Ivanti patches critical flaw affecting Standalone Sentry. More details on Turla's targeting of European NGOs.

Summary

By the CyberWire staff

At a glance.

Ivanti patches critical flaw affecting Standalone Sentry.
More details on Turla's targeting of European NGOs.
US House passes bill to bar data brokers from selling US citizens' data to foreign adversaries.

Ivanti patches critical flaw affecting Standalone Sentry.

Ivanti has issued a patch for a critical remote code execution vulnerability (CVE-2023-41724) affecting its Standalone Sentry appliances, BleepingComputer reports. The company stated, "This vulnerability impacts all supported versions 9.17.0, 9.18.0, and 9.19.0. Older versions are also at risk. There is a patch available now via the standard download portal. We strongly encourage customers to act immediately to ensure they are fully protected. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. By exploiting CVE-2023-41724, an unauthenticated threat actor can execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network."

The flaw was discovered and reported by researchers at the NATO Cyber Security Centre.

Create your own luck. 25% off top cert prep.

Boost confidence without relying on luck! N2K's practice tests offer a comprehensive toolkit for ultimate success, including a vast question Qbank for custom quizzes, final exam simulations, performance tracking, and more in our robust LMS. Visit n2k.com/certify, use code NETWORK, and save 25% on our top practice tests. Don't miss out - offer ends 3/27.

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

More details on Turla's targeting of European NGOs.

Cisco Talos has published an update to its previous reports on a cyberespionage campaign by the Russian threat actor Turla. The campaign, which used a new backdoor dubbed "TinyTurla-NG," targeted a "Polish non-governmental organization (NGO) working on improving Polish democracy and supporting Ukraine during the Russian invasion." Talos describes the full kill chain used by the threat actor, noting that "Before deploying TinyTurla-NG, Turla will attempt to configure anti-virus software exclusions to evade detection of their backdoor. Once exclusions have been set up, TTNG is written to the disk, and persistence is established by creating a malicious service."

US House passes bill to bar data brokers from selling US citizens' data to foreign adversaries.

The US House of Representatives yesterday unanimously passed a bill that would prevent data brokers from selling Americans’ sensitive data to foreign adversaries, the Record reports. House Energy and Commerce Committee leaders Cathy McMorris Rodgers (Republican of Washington) and Frank Pallone (Democrat of New Jersey) noted in a joint statement that the legislation is an "important complement to more comprehensive national data privacy legislation, which we remain committed to working together on."

Notes.

Today's issue includes events affecting Poland, Russia, and the United States.

Attacks, Threats, and Vulnerabilities

Hackers claim to have breached Israeli nuclear facility’s computer network (The Record) An Iran-linked hacking group claims to have breached the computer network of a sensitive Israeli nuclear installation in an incident declared by the ‘Anonymous’ hackers as a protest against the war in Gaza.

Famous Spa GP F1 race comms hijacked by phishing scammers (Cyber Daily) Hackers are launching phishing attacks on Formula 1 (F1) fans after hijacking the official email account of one of the most infamous Grand Prix events in the world - Spa.

New details on TinyTurla’s post-compromise activity reveal full kill chain (Cisco Talos Blog) We now have new information on the entire kill chain this actor uses, including the tactics, techniques and procedures (TTPs) utilized to steal valuable information from their victims and propagate through their infected enterprises.

Rescoms rides waves of AceCryptor spam (WeLiveSecurity) ESET research shares insights into AceCryptor, one of the most popular and prevalent cryptors-as-a-service (CaaS) in the second half of 2023, with a focus on Rescoms campaigns in European countries

International freight tech firm isolates Canada operations after cyberattack (The Record) Radiant Logistics, in a filing with U.S. regulators, said it first detected a cybersecurity incident on March 14.

Products, Services, and Solutions

IONIX Advances Industry Leading Attack Surface Management Platform With Centralized Threat Center for Swift Zero-day Response (GlobeNewswire News Room) Helps security teams accelerate response to zero-day exploits in the wild up to three times faster...

Litigation, Investigation, and Law Enforcement

Treasury Sanctions Actors Supporting Kremlin-Directed Malign Influence Efforts (U.S. Department of the Treasury) WASHINGTON — Today, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated two individuals and two entities for services they provided the Government of the Russian Federation (GoR) in connection with a foreign malign influence campaign, including attempting to impersonate legitimate media outlets.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.

Power Women of GovCon (Arlington, Virginia, USA, Feb 28 - Mar 28, 2024) DCA Live is excited to announce our first ever NEW Power Women of GovCon list and event! We can’t wait to toast the women leading and advising some of the fastest growing and most exciting firms in the DC region’s robust and dynamic government contracting community. We’ll profile these women in the coming weeks and recognize them at a special event on February 28 in Arlington, VA. Join us! You will want to get to know these great women leaders.

SINETSilicon Valley 2024 (Mountain View, California, USA, Mar 21, 2024) SINET – Silicon Valley provides a venue where entrepreneurs can meet and interact directly with leaders of government, business and the investment community in an open, collaborative environment focused on identifying solutions to Cybersecurity challenges.

SANS Orlando 2024 (Orlando (or virtual), Florida, USA, Mar 24 - 29, 2024) At SANS Orlando 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Insider Risk Management Program Evaluation & Optimization Training Course (Vienna, Virginia, USA, Apr 8 - 9, 2024) The training course will be taught on April 8-9, 2024. Students will receive extensive training, knowledge and resources to help them evaluate an Insider Risk Management (IRM) Program, identify gaps and provide cost effective strategies to optimize the program. This training will provide a 360 perspective for detecting Insider Risks / Threats and also covers establishing an Employee Continuous Monitoring & Reporting Program and employee monitoring on computer systems and networks using Insider Threat Detection Tools. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended our training courses and received ITP Manager Certificates. The Insider Threat Defense Group offers the most affordable, advanced / next generation and value packed training for IRM. This provides students with IRM training that is taught from a real world, practical and operational perspective.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 03.21.24