US government contractor responds to alleged breach. At least five suspected Chinese threat actors exploited Ivanti flaws.

Summary

By the CyberWire staff

At a glance.

US government contractor responds to alleged breach.
At least five suspected Chinese threat actors exploited Ivanti flaws.
Initial access brokers distribute new malware downloader.

US government contractor responds to alleged breach.

US federal IT contractor Acuity has confirmed that hackers stole some of its data, but the company maintains that the information is old and non-sensitive, SecurityWeek reports. A threat actor known as "IntelBroker" posted on BreachForums claiming to have stolen classified information belonging to Five Eyes intelligence agencies.

Acuity CEO Rui Garcia told SecurityWeek, "Acuity recently identified a cybersecurity incident related to GitHub repositories that housed dated and non-sensitive information. Immediately upon becoming aware of this zero-day vulnerability, Acuity applied the vendor’s security updates and performed mitigating actions in accordance with the vendor’s guidance. After conducting our own analysis and following a third-party cybersecurity expert investigation, Acuity has seen no evidence of impact on any of our clients’ sensitive data. In addition to cooperating with law enforcement, Acuity takes the security of its customers’ data seriously and is implementing appropriate measures to secure its operations further."

Balancing Your Cyber Security Strategy – Going on the Offensive

With more than half of cybersecurity experts saying an increase in pen testing decreased breaches by over 50%, it is clear that the shift to offensive security is underway. Download our OffSec Shift report to explore how leading organizations blend defense and offense for a comprehensive cybersecurity strategy.

At least five suspected Chinese threat actors exploited Ivanti flaws.

Mandiant has published a report on zero-day exploitation of several now-patched Ivanti vulnerabilities (CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893). Mandiant observed exploitation by five suspected China-linked threat actors (including Volt Typhoon), as well as three financially motivated groups. The researchers note, "Mandiant has observed different types of post-exploitation activity across our incident response engagements, including lateral movement supported by the deployment of open-source tooling and custom malware families. In addition, we've seen these suspected China-nexus actors evolve their understanding of Ivanti Connect Secure by abusing appliance-specific functionality to achieve their objectives."

Fill in the cyber roles and skills gaps you actually need.

N2K’s Talent Insights solutions provide the workforce intelligence needed to take strategic action. Our workforce experts and proprietary data-analysis tools do the heavy lifting to assess and refine your cyber job roles, the competencies required, and build org charts to organize your workforce. The takeaway? Clarity on where you are, what you need, and a data-driven framework to get you there. Ready to dive in? Learn more.

Initial access brokers distribute new malware downloader.

Researchers at Proofpoint and Team Cymru describe a malware downloader called "Latrodectus" that surfaced in November 2023. The malware is similar to IcedID, and was likely made by the same developers. Latrodectus is being used by initial access brokers (IABs) and is distributed via phishing campaigns. The researchers note, "While use of Latrodectus decreased in December 2023 through January 2024, Latrodectus use increased in campaigns throughout February and March 2024. It was first observed in Proofpoint data being distributed by threat actor TA577 but has been used by at least one other threat actor, TA578."

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

On-demand Webinar—2024 and beyond: Top six cloud security trends

Watch this webinar to find out about six emerging trends that are dominating the cloud cybersecurity landscape. You’ll also discover a range of solutions that can help you protect the security of your cloud environments. Watch now.

Notes.

Today's issue includes events affecting , and China the United States.

Attacks, Threats, and Vulnerabilities

Panera Bread week-long IT outage caused by ransomware attack (BleepingComputer) Panera Bread's recent week-long outage was caused by a ransomware attack, according to people familiar with the matter and emails seen by BleepingComputer.

Fake AI law firms are sending fake DMCA threats to generate fake SEO gains (Ars Technica) How one journalist found himself targeted by generative AI over a keyfob photo.

New Latrodectus malware replaces IcedID in network breaches (BleepingComputer) A relatively new malware called Latrodectus is believed to be an evolution of the IcedID loader, seen in malicious email campaigns since November 2023.

Lens Maker Hoya Scrambling to Restore Systems Following Cyberattack (SecurityWeek) Japanese lens maker Hoya says production processes and ordering systems were disrupted by a cyberattack.

Visa warns of new JSOutProx malware variant targeting financial orgs (BleepingComputer) Visa is warning about a spike in detections for a new version of the JsOutProx malware targeting financial institutions and their customers.

China is trying to influence US elections with AI, Microsoft claims (Silicon Republic) Microsoft claims China-affiliated actors are using 'deceptive' social media accounts to sow division and influence elections around the world.

Litigation, Investigation, and Law Enforcement

Google sues alleged developers of fraudulent crypto investment apps (The Record) Google on Thursday filed suit against two developers accused of making fraudulent investment apps and uploading them to the Google Play store.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.

Insider Risk Management Program Evaluation & Optimization Training Course (Vienna, Virginia, USA, Apr 8 - 9, 2024) The training course will be taught on April 8-9, 2024. Students will receive extensive training, knowledge and resources to help them evaluate an Insider Risk Management (IRM) Program, identify gaps and provide cost effective strategies to optimize the program. This training will provide a 360 perspective for detecting Insider Risks / Threats and also covers establishing an Employee Continuous Monitoring & Reporting Program and employee monitoring on computer systems and networks using Insider Threat Detection Tools. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended our training courses and received ITP Manager Certificates. The Insider Threat Defense Group offers the most affordable, advanced / next generation and value packed training for IRM. This provides students with IRM training that is taught from a real world, practical and operational perspective.

SANS New York City Spring 2024 (New York (or virtual), New York, USA, Apr 8 - 13, 2024) At SANS New York City Spring 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Santa Clara (Santa Clara (and virtual), California, USA, Apr 8 - 13, 2024) At SANS Santa Clara 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Cybersecurity Competitions & Gaming (Virtual, Apr 9, 2024) Season IV, US Cyber Games: An Overview The United States faces a critical shortage of well-qualified cyber talent. While attracting students to computer science programs is a crucial first step, additional, complementary programming is needed to truly begin to close this workforce gap. The US Cyber Games program looks to serve this need via practical, hands-on experience with current and emerging technologies provided through cybersecurity competitions and games. These competitions support traditional academic pathways and widen the net by engaging new and different populations with opportunities to learn more about the field, develop skills, gain invaluable experience, and establish connections with industry professionals.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 04.05.24