At a glance.
- Atlassian patches critical flaw in Confluence Data Center and Confluence Server.
- Ivanti Connect Secure zero-days exploited.
- COLDRIVER continues targeting Western officials.
- Iranian threat actor targets universities and research organizations.
- TA866 returns with widespread phishing campaigns.
- Massive credential dump offered on underground forums.
- Lazarus Group shares money laundering networks with Southeast Asian criminal gangs.
- UK councils disrupted by cyberattacks.
- VF ransomware attack affected data belonging to 35 million customers.
Atlassian patches critical flaw in Confluence Data Center and Confluence Server.
Atlassian has released a patch for a critical template injection vulnerability (CVE-2023-22527) in Confluence Data Center and Confluence Server that could lead to remote code execution, Help Net Security reports. The bug, which has been assigned a CVSS score of 10, affects all versions released before December 5th. Atlassian says in its advisory, "If you are on an out-of-date version, you must immediately patch. Atlassian recommends that you patch each of your affected installations to the latest version available."
The vulnerability's description states, "A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin."
Ivanti Connect Secure zero-days exploited.
Two recently disclosed zero-days affecting Ivanti Connect Secure VPNs are now undergoing widespread exploitation, according to researchers at Volexity. The vulnerabilities were initially being exploited in limited attacks by the suspected Chinese threat actor UTA0178. Volexity says additional actors now have access to the exploit, and have compromised more than 1,700 devices around the world. The targeting appears to be indiscriminate: “Victims are globally distributed and vary greatly in size, from small businesses to some of the largest organizations in the world, including multiple Fortune 500 companies across multiple industry verticals.”
BleepingComputer notes that more than 16,800 Connect Secure appliances are currently exposed to the internet. Volexity urges organizations to apply the mitigation provided by Ivanti until patches are available.