NCSC Anticipates Ongoing Ties with CISA During Trump Era

CISA Adds Mitel and Oracle Vulnerabilities to Exploited List

January 9, 2025January 9, 2025

CISA Adds Critical Vulnerabilities to KEV Catalog: What You Need to Know

On January 7, the Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog, adding three significant security flaws that pose serious risks to organizations. Among these, two vulnerabilities target the Mitel MiCollab communications platform, while the third concerns Oracle WebLogic Server, a widely used application server. The most critical of these is CVE-2024-41713, a path traversal vulnerability that could allow attackers to gain unauthorized access, emphasizing the urgent need for organizations to strengthen their cybersecurity measures.

Overview of Newly Added Vulnerabilities

CISA’s latest update includes the following vulnerabilities:

CVE-2024-41713 (Mitel MiCollab): Rated critical with a CVSS score of 9.1, this vulnerability allows unauthenticated attackers to potentially access the entire unified communications infrastructure.
CVE-2024-55550 (Mitel MiCollab): This vulnerability has a CVSS score of 4.4 and, while less severe, can lead to greater system compromise when exploited alongside other vulnerabilities.
CVE-2020-2883 (Oracle WebLogic Server): Though patched in April 2020, this bug remains a significant threat, allowing unauthenticated attackers to take control of affected servers through specific network protocols.

Risks Associated with Mitel MiCollab Vulnerabilities

According to Sarah Jones, a cyber threat intelligence research analyst at Critical Start, CVE-2024-41713 is particularly alarming due to its potential for exploitation without any authentication requirements. This vulnerability opens the door for attackers to compromise systems, exfiltrate sensitive data, and move laterally within networks.

Jones also highlighted the risks posed by CVE-2024-55550. While it requires administrative privileges to exploit, it allows attackers to read sensitive local files due to insufficient input sanitization.

The Ongoing Threat of Oracle WebLogic Server Vulnerability

The vulnerability CVE-2020-2883 in Oracle WebLogic Server is troubling because, despite being patched, the methods to exploit it are well-known and documented. This age of the vulnerability raises concerns about its potential for misuse by threat actors who can access affected servers remotely.

Recommended Actions for Organizations

To safeguard against these vulnerabilities, organizations should adopt a multi-layered defense strategy. Here are immediate actions recommended by cybersecurity experts:

Emergency Patch: Ensure that all affected Mitel MiCollab systems are promptly patched.
Deploy Web Application Firewall Rules: Implement rules to filter path traversal attempts.
Verify Oracle WebLogic Server Installations: Confirm that all installations are up-to-date and patched against CVE-2020-2883.

Conclusion and Call to Action

With the addition of these critical vulnerabilities to CISA’s KEV catalog, it is crucial for organizations to take swift action to protect their systems. Stay informed about the latest cybersecurity threats and best practices. If you have thoughts on this topic or want to read more articles about cybersecurity, feel free to share your comments below. For further reading, check out CISA’s official resources and explore related cybersecurity measures on our site.

Atrium Health Breach Affects Over 585,000 Patients

SRP Federal Credit Union Hack Impacts Over 240,000 Customers

December 16, 2024December 16, 2024

SRP Federal Credit Union in South Carolina has experienced a significant data breach affecting over 240,000 individuals due to a cyberattack linked to the Nitrogen ransomware operation. The breach, which lasted from September 5 to November 4, resulted in the theft of approximately 650 GB of sensitive data, including names, birthdates, Social Security numbers, financial details, and driver’s license numbers. While the attackers claimed responsibility, the credit union has not confirmed these claims. Customers are urged to monitor accounts for unusual activity, change passwords, and consider credit monitoring services. This incident underscores the ongoing cybersecurity threats facing financial institutions.

Boosting Team Security with Threat-Informed Defense

January 12, 2025January 12, 2025

In today’s cybersecurity landscape, adopting a threat-informed defense strategy is vital for security teams. This approach enhances individual and collective effectiveness by equipping team members with knowledge of cyber adversaries’ tactics, techniques, and procedures (TTPs). Key benefits include heightened awareness of emerging threats, improved decision-making for resource allocation, and enhanced collaboration among team members. Additionally, this strategy fosters continuous skill development, increases efficiency by focusing on relevant threats, and strengthens team dynamics. Ultimately, a threat-informed defense contributes to a more robust organizational security posture, making it essential for all security professionals to embrace.

Meet the Woman Building Africa’s Cybersecurity Talent Hub

December 13, 2024December 13, 2024

Confidence Staveley is revolutionizing Africa’s cybersecurity landscape through her CyberGirls Fellowship, empowering over 3,000 young women, 60% of whom have secured jobs with a 400% income increase. Honored as a 2024 “Power Player” by SC Media, she is addressing the gender gap in a field where women represent only 9% of the workforce. Staveley leads the CyberSafe Foundation, focusing on safety and inclusion, and aims to educate individuals about digital risks while providing free resources and mentorship. Her vision is to position Africa as a global cybersecurity talent hub, inspiring the next generation of women in tech.

Why Security Leaders Struggle to Secure Funding

Exploits of Critical Fortinet EMS Bug Continue

December 23, 2024December 23, 2024

A critical SQL injection vulnerability (CVE-2023-48788) in Fortinet FortiClient EMS is posing a global threat, affecting organizations in multiple countries, including Brazil, France, and India. Cybercriminals exploit this vulnerability to gain unauthorized access and control over exposed Windows systems. Kaspersky reports that attackers have used tools like ScreenConnect and Mimikatz for credential theft and data gathering. The increasing complexity of these attacks emphasizes the need for enhanced security measures, including regular software updates, intrusion detection systems, and employee training on cybersecurity practices. Organizations are urged to stay informed and proactive to mitigate risks associated with this vulnerability.

Gamaredon Launches BoneSpy and PlainGnome Android Malware

Barcelona Emerges as a Rising Spyware Hub

January 17, 2025January 17, 2025

Barcelona is emerging as a key hub for spyware and cybersecurity firms, attracting businesses with its favorable conditions and tax incentives. However, this growth raises concerns about ethical practices, particularly regarding companies like Palm Beach Networks, which has faced scrutiny due to controversial ties and a lack of transparency. The firm’s connections to the sanctioned NSO Group and its history of name changes heighten alarms among experts. As spyware firms increase in the city, human rights advocates warn of potential misuse against activists and officials, emphasizing the urgent need for regulatory frameworks to ensure accountability and protect individual privacy.

Chinese Hackers Linked to Years of Cyber Attacks on Japan

January 9, 2025January 9, 2025

The Chinese hacking operation MirrorFace has conducted over 200 cyberattacks against Japanese institutions, including the Foreign and Defense ministries, from 2019 to 2024. These sophisticated attacks, often utilizing malware via phishing emails, have targeted critical sectors like aerospace, IT, and telecommunications. The National Police Agency (NPA) has raised alarms about national security threats, especially following a significant disruption of Japan Airlines. The NPA urges organizations to enhance cybersecurity defenses to combat these escalating threats. The situation highlights the pressing need for improved cybersecurity strategies across vulnerable sectors in Japan.