Evasive Panda leverages Monlam Prayer Festival to target Tibetans. TeamCity flaw is undergoing widespread exploitation.

Announcement

Live webinar: CISOs Are the New Architects (of the Workforce).

Our industry has become enamored with superstars and purple unicorns; not with the aggregate skill set of the team. Join N2K’s Simone Petrella and Kim Jones from Intuit on Wednesday, March 27th at 2pm ET for a live discussion on the evolving role of CISOs and the pivotal role they play in shaping the modern security workforce landscape. Learn more and register now.

CSO Perspectives Live | Tuesday, April 2nd at 2pm ET.

Join us for CSO Perspectives Live on Tuesday, April 2, 2024 at 2:00 PM EST. During this live and interactive event, Rick Howard and a panel of our Hash Table security experts will discuss emerging industry trends, recent threats and events, and the evolving role of executives in our field. Register now.

Summary

By the CyberWire staff

At a glance.

Evasive Panda leverages Monlam Prayer Festival to target Tibetans.
TeamCity flaw is undergoing widespread exploitation.
Play ransomware group leaks Swiss government data.

Evasive Panda leverages Monlam Prayer Festival to target Tibetans.

ESET says the China-aligned threat actor Evasive Panda is targeting Tibetans with Trojanized versions of Tibetan language translation software. The threat actor also compromised a website belonging to the organizer of the annual Monlam Prayer Festival in order to launch watering-hole attacks. The researchers note, "The attackers aimed to deploy malicious downloaders for Windows and macOS to compromise website visitors with MgBot and a backdoor that, to the best of our knowledge, has not been publicly documented yet; we have named it Nightdoor."

Team Cymru’s Threat Intelligence solutions allow you to aim your sights on the malicious actors.

Imagine a world where you're always one step ahead of cyber threats, where your defenses are impenetrable because you see what others don't. With real-time access to the worlds largest threat intelligence data ocean, we enable you to turn the tables on attackers. Transform your security from reactive to proactive through accelerated threat hunting and incident response, made possible through automation. Team Cymru: be the hunter, not the hunted.

TeamCity flaw is undergoing widespread exploitation.

A critical authentication bypass vulnerability (CVE-2024-27198) affecting JetBrains TeamCity is being widely exploited to create administrator accounts on vulnerable hosts, BleepingComputer reports. "Exploitation appears to be massive, with hundreds of new users created on unpatched instances of TeamCity exposed on the public web," BleepingComputer says. The Register reports that at least one ransomware group has been observed targeting the vulnerability.

JetBrains disclosed the flaw on Monday, and users are urged to apply the patch as soon as possible.

Experience the ultimate cloud security challenge.

Put your cloud security skills to the test in a virtual game of Capture the Flag. Join Lacework in this interactive and gamified learning session, where you’ll dive into challenges simulating real-world investigations and threat-hunting scenarios. Plus, the top three scorers will receive a Valve Steam Deck. Attendance is limited, so register now to secure your spot.

Play ransomware group leaks Swiss government data.

Switzerland’s National Cyber Security Centre (NCSC) yesterday disclosed that the Play ransomware gang has leaked 65,000 government documents belonging to the Swiss government, some of which included classified information and sensitive personal data, the Record reports. The documents were stolen during an attack against IT provider and government contractor Xplain in May 2023. The NCSC says most of the government-related files belonged to the Federal Department of Justice and Police (FDJP), including the Federal Office of Justice, Federal Office of Police, State Secretariat for Migration, and the internal IT service centre ISC-FDJP.

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

Notes.

Today's issue includes events affecting China, Switzerland, and the United States.

Attacks, Threats, and Vulnerabilities

Inside Chinese hacking company’s culture of influence, alcohol and sex (C4ISRNet) Hackers such as those at China's I-Soon outnumber FBI cybersecurity staff by “at least 50 to one,” FBI director Christopher Wray has said.

Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities (Check Point Research) Key Points Introduction On January 10, 2024, Ivanti published a security advisory regarding two vulnerabilities in Ivanti Connect Secure VPN. These vulnerabilities, which were exploited in the wild, are identified as CVE-2023-46805 and CVE-2023-21887. The exploitation of these vulnerabilities was quickly adopted by a number of threat actors, resulting in a broad range of malicious activities. Check Point Research […]

Evasive Panda leverages Monlam Festival to target Tibetans (ESET) ESET research uncovers a cyberespionage campaign that has been victimizing Tibetans through targeted watering hole (also known as a strategic web compromise) and supply-chain compromise attacks

Iran-linked ‘Lord Nemesis’ group appears intent on intimidating Israeli organizations, report says (The Record) An Iranian state-backed hacking group recently infiltrated a company that makes academic administration software and used that access to intimidate other Israeli organizations, analysts said on Thursday.

Lithuania warns China has ramped up espionage campaigns (The Record) China's activity in the country’s cyberspace has increased since Lithuania announced the opening of a de facto Taiwanese embassy, prompting China to withdraw its ambassador from Vilnius.

Security Patches, Mitigations, and Software Updates

VMware sandbox escape bugs are so critical, patches are released for end-of-life products (Ars Technica) VMware ESXi, Workstation, Fusion, and Cloud Foundation all affected.

Legislation, Policy, and Regulation

Bills targeting data brokers and TikTok approved in House committee (The Record) The House Energy and Commerce Committee advanced bills that would force TikTok to separate from its Chinese ownership or be stripped from app stores and block data brokers from selling or transferring Americans’ data to foreign adversaries.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.

Power Women of GovCon (Arlington, Virginia, USA, Feb 28 - Mar 28, 2024) DCA Live is excited to announce our first ever NEW Power Women of GovCon list and event! We can’t wait to toast the women leading and advising some of the fastest growing and most exciting firms in the DC region’s robust and dynamic government contracting community. We’ll profile these women in the coming weeks and recognize them at a special event on February 28 in Arlington, VA. Join us! You will want to get to know these great women leaders.

SANS Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Mar 4 - 9, 2024) At SANS Las Vegas 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SO-CON Summit (Arlington, Virginia, USA, Mar 11 - 15, 2024) It will feature over 20 unique cybersecurity sessions from industry experts. They’ll be sharing new research, new open source tools, best-practices, and much more. The first day of the summit will be followed by several days of training (including red teaming, tradecraft analysis, AD security fundamentals, and much more).

SANS Dallas 2024 (Dallas (and virtual), Texas, USA, Mar 11 - 16, 2024) At SANS Dallas 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 03.08.24