CISA and FBI Warn of Exploited Flaws and HiatusRAT Threats

December 17, 2024December 17, 2024

CISA Adds New Vulnerabilities to Known Exploited Vulnerabilities Catalog: Key Details Unveiled

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added two significant security flaws to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the urgency of these issues due to active exploitation in the wild. The newly identified vulnerabilities, CVE-2024-20767 and CVE-2024-35250, pose serious risks to users of Adobe ColdFusion and Microsoft Windows Kernel-Mode Driver, respectively. Understanding these vulnerabilities is crucial for organizations aiming to safeguard their networks against potential attacks.

Overview of Newly Identified Vulnerabilities

CISA’s addition of these vulnerabilities underscores the importance of timely updates and patches for software security. Here are the key details:

CVE-2024-20767 (CVSS score: 7.4): This vulnerability in Adobe ColdFusion involves improper access control, allowing attackers to access or modify restricted files through an internet-exposed admin panel. Adobe released a patch for this issue in March 2024.
CVE-2024-35250 (CVSS score: 7.8): This flaw in the Microsoft Windows Kernel-Mode Driver enables local attackers to escalate privileges by exploiting an untrusted pointer dereference. Microsoft issued a patch for this vulnerability in June 2024.

The Taiwanese cybersecurity firm DEVCORE discovered these vulnerabilities and provided additional technical insights in August 2024, linking the issues to the Microsoft Kernel Streaming Service (MSKSSRV). Although proof-of-concept (PoC) exploits exist, specific details on how these vulnerabilities are being weaponized in real-world scenarios remain scarce.

Recommendations for Federal Agencies

In response to these active threats, CISA recommends that Federal Civilian Executive Branch (FCEB) agencies implement necessary remediation by January 6, 2025. This proactive approach is vital for securing sensitive networks against potential exploitation.

FBI Alerts on HiatusRAT Targeting IoT Devices

In a related security advisory, the Federal Bureau of Investigation (FBI) has warned about the expansion of HiatusRAT campaigns. These campaigns are now targeting not only network edge devices like routers but also Internet of Things (IoT) devices from manufacturers such as Hikvision, D-Link, and Dahua across the U.S., Australia, Canada, New Zealand, and the United Kingdom.

The FBI revealed that threat actors scanned web cameras and DVRs for various vulnerabilities, including:

CVE-2017-7921
CVE-2018-9995
CVE-2020-25078
CVE-2021-33044
CVE-2021-36260

Many of these vulnerabilities remain unaddressed by vendors, increasing the risk to users.

Ransomware Campaigns Exploiting DrayTek Routers

Additionally, Forescout Vedere Labs has reported that security flaws in DrayTek routers have been exploited in a ransomware campaign affecting over 20,000 DrayTek Vigor devices between August and September 2023. This operation involved a suspected zero-day vulnerability, enabling attackers to infiltrate networks and deploy ransomware while leveraging three distinct threat actor groups.

Key points from the Forescout report include:

Monstrous Mantis: Identified and exploited the vulnerability, harvesting credentials for further exploitation.
Ruthless Mantis: Successfully compromised at least 337 organizations, mainly in the U.K. and the Netherlands.
LARVA-15: Acted as an initial access broker, selling access gained from Monstrous Mantis to other threat actors.

The ongoing exploitation of vulnerabilities emphasizes the need for thorough root cause analysis and systematic code reviews by vendors post-disclosure.

Stay Informed and Secure

As cyber threats continue to evolve, staying informed about the latest vulnerabilities and security advisories is essential for organizations. If you found this article insightful, follow us on Twitter and LinkedIn for more exclusive cybersecurity content. Share your thoughts in the comments below or explore our related articles for further information on safeguarding your digital assets.

Azure Airflow Flaws Could Expose Kubernetes Cluster to Attacks

December 31, 2024December 31, 2024

Cybersecurity experts have uncovered critical vulnerabilities in Microsoft’s Azure Data Factory integration with Apache Airflow, raising concerns about potential data exfiltration and malware deployment. Palo Alto Networks’ Unit 42 identified three main flaws, including misconfigured Kubernetes RBAC and weak authentication, which could enable attackers to gain unauthorized access. Exploitation could involve uploading malicious files to a linked GitHub repository, granting attackers shadow administrative control over the Airflow cluster. This situation highlights the importance of robust service permission management and monitoring. Additionally, a separate privilege escalation issue in Azure Key Vault further underscores the need for heightened security measures.

BeyondTrust Releases Urgent Patch for Critical Security Flaw

December 18, 2024December 18, 2024

BeyondTrust has revealed a critical security vulnerability, CVE-2024-12356, affecting its Privileged Remote Access (PRA) and Remote Support (RS) products, with a CVSS score of 9.8. This flaw allows unauthorized users to execute arbitrary commands through command injection. It impacts versions 24.3.1 and earlier, with patches already available for cloud instances since December 16, 2024. Users of on-premises versions must apply updates to protect their systems. The vulnerability was discovered during an investigation following a security incident involving a compromised API key. BeyondTrust advises users to update software and monitor security advisories for further protection.

Top 5 Critical Sectors Targeted by Cyberattacks in 2024

December 27, 2024December 27, 2024

Cyberattacks on critical infrastructure have become a major national security concern, especially following incidents like the 2021 Colonial Pipeline attack. This has sparked calls for improved cybersecurity measures across essential sectors, including transportation, energy, and healthcare. A recent study found that nearly 45% of organizations experienced significant financial losses due to cyberattacks, with the manufacturing, financial services, energy, and healthcare sectors being particularly impacted in 2024. Notable breaches include attacks on LoanDepot and Change Healthcare. The growing frequency of these attacks highlights the urgent need for stronger defenses and awareness of cybersecurity best practices.

FBI Alerts on Growing Use of AI in Financial Fraud

December 12, 2024December 12, 2024

The FBI has issued a warning about the rising threat of AI-driven financial fraud schemes, emphasizing the use of generative AI by cybercriminals to create convincing scams. Techniques include AI-generated text for phishing emails, realistic fake identities through enhanced images, vocal cloning to impersonate trusted figures, and AI-generated videos to promote fraudulent investments. To protect against these threats, the FBI suggests establishing secret verification methods, limiting personal information shared online, and carefully scrutinizing digital communications for inconsistencies. Staying informed and vigilant is crucial to safeguard against this evolving risk.

Oracle Alerts Users: Critical Agile PLM Vulnerability Exploited

December 1, 2024December 1, 2024

Oracle has issued a critical alert about a high-severity security flaw, CVE-2024-21287, in its Agile Product Lifecycle Management (PLM) Framework, with a CVSS score of 7.5. This vulnerability, already exploited in the wild, allows unauthorized access to sensitive information without authentication. Attackers could potentially disclose files from affected systems, posing significant risks to organizations. Oracle recommends users promptly apply the latest security patches, monitor for suspicious activity, and educate employees on cybersecurity best practices. The discovery was made by CrowdStrike security experts, though details about the exploitation remain unclear.

Over 15,000 Four-Faith Routers Vulnerable to New Exploit

December 28, 2024December 28, 2024

A critical vulnerability (CVE-2024-12856) has been found in specific Four-Faith router models (F3x24 and F3x36), with active exploitation reported. This OS command injection flaw, scoring 7.2 on the CVSS scale, primarily threatens users who have not changed default credentials, allowing attackers to gain unauthorized access and execute commands. Recent findings indicate that hackers are exploiting this vulnerability via HTTP, particularly when users adjust system time. With over 15,000 affected devices online, users are advised to change default credentials, monitor network activity, and update firmware to mitigate risks. Cybersecurity vigilance is crucial against evolving threats.