Crooks stole around $112 million worth of Ripple XRP from the crypto wallet of Ripple’s co-founder Chris Larsen.

This week, crooks stole around $112 million worth of the Ripple-focused cryptocurrency XRP from a crypto wallet belonging to the Ripple’s co-founder and executive chairman Chris Larsen.

Larsen pointed out that the hackers compromised his personal XRP accounts, while the @Ripple was not impacted.

Yesterday, there was unauthorized access to a few of my personal XRP accounts (not @Ripple) – we were quickly able to catch the problem and notify exchanges to freeze the affected addresses. Law enforcement is already involved. https://t.co/T3HtKSlzLg

— Chris Larsen (@chrislarsensf) January 31, 2024

Larsen revealed that his company was able to quickly detect the fraudulent activity and freeze the affected address with the support of other exchanges. The Ripple’s co-founder immediately notified law enforcement.

“Larsen wrote the post less than an hour after the well-known crypto security researcher ZachXBT broke news of the hack.” states Techcrunch.co that first reported the news.

The crypto expert ZachXBT first discovered the hack and reported that the crooks attempted to launder the stolen funds through multiple crypto exchanges and platforms, including MEXC, Gate, Binance, Kraken, OKX, HTX, and HitBTC.

TechCrunch highlighted the impossibility of determining whether the compromised account actually belongs to Ripple.

The post includes an analysis of the hacked wallet through on-chain data from XRPScan and attempts to shed light on its link with Larsen’s account.

However a Ripple’s spokesperson confirmed that Ripple was not impacted.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, XRP)

German police seized 50,000 Bitcoin from the former operator of the now-defunct piracy website movie2k.to.

The police in Saxony, Germany, have seized 50,000 Bitcoin (more than $2.1 billion at the current exchange rate) from the former operator of the now-defunct piracy site movie2k.

“This is the most extensive security of Bitcoins by law enforcement authorities in the Federal Republic of Germany to date.” reads the press release published by the German police.

The man voluntarily transferred the crypto funds to wallets under the control of the German authorities.

The seizure is the result of an investigation conducted by the Dresden General Prosecutor’s Office, the Saxony State Criminal Police Office and the tax investigation of the Leipzig II Tax Office as the Saxony Integrated Investigation Unit (INES).

The investigation was also supported by the Federal Criminal Police Office (BKA), the FBI and a Munich forensic IT expert company.

According to German media, one of the two operators was also involved in the operations of the site mega-downloads.net. 

Movie2k was a platform involved in the unauthorized distribution of copyrighted movies, TV shows, and other media content. It was operating between 2008 and 2013. In 2013, the Motion Picture Association of America (MPAA) shut down the website due to concerns related to copyright infringement.

Widely favored among pirates, Movie2k provided an extensive array of content along with user-friendly streaming and download features. Additionally, the website fostered a substantial community of users who actively shared links to pirated content.”

The investigation conducted by the German authorities led to the identification of two operators of the popular platform, a 40-year-old German national and a Polish 37-year-old.

The duo purchased a substantial amount of Bitcoin with the proceeds obtained from subscriptions and advertising through the platform.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – cybercrime, Apple)

Mandiant spotted new malware used by a China-linked threat actor UNC5221 targeting Ivanti Connect Secure VPN and Policy Secure devices.

Mandiant researchers discovered new malware employed by a China-linked APT group known as UNC5221 and other threat groups targeting Ivanti Connect Secure VPN and Policy Secure devices.

The attackers were observed exploiting CVE-2023-46805 and CVE-2024-21887 to execute arbitrary commands on the unpatched Ivanti devices.

The cybersecurity firm reported that threat actors are employing the malware in post-exploitation activity, likely performed through automated methods.

Mandiant recently observed a mitigation bypass technique used to deploy a custom web shell tracked as BUSHWALK. Successful exploitation would bypass the initial mitigation provided by Ivanti on Jan. 10, 2024.

Mandiant speculates that mitigation bypass activity is highly targeted, restricted, and differs from the mass exploitation activity observed after the disclosure of the Ivanti flaws.

Other malware employed in the attack is a new variant of the LIGHTWIRE web shell, the Python web shell backdoor CHAINLINE and FRAMESTING web shell.

Mandiant also completed the analysis of another malware family employed in the attacks, the ZIPLINE passive backdoor. The backdoor allows operators to support the authentication of its custom protocol used to establish C2.

Mandiant also reported that threat actors employed several open-source tools to facilitate post-exploitation activities on Ivanti CS appliances. The tools were used to perform internal network reconnaissance, lateral movement, and data exfiltration within a restricted number of victim environments.

Some of the open-source utilities used by the threat actors, include Impacket, CrackMapExec, iodine, and Enum4linux.

“Additionally, Linux-based tools identified in incident response investigations use code from multiple Chinese-language Github repositories. As noted in our previous blog post, UNC5221 has largely leveraged TTPs associated with zero-day exploitation of edge infrastructure by suspected PRC nexus actors.” concludes Mandiant.

Ivanti also warned of two new high-severity vulnerabilities in its Connect Secure and Policy Secure solutions respectively tracked as CVE-2024-21888 (CVSS score: 8.8) and CVE-2024-21893 (CVSS score: 8.2). The software company also warned that one of these two vulnerabilities is under active exploitation in the wild.

The vulnerability CVE-2024-21888 is a privilege escalation issue that resides in the web component of Ivanti Connect Secure (9.x, 22.x) and Policy Secure (9.x, 22.x). An attacker can exploit the vulnerability to gain admin privileges.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ivanti)

CISA is ordering federal agencies to disconnect Ivanti Connect Secure and Ivanti Policy Secure products within 48 hours.

For the first time since its establishment, CISA is ordering federal agencies to disconnect all instances of Ivanti Connect Secure and Ivanti Policy Secure products within 48 hours.

The CISA’s emergency directive orders to disconnect all instances no later than 11:59PM on Friday February 2, 2024.

“As soon as possible and no later than 11:59PM on Friday February 2, 2024, disconnect all instances of Ivanti Connect Secure and Ivanti Policy Secure solution products from agency networks.” reads the directive.

The government agency recommends continuing to look for indicators of compromise on any systems connected to—or recently connected to—the affected Ivanti device.

The government experts also ordered to monitor the authentication or identity management services that could be exposed and urged to isolate the systems from any enterprise resources to the greatest degree possible. CISA also warned to continue to audit privilege-level access accounts.

“To bring a product back into service, agencies are required to perform the following actions:

1. Export configuration settings.
2. Complete a factory reset per Ivanti’s instructions.
3. Rebuild the device per Ivanti’s instructions AND upgrade to one of the following supported software versions through Ivanti’s download portal (there is no cost to upgrade): 9.1R18.3, 22.4R2.2, 22.5R1.1, 9.1R14.4, 9.1R17.2.”

IVANTI recently warned of four zero-days, three of which are actively exploited in the wild.

In early January, the software firm reported that threat actors are exploiting two zero-day vulnerabilities (CVE-2023-46805, CVE-2024-21887) in Connect Secure (ICS) and Policy Secure to remotely execute arbitrary commands on targeted gateways.

The flaw CVE-2023-46805 (CVSS score 8.2) is an Authentication Bypass issue that resides in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure. A remote attacker can trigger the vulnerability to access restricted resources by bypassing control checks.

The second flaw, tracked as CVE-2024-21887 (CVSS score 9.1) is a command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure. An authenticated administrator can exploit the issue by sending specially crafted requests and execute arbitrary commands on the appliance.

An attacker can chain the two flaws to send specially crafted requests to unpatched systems and execute arbitrary commands. 

“If CVE-2024-21887 is used in conjunction with CVE-2023-46805, exploitation does not require authentication and enables a threat actor to craft malicious requests and execute arbitrary commands on the system.” reads the advisory published by Ivanti.

This week Ivanti warned of two new high-severity vulnerabilities in its Connect Secure and Policy Secure solutions respectively tracked as CVE-2024-21888 (CVSS score: 8.8) and CVE-2024-21893 (CVSS score: 8.2). The software company also warned that one of these two vulnerabilities is under active exploitation in the wild.

The vulnerability CVE-2024-21888 is a privilege escalation issue that resides in the web component of Ivanti Connect Secure (9.x, 22.x) and Policy Secure (9.x, 22.x). An attacker can exploit the vulnerability to gain admin privileges.

The second flaw CVE-2024-21893 is a server-side request forgery vulnerability in the SAML component of Connect Secure (9.x, 22.x), Policy Secure (9.x, 22.x) and Neurons for ZTA. An authenticated attacker can exploit the issue to access certain restricted resources.

The company also warns that the situation is still evolving and multiple threat actors can rapidly adapat their tactics, techniques, and procedures to exploit these issues in their campaigns.

“At the time of publication, the exploitation of CVE-2024-21893 appears to be targeted. Ivanti expects the threat actor to change their behavior and we expect a sharp increase in exploitation once this information is public – similar to what we observed on 11 January following the 10 January disclosure.” reads the advisory.

“Be aware that the situation is still evolving. Ivanti will update this knowledge base article as more information becomes available.”

The software firm recommends importing the “mitigation.release.20240126.5.xml” file via the download portal as temporary workarounds to address CVE-2024-21888 and CVE-2024-21893.

Mandiant researchers recently discovered new malware employed by a China-linked APT group known as UNC5221 and other threat groups targeting Ivanti Connect Secure VPN and Policy Secure devices.

The cybersecurity firm reported that threat actors are employing the malware in post-exploitation activity, likely performed through automated methods.

Mandiant recently observed a mitigation bypass technique used to deploy a custom web shell tracked as BUSHWALK. Successful exploitation would bypass the initial mitigation provided by Ivanti on Jan. 10, 2024.

Mandiant speculates that mitigation bypass activity is highly targeted, restricted, and differs from the mass exploitation activity observed after the disclosure of the Ivanti flaws.

Other malware employed in the attack is a new variant of the LIGHTWIRE web shell, the Python web shell backdoor CHAINLINE and FRAMESTING web shell.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, IVANTI)

A US man has been sentenced to federal prison for his role in a fraudulent scheme that resulted in the theft of millions of dollars through SIM swapping.

Daniel James Junk (22) of Portland was sentenced to 72 months in federal prison for his role in a scheme that resulted in the theft of millions of dollars of cryptocurrency using a SIM swapping.

The man conducted SIM swapping attacks to take control of victims’ phone numbers tricking the mobile operator employees into porting them to SIMs under the control of the fraudster. Once hijacked a SIM, the attacker can steal money, cryptocurrencies and personal information, including contacts synced with online accounts. The criminals could hijack social media accounts and bypass 2FA services based on SMS used by online services, including financial ones.

Junk was also sentenced to three years’ supervised release and was also ordered to pay more than $3 million in restitution to his victims.

Based on court documents, between December 2019 and March 2022, Junk participated in a fraud scheme to steal funds from the cryptocurrency exchange accounts of his victims.

“Junk actively participated in an online SIM-swapping community where various individuals would partner with one another to play different roles needed to successfully execute a SIM swap scam.” reads the press release published by DoJ. “Throughout his involvement in such schemes, Junk performed some aspects of all the required roles including finding victims to target through breached databases or other exploits, porting victim phone numbers to devices controlled by members of the fraud conspiracy, and physically possessing the phone used for the “swap.” Junk and members of his online community also coordinated with one another to plan and carry out various in-person crimes including attempting to steal a 90-year-old victim’s cell phone and committing fraud at cellular telephone stores.”

On March 3, 2022, the FBI executed a federal search warrant on Junk’s apartment and seized his electronic equipment. The seized computer had an active browser showing that Junk was attempting to illegally access accounts belonging to other people when the FBI arrived at his residence. The FBI seized more than 71 bitcoins worth approximately $3 million. Two months later, Junk turned over an extra 33 bitcoins, valued at around $1 million.

In early January 2024, while awaiting sentencing, Junk was found to possess additional evidence of fraud. The FBI found lists of victims and approximately 25,000 compromised email addresses. “On January 10, 2024, Junk’s release was revoked, and he was ordered into custody pending sentencing.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SIM SWAPPING)

The Computer Emergency Response Team in Ukraine (CERT-UA) reported that a PurpleFox malware campaign had already infected at least 2,000 computers in the country.

The Computer Emergency Response Team in Ukraine (CERT-UA) is warning about a malware campaign that has infected at least 2,000 computers in the country with the PurpleFox malware (aka ‘DirtyMoe‘).

“The Government Computer Emergency Response Team of Ukraine CERT-UA, guided by Clause 1 of Article 9 of the Law of Ukraine “On the Basic Principles of Ensuring Cyber ​​Security of Ukraine”, took measures to provide practical assistance to a state-owned enterprise due to the massive damage to the organization’s computers by the malicious program DIRTYMOE (PURPLEFOX).” reads the alert published by CERT-UA. “As part of a detailed study of the cyber threat, a study of the received samples of malicious programs was conducted, the peculiarities of the functioning of the management server infrastructure were established, and more than 2,000 affected computers were identified in the Ukrainian segment of the Internet.”

In June 2021, researchers from Avast warned of the rapid growth of the DirtyMoe botnet (PurpleFox, Perkiler, and NuggetPhantom), which passed from 10,000 infected systems in 2020 to more than 100,000 in the first half of 2021. Experts defined DirtyMoe as a complex malware that has been designed as a modular system.

The Windows botnet has been active since late 2017, it was mainly used to mine cryptocurrency, but it was also involved in DDoS attacks in 2018. The DirtyMoe rootkit was delivered via malspam campaigns or served by malicious sites hosting the PurpleFox exploit kit that triggers vulnerabilities in Internet Explorer, such as the CVE-2020-0674 scripting engine memory corruption vulnerability.

The operations behind the DirtyMoe botnet rapidly changed since the end of 2020, when the malware authors added a worm module that could increase their activity by spreading via the internet to other Windows systems.

CERT-UA shared technical details about the ongoing campaign, tracked as UAC-0027, due to the complexity of removing the DIRTYMOE components due to the use of the rootkit.

In the attacks observed by the Ukrainian authorities, the infection chain relies on MSI installers to deploy the PurpleFox malware.

The malware uses exploits for known vulnerabilities and password brute-forcing attacks for self-propagation.

Between January 20 and January 31, 2024, CERT-UA identified 486 IP addresses associated with intermediate control servers. The majority of these addresses are linked to (compromised) equipment located in China. Approximately 20 new IP addresses are added daily.

The alert includes indicators of compromise and guidance to remove the malware from the infected systems.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PurpleFox malware)

Cloudflare revealed that a nation-state actor breached its internal Atlassian server, gaining access to the internal wiki and its bug database (Atlassian Jira).

The incident took place on Thanksgiving Day, November 23, 2023, and Cloudflare immediately began an investigation with the help of CrowdStrike. The company pointed out that no customer data or systems were impacted by this security breach. 

Cloudflare disclosed today that its internal Atlassian server was breached by a suspected ‘nation-state attacker’ who accessed its Confluence wiki, Jira bug database, and Bitbucket source code management system.

The nation-state actor first gained access to the company’s Atlassian server on November 14 and then accessed the Confluence and Jira systems.

“From November 14 to 17, a threat actor did reconnaissance and then accessed our internal wiki (which uses Atlassian Confluence) and our bug database (Atlassian Jira). On November 20 and 21, we saw additional access indicating they may have come back to test access to ensure they had connectivity.” reads the blog post published by the company. “They then returned on November 22 and established persistent access to our Atlassian server using ScriptRunner for Jira, gained access to our source code management system (which uses Atlassian Bitbucket), and tried, unsuccessfully, to access a console server that had access to the data center that Cloudflare had not yet put into production in São Paulo, Brazil.”

The threat actor also attempted to gain access to a console server in a new company’s data center in São Paulo, but all attempts failed.

The investigation revealed that the attackers used one access token and three service account credentials that were obtained in Okta compromise of October 2023. Cloudflare admitted having failed to rotate these authentication elements.

The company locked out the threat actor on November 24 and CrowdStrike confirmed that the threat was completely eradicated.

To prevent the attacker from using the obtained technical information, Cloudflare rotated every production credential (more than 5,000 individual credentials), physically segmented test and staging systems, performed forensic triages on 4,893 systems, reimaged and rebooted every machine in its global network including all the systems that were accessed by the intruders.

“This was a security incident involving a sophisticated actor, likely a nation-state, who operated in a thoughtful and methodical manner. The efforts we have taken ensure that the ongoing impact of the incident was limited and that we are well-prepared to fend off any sophisticated attacks in the future.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Okta)

A former software engineer with the U.S. CIA has been sentenced to 40 years in prison for leaking classified documents.

Former CIA employee Joshua Adam Schulte has been sentenced to 40 years in prison for passing classified documents to WikiLeaks and for possessing child pornographic material.

“Damian Williams, the United States Attorney for the Southern District of New York; Matthew G. Olsen, the Assistant Attorney General for National Security; and James Smith, the Assistant Director in Charge of the New York Field Office of the Federal Bureau of Investigation (“FBI”), announced today that JOSHUA ADAM SCHULTE was sentenced to 40 years in prison by U.S. District Judge Jesse M. Furman for crimes of espionage, computer hacking, contempt of Court, making false statements to the FBI, and child pornography.” reads the press release published by DoJ. “SCHULTE’s theft is the largest data breach in the history of the CIA, and his transmission of that stolen information to WikiLeaks is one of the largest unauthorized disclosures of classified information in the history of the U.S.”

In July 2022, Schulte was found guilty in a New York federal court of stealing the agency’s hacking tools and leaking them to WikiLeaks in 2017.

The huge trove of data, called “Vault 7,” exposed the hacking capabilities of the US Intelligence Agency and its internal infrastructure. The archive includes confidential information, malicious codes, and exploits specifically designed to target popular products from various IT companies, including Samsung, Apple, Google, and Microsoft.

The hacking tools developed by the US cyber spies can target mobile devices, desktop computers, and IoT devices such as routers and smart TVs.

The arsenal used by the Central Intelligence Agency hackers was composed of hacking tools developed by the CCI’s Engineering Development Group (EDG).

The developers at EDG are tasked for developing and testing any kind of malicious code, including implants, backdoors, exploits, Trojans and viruses. The CIA has dozens of zero-day exploit codes in its arsenal that can be used to target almost any platform, from Windows and Linux PC, to Android and iOS mobile devices.

In middle May 2018, both The New York Times and The Washington Post, revealed the name of the alleged source of the Vault 7 leak, the man who passed the secret documents to Wikileaks. According to his LinkedIn profile, Schulte worked for the NSA for five months in 2010 as a systems engineer, after this experience, he joined the CIA as a software engineer and he left the CIA in November 2016.

Schulte was identified a few days after WikiLeaks started leaking the precious dumps.

Schulte was arrested for possession of child pornography, he was charged with three counts of receipt, possession and transportation of child pornography in August 2017.

The man was released in September 2017, but in December he was arrested again for violating the conditions of his release.

In November 2018, Joshua Adam Schulte faced new charges, including in a new indictment filed in Manhattan federal court, he was charged with the unlawful transmission and attempted unlawful transmission of national defense secrets from prison.

In February 2018, the lawyers of the former CIA employee asked the court for a mistrial, in this case, they claimed the prosecutors withheld evidence that could exonerate his client during the trial in the Manhattan federal court.

While SCHULTE was in jail, he obtained access to contraband cell phones and used them to create anonymous, encrypted email and social media accounts.  SCHULTE also attempted these devices to transmit protected discovery materials to WikiLeaks.

In March 2017, during a search of SCHULTE’s apartment in New York the FBI found multiple computers, servers, and other electronic storage devices, including SCHULTE’s personal desktop computer (the “Desktop Computer”), which SCHULTE built while living in Virginia and then transported to New York in November 2016. The personal desktop computer was containing tens of thousands of videos and images of child sexual abuse materials, including approximately 3,400 images and videos of disturbing and horrific child pornography and the rape and sexual abuse of children as young as two years old, as well as images of bestiality and sadomasochism. The man stockpiled these disturbing materials while he was serving the CIA and continued to collect child pornography from the dark web and Russian websites after moving to New York.

On September 13, 2023, SCHULTE was also found guilty at trial on charges of receiving, possessing, and transporting child pornography.

“Today, Joshua Schulte was rightly punished not only for his betrayal of our country, but for his substantial possession of horrific child pornographic material.  The severity of his actions is evident, and the sentence imposed reflects the magnitude of the disturbing and harmful threat posed by his criminal conduct.” FBI Assistant Director in Charge James Smith said: “The FBI will not yield in our efforts to bring to justice anyone who endangers innocent children or threatens our national security.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Joshua Adam Schulte)

An international law enforcement operation, named Synergia, led to the arrest of 31 individuals involved in ransomware, banking malware, and phishing attacks.

Operation Synergia was led by Interpol and ran from September to November 2023 involving law enforcement agencies from 50 countries.

The international law enforcement operation was launched to curb the escalation and professionalisation of transnational cybercrime.

Authorities detained 31 individuals, 26 of whom were in Europe, and identified an additional 70 suspects. Four people were arrested in South Sudan and Zimbabwe.

The law enforcement agencies identified more than 1,300 suspicious IP addresses associated with C2 servers, 70% of which have been taken down. Most of the C2 servers taken down were in Europe, while other servers were taken down in Hong Kong (153) and Singapore (86).

“Operation Synergia demonstrated how cybersecurity is most effective when international law enforcement, national authorities, and private sector partners cooperate to share best practices and pro-actively combat cybercrime. INTERPOL and its Gateway Partners Group-IB, Kaspersky, TrendMicro, Shadowserver and Ad hoc partner Team Cymru provided analysis and intelligence support throughout the operation.” reads the press release published by Interpol.

The police carried out house searches and seized multiple servers, along with electronic devices.

“The results of this operation, achieved through the collective efforts of multiple countries and partners, show our unwavering commitment to safeguarding the digital space. By dismantling the infrastructure behind phishing, banking malware, and ransomware attacks, we are one step closer to protecting our digital ecosystems and a safer, more secure online experience for all.” said Bernardo Pillot, Assistant Director to INTERPOL Cybercrime Directorate.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Operation Synergia)

Albania’s Institute of Statistics (INSTAT) announced that it was targeted by a sophisticated cyberattack that affected some of its systems.

A sophisticated cyberattack on Wednesday hit Albania’s Institute of Statistics (INSTAT). The institute confirmed that the attack affected some of its systems.

Albania’s Institute of Statistics (INSTAT) promptly activated emergency protocols to respond to the incident. The organization launched an investigation into the cyberattack and determined that only “some of INSTAT systems were affected.” The attack did not impact systems employed in the 2013 census.

“INSTAT assures the public that the 2023 Census data are not the subject of this attack. INSTAT’s technical team immediately activated emergency protocols to protect the data and prevent further damage.
INSTAT will continue its statistical activity and will use alternative means of communication such as the email address [email protected] and the official social media channels, Instagram and Facebook.” reads the statement published by INSTAT on Facebook.

NSTAT notified local authorities and is working to resume normal operations.

Albania’s cyber agency (AKCESK), along with state police, is helping INSTAT recover the affected systems and attribute the attack to a specific threat actor.

The Record Media reported that the Iran-linked hacking group Homeland Justice claimed responsibility for the attack. The hackers added that they have stolen over a 100 Terabytes of GIS and census data from the INSTAT.

“We now have full access to over a 100 Terabytes of your GIS and census data. The data have also been copied and removed from the servers. We will bring Justice back to our Homeland
All the statistics are against you
DestroyDurresMilitaryCamp (#DDMC)” states the message published by the group on its Telegram channel.

Despite claims, it's yet to be verified if any data was compromised. While INSTAT insists recent census data was unaffected, Homeland Justice claims they copied over 100 terabytes of geographic and population data. Albania's cyber agency AKCESK is now collaborating with state…

— The Record From Recorded Future News (@TheRecord_Media) February 2, 2024

In December 2023, Albania’s National Authority for Electronic Certification and Cyber Security (AKCESK) revealed that cyber attacks hit the Assembly of the Republic of Albania and telecom company One Albania.

The telecom carrier disclosed the cyber attack with a post published on Facebook, the company also added that the cyber attack did not interrupt its services.

The Iranian hacker group Homeland Justice also claimed responsibility for this attack on its Telegram channel. The group also claimed to have hacked Air Albania.

In September 2022, Albania blamed Iran for another cyberattack that hit computer systems used by the state police.

Albania interrupted diplomatic ties with Iran and expelled the country’s embassy staff over the massive cyber attack that hit the country in mid-July 2022.

The cyberattack hit the servers of the National Agency for Information Society (AKSHI), which handles many government services. Most of the desk services for the population were interrupted, and only several important services, such as online tax filing, were working because they are provided by servers not targeted in the attack. Albania reported the attack to the NATO Member States and other allies.

The relations between Albania and Iran have deteriorated since the government of Tirana offered asylum to thousands of Iranian dissidents.

The United States government issued a statement condemning Iran for attacking Albania.

“The United States strongly condemns Iran’s cyberattack against our NATO Ally, Albania. We join in Prime Minister Rama’s call for Iran to be held accountable for this unprecedented cyber incident. The United States will take further action to hold Iran accountable for actions that threaten the security of a U.S. ally and set a troubling precedent for cyberspace.” U.S. National Security Council spokesperson Adrienne Watson said. “We have concluded that the Government of Iran conducted this reckless and irresponsible cyberattack and that it is responsible for subsequent hack and leak operations.”

NATO, and the U.K. also formally blamed the Iranian government for the cyberattacks against Albania.

The U.S. Treasury Department announced sanctions against Iran ‘s Ministry of Intelligence and Security (MOIS) and its Minister of Intelligence over the cyber attack that hit Albania in July.

MOIS is the primary intelligence agency of the Islamic Republic of Iran and a member of the Iran Intelligence Community. It is also known as VAJA and previously as VEVAK (Vezarat-e Ettela’at va Amniyat-e Keshvar) or alternatively MOIS.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Albania)

A vulnerability impacting the decentralized social network Mastodon can be exploited by threat actors to impersonate and take over any account.

A security flaw, tracked as CVE-2024-23832 (CVSS score 9.4), in the decentralized social network Mastodon can be exploited to impersonate and take over any account.

The issue is caused by insufficient origin validation in all Mastodon.

“Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account.” reads the advisory.

The issue impacts Mastodon version prior to 3.5.17, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.

The vulnerability was discovered by security researcher arcanicanis.

Mastodon plans to release technical details about the vulnerability after February 15, 2024, to give admins ample time to update their server instances.

Maintainers of the project fear that threat actors can start massive exploitation of the issue in the wild.

“This advisory will be edited with more details on 2024/02/15, when admins have been given some time to update, as we think any amount of detail would make it very easy to come up with an exploit.” continues the advisory.

In July 2023, Mastodon addressed a critical flaw, tracked as CVE-2023-36460, in the media attachments feature, that allowed attackers to create and overwrite files in any accessible location within an instance.

This vulnerability could potentially lead to Denial of Service (DoS) and arbitrary remote code execution.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, social network)

Cleaning products giant Clorox estimates the economic impact of the cyber attack that hit the company in August 2023 at $49 million.

The Clorox Company is a multinational consumer goods company that specializes in the production and marketing of various household and professional cleaning, health, and personal care products.

The cleaning product giant announced in mid-August it was the victim of a cybersecurity incident that forced it to take some systems offline.

At this time, Clorox has yet to share technical details of the cyberattack. The described impacts suggest that the company was likely a ransomware attack.

According to a filing with SEC, Clorox estimates the economic impact of the cyber attack that hit the company in August 2023 at $49 million.

The costs include losses caused by disruptions, as well as expenses for third-party forensics and consultants assisting the company in investigating and remediating the attack.

The company also expects a negative on the fiscal year 2024 results.

“The effects of the cyberattack are expected to negatively impact fiscal year 2024 results, though some of the anticipated net sales not recognized in the first quarter as a result of the disruptions were recognized in the second quarter, and some are expected to be recognized in subsequent quarters of fiscal year 2024 as customers rebuild inventories.” reads the SEC filing. “The Company also incurred incremental expenses of approximately $25 and $49 as a result of the cyberattack for the three and six months ended December 31, 2023, respectively. These costs relate to third-party consulting services, including IT recovery and forensic experts and other professional services incurred to investigate and remediate the attack, as well as incremental operating costs incurred from the resulting disruption to the Company’s business operations. The Company expects to incur lessening costs related to the cyberattack in future periods.”

The company added that it did not record any insurance proceeds in the three and six months ending on December 31, 2023, associated with the cyberattack. The recognition of insurance recoveries, if applicable, may not align with the timing of recognizing the associated expenses.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Clorox)

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

Clorox estimates the costs of the August cyberattack will exceed $49 Million

Mastodon fixed a flaw that can allow the takeover of any account

Iranian hackers breached Albania’s Institute of Statistics (INSTAT)

Operation Synergia led to the arrest of 31 individuals

Ex CIA employee Joshua Adam Schulte sentenced to 40 years in prison

Cloudflare breached on Thanksgiving Day, but the attack was promptly contained

PurpleFox malware infected at least 2,000 computers in Ukraine

Multiple malware used in attacks exploiting Ivanti VPN flaws

Police seized 50,000 Bitcoin from operator of the now-defunct piracy site movie2k

Crooks stole around $112 million worth of XRP from Ripple’s co-founder

CISA adds Apple improper authentication bug to its Known Exploited Vulnerabilities catalog

Ivanti warns of a new actively exploited zero-day

Threat actors exploit Ivanti VPN bugs to deploy KrustyLoader Malware

Data leak at fintech giant Direct Trading Technologies

Root access vulnerability in GNU Library C (glibc) impacts many Linux distros

Italian data protection authority said that ChatGPT violated EU privacy laws

Juniper Networks released out-of-band updates to fix high-severity flaws

Hundreds of network operators’ credentials found circulating in Dark Web

Cactus ransomware gang claims the Schneider Electric hack

Mercedes-Benz accidentally exposed sensitive data, including source code

Experts detailed Microsoft Outlook flaw that can leak NTLM v2 hashed passwords

NSA buys internet browsing records from data brokers without a warrant

Ukraine’s SBU arrested a member of Pro-Russia hackers group ‘Cyber Army of Russia’

Multiple PoC exploits released for Jenkins flaw CVE-2024-23897

Medusa ransomware attack hit Kansas City Area Transportation Authority

Cybercrime

Who is Alleged Medibank Hacker Aleksandr Ermakov?

Ransomware Revenue Down As More Victims Refuse to Pay  

Energy giant Schneider Electric hit by Cactus ransomware attack

Hundreds Of Network Operators’ Credentials Found Circulating In Dark Web  

Fla. Man Charged in SIM-Swapping Spree is Key Suspect in Hacker Groups Oktapus, Scattered Spider

Data of 750 Million Indian Mobile Subscribers Sold on Hacker Forums     

Hackers steal $112 million of XRP Ripple cryptocurrency  

movie2k.to: Ex-operator hands over BTC worth 2 billion euros 

Portland Man Sentenced to Federal Prison for Role in SIM Swapping Identity Theft and Fraud Scheme  

INTERPOL-led operation targets growing cyber threats  

Malware

New Ransomware Reporting Requirements Kick in as Victims Increasingly Avoid Paying  

KRUSTYLOADER – RUST MALWARE LINKED TO COMPROMISED IVANTI CONNECTSECURE  

Evolution of UNC4990: Uncovering USB Malware’s Hidden Depths  

China’s Hackers Have Entire Nation in Their Crosshairs, FBI Director Warns  

Outsmarting Ransomware’s New Playbook

UAC-0027: DIRTYMOE (PURPLEFOX) affected more than 2000 computers in Ukraine  

Hacking

Outlook Vulnerability Discovery and New Ways to Leak NTLM Hashes 

Thanksgiving 2023 security incident

Exclusive: US disabled Chinese hacking network targeting critical infrastructure   

Iran-linked hackers claim attack on Albania’s Institute of Statistics     

Intelligence and Information Warfare 

Ukraine’s security service detains member of Russian ‘Cyber Army’  

Wyden Releases Documents Confirming the NSA Buys Americans’ Internet Browsing Records

The Bear and The Shell: New Campaign Against Russian Opposition   

Spying From Space 

Wikileaks source and former CIA worker Joshua Schulte sentenced to 40 years jail

Former Cia Officer Joshua Adam Schulte Sentenced To 40 Years In Prison For Espionage And Child Pornography Crimes  

Cybersecurity

How a mistakenly published password exposed Mercedes-Benz source code

Zero-day, supply-chain attacks drove data breach high for 2023      

ChatGPT violated European privacy laws, Italy tells chatbot maker OpenAI

ENISA Single Programming Document 2024 – 2026

Qualys TRU Discovers Important Vulnerabilities in GNU C Library’s syslog()   

Supplemental Direction V1: ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities         

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Resecurity identified bad actors offering a significant number of AnyDesk customer credentials for sale on the Dark Web.

Such information being available for cybercriminals could act as a catalyst for new attacks, including targeted phishing campaigns. Having additional context about a particular customer, the probability of a successful compromise could increase significantly. For example, one possible scenario could involve these details being used in malicious emails sent on behalf of the software vendor, managed services providers (MSPs), or IT outsourcing companies with the goal of acquiring sensitive information – in such case, downstream damage may be significant. The sources and methods for acquiring data of this nature may vary depending on threat actors’ unique Tactics, Techniques, and Procedures (TTPs). While this credential leak is widely believed to be the result of infostealer infections, this uncertainty nevertheless creates a new area of concern. Assuming the prevailing infostealer hypothesis is correct and considering the latest incident disclosure, timely password resets would be a mandatory mitigation measure for all AnyDesk customers. The end-users of AnyDesk include IT administrators, who are often targeted by threat actors. Thus, it is critical that AnyDesk ensures this cyberattack hasn’t impacted access to any other critical systems to which their IT admins may have privileged access.. By gaining access to the AnyDesk portal, bad actors could learn meaningful details about the customers – including but not limited to the used license key, number of active connections, duration of sessions, customer ID and contact information, email associated with the account, and the total number of hosts with remote access management software activated, along with their online or offline status and IDs.

 It is possible that cybercriminals familiar with the incident are hurrying to monetize available customer credentials via the Dark Web acquired from different sources, understanding that AnyDesk may take proactive measures to reset their credentials. Such data could be extremely valuable for both initial access brokers and ransomware groups familiar with AnyDesk, often abused as one of the tools following successful network intrusions. Notably, per additional context acquired from the actor, the majority of exposed accounts on the Dark Web didn’t have 2FA enabled.

Notably, the timestamps visible on the shared screenshots by the actor illustrate successful unauthorized access with sessions dated Feb 3, 2024 (post-incident disclosure). Some users may not have changed their password, or this process might still be ongoing. Handling remediation, especially for a large customer base, is complex and may not be instantly executed.

Per a public statement from AnyDesk on February 2, 2024, “as a precaution, we (AnyDesk) are revoking all passwords to our web portal, my.anydesk.com, and we recommend that users change their passwords if the same credentials are used elsewhere.” However, there seems to be an issue with it. Other cybersecurity experts, such as Alon Gal, Co-Founder & CTO of Hudson Rock, have also noticed the issue and alerted the broader community. According to Gal, over 30,000 user credentials could be circulating on the Dark Web due to infostealer activity. Proper mechanisms should be considered to mitigate the risk of customer compromise, regardless of the past incident announcement.

Dark Web actors have expressed a strong interest in AnyDesk customer credentials. The opportunity to acquire them in bulk will be extremely attractive for actors involved in spam, online banking theft, scam, business email compromise (BEC), and account takeover (ATO) activities. The spectrum of cyber risks associated with this new development transforms proportionally, ranging from the use of this information in further fraudulent and scam campaigns to targeted phishing and malicious cyber activity.

Resecurity informed AnyDesk and notified multiple consumers and enterprises whose credentials have been exposed on the Dark Web.

Notably, the activity with AnyDesk comes right after Cloudflare announced it was targeted, along with Microsoft and Hewlett Packard Enterprise disclosing cybersecurity incidents conducted by a suspected nation-state attacker.

Additional details are available in the analysis published by cybersecurity firm Resecurity:

https://www.resecurity.com/blog/article/following-the-anydesk-incident-customer-credentials-leaked-and-published-for-sale-on-the-dark-web

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, AnyDesk)

A cyber attack forced Lurie Children’s Hospital in Chicago to take IT systems offline with a severe impact on its operations.

The Lurie Children’s Hospital in Chicago took IT systems offline after a cyberattack. The security incident severely impacted normal operations also causing the delay of medical care.

Lurie Children’s Hospital is one of the top pediatric hospitals in the United States. Formerly known as Children’s Memorial Hospital, it was renamed in recognition of Ann and Robert H. Lurie, who made a significant donation to the hospital.

Lurie Children’s Hospital offers a wide range of specialized medical services, including pediatric surgery, oncology, cardiology, neurology, and neonatology.

In addition to its clinical services, Lurie Children’s Hospital is actively involved in pediatric research, striving to advance medical knowledge and develop innovative treatments for childhood diseases and disorders.

Lurie Children’s is a Chicago-based pediatric acute care hospital with 360 beds, it is located on the university’s Streeterville campus with more than 1,665 physicians on its medical staff and 4,000 employees.

The hospital announced this week that it promptly started the incident response procedure. The healthcare organization notified law enforcement agencies and is working with leading experts to investigate the incident.

pic.twitter.com/4Smx7S3POj

— Lurie Children's (@LurieChildrens) February 2, 2024

“Lurie Children’s is actively responding to a cybersecurity matter. We are taking this very seriously, are investigating with the support of leading experts, and are working in collaboration with law enforcement agencies. As part of our response to this matter, we have taken network systems offline.” states a first update provided by the hospital. “We recognize the concern and inconvenience the systems outage may cause our patient families and community providers, and are working diligently to resolve this matter as quickly and effectively as possible.”

Lurie confirmed that the attack disrupted the hospital’s access to the internet, email, phone services, and the MyChat platform.

“The incident has impacted phones, emails, internet service, some elective surgeries and procedures even had to be canceled.” reported the website Abc7chicago.

pic.twitter.com/fVdZ9cOcO2

— Lurie Children's (@LurieChildrens) February 3, 2024

A dedicated helpline has been set up to address various requirements, such as handling non-urgent patient inquiries, addressing care-related questions, providing details about scheduled patient appointments, and processing requests for prescription refills.

At this time, no ransomware group has claimed responsibility for the cyber attack on Lurie Children’s Hospital.

Cyber attacks against hospitals are very dangerous, and despite major ransomware gangs imposing restrictions on their affiliates to avoid targeting them, many incidents have recently made headlines.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Lurie Hospital)

The US government issued sanctions against six Iranian government officials linked to cyberattacks against critical infrastructure organizations. 

The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has imposed sanctions on six Iranian government officials associated with cyberattacks targeting critical infrastructure organizations in the US and abroad.

“Today, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned six officials in the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC), an Iranian government organization responsible for a series of malicious cyber activities against critical infrastructure in the United States and other countries.” reads the announcement published by the US OFAC.

The six members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) are Hamid Reza Lashgarian, Mahdi Lashgarian, Hamid Homayunfal, Milad Mansuri, Mohammad Bagher Shirinkar, and Reza Mohammad Amin Saberian.

Reza Lashgarian is also the head of the IRGC-CEC. The Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) is an organization within the Iranian government responsible for cybersecurity and cyber warfare. It is considered a major threat by many countries, including the United States, due to its involvement in various malicious cyber activities.

The announcement states that these individuals were involved in cyber operations against critical infrastructure, they hacked and posted images on the screens of programmable logic controllers manufactured by the Israeli firm Unitronics. 

The OFAC states that ICS and SCADA systems used in critical infrastructure environments, are sensitive targets. 

“The deliberate targeting of critical infrastructure by Iranian cyber actors is an unconscionable and dangerous act,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson.  “The United States will not tolerate such actions and will use the full range of our tools and authorities to hold the perpetrators to account.”

While this specific operation did not lead to the disruption of critical services, their effects can jeopardize public welfare and result in severe humanitarian consequences.

Iran-linked threat actors are known for their cyber activities against U.S. critical infrastructure, including ransomware attacks. They also targeted entities in European countries and Israel.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Iran)

Remote desktop software company AnyDesk announced that threat actors compromised its production environment.

Remote desktop software company AnyDesk announced on Friday that threat actors had access to its production systems.

The security breach was discovered as a result of a security audit, the company immediately notified relevant authorities. AnyDesk did not reveal if it has suffered a data breach.

AnyDesk is a remote desktop software that allows users to connect to a computer or device remotely. It enables users to access and control a computer from another location as if they were sitting in front of it. AnyDesk is commonly used for remote technical support, online collaboration, and accessing files or applications on a remote computer.

The company started a remediation and response plan with the help of cyber security firm CrowdStrike. AnyDesk pointed out that this security breach is not related to ransomware.

“Following indications of an incident on some of our systems, we conducted a security audit and found evidence of compromised production systems. We immediately activated a remediation and response plan involving cyber security experts CrowdStrike. The remediation plan has concluded successfully. The relevant authorities have been notified and we are working closely with them. This incident is not related to ransomware.” reads the incident response notice published by the company.

In response to the security breach, the company revoked all security-related certificates and systems have been remediated or replaced where necessary.

The company is going to revoke the existing code signing certificate used to sign its binaries.

AnyDesk remarked that its systems don’t store private keys, security tokens or passwords that could be exploited by threat actors to target end-user devices. As a precaution, the company also revoked all passwords to the web portal my.anydesk.com, and recommended that users change their passwords if the same credentials are used elsewhere.

Researchers at cybersecurity firm Resecurity identified threat actors offering a significant number of AnyDesk customer credentials for sale on the Dark Web.

Resecurity experts pointed out that it is possible that cybercriminals familiar with the incident are hurrying to monetize available customer credentials via the Dark Web acquired from different sources, understanding that AnyDesk may take proactive measures to reset their credentials. Such data could be extremely valuable for both initial access brokers and ransomware groups familiar with AnyDesk, often abused as one of the tools following successful network intrusions. Notably, per additional context acquired from the actor, the majority of exposed accounts on the Dark Web didn’t have 2FA enabled.

“The samples provided by the threat actors were related to compromised access credentials that belong to various consumers and enterprises, and which grant access to the AnyDesk customer portal. As a security measure, the threat actor sanitized some of the passwords. The threat actor offered 18,317 accounts for $15,000 to be paid in cryptocurrency.” reported Resecurity. “He also agreed to make a deal via escrow on Exploit. Resecurity reached out to the majority of the contacts identified as potential victims and confirmed they had used AnyDesk products recently or long ago. The threat actor didn’t share any additional information.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AnyDesk)

What is Data Security Posture Management (DSPM) and how you can mitigate the risks of data leaks such as the ‘Mother of All Breaches’

Cybersecurity researchers recently uncovered what is now being dubbed the ‘Mother of all Breaches.’ With over 26 billion personal records exposed, this data leak has set a new, unfortunate record in the world of cybersecurity. Platforms such as Twitter, LinkedIn, and Dropbox were among the victims, highlighting the pervasive nature of the breach that has sent shockwaves across the digital landscape.

The leaked information includes a staggering amount of sensitive personal details, making users susceptible to identity theft, sophisticated phishing schemes, targeted cyberattacks, and unauthorized access to personal and sensitive accounts. What makes this breach particularly alarming is the inclusion of records from various government organizations across the United States, Brazil, Germany, the Philippines, Turkey, and more.

As the cybersecurity community grapples with the aftermath of this massive data leak, it’s essential to reflect on the implications and consider proactive measures to avoid such catastrophes in the future. One key aspect that emerges from this incident is the growing security gap in the cloud, where the data housed within the infrastructure becomes a vulnerable target.

The Cloud Data Security Gap and the Rise of DSPM

The increasing reliance on cloud storage for sensitive data has given rise to a significant security gap, commonly referred to as the cloud data security gap. According to a recent report, in 2023, cloud-based data breaches made up 45% of all breaches. This gap represents the disparity between the security measures implemented for cloud infrastructure and the actual security of the data residing within it. It is in response to this challenge that the concept of Data Security Posture Management (DSPM) has gained prominence.

DSPM diverges from traditional Cloud Security Posture Management (CSPM) solutions by focusing on the data itself rather than just identifying vulnerabilities in the cloud infrastructure. CSPM may be effective in pinpointing weaknesses in the infrastructure, but it often falls short in addressing the unique challenges posed by securing sensitive data in dynamic and distributed cloud environments.

How DSPM Mitigates the Risk of Catastrophic Data Breaches

Finding and Eliminating Shadow Data:

Shadow data, scattered across various locations without adhering to organizational data management frameworks and security policies, poses a significant risk. DSPM solutions excel in locating shadow data, providing actionable guidance for deletion or remediation. They identify sensitive information across different security postures, discover duplicate copies, and scrutinize privileges, mitigating the risk of unauthorized access.

Identifying Over-Privileged Users and Third Parties:

Controlling access to data is a fundamental principle of cybersecurity, but traditional access controls are tied to specific data stores. DSPM extends access control policies across cloud environments, ensuring that access control travels with the data, even when it is copied or moved. This prevents situations where copied data no longer adheres to the original access control policies.

Identifying Data Movement and Ensuring Security Posture Follows:

In the dynamic landscape of cloud computing, data moves seamlessly, but its security posture may not necessarily follow. DSPM solutions monitor data movement, detect changes in security posture, and alert relevant teams for remediation. By focusing on securing sensitive data rather than just cloud infrastructure, DSPM provides a comprehensive solution to the challenges posed by the distributed nature of cloud computing.

Conclusion

The recent ‘Mother of all Breaches’ serves as a stark reminder of the evolving threats in cyberspace. As organizations grapple with the fallout, adopting a data-centric approach through DSPM emerges as a crucial step in fortifying against catastrophic data breaches. By ensuring that sensitive data always maintains the correct security posture, DSPM not only reduces the risk of breaches but also instills confidence in users and administrators regarding data security in the cloud. As the digital landscape continues to evolve, proactive measures like DSPM are essential for safeguarding the integrity of sensitive information in an increasingly interconnected world.

About the author,  Ron Reiter, CTO and cofounder of Sentra.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Mother of all Breaches)

Scammers stole HK$200 million (roughly $25,5 million) from a multi-national company using a deepfake conf call to trick an employee into transferring the funds.

Scammers successfully stole HK$200 million (approximately $25.5 million) from a multinational company in Hong Kong by employing a deepfake video call to deceive an employee into transferring the funds.

The employee attended a video conference call with deepfake recreations of the company’s chief financial officer (CFO) and other employees who instructed him to transfer the funds.

The news was reported by The South China Morning Post, however the local authorities did not name the company.

“Everyone present on the video calls except the victim was a fake representation of real people. The scammers applied deepfake technology to turn publicly available video and other footage into convincing versions of the meeting’s participants.” reads the post published by The South China Morning Post.

The scammers used publicly available footage of the company employees and used deepfake technology to create fake versions of the participants of the meeting.

Crooks targeted an employee in the finance department of the company. They send an email to the employee urging him to participate in a video call with the UK-based CFO to receive instructions for transactions to be performed.

The employee executed the money transfers during the meeting and transferred around HK$200 million to five bank accounts, with 15 transactions.

The employee discovered the scam a week later and notified the company and local authorities.

“Hong Kong police senior superintendent Baron Chan said that during the video call, the employee was asked to do a self-introduction, but did not interact with anyone else.” reported the website The Star.

“The “fake” colleagues gave orders to the victim, and the meeting ended abruptly after, added Chan.”

The police revealed that the scammers also targeted other employees of the company with the same technique, but the attempts failed.

The investigation is still ongoing, the police have yet to identify the gang behind the scam

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, deepfake)

Airbus Navblue Flysmart+ Manager allowed attackers to tamper with the engine performance calculations and intercept data.

Flysmart+ is a suite of apps for pilot EFBs, helping deliver efficient and safe departure and arrival of flights. Researchers from Pen Test Partners discovered a vulnerability in Navblue Flysmart+ Manager that can be exploited to tamper with the engine performance calculations. The experts pointed out that the issue potentially exposes to tailstrike or runway excursion during departure.

Pen Test Partners says the app helps “deliver efficient and safe departure and arrival of flights”.

The researchers noticed that one of the iOS apps had ATS (App Transport Security) intentionally disabled.

The ATS is a security mechanism that forces the use of the HTTPS protocol, which means that disabling it could open to tamper with and decrypt the traffic.

“With ATS disabled, insecure communication happens. It makes the app susceptible to interception where an attacker could force a victim to use the unencrypted HTTP protocol while forwarding the data to the real server, encrypted.” reads the report published by Pen Test Partners. “An entry in the info.plist file alongside the app allows insecure HTTP loads to any domain.”

Pen Test Partners researchers were able to exploit the issue to view the data being downloaded from the NAVBLUE Servers.

Most of the files downloaded by the researchers were SQLite databases containing information on specific aircraft, and many of them included take-off performance data (PERF).

An attacker can modify aircraft performance data included in these files or adjust airport information such as the. runway lengths with serious consequences.

In a practical attack scenario, threat actors have to tamper with the traffic from the apps when pilots update Flysmart+ EFB apps over a potentially insecure network. The apps would likely be updated once a month.

“Given that airlines typically use the same hotel for pilots who are down route / on a layover, an attacker could target the hotel’s Wi-Fi networks with the goal of modifying aircraft performance data.” continues the experts. “It’s quite easy to identify pilots in layover hotels. It’s also fairly easy to identify the airline and therefore the suite of EFB apps they are likely to be using.”

The experts reported the issue to Airbus in June 2022. The company confirmed that the next version of the software would address the issue. The company also added that it has provided a mitigation measure to its customers in May 2023.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Airbus)

The Ivanti SSRF vulnerability tracked as CVE-2024-21893 is actively exploited in attacks in the wild by multiple threat actors.

The Ivanti Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2024-21893, is currently being actively exploited in real-world attacks by various threat actors.

Last week Ivanti warned of two new high-severity vulnerabilities in its Connect Secure and Policy Secure solutions respectively tracked as CVE-2024-21888 (CVSS score: 8.8) and CVE-2024-21893 (CVSS score: 8.2). The software company also warned that one of these two vulnerabilities is under active exploitation in the wild.

The flaw CVE-2024-21893 is a server-side request forgery vulnerability in the SAML component of Connect Secure (9.x, 22.x), Policy Secure (9.x, 22.x) and Neurons for ZTA. An authenticated attacker can exploit the issue to access certain restricted resources.

The company warned that the situation is still evolving and multiple threat actors can rapidly adapt their tactics, techniques, and procedures to exploit these issues in their campaigns.

“At the time of publication, the exploitation of CVE-2024-21893 appears to be targeted. Ivanti expects the threat actor to change their behavior and we expect a sharp increase in exploitation once this information is public – similar to what we observed on 11 January following the 10 January disclosure.” reads the advisory.

“Be aware that the situation is still evolving. Ivanti will update this knowledge base article as more information becomes available.”

The software firm recommends importing the “mitigation.release.20240126.5.xml” file via the download portal as temporary workarounds to address CVE-2024-21888 and CVE-2024-21893.

On February 2, 2024, researchers from Rapid7 published a technical analysis of the issue along with a proof-of-concept (PoC) exploit on February 2, 2024. The availability of a PoC exploit code could help threat actors to launch attacks against Internet-facing installs.

Researchers from Shadowserver observed the exploitation of the flaw CVE-2024-21893 in the wild by multiple threat actors, however, they pointed out that the attacks began hours prior to the publication of the Rapid7 PoC code.

As of today you can also track CVE-2024-21893 exploitation on our Dashboard at https://t.co/zpV2pgRlNp

Ivanti products exploitation attempts by CVE over time (now includes CVE-2024-21893, note tag added 2024-02-03):https://t.co/iaH6eRbU98 pic.twitter.com/TcCTNQ1HHQ

— Shadowserver (@Shadowserver) February 4, 2024

The attacks observed by Shadowserver involved hundreds of distinct IP addresses.

On January 1st, for the first time since its establishment, CISA ordered federal agencies to disconnect all instances of Ivanti Connect Secure and Ivanti Policy Secure products within 48 hours.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, IVANTI)

Hewlett Packard Enterprise (HPE) is investigating a new data breach after a threat actor claimed to have stolen data on a hacking forum.

Hewlett Packard Enterprise (HPE) is investigating a new data breach, following the discovery of an offer on a hacking forum where a threat actor claimed to be selling the allegedly stolen data.

According to Bleeping Computer, the company has yet to find any evidence suggesting a new security breach.

The announcement was published on BreachForums by a threat actor who uses the moniker IntelBroker.

“Hello BreachForums Community. Today, I am selling the data I have taken from Hewlett Packard Enterprise.” reads the announcement published by IntelBroker. “More specifically, the data includes: CI/CD access , System logs , Config Files , Access Tokens , HPE StoreOnce Files (Serial numbers warrant etc) & Access passwords. (Email services are also included)”

The announcement also published some screenshots containing allegedly stolen HPE credentials.

IntelBroker is considered a reputable threat actor, it was linked to the breaches of DC Health Link and Volvo Cars.

Recently Hewlett Packard Enterprise (HPE) revealed that alleged Russia-linked cyberespionage group Midnight Blizzard gained access to its Microsoft Office 365 cloud-based email environment.

The attackers were collecting information on the cybersecurity division of the company and other functions.

HPE became aware of the intrusion on December 2023 and immediately launched an investigation into the security breach with the help of external cybersecurity experts.

The investigation revealed that the attackers gained access to the company environment and exfiltrated data since May 2023. The cyberspies compromised a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions.

“On December 12, 2023, Hewlett Packard Enterprise Company (the “Company,” “HPE,” or “we”) was notified that a suspected nation-state actor, believed to be the threat actor Midnight Blizzard, the state-sponsored actor also known as Cozy Bear, had gained unauthorized access to HPE’s cloud-based email environment. The Company, with assistance from external cybersecurity experts, immediately activated our response process to investigate, contain, and remediate the incident, eradicating the activity.” reads FORM8-K filing with the U.S. Securities and Exchange Commission (SEC). “Based on our investigation, we now believe that the threat actor accessed and exfiltrated data beginning in May 2023 from a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions.”

The investigation is still ongoing, however, the IT giant determined that the intrusion is likely linked to another attack conducted by the same APT group, of which they were notified in June 2023.

As early as May 2023, the company discovered unauthorized access to and exfiltration of a limited number of SharePoint files.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, HPE)

The U.S. government imposes visa restrictions on individuals who are involved in the illegal use of commercial spyware.

The U.S. State Department announced it is implementing a new policy to impose visa restrictions on individuals involved in the misuse of commercial spyware.

The policy underscores the U.S. government’s commitment to addressing the misuse of surveillance software, which poses a significant threat to society.

“The misuse of commercial spyware threatens privacy and freedoms of expression, peaceful assembly, and association.  Such targeting has been linked to arbitrary detentions, forced disappearances, and extrajudicial killings in the most egregious of cases.  Additionally, the misuse of these tools presents a security and counterintelligence threat to U.S. personnel.” reads the announcement. The United States stands on the side of human rights and fundamental freedoms and will continue to promote accountability for individuals involved in commercial spyware misuse.”

The policy specifically addresses the abuse of commercial spyware for unlawfully surveilling, harassing, suppressing, or intimidating individuals.

Visa restrictions target individuals believed to facilitate or derive financial benefit from the misuse of commercial spyware and also surveillance companies that act on behalf of governments.

The restrictions are extended to the immediate family members of the targeted individuals, including spouses and children of any age.

In March 2023, the US Government issued an Executive Order on the prohibition on use by the United States Government of commercial spyware that poses risks to national security.

In July 2023, the Commerce Department’s Bureau of Industry and Security (BIS) added surveillance technology vendors Intellexa and Cytrox to the Entity List for trafficking in cyber exploits used to gain access to information systems.

The Entity List maintained by the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) is a trade control list created and maintained by the U.S. government. It identifies foreign individuals, organizations, companies, and government entities that are subject to specific export controls and restrictions due to their involvement in activities that threaten the U.S. national security or foreign policy interests.

The U.S. Government warns of the key role that surveillance technology plays in surveillance activities that can lead to repression and other human rights abuses.

The Commerce Department’s action targeted the above companies because their technology could contribute to the development of surveillance tools that pose a risk of misuse in violations or abuses of human rights.

The financial entities added to the Entity List include Intellexa S.A. in Greece, Cytrox Holdings Crt in Hungary, Intellexa Limited in Ireland, and Cytrox AD in North Macedonia.

In May 2023, Google’s Threat Analysis Group (TAG) researchers discovered three campaigns, between August and October 2021, targeting Android users with five zero-day vulnerabilities.

The attacks aimed at installing the surveillance spyware Predator, developed by the North Macedonian firm Cytrox.

According to Google, the exploits were included in Cytrox’s commercial surveillance spyware that is sold to different nation-state actors, including Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain, and Indonesia.

In December 2022, a report published by CitizenLab researchers detailed the use of the Predator spyware against exiled politician Ayman Nour and the host of a popular news program.

The disconcerting aspect of these attacks is that Ayman Nour’s phone was simultaneously infected with both Cytrox’s Predator and NSO Group’s Pegasus spyware, operated by two different nation-state actors.

The exploits were used to initially deliver the ALIEN Android banking Trojan that acts as a loader for the PREDATOR implant.

In November 2021, the Commerce Department’s Bureau of Industry and Security (BIS) sanctioned four companies for the development of spyware or the sale of hacking tools used by nation-state actors.

The surveillance firms were NSO Group and Candiru from Israel, Computer Security Initiative Consultancy PTE. LTD from Singapore, and Positive Technologies from Russia.

NSO Group and Candiru were sanctioned for the development and sale of surveillance software used to spy on journalists and activists. Positive Technologies and Computer Security Initiative Consultancy PTE. LTD. are being sanctioned because both entities traffic in cyber exploits used by threat actors to compromise computer networks of organizations worldwide. The US authorities have added the companies to the Entity List based on their engagement in activities counter to U.S. national security.

In the last couple of years, like NSO Group and Candiru, made the headlines because their spyware was used by totalitarian regimes to spy on journalists, dissidents, and government opposition.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, commercial spyware)

A Belarusian and Cypriot national linked with the cryptocurrency exchange BTC-e is facing charges that can lead maximum penalty of 25 years in prison.

Aliaksandr Klimenka, a Belarusian and Cypriot national linked with the now-defunct cryptocurrency exchange BTC-e, is facing charges with money laundering conspiracy and operation of an unlicensed money services business.

“An indictment was unsealed on Tuesday charging a Belarusian and Cypriot national with money laundering conspiracy and operation of an unlicensed money services business.” reads the press release published by DoJ. “According to the indictment, between 2011 and July 2017, Aliaksandr Klimenka, 42, allegedly controlled BTC-e, a digital currency exchange, with Alexander Vinnik and others.”

According to the indictment, Klimenka allegedly controlled the platform BTC-e with Alexander Vinnik and others. Klimenka also allegedly controlled a technology services company named Soft-FX, and the financial company FX Open. 

The servers that were hosting the BTC-e were maintained in the United States, and according to the DoJ, they were allegedly leased to and maintained by Klimenka and Soft-FX.

BTC-e was popular in the cybercrime ecosystem, it was an illegal platform because it was not registered as a money services business with the U.S. Department of Treasury and had no anti-money laundering process, no system for appropriate “know your customer” or “KYC” verification, and no anti-money laundering program.  

In 2017, Greek Police arrested the Russian national Alexander Vinnik and they accused the man of running the BTC-e Bitcoin exchange to launder more than US$4bn worth of the cryptocurrency.

The authorities reported that since 2011, 7 million Bitcoin had gone into the BTC-e exchange and 5.5 million withdrawn.

The police arrested Klimenka in Latvia on December 21, 2023, he was extradited to the U.S. and is currently being held in custody. The man is facing charges that can lead maximum penalty of 25 years in prison.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, commercial spyware)

Google released Android ’s February 2024 security patches to address 46 vulnerabilities, including a critical remote code execution issue.

Google released Android February 2024 security patches to address 46 vulnerabilities, including a critical remote code execution flaw tracked as CVE-2024-0031.

The vulnerability resides in the System and impacts Android Open Source Project (AOSP) versions 11, 12, 12L, 13, and 14.

“Source code patches for these issues have been released to the Android Open Source Project (AOSP) repository and linked from this bulletin. This bulletin also includes links to patches outside of AOSP.” reads the advisory published by Google. “The most severe of these issues is a critical security vulnerability in the System component that could lead to remote code execution with no additional execution privileges needed.”

Google released Android’s 2024-02-01 security patch level and Android’s 2024-02-05 security patch level to fix the issues.

The company released two security patch levels to allow partners to resolve a subset of vulnerabilities. However, the company recommends Android partners to address all the issues included in the bulletin.

Users should apply the security patches as soon as the software updates are available for them.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Google)

Google’s TAG revealed that Commercial spyware vendors (CSV) were behind most of the zero-day vulnerabilities discovered in 2023.

The latest report published by Google Threat Analysis Group (TAG), titled “Buying Spying, an in-depth report with our insights into Commercial Surveillance Vendors (CSVs)”, warns of the rise of commercial spyware vendors and the risks to free speech, the free press, and the open internet.

Surveillance software is used to spy on high-risk users, including journalists, human rights defenders, dissidents and opposition party politicians.

The surveillance industry is experiencing exponential growth, fueled by the sustained demand from rogue governments, intelligence agencies, and malicious actors for sophisticated malware and surveillance tools.

Google’s TAG tracked the activity of around 40 CSVs focusing on the types of software they develop.

Google researchers pointed out that governments have lost the monopoly on the most sophisticated capabilities, and many private organizations play a significant role in developing some of the most advanced tools. In 2023, TAG identified 250 days actively exploited in the wild, 20 of which were exploited by Commercial Surveillance Vendors (CSVs). Google also reported that CSVs are responsible for half of the known 0-day exploits targeting Google products and Android devices.

Out of the 72 known in-the-wild 0-day exploits targeting Google products since mid-2014, 35 of them were used by CSVs. The experts highlighted that this is a conservative estimate because many 0-day exploits are still unknown.

“If governments ever had a monopoly on the most sophisticated capabilities, that era is certainly over. The private sector is now responsible for a significant portion of the most sophisticated tools we detect. In 2023, TAG discovered 250 days being actively exploited in the wild, 20 of which were exploited by CSVs.” reads the report published by Google. “Finally, CSVs pose a threat to Google users, and Google is committed to disrupting that threat and keeping our users safe. CSVs are behind half of known 0-day exploits targeting Google products, as well as Android ecosystem devices. Of the 72 known in-the-wild 0-day exploits affecting Google products since mid-2014, TAG attributes 35 of these 0-days to CSVs. This is a lower bounds estimate, as it reflects only known 0-day exploits where we have high confidence in attribution. The actual number of 0-days developed by CSVs is almost certainly higher, including 0-days targeting Google products.”

The report includes the names of CSVs of any size and information about their commercial spyware.

Google hopes this report will serve as a call to action. CSVs will continue to invest in the research of powerful exploits that can allow attackers to take complete control over devices.

The overall earnings generated from the sale of this surveillance software are millionaires. TAG experts also state that CSVs customers receive a full suite for their operations, including the initial delivery mechanism, necessary exploits, command and control infrastructure, and tools for managing data stolen from compromised devices.

“We believe it is time for government, industry, and civil society to come together to change the incentive structure that has allowed these technologies to spread so widely.” concludes Google.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Google)

China-linked APT group breached the Dutch Ministry of Defence last year and installed malware on compromised systems.

Dutch Military Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) published a joint report warning that a China-linked APT group breached the Dutch Ministry of Defence last year. The effects of the attack were limited because of the network segmentation implemented in the government infrastructure.

“The Ministry of Defence (MOD) of the Netherlands was impacted in 2023 by an intrusion into one of its networks. The effects were limited because of prior network segmentation” reads the report. “MIVD & AIVD assess with high confidence that the malicious activity was conducted by a state-sponsored actor from the People’s Republic of China. This is part of a wider trend of Chinese political espionage against the Netherlands and its allies.”

The government experts discovered a previously unpublished remote access trojan (RAT), tracked as COATHANGER, specifically designed to target Fortigate appliances. The RAT is used as second-stage malware, the experts pointed out that it doesn’t exploit a new vulnerability. COATHANGER is a stealthy malware that hooks system calls that could reveal its presence. The malware survives reboots and firmware upgrades.

“Notably, the COATHANGER implant is persistent, recovering after every reboot by injecting a backup of itself in the process responsible for rebooting the system. Moreover, the infection survives firmware upgrades.” continues the report. “Even fully patched FortiGate devices may therefore be infected, if they were compromised before the latest patch was applied.”

The attack chain starts with the exploitation of the CVE-2022-42475 vulnerability for FortiGate devices.

In December 2023, Fortinet urged its customers to update their installs to address an actively exploited FortiOS SSL-VPN vulnerability, tracked as CVE-2022-42475, that could be exploited by an unauthenticated, remote attacker to execute arbitrary code on devices.

The CVE-2022-42475 flaw is a heap-based buffer overflow weakness that resides in FortiOS sslvpnd that allowed unauthenticated attackers to crash targeted devices remotely or gain remote code execution

“A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.” reads the advisory published by the security vendor. “Fortinet is aware of an instance where this vulnerability was exploited in the wild,”

Fortinet addressed the issue with the release of FortiOS 7.2.3.

The Chinese spies breached a network that was used for research and development (R&D) of unclassified projects and collaboration with two third-party research institutes.

The Dutch Ministry of Defence already notified the two third-party research institutes.

““For the first time, the MIVD has chosen to make public a technical report on the working methods of Chinese hackers. It is important to attribute such espionage activities by China,” said Defense Minister Kajsa Ollongren. “In this way we increase international resilience against this type of cyber espionage.” s

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China-linked APT)

The maintainers of Shim addressed six vulnerabilities, including a critical flaw that could potentially lead to remote code execution.

The maintainers of ‘shim’ addressed six vulnerabilities with the release of version 15.8. The most severe of these vulnerabilities, tracked as CVE-2023-40547 (CVSS score: 9.8), can lead to remote code execution under specific circumstances.

The vulnerability CVE-2023-40547 is an RCE in http boot support that can lead to Secure Boot bypass

“A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise.” reads the advisory.

shim is a small piece of code used by most Linux distributions in the boot process to support Secure Boot.

It is frequently employed when either the bootloader or the operating system kernel lacks a signature recognized by the UEFI firmware. The shim, signed with a key trusted by the firmware, enables the loading and execution of an unsigned bootloader or kernel.

The flaw was discovered by Bill Demirkapi of the Microsoft Security Response Center (MSRC).

found a critical bug that exists in every Linux boot loader signed in the past decade https://t.co/kjATsR4uvJ https://t.co/JrECpgGmWD pic.twitter.com/oKEl7PTUSp

— Bill Demirkapi (@BillDemirkapi) January 24, 2024

“Discovered and reported by Bill Demirkapi at Microsoft’s Security Response Center, this particular vulnerability stems from HTTP protocol handling, leading to an out-of-bounds write that can lead to complete system compromise.” reads the post published by Eclypsium.

Demirkapi warns that the vulnerability impacts every Linux boot loader signed in the past decade.

Researchers from Eclypsium illustrated the following attack scenarios:

An attacker could execute a Man-in-the-Middle (MiTM) attack to intercept HTTP traffic between the victim and the HTTP server while serving files in support of HTTP boot. This attack could be conducted from any network segment positioned between the victim and the legitimate server.

Additionally, an attacker with sufficient privileges can trigger the issue to manipulate data in the EFI Variables or on the EFI partition, achieved through a live Linux USB stick. The attacker can modify the boot order to load a remote and vulnerable shim on the system, enabling the execution of privileged code from the same remote server without disabling Secure Boot.

In a third attack path, an attacker on the same network can manipulate PXE to chain-load a vulnerable shim bootloader. Exploiting this vulnerability grants the attacker control over the system before the kernel is loaded, providing privileged access and the ability to bypass any controls implemented by the kernel and operating system.

“An attacker exploiting this vulnerability gains control of the system before the kernel is loaded, which means they have privileged access and the ability to circumvent any controls implemented by the kernel and operating system.” states Eclypsium.

Below are the other vulnerabilities in shim fixed by the maintainers:

• CVE-2023-40546 – Fixes a LogError() invocation (NULL pointer dereference).
• CVE-2023-40548 – Fixes an integer overflow on SBAT section size on 32-bit systems (heap overflow).
• CVE-2023-40549 – Fixes an out-of-bounds read when loading a PE binary.
• CVE-2023-40550 – Fixes an out-of-bounds read when trying to validate the SBAT information.
• CVE-2023-40551 – Fix bounds check for MZ binaries

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Shim)

A new vulnerability in JetBrains TeamCity On-Premises can be exploited by threat actors to take over vulnerable instances.

JetBrains addressed a critical security vulnerability, tracked as CVE-2024-23917 (CVSS score 9.8) in its TeamCity On-Premises continuous integration and continuous deployment (CI/CD) software.

An attacker can trigger the vulnerability to take over vulnerable installs.

“The vulnerability may enable an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and gain administrative control of that TeamCity server.” reads the advisory. “The vulnerability affects all TeamCity On-Premises versions from 2017.1 through 2023.11.2.”

JetBrains has fixed the flaw with the release of version 2023.11.3.

Administrators who are not able to update their instances to version 2023.11.3 can download a security patch plugin to patch their environment. The security patch plugin can be installed on TeamCity versions 2017.1 through 2023.11.2. It will patch the vulnerability described above.

“The security patch plugin will only address the vulnerability described above. We always recommend upgrading your server to the latest version to benefit from many other security updates.” concludes the advisory. “If your server is publicly accessible over the internet and you are unable to take one of the above mitigation steps immediately, we recommend temporarily making it inaccessible until mitigation actions have been completed.”

The company is not aware of attacks in the wild exploiting this vulnerability.

In December, experts warn that the Russia-linked APT29 group has been observed targeting JetBrains TeamCity servers to gain initial access to the targets’ networks.

The attackers were observed exploiting an authentication bypass issue, tracked as CVE-2023-42793, affecting the on-premises version of TeamCity. An attacker can exploit the flaw to steal source code and stored service secrets and private keys of the target organization. By injecting malicious code, an attacker can also compromise the integrity of software releases and impact all downstream users.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, TeamCity)