CISA Warns Agencies to Fix Critical Array Networks Flaw

December 1, 2024December 1, 2024

Critical Security Flaw in Array Networks AG and vxAG Gateways: CISA Adds to Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added a critical security flaw affecting Array Networks AG and vxAG secure access gateways to its Known Exploited Vulnerabilities (KEV) catalog. This decision follows reports of active exploitation in the wild. The vulnerability, identified as CVE-2023-28461, has a high CVSS score of 9.8 and poses a significant risk due to missing authentication, potentially allowing attackers to execute arbitrary code remotely.

In March 2023, Array Networks released patches (version 9.4.0.484) to address this serious security shortcoming. According to Array Networks, "The Array AG/vxAG remote code execution vulnerability is a web security vulnerability that allows an attacker to browse the filesystem or execute remote code on the SSL VPN gateway using flags attribute in HTTP header without authentication." This flaw can be exploited through a vulnerable URL, highlighting the urgency for organizations to act.

Understanding the Threat Landscape

The inclusion of CVE-2023-28461 in the KEV catalog comes shortly after cybersecurity firm Trend Micro reported that a China-linked cyber espionage group, known as Earth Kasha (also referred to as MirrorFace), is exploiting security vulnerabilities in public-facing enterprise products. These products include not only Array AG but also Proself (CVE-2023-45727) and Fortinet FortiOS/FortiProxy (CVE-2023-27997).

Key Insights on Earth Kasha:
- Primarily targets Japanese entities.
- Recently expanded its attacks to Taiwan, India, and Europe.
- Previously linked to campaigns aimed at diplomatic entities within the European Union.

Earlier this month, ESET revealed an Earth Kasha campaign that targeted an unnamed diplomatic entity in the EU, using the upcoming World Expo 2025 in Osaka, Japan, as bait to deliver a backdoor known as ANEL.

Recommendations for Federal Agencies

In light of the ongoing exploitation of these vulnerabilities, CISA advises Federal Civilian Executive Branch (FCEB) agencies to apply the necessary patches by December 16, 2024. This proactive measure is essential for securing their networks against potential threats.

Wider Implications: The Rise of Chinese Hacking Groups

Recent data from VulnCheck indicates that 15 Chinese hacking groups have been linked to the exploitation of at least one of the top 15 routinely exploited vulnerabilities in 2023. The cybersecurity firm has identified over 440,000 internet-exposed hosts that are potentially vulnerable to attacks.

Best Practices for Organizations:
- Evaluate exposure to vulnerable technologies.
- Enhance visibility into potential risks.
- Leverage robust threat intelligence.
- Maintain strong patch management practices.
- Minimize internet-facing exposure of devices.

As Patrick Garrity from VulnCheck emphasizes, organizations need to be vigilant and proactive to safeguard their networks against these emerging threats.

Stay Informed and Secure

As cybersecurity threats continue to evolve, it’s crucial for organizations to stay informed about vulnerabilities like CVE-2023-28461. For more insights and updates on cybersecurity, follow us on Twitter and LinkedIn. Share your thoughts in the comments below and check out our related articles on best practices for cybersecurity.

cyber security awareness tips for students

Stay Secure: Top Cybersecurity Tips Every Student Should Know

December 7, 2024December 7, 2024

In today’s digital era, students face increased cybersecurity threats as they rely on technology for education and social interactions. To safeguard personal and academic information, students should implement essential cybersecurity practices. Key tips include: using strong, unique passwords; enabling two-factor authentication; being cautious of phishing scams; regularly updating software; using a VPN on public Wi-Fi; securing devices with passwords or biometrics; limiting personal information shared online; backing up data consistently; staying informed about cybersecurity trends; and trusting instincts when encountering suspicious online activity. Prioritizing these practices fosters a culture of awareness and responsibility in the digital landscape.

Stay Safe Online: Essential IT Security Tips Every Employee Should Know

January 8, 2025January 8, 2025

In today’s digital landscape, IT security is crucial as cyber threats increase. Employees serve as the first line of defense, making it essential to adopt good online security practices. Key tips include using strong, unique passwords, enabling two-factor authentication (2FA), and being cautious with emails and links to avoid phishing attacks. Regularly updating software, securing devices, and using encrypted connections on public Wi-Fi are vital. Employees should also be mindful of social media sharing, recognize security incidents, and understand company policies. Continuous education on cybersecurity helps create a proactive culture of awareness and resilience against threats.

Cybercriminals Spread Remcos RAT via Excel Phishing Attack

December 1, 2024December 12, 2024

Researchers have identified a new phishing campaign distributing a fileless variant of the Remcos Remote Access Trojan (RAT). This attack starts with a phishing email using purchase order themes to trick victims into opening a malicious Excel attachment that exploits a known vulnerability in Microsoft Office. Executing the attachment launches an HTML Application (HTA) file that downloads and runs malware from a remote server. The fileless Remcos RAT operates by injecting malware directly into memory, enabling it to harvest sensitive data, execute remote commands, and activate surveillance features. This highlights the need for enhanced cybersecurity awareness and measures.

Moxa Warns of Critical Router Vulnerabilities

January 7, 2025January 7, 2025

Moxa, a Taiwan-based technology company, has issued an urgent warning about two critical security vulnerabilities in its cellular routers and network security appliances. Reported by researcher Lars Haulin, CVE-2024-9138 allows privilege escalation via hard-coded credentials, while CVE-2024-9140 lets attackers bypass input restrictions to execute unauthorized commands. Affected products include several EDR and OnCell series with specific firmware versions. Moxa recommends upgrading to newer firmware and limiting internet exposure. Patches are available, and users are urged to implement security measures to safeguard against potential exploitation. Staying informed on such vulnerabilities is essential for user protection.

New Termite Ransomware Group Linked to Blue Yonder Hack

Ransomware Hits 61K Avery Customers, Data Compromised

January 16, 2025January 16, 2025

Avery Products Corporation, a U.S. multinational in labeling and packaging, suffered a major ransomware attack, compromising sensitive data from over 61,000 customers. The breach, identified by BleepingComputer, involved a credit card skimmer on Avery’s website, capturing personal information like names, addresses, phone numbers, and payment details from transactions made between July and December. In response, Avery is offering affected customers one year of complimentary credit monitoring and has notified them about the breach. The incident highlights the growing threat of ransomware attacks and underscores the importance of safeguarding personal information in online transactions.

Understanding Proxy Firewalls: What You Need to Know

December 23, 2024December 23, 2024

Proxy firewalls are essential for enhancing network security in organizations by acting as a barrier between internal networks and the public internet. They use their own IP address to mask internal user details, preventing direct communication with external threats. By monitoring and analyzing incoming and outgoing traffic, proxy firewalls block potential threats and ensure compliance with security policies. Key functions include traffic monitoring, IP address masking, and deep packet inspection, which collectively reduce the risk of cyber attacks and allow for content filtering. Understanding proxy firewalls is crucial for businesses looking to protect sensitive data in today’s digital landscape.