PoC exploit released for Ivanti flaws. Black Basta chat logs leaked.

Summary

By the CyberWire staff

At a glance.

PoC exploit released for Ivanti flaws.
Black Basta chat logs leaked.
SEC rebrands its Crypto Assets and Cyber Unit.

PoC exploit released for Ivanti flaws.

A proof-of-concept (PoC) exploit is available for a string of vulnerabilities affecting Ivanti Endpoint Manager, the Register reports. Researchers at Horizon3.ai published a technical write-up of the flaws on Wednesday. The four vulnerabilities (CVE-2024-10811, CVE-2024-13161, CVE-2024-13160, and CVE-2024-13159) were assigned CVSS scores of 9.8, and can "allow an unauthenticated attacker to coerce the Ivanti EPM machine account credential to be used in relay attacks, potentially allowing for server compromise." Ivanti issued patches for the flaws last month, and organizations should look to apply the fixes with renewed urgency.

Enhance Your Network Security with Zero Trust!

IT pros, are you ready to fortify your defenses? Discover ThreatLocker® Network Control, a powerful Zero Trust host-based firewall with dynamic ACLs. Gain full visibility, granular control, and advanced filtering to secure your network like never before. Learn how to stop breaches, implement microsegmentation, and integrate seamlessly with the ThreatLocker Platform. Download the whitepaper now and get the insights you need to enhance your organization’s defenses!

Black Basta chat logs leaked.

An individual who goes by the alias "ExploitWhispers" has leaked nearly 200,000 internal messages belonging to the Black Basta ransomware gang, BleepingComputer reports. Researchers at PRODAFT note that the leaker "claimed they released the data because the group was targeting Russian banks."

BleepingComputer says the data, which was uploaded to a Telegram channel, contains "a wide range of information, including phishing templates and emails to send them to, cryptocurrency addresses, data drops, victims' credentials," and details on tactics. The dump also includes information on some of the gang's leaders and members.

Many Voices. One Community.

Join Us at the RSAC 2025 Conference. Join us at RSAC, April 28 - May 1 in San Francisco and gain access to cybersecurity innovators, expert-led sessions, and hands-on workshops. Leave with new strategies, insights, and connections to elevate your cybersecurity journey.

SEC rebrands its Crypto Assets and Cyber Unit.

The US Securities and Exchange Commission (SEC) announced yesterday that it's changed the Crypto Assets and Cyber Unit to the "Cyber and Emerging Technologies Unit (CETU)," CyberScoop reports. The newly rebranded unit, consisting of about thirty fraud specialists and attorneys led by Laura D’Allaird, will "focus on combatting cyber-related misconduct and to protect retail investors from bad actors in the emerging technologies space."

The CETU will focus on combatting misconduct in the following areas:

Fraud committed using emerging technologies, such as artificial intelligence and machine learning
Use of social media, the dark web, or false websites to perpetrate fraud
Hacking to obtain material nonpublic information
Takeovers of retail brokerage accounts
Fraud involving blockchain technology and crypto assets
Regulated entities’ compliance with cybersecurity rules and regulations
Public issuer fraudulent disclosure relating to cybersecurity

Notes.

Today's issue includes events affecting , and Russia the United States.

Attacks, Threats, and Vulnerabilities

Weathering the storm: In the midst of a Typhoon (Cisco Talos Blog) Cisco Talos has been closely monitoring reports of widespread intrusion activity against several major U.S. telecommunications companies, by a threat actor dubbed Salt Typhoon. This blog highlights our observations on this campaign and identifies recommendations for detection and prevention.

Black Basta ransomware gang's internal chat logs leak online (BleepingComputer) An unknown leaker has released what they claim to be an archive of internal Matrix chat logs belonging to the Black Basta ransomware operation.

Ivanti endpoint manager can become endpoint ravager (The Register) PoC exploit code shows why this is a patch priority

Legislation, Policy, and Regulation

Senate confirms Kash Patel as FBI director (NBC News) The Trump loyalist is taking over a bureau in turmoil over firings and an effort to gather names of people who worked on Jan. 6 Capitol riot investigations.

Pentagon fast-tracks ‘Cyber Command 2.0’ review, requests authorities wish list (The Record) Defense Secretary Pete Hegseth has given U.S. Cyber Command a few weeks to finish up a Biden-era plan to revamp itself, sources tell Recorded Future News.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Zero Trust World 2025 (Orlando, Florida, USA, Feb 19 - 21, 2025) Whether you’re Zero Trust curious, actively adopting, or simply want to harden your cybersecurity, Zero Trust World provides education and training to support IT professionals. Through thought leadership and hands-on hacking labs, you’ll explore the threat landscape and what’s possible by changing your defense strategy to default-deny.

The Business of Space Conference (Huntsville, Alabama, Feb 23 - 25, 2025) Engage with top academics, business leaders, innovators, and policy influencers working on the new space economy. Dive into keynote presentations and discussions that foster collaboration between researchers and space economy industry stakeholders. These conversations will present the latest insights into the new space economy and shape future academic and policy research.

Satellite 2025 (Washington, DC, USA, Mar 10 - 13, 2025) For 40+ years SATELLITE has gathered the global space and satellite communities for four immersive days of enterprise, insights, and innovation. This year, with the debut of GovMilSpace, SATELLITE expands its reach to address the needs and priorities of the defense sector.

GovMilSpace (Washington, DC, USA, Mar 10 - 13, 2025) Demystify the future of space technology. In alignment with the SATELLITE Conference & Exhibition, GovMilSpace brings together government and military agencies, the intelligence community, and satellite and space industry partners to explore how private industry can enhance critical missions for the U.S. and its global allies.

WICYS 2025 (Dallas and Virtual, Texas, USA, Apr 2 - 5, 2025) WiCyS 2025 is the go-to event for cybersecurity professionals, students, and organizations. The conference is the flagship event to recruit, retain and advance women in cybersecurity.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 02.21.25