Cyber espionage

TWiC: China Cyberattacks, ManageEngine Exploits, FBI Urges Barracuda Appliance Removal, Cyber Insurance

In this edition of This Week in Cybersecurity, we bring you a comprehensive overview of the latest developments and pressing concerns within cybersecurity. As threats continue to evolve, it is crucial to stay informed and prepared. Join us as we explore four pivotal topics that demand attention and action.

Hackers Exploit Barracuda Email Security Appliances: FBI Urges Immediate Removal

The FBI has issued a compelling alert urging the swift removal of compromised email security appliances manufactured by Barracuda Networks. This comes after Barracuda issued the same advice back in May, which was detailed in another nGuard Security Advisory. Despite patches designed to fix the exploited zero-day vulnerability (CVE-2023-2868), the FBI asserts that these patches have proven ineffective against suspected Chinese hackers. Organizations are strongly advised to remove all Barracuda Email Security Gateway (ESG) appliances promptly. This warning underscores the importance of vigilance and the evolving nature of cyber threats. To protect your organization from these attacks and stay informed of these new vulnerabilities as they are discovered, nGuard offers Vulnerability Scanning and Penetration Testing, along with Security Device Configuration Audit services that can help identify vulnerabilities, assess risks, and fortify your infrastructure against potential attacks.

Growing Concerns of Destructive Cyberattacks by China

Top U.S. cyber official, Jen Easterly, director of the U.S. Cybersecurity and Infrastructure Agency, has sounded an alarm about the potential for China to launch destructive cyberattacks on critical U.S. infrastructure in the event of escalated tensions. China’s hackers are reportedly positioning themselves for such actions, which represent a significant departure from their historical cyber espionage activities. nGuard has a wide range of experience helping organizations secure their critical infrastructure from Energy and Utilities, to Manufacturing, to Healthcare, to Government.

Cyber Insurance and the Nexus of Coverage and Protection

As cybersecurity evolves, the relationship between cybersecurity and insurance industries becomes increasingly intricate. Experts in the field gathered at the Def Con hacker conference to discuss the need for cyber insurance, its assessment, and its alignment with cybersecurity measures. Back in February, nGuard wrote about 5 new requirements that insurance companies need to issue policies. Security Awareness Training and Testing, Vulnerability Management, and 24/7/365 Monitoring were among the requirements listed. While cyber insurance offers financial protection, factors like calculating premiums and assessing risks are challenges that require attention. The role of cyber insurance as a motivator to enhance cybersecurity programs is emphasized, with a call to move quickly in preparing for potential cyberattacks.

Lazarus Hackers Exploit ManageEngine Vulnerability: New Threats Emerge

The North Korean state-backed Lazarus hacker group has capitalized on a critical ManageEngine ServiceDesk vulnerability (CVE-2022-47966) to compromise an internet backbone infrastructure provider and healthcare organizations. In early 2023, Lazarus exploited the flaw in multiple Zoho ManageEngine products to infiltrate a U.K. internet backbone provider, deploying the “QuiteRAT” malware and unveiling the newly discovered “CollectionRAT” remote access trojan (RAT). QuiteRAT, a potent malware discovered in February 2023, showcases enhanced capabilities compared to its predecessor, MagicRAT. CollectionRAT, linked to the “EarlyRAT” family and the Andariel subgroup, boasts sophisticated features, including on-the-fly code decryption using the Microsoft Foundation Class framework. Lazarus’ evolving tactics, employing open-source tools and frameworks, pose challenges for attribution and defense strategies. To safeguard against emerging threats, nGuard offers comprehensive Penetration Testing and Vulnerability Management services to assess vulnerabilities, enhance security, and mitigate risks.

The evolving nature of cyber threats demands taking proactive measures and forming strategic partnerships. As highlighted in the topics covered, cybersecurity is ever-changing where staying informed, prepared, and collaborating with experts is critical. At nGuard, we offer a suite of solutions designed to assist organizations in navigating this complex landscape. From incident response and vulnerability management to proactive security assessments, we are ready to enhance your security posture. The key to cybersecurity success lies in constant adaptation and continuous improvement.

In the Crosshairs: Unraveling Microsoft’s Cybersecurity Saga

In recent weeks, Microsoft has been at the center of numerous cybersecurity incidents, highlighting the ongoing challenges faced by tech giants in maintaining the security of their systems. This article provides a summary of these events, drawing on information from various sources.

Chinese APT Targets Microsoft Outlook
A Chinese Advanced Persistent Threat (APT) group, known as Storm-0558, has been reported to have successfully breached Microsoft Outlook email accounts of more than two dozen organizations worldwide, including U.S. and Western European government agencies. The group exploited a token validation issue to impersonate Azure AD users and gain access to enterprise mail. The intrusion was discovered and reported to Microsoft by U.S. government officials last month, and the company has since mitigated the attack. Such incidents underscore the importance of comprehensive security assessments that proactively address key disciplines, helping organizations identify and mitigate potential vulnerabilities.

Microsoft Teams Exploited to Deliver Malware
In another incident, Microsoft Teams was exploited to deliver malware. The exploit, known as “AutoDeliver,” was used to deliver a remote access trojan (RAT) to victims. The RAT was then used to steal sensitive information from the infected systems. The exploit took advantage of the fact that Microsoft Teams allows for the automatic downloading and execution of arbitrary files shared in a chat. This incident underscores the need for an effective Cyber Security Incident Response strategy to respond to cybersecurity incidents swiftly and efficiently.

Moreover, this case highlights the potential risks associated with social engineering, where users could be tricked into sharing or opening malicious files. It also underscores the value of Red Team Testing, a strategy that uses simulated attacks to identify vulnerabilities. Finally, this incident emphasizes the importance of conducting a thorough Cloud Configuration Security Audit for MS Teams and other Microsoft cloud services. This type of audit can help identify and rectify potential security misconfigurations, further strengthening defenses against similar exploits.

Zero-Day Vulnerabilities Disclosed in July Security Update
Microsoft’s July security update was a significant one, with the company disclosing several zero-day vulnerabilities. These vulnerabilities, if exploited, could allow an attacker to execute arbitrary code, gain elevated privileges, or cause a denial of service. Microsoft has released patches for these vulnerabilities, and users are advised to update their systems as soon as possible. Such vulnerabilities highlight the importance of regular penetration testing to identify potential security gaps and take proactive measures to secure systems.

MS Office Zero-Day Vulnerability
A zero-day vulnerability in Microsoft Office was also disclosed. The vulnerability, tracked as CVE-2023-36884, could allow an attacker to execute arbitrary code on a victim’s system if they open a specially crafted Office document. Microsoft has released a patch for this vulnerability.

Chinese Hackers Breach US Government Email Through Microsoft Cloud
Chinese cyberspies exploited a fundamental gap in Microsoft’s cloud, leading to a targeted hack of unclassified U.S. email accounts. The hackers had access to the email accounts for about a month before the issue was discovered and access cut off. The Microsoft vulnerability was discovered last month by the State Department. This incident highlights the need for robust cloud security measures to secure cloud-based infrastructure to protect against such breaches.

These incidents underscore the importance of maintaining strong cybersecurity practices and keeping software up to date. Microsoft has taken steps to mitigate these issues and continues to work on improving the security of its products. However, these incidents serve as a reminder that even the most robust systems can be vulnerable to attack. As such, organizations and individuals alike must remain vigilant and proactive in their cybersecurity efforts.

National Security at Stake: Old Cisco Flaw Exploited by Russian Hackers Raises New Concerns

Introduction
The international cybersecurity community is continually challenged to stay one step ahead of new threats in an ever-changing cyber landscape. Russian hackers exploiting a six-year-old Cisco weakness to target government entities have caused serious national security concerns, according to a recent joint warning from the US and UK cybersecurity agencies. This development emphasizes how vital it is to stay on top of patch management & operating system updates in order to guard against prospective cyberattacks and safeguard critical data. In these situations, nGuard’s all-encompassing cybersecurity solutions can be crucial in protecting businesses and government institutions.

The Old Cisco Flaw Resurfaces with National Security Implications
In their IOS and IOS XE software, Cisco discovered a critical vulnerability (CVE-2017-3881) back in 2017 that might allow an unauthenticated attacker to take over vulnerable devices. Despite Cisco issuing a patch for this vulnerability, some vulnerable devices remained unpatched, enabling Russian hacker group APT28 a chance to take advantage of this long-standing weakness.

Concerns regarding the potential effects on national security have been raised by the exploitation of this Cisco vulnerability because APT28, also known as Fancy Bear, is notorious for attacking many corporations and government entities. Government agencies in the US and the UK have both been compromised, leading the cybersecurity groups in both nations to demand heightened vigilance and stronger security procedures.

This Cisco vulnerability is similar to earlier nGuard advisories on Fortinet vulnerabilities. A Fortinet authentication bypass vulnerability and industrial appliance issues that caused US airport sites to go offline were also the subject of urgent alerts. These occurrences, together with the Cisco fault exploitation, show how crucial it is to address security flaws and maintain strong cybersecurity measures in order to safeguard vital infrastructure and interests in national security.

Conclusion
Russian hackers’ use of the outdated Cisco vulnerability serves as a wake-up call for the international cybersecurity community, with significant ramifications for national security. Organizations and governmental bodies must maintain current security protocols and make investments in cybersecurity solutions to safeguard their systems and sensitive data as cyber threats continue to develop. By doing so, we may reduce the risks posed by knowledgeable hacker groups like APT28 and maintain the security of all nations.

Organizations can assure that their security infrastructure is strong and up-to-date by using nGuard’s Managed Security Services, which provide continuous monitoring, threat detection, and response. Additionally, enterprises can proactively detect and address security flaws with the use of nGuard’s Security Assessments, such as penetration testing and vulnerability assessments, before threat actors like APT28 can take advantage of them.