AI’s Make or Break Year Ahead (NetApp) Organizations Worldwide Brace for a Year of AI Transformation, Security Challenges, and Sustainability Imperatives

Marketplace

DTEX Establishes Advisory Board with The Honorable Sue Gordon and Rear Admiral (Ret.) Mike Studeman (GlobeNewswire News Room) Top Cybersecurity and Intelligence Leaders to Help Drive Company Strategy, Highlight Insider Risk Management’s Critical Role for National Security and...

Titania Appoints Experienced Cybersecurity Leader Victoria Dimmick as CEO to Spearhead Next Phase of Growth (Titania) Titania, a global leader in network security and compliance assurance, is pleased to announce the appointment of Victoria Dimmick as CEO.

Island Announces Participation of Singapore-based Global Investor EDBI in its Series D Round to Accelerate Expansion Plans in the Asia-Pacific Region (Island.io) Island Announces Participation of Singapore-based Global Investor EDBI in its Series D Round to Accelerate Expansion Plans in the Asia-Pacific Region

RegScale’s New CTO Explains How We’re Transforming the GRC Industry (RegScale) Hear from RegScale's new CTO about how we’re transforming the GRC industry — and how his years of engineering leadership will move the company forward.

Products, Services, and Solutions

Previously Undetectable AI-Designed Cyberattacks Can Now Be Found in Minutes as CyTwist Launches Breakthrough Malware Detection Engine (CyTwist) In a recent red team AI-generated malware cyberattack, mirroring the attack on France’s government agencies, CyTwist’s purpose-built patented detection engine uncovered in minutes, what usually takes months, demonstrating its unmatched protection against AI-originated attacks and novel malware [Tel Aviv, Israel – Dec 10, 2024] – Today, CyTwist, a leading cybersecurity platform countering Advanced Persistent Threats […]

Stamus Networks Announces Clear NDR: The Next Generation of Open and Transparent Network Defense (Stamus Networks) PRESS RELEASE: Stamus Networks announces Clear NDR™, an open and transparent NDR system.

Data Protection and Security with Versa’s Endpoint DLP Solution (The Versa Networks Blog - The Versa Networks Blog) Data Protection and Security with Versa’s Endpoint DLP Solution In a hyper-digital and remote-working world, protecting sensitive data has become more critical than ever. Endpoint and network Data Loss Prevention (DLP) work together to provide data visibility and control, safeguarding businesses against potential breaches and compliance risks. For this blog, we’ll focus on the value

Legislation, Policy, and Regulation

Federal Appeals Court Upholds Law Threatening US TikTok Ban (Infosecurity Magazine) Appeals court upheld law forcing TikTok divestiture, citing national security risks over China ties

BreachRx Cyber Rules Research & Regulations Report (CRRR) | 2024: The Year of SEC Cyber Rules (BreachRx) Download the research to learn more about the new cyber rules and regulations and what they reveal about the new era of transparency.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

CyberWiseCon Europe 2025 (Vilnius and virtual, Lithuania, May 21 - 23, 2025) CyberWiseCon is a premier IT security conference that brings together cybersecurity experts, industry leaders, and IT professionals from around the Europe.

Events

SecureWorld Pacific Virtual Conference (Virtual, Dec 11, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

GovSummit (Washington, DC, USA, Dec 11, 2024) In a world of escalating digital threats and disruptions, Splunk stands at the core of government agencies, equipping them with the solutions they need to stay resilient and ensure mission success, even in the face of the unexpected. Today, the power is in digital resilience.

Hacking 4 Humanity 2025 (Virtual, Jan 24 - Feb 7, 2025) Online hate is on the rise, leading to real-world devastating effects on individuals and communities around the world. Join Carnegie Mellon, Duquesne, Pitt, and other undergrad and grad students from Pittsburgh at a multidisciplinary hackathon to develop new tech and policy solutions that mitigate online hate and create safer communities. Hacking4Humanity is a tech and policy hackathon for undergraduate and graduate students, which offers students a new way to engage with real-world social problems that can be improved with novel technical and policy solutions.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 12.11.24