While Progress has released patches for the vulnerabilities, attackers are trying to exploit them before organizations have a chance to remediate.

Source: Color4260 via Shutterstock

Attackers appear to be pounding away at a couple of critical bugs that Progress Software disclosed this week in its MOVEit file transfer application, with nearly the same ferocity as they did the zero-day flaw the company disclosed almost exactly a year ago.

While patches are available for the new flaws, the big question now for affected organizations is whether they can apply them quickly enough to beat adversaries targeting their systems, especially with a proof-of-concept (PoC) exploit available in the wild.

**Patching Alone Is Insufficient**

Even those that might have already applied updates have more work to do because the original patch that Progress issued for one of the flaws does not mitigate new issues that the software maker discovered after the patch release.

The new MOVEit Transfer vulnerabilities are both improper authentication issues in the SFTP module. They allow an attacker to potentially impersonate any user on an affected instance and take control of it. One of the flaws, tracked as CVE-2024-5806, affects MOVEit Transfer versions from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, and from 2024.0.0 before 2024.0.2. The other, identified as CVE-2024-5805, affects MOVEit Gateway: 2024.0.0.

When Progress first disclosed CVE-2024-5806 on June 25, the company assigned the flaw a medium-severity score of 7.4 out of a maximum possible 10 on the CVSS scale. Progress quickly upgraded that score to 9.1 after researchers at watchTowr discovered a vulnerability in a third-party component (IPWorks SSH) used in MOVEit Transfer. Progress described the issue as introducing new risks to organizations, including those that might have already applied the patch for CVE-2024-5806.

In an update to its original advisory, Progress urged affected organizations to install the patch and also block public inbound RDP access to MOVEit Transfer servers and limit outbound transfers to only known and trusted endpoints.

An Internet scan that Censys conducted on June 25 unearthed some 2,700 MOVEit Transfer instances online, most of them in the US. Internet scanning entity ShadowServer, which reported observing exploit attempts targeting CVE-2024-5806 almost immediately after Progress disclosed the flaw, identified some 1,800 instances online as of June 27.

**Relatively Easy to Exploit**

"Based on our understanding of the vulnerability, exploitation doesn't appear exceptionally difficult," says Emily Austin, principal security researcher at Censys. In theory, an actor would need to identify an unpatched MOVEit Transfer instance and know a valid username for accessing the service, she says. "While knowing a valid username might seem like a hurdle, a little OSNIT combined with watchTowr researchers' discovery of a method for enumerating valid MOVEit Transfer instance usernames makes this somewhat trivial," Austin notes.

The new flaws come a year after Progress disclosed CVE-2023-34362, a SQL injection zero-day vulnerability in MOVEit Transfer that ranked as one of the most widely exploited flaws of 2023. The Cl0p ransomware group, which claimed credit for discovering the flaw, was among the many that exploited it with devastating affect last year.

Affected organizations cannot afford to delay given how widely they are being targeted, says Mike Walters, president and co-founder of Action1. "The consequences can be devastating because these vulnerabilities allow an attacker to take over the server," Walters says. "With a CVSS score of 9.1 and a PoC available, the vulnerability will likely be added to the toolkit of leading APT groups rather quickly." If the companies that were attacked last time have not ramped up their information security in any way, the consequences for them could well be the same as last time, he warns.

Austin says CVE-2024-5806 is somewhat more complex than the SQL injection bug in MOVEit Transfer that Cl0p exploited throughout 2023. Even so, instance administrators should still take the new flaw very seriously and follow mitigation guidance provided by Progress Software, she says.

"We don't have a way to see exploitation or patch status of MOVEit Transfer instances, but we know that as of Tuesday, June 25, 2024, there are 2,700 MOVEit Transfer instances exposed to the Internet," Austin says. "This is very similar to the number of MOVEit Transfer exposures we observed around this time last year, suggesting that the tool is still widely used in spite of various security issues."

**Cause for Optimism?**

Despite the severity of the threat, there is still some optimism that the new flaws that Progress disclosed this week — especially CVE-2024-5806 — won't cause quite as much damage as last year's SQL injection flaw because patches are already available.

At this time, it seems unlikely that the exploitation of this vulnerability will be as widespread as last year's massive campaign exploiting CVE-2023-34362, says Paul Prudhomme, principal security analyst at SecurityScorecard. "That was a zero-day vulnerability, giving threat actors more time to exploit it before a patch became available," he says. "In this case, threat actors have less time because patches are already available; the most that they can do is take advantage of organizations’ delays in patching it, so this window of time is crucial to minimizing its impact."

Prudhomme reiterates that patching alone is not sufficient against vulnerabilities such as CVE-2024-5806. "A layered security approach, combining patching with threat intelligence and proactive risk management, is essential," he says. "Organizations can build resilience against evolving cyber threats by prioritizing a multifaceted approach to security.”

**About the Author(s)**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

MOVEit Transfer Flaws Push Security Defense Into a Race With Attackers

In this Black Hat USA preview, scholar Jason Healey examines strategies for measuring and shifting the balance of cyber defense.

Source: Ronstik via Alamy

Defenders are perpetually playing catch-up to attackers. For every security innovation or new technology introduced, cybercriminals develop just as many tricks to bypass them. This ongoing struggle will be the focus of an upcoming presentation at Black Hat USA 2024, this August in Las Vegas, by Jason Healey, a senior research scholar at Columbia University.

"For over 50 years, we've known that the red team always gets through," Healey says. "Despite the billions of dollars spent, thousands of patents filed, and countless hours worked, defense hasn't notably improved relative to offense."

Last year's publication of the US National Cybersecurity Strategy marked a significant milestone, setting a new goal to enhance defense at the largest scale and least cost. However, Healey argues that progress means little without measurable indicators to determine whether defense is gaining relative advantages over offense.

Healey's session at Black Hat — titled "Is Defense Winning?" — will introduce several key indicators to assess whether the balance is shifting in favor of defense.

"Many of these indicators, such as changes to mean time to detect \[MTTD\], are already collected by the community," he says. "Others, like measuring the mean time between catastrophes, might need to be fresh."

Drawing parallels with climate change metrics, Healey says there is a need for a similar holistic approach to security as well.

"Just as climate experts track CO2 levels and temperature changes, we need macro-level indicators to understand cyberspace as a whole," he says.

**Measuring Success in Cyber Defense**

Healey played a role in drafting the National Cybersecurity Strategy, which incorporates the concept of defensibility and leverage. He believes systemic changes, such as automated updates, over individual actions, like user education or isolated security measures, will be more important in affecting change for defenders.

"We need to find areas where the smallest turn of the screwdriver will have the largest impact," he says.

One of the critical challenges Healey addresses is how to measure success in cyber defense. He proposes several propositions and indicators to gauge progress, including the ability of threat actors to adapt their tactics, techniques, and procedures (TTPs).

"We would want to see them having to rapidly change their TTPs because we're thwarting them," he says.

Healey also calls for the cybersecurity community to leverage existing reports, such as Verizon's annual data breach report and Google's zero-day reports, to establish defensibility metrics.

"Companies like Veracode already report relevant metrics, but they need to be presented in time series to track trends," he says.

**Achieving New Indicators for Defense**

Healey's ultimate goal is to inspire the cybersecurity community to strive for measurable improvements. His presentation aims to spark a crucial conversation about the effectiveness of current strategies and the importance of setting tangible goals, challenging attendees to reflect on their collective impact.

"We need to set reasonable targets, like reducing the mean time to detect and dwell time to less than 24 hours by 2030," Healey says. "Are we actually making the difference we say we want to have in the world?"

By introducing new indicators and drawing on lessons from other fields, Healey aims to equip defenders with the tools they need to shift the balance in their favor. The date and time for Healey's presentation will be published soon.

**About the Author(s)**

Contributing Writer, Dark Reading

Joan Goodchild is a veteran journalist, editor, and writer who has been covering security for more than a decade. She has written for several publications and previously served as editor-in-chief for CSO Online.

Is Defense Winning? A Look at Decades of Playing Catch-up

The heightened regulatory and legal pressure on software-producing organizations to secure their supply chains and ensure the integrity of their software should come as no surprise. In the last several years, the software supply chain has become an increasingly attractive target for attackers who see opportunities to force-multiply their attacks by orders of magnitude. For example, look no

The heightened regulatory and legal pressure on software-producing organizations to secure their supply chains and ensure the integrity of their software should come as no surprise. In the last several years, the software supply chain has become an increasingly attractive target for attackers who see opportunities to force-multiply their attacks by orders of magnitude. For example, look no further than 2021's Log4j breach, where Log4j (an open-source logging framework maintained by Apache and used in a myriad of different applications) was the root of exploits that put thousands of systems at risk.

Log4j's communication functionality was vulnerable and thus provided an opening for an attacker to inject malicious code into the logs which could then be executed on the system. After its discovery, security researchers saw millions of attempted exploits, many of which turned into successful denial-of-service (DoS) attacks. According to some of the latest research by Gartner, close to half of enterprise organizations will have been the target of a software supply chain attack by 2025.

But what is the software supply chain? Well for starters, it's defined as the sum total of all the code, people, systems, and processes that contribute to the development and delivery of software artifacts, both inside and outside of an organization. And what makes securing the software supply chain so challenging is the complex and highly-distributed nature of developing modern applications. Organizations employ global teams of developers who rely on an unprecedented number of open source dependencies, along with a breadth of code repos and artifact registries, CI/CD pipelines, and infrastructure resources used for building and deploying their applications.

And while security and compliance are consistently a top concern for enterprise organizations, the challenge of securing the organization's software supply chains looms larger and larger. Many organizations are making material progress with operationalizing DevSecOps practices, however, a great deal of them still find themselves in the early stages of figuring out what to do.

Which is exactly why we've put this article together. Though the following is by no means an exhaustive list, here are four guiding principles for getting your software supply chain security efforts rolling in the right direction.

****Consider All Aspects of your Software Supply Chain When Applying Security****

Given that over 80% of code bases have at least one open-source vulnerability, it stands to reason that OSS dependencies have been a central focus of software supply chain security. However, modern software supply chains encompass other entities whose security postures are either overlooked or not understood broadly enough within the organization to be properly managed. These entities are code repositories, CI and CD pipelines, infrastructure, and artifact registries, each of which requires security controls and regular compliance assessment.

Frameworks such as OWASP Top-10 for CI/CD and CIS Software Supply Chain Security Benchmark. Adhering to these frameworks will require granular RBAC, applying the principle of least privilege, scanning containers and infrastructure-as-code for vulnerabilities and misconfigurations, isolating builds, integrating application security testing, and proper management of secrets – just to name a few.

****SBOMs are Essential for Remediating Zero-days and Other Component Issues****

Part of Executive Order 14028, issued by the White House in mid-2021 to strengthen the nation's cybersecurity posture, mandates that software producers provide their federal customers with a software bill of materials (SBOMs). SBOMs are essentially formal records intended to provide visibility into all the components that make up a piece of software. They provide a detailed, machine-readable inventory that lists all open source and third-party libraries, dependencies, and components used in building the software.

Whether an organization is compelled by EO 14028 or not, generating and managing SBOMs for software artifacts is a valuable practice. SBOMs are an indispensable tool for remediating component issues or zero-day vulnerabilities. When stored in a searchable repository, SBOMs provide a map of where a specific dependency exists and enable security teams to quickly trace vulnerabilities back to impacted components.

****Govern the Software Development Lifecycle with Policy-as-code****

In the world of modern application development, rock-solid guardrails are an essential tool for eliminating errors and intentional actions that compromise security and compliance. Proper governance throughout the software supply chain means that the organization has made it easy to do the right things and extremely difficult to do the wrong things.

While many platforms and tools offer out-of-the-box policies that can be quickly enforced, policy-as-code based on the Open Policy Agent industry standard enables authoring and enforcing fully-customizable policies. Policies governing everything from access privileges to allowing or denying the use of OSS dependencies based on criteria such as supplier, version, package URL, and license.

****Be able to Verify & Ensure Trust in your Software Artifacts using SLSA****

How can users and consumers know that a piece of software is trustworthy? In determining the trustworthiness of a software artifact, you'd want to know about things like who wrote the code, who built it, and on which development platform it was built. Knowing what components are in it would also be something you should know.

Making a decision whether to trust software is possible once provenance– the record of a software's origins and chain of custody– can be verified. For this, the Supply Chain Levels for Software Artifacts (SLSA) framework was created. It gives software-producing organizations the ability to capture information about any aspect of the software supply chain, verify properties of artifacts and their build, and reduce the risk of security issues. In practice, it's essential for software-producing organizations to adopt and adhere to the SLSA framework requirements and implement a means of verifying and generating software attestations which are authenticated statements (metadata) about software artifacts throughout their software supply chains.

Given the magnitude and complexity of securing the modern software supply chain, the above guidance merely scratches the surface. But like everything else in the world of building and deploying modern applications, the practice is evolving fast. To help you get started, we recommend reading _How to Securely Deliver Software –_ an ebook full of best practices designed to strengthen your security posture and minimize risk for your business.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Practical Guidance For Securing Your Software Supply Chain

An unknown adversary compromised a CISA app containing the data via a vulnerability in the Ivanti Connect Secure appliance this January.

Source: SeventyFour via Shutterstock

An unknown threat actor may have accessed critical information on US chemical facilities by compromising the US Cybersecurity and Infrastructure Security Agency's (CISA) Chemical Security Assessment Tool (CSAT) earlier this year, by way of known Ivanti flaws.

Data the adversary may have accessed includes the types and quantities of chemicals stored at different facilities, facility-specific security vulnerability assessments, site security plans, and personnel identity information of individuals who might have sought access to restricted areas at high-risk facilities.

**Anti-Terror Related Data**

CISA required chemical facilities around the country to provide this information as part of the Department of Homeland Security's Chemical Facility Anti-Terrorism Standards (CFATS) program to enhance security at high-risk chemical facilities in the US. CFATS expired in July 2023.

According to CISA, a threat actor may have accessed data in its CSAT application after chaining together several zero-day vulnerabilities Ivanti disclosed earlier this year in its Connect Secure appliance. In a notification letter to stakeholders, DHS associate director Kelly Murray said the intrusion happened during a two-day period, sometime between Jan. 23 and Jan. 26, 2024.

After gaining access to the Ivanti appliance, the threat actor deployed a web shell on it that enabled remote command execution and arbitrary file writes to the underlying system, Murray said. The attacker accessed the web shell several times during the two-day period but there is no evidence of any data exfiltration or lateral movement beyond the Ivanti device, she said.

"While CISA's investigation found no evidence of exfiltration of data, this may have resulted in the potential unauthorized access of Top-Screen surveys, Security Vulnerability Assessments, Site Security Plans, Personnel Surety Program submissions, and CSAT user accounts," Murray said. "All information in CSAT was encrypted using AES 256 encryption and information from each application had additional security controls limiting the likelihood of lateral access," she noted.

Even so, David Brumley, CEO of ForAllSecure, says the CVEs that CISA pointed to in its advisory would allow an attacker to go from a remote and unprivileged status over the network to having full access. And at least one of the vulnerabilities already has a public exploit, Brumley says.  
"CISA is saying for users to rotate their passwords, but I'm sure internally they're doing an internal investigation as well," he notes. "The vulnerabilities listed would have given attackers access to key parts of the network potentially."    
Brumley says its somewhat ironic that the very entity that notified other organizations about these vulnerabilities became a victim itself.

"If CISA can't patch fast enough, what does that say about the rest of us?", Brumley says. "We need to be investing in quicker turnarounds from time-of-vulnerability-disclosure to having all systems patched."

**Potential Safety Implications**

Howard Goodman, technical director at Skybox Security, says the breach has potential security implications given the nature of the CSAT tool and the sensitive data it contains. "The exposure of chemical inventories and security plans could potentially be exploited by malicious actors to target facilities, posing risks to public safety and the environment," Goodman says.

Affected organizations should conduct a thorough review of their existing cybersecurity measures and, if needed, update them. They should also consider enhancing physical and cybersecurity measures, especially in areas identified in their CSAT submission. In addition, they should "increase monitoring and threat detection capabilities to identify any suspicious activities that may indicate targeted attacks," Goodman says. "Engage in information sharing with industry peers and relevant government agencies to stay informed about potential threats and best practices."

**Ivanti Zero-Days**

The DHS breach notification did not identify the specific Ivanti vulnerability or vulnerabilities that the threat actor exploited to gain access to the CSAT application. However, it directed stakeholders to a CISA advisory on Feb. 29, 2024, that warned about exploit activity targeting three vulnerabilities in Ivanti Connect and Policy Secure Gateways: CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893. The flaws affect all supported versions of Ivanti Connect Secure and Ivanti Policy Secure gateways. Attackers can exploit the vulnerabilities in a chained fashion to bypass authentication mechanisms, craft malicious requests, and execute arbitrary commands with admin level privileges on affected systems.

The flaws were among several critical vulnerabilities Ivanti disclosed earlier this year, prompting a complete overhaul of its security practices.

In an emailed comment, Roger Grimes, data-driven defense evangelist at KnowBe4, expressed some dissatisfaction with CISA's decision not to mention whether the agency had patched the flaws. 

"If they were exploited by a known vulnerability where a patch was available...why wasn't the patch installed?" Grimes said. "Was it simply due to the fact that the exploit happened faster than the patch could be applied \[or\] was the patch missed?"

CISA itself has recommended that all affected chemical facilities maintain their current cybersecurity and physical security postures and address vulnerabilities as they would normally.

"While the investigation found no evidence of credentials being stolen," CISA added, "CISA encourages individuals who had CSAT accounts to reset the passwords for any account, business or personal, which used the same password."

**About the Author(s)**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Threat Actor May Have Accessed Sensitive Info on CISA Chemical App

A list of topics we covered in the week of June 17 to June 23 of 2024

June 21, 2024 - A cybercriminals is giving 1 million data records from the Ticketmaster breach away for free, saying that Ticketmaster refused to pay

June 21, 2024 - “Immediately stop using \[Kaspersky\] and switch to an alternative” warned the Commerce Secretary in a new US ban of the antivirus provider.

June 21, 2024 - IntelBroker is offering source code from major companies for sale. Are they demonstrating the value of a zero-day they are also selling?

June 20, 2024 - The FTC has referred a complaint against TikTok and its parent company ByteDance to the Department of Justice.

June 18, 2024 - Despite existing countermeasures, Android overlays are still used in malware attacks and phishing. What are they and what can we do?

 A week in security (June 17 &#8211; June 23) 

PRESS RELEASE

DALLAS and TOKYO, June 18, 2024— VicOne, an automotive cybersecurity solutions leader, today announced that its xNexus and xZETA solutions are available in AWS Marketplace, a digital catalog with thousands of software listings from independent software vendors that make it easy to find, test, buy, and deploy software that runs on Amazon Web Services (AWS). xNexus is a next-generation vehicle security operations center (VSOC) platform and xZETA is an automotive vulnerability and software bill of materials (SBOM) management system. These safeguard the automotive software supply chain with unique zero-day threat intelligence, providing accurate, contextualized, and actionable insights for risk assessment.

AWS customers will now have access to VicOne’s solutions directly within AWS Marketplace. VicOne provides AWS customers with the ability to streamline the purchase and management of xNexus and xZETA within their AWS Marketplace account. 

“In various ways, our listing in AWS Marketplace is another of our efforts to help automotive manufacturers to securely put in place all of the many high-quality solutions they need across a globally scoped software supply chain for SDVs (software-defined vehicles),” said Max Cheng, chief executive officer of VicOne. “By accessing VicOne solutions, customers, MSSPs (managed security service providers) and other partners can more efficiently and simply offer our products to protect the automotive software supply chain against zero-day vulnerabilities and cyberattacks.” 

xNexus integrates with VicOne’s in-vehicle VSOC sensor, leveraging a unique large language modeling (LLM) approach to provide customized reporting to support VSOC teams. xNexus provides VSOC teams with actionable and contextualized attack paths based on different stakeholders’ needs. The capabilities delivered by VicOne’s next-gen VSOC platform accelerate threat investigations, enable confident response to attacks, and effectively reduce the burden of chasing false alarms. 

xZETA is an automotive vulnerability and SBOM management system that scans vehicle software to identify zero-day, undisclosed, known, and customer-discovered vulnerabilities, along with CWE, malware, and advanced persistent threats. Through xZETA’s patent-pending VicOne Vulnerability Impact Rating (VVIR) technology, external and internal insights are integrated to prioritize high-risk vulnerabilities. This enables swift identification of high-risk issues and formulation of corresponding strategies. Information feeds back into Threat Analysis and Risk Assessment (TARA) results to ensure alignment with ISO/SAE 21434 processes and maintain continuous monitoring.

Services will be available in Japan as soon as it is ready.

To learn more about the VicOne solutions available in AWS Marketplace, please visit here.

About VicOne

With a vision to secure the vehicles of tomorrow, VicOne delivers a broad portfolio of cybersecurity software and services for the automotive industry. Purpose-built to address the rigorous needs of automotive manufacturers and suppliers, VicOne solutions are designed to secure and scale with the specialized demands of the modern vehicle. As a Trend Micro subsidiary, VicOne is powered by a solid foundation in cybersecurity drawn from Trend Micro’s 30+ years in the industry, delivering unparalleled automotive protection and deep security insights that enable our customers to build secure as well as smart vehicles. For more information, visit vicone.com.

You May Also Like

VicOne Solutions for Detection of Zero-Day Vulnerabilities and Contextualized Attack Paths

IntelBroker is offering source code from major companies for sale. Are they demonstrating the value of a zero-day they are also selling?

A moderator of the notorious data breach trading platform BreachForums is offering data for sale they claim comes from a data breach at T-Mobile.

The moderator, going by the name of IntelBroker, describes the data as containing source code, SQL files, images, Terraform data, t-mobile.com certifications, and “Siloprograms.” (We’ve not heard of siloprograms, and can’t find a reference to them anywhere, so perhaps it’s a mistranslation or typo.)

Post offereing data for sale supposedly from a T-Mobile internal breach

To prove they had the data, IntelBroker posted several screenshots showing access with administrative privileges to a Confluence server and T-Mobile’s internal Slack channels for developers.

But according to sources known to BleepingComputer, the data shared by IntelBroker actually consists of older screenshots. These screenshots show T-Mobile’s infrastructure, posted at a known—yet unnamed—third-party vendor’s servers, from where they were stolen.

When we looked at the screenshots IntelBroker attached to their post, we spotted something interesting in one of them.

Found CVE-2024-1597

This screenshot shows a search query for a critical vulnerability in Jira, a project management tool used by teams to plan, track, release and support software. It’s typically a place where you could find the source code of works in progress.

The search returns the result CVE-2024-1597, a SQL injection vulnerability. SQL injection happens when a cybercriminal injects malicious SQL code into a form on a website, such as a login page, instead of the data the form is asking for. The vulnerability affects Confluence Data Center and Server according to Atlassian’s May security bulletin.

For a better understanding, it’s important to note that Jira and Confluence are both products created by Atlassian, where Jira is the project management and issue tracking tool and Confluence is the collaboration and documentation tool. They are often used together.

If IntelBroker has a working exploit for the SQL injection vulnerability, this could also explain their claim that they have the source code of three internal tools used at Apple, including a single sign-on authentication system known as AppleConnect.

This theory is supported by the fact that IntelBroker is also offering a Jira zero-day for sale.

IntelBroker selling zero-day for JIra

> “I’m selling a zero-day RCE for Atlassian’s Jira.
> 
> Works for the latest version of the desktop app, as well as Jira with confluence.
> 
> No login is required for this, and works with Okta SSO.”

If this is true then this exploit, or its fruits, might be used for data breaches that involve personal data.

Meanwhile, T-Mobile has denied it has suffered a breach, saying it is investigating whether there has been a breach at a third-party provider.

> “We have no indication that T-Mobile customer data or source code was included and can confirm that the bad actor’s claim that T-Mobile’s infrastructure was accessed is false.”

**We don’t just report on threats – we help safeguard your entire digital identit**y

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 Was T-Mobile compromised by a zero-day in Jira? 

Crypto exchange Kraken revealed that an unnamed security researcher exploited an "extremely critical" zero-day flaw in its platform to steal $3 million in digital assets and refused to return them.
Details of the incident were shared by Kraken's Chief Security Officer, Nick Percoco, on X (formerly Twitter), stating it received a Bug Bounty program alert about a bug that "allowed them to

Cybercrime / Crypto Security

Crypto exchange Kraken revealed that an unnamed security researcher exploited an "extremely critical" zero-day flaw in its platform to steal $3 million in digital assets and refused to return them.

Details of the incident were shared by Kraken's Chief Security Officer, Nick Percoco, on X (formerly Twitter), stating it received a Bug Bounty program alert about a bug that "allowed them to artificially inflate their balance on our platform" without sharing any other details

The company said it identified a security issue within minutes of receiving the alert that essentially permitted an attacker to "initiate a deposit onto our platform and receive funds in their account without fully completing the deposit."

While Kraken emphasized that no client assets were at risk of the issue, it could have enabled a threat actor to print assets in their accounts. The problem was addressed within 47 minutes, it said.

It also said the flaw stemmed from a recent user interface change that allows customers to deposit funds and use them before they were cleared.

On top of that, further investigation unearthed the fact that three accounts, including one belonging to the supposed security researcher, had exploited the flaw within a few days of each other and siphon $3 million.

"This individual discovered the bug in our funding system, and leveraged it to credit their account with $4 in crypto," Percoco said. "This would have been sufficient to prove the flaw, file a bug bounty report with our team, and collect a very sizable reward under the terms of our program."

"Instead, the 'security researcher' disclosed this bug to two other individuals who they work with who fraudulently generated much larger sums. They ultimately withdrew nearly $3 million from their Kraken accounts. This was from Kraken's treasuries, not other client assets."

In a strange turn of events, on being approached by Kraken to share their proof-of-concept (PoC) exploit used to create the on-chain activity and to arrange the return of the funds that they had withdrawn, they instead demanded that the company get in touch with their business development team to pay a set amount in order to release the assets.

"This is not white hat hacking, it is extortion," Percoco said, urging the concerned parties to return the stolen funds.

The name of the company was not disclosed, but Kraken said it's treating the security event as a criminal case and that it's coordinating with law enforcement agencies about the matter.

"As a security researcher, your license to 'hack' a company is enabled by following the simple rules of the bug bounty program you are participating in," Percoco noted. "Ignoring those rules and extorting the company revokes your 'license to hack.' It makes you, and your company, criminals."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Kraken Crypto Exchange Hit by $3 Million Theft Exploiting Zero-Day Flaw

The China-nexus cyber espionage actor linked to the zero-day exploitation of security flaws in Fortinet, Ivanti, and VMware devices has been observed utilizing multiple persistence mechanisms in order to maintain unfettered access to compromised environments.
"Persistence mechanisms encompassed network devices, hypervisors, and virtual machines, ensuring alternative channels remain available

Zero-Day Exploits / Cyber Espionage

The China-nexus cyber espionage actor linked to the zero-day exploitation of security flaws in Fortinet, Ivanti, and VMware devices has been observed utilizing multiple persistence mechanisms in order to maintain unfettered access to compromised environments.

"Persistence mechanisms encompassed network devices, hypervisors, and virtual machines, ensuring alternative channels remain available even if the primary layer is detected and eliminated," Mandiant researchers said in a new report.

The threat actor in question is **UNC3886**, which the Google-owned threat intelligence company branded as "sophisticated, cautious, and evasive."

Attacks orchestrated by the adversary have leveraged zero-day flaws such as CVE-2022-41328 (Fortinet FortiOS), CVE-2022-22948 (VMware vCenter), and CVE-2023-20867 (VMware Tools) to perform various malicious actions, ranging from deploying backdoors to obtaining credentials for deeper access.

It has also been observed exploiting CVE-2022-42475, another shortcoming impacting Fortinet FortiGate, shortly after its public disclosure by the network security company.

These intrusions have primarily singled out entities in North America, Southeast Asia, and Oceania, with additional victims identified in Europe, Africa, and other parts of Asia. Targeted industries span governments, telecommunications, technology, aerospace and defense, and energy and utility sectors.

A notable tactic in UNC3886's arsenal is that it developed techniques that evade security software and enable it to burrow into government and business networks and spy on victims for extended periods of time without detection.

This entails the use of publicly available rootkits like Reptile and Medusa on guest virtual machines (VMs), the latter of which is deployed using an installer component dubbed SEAELF.

"Unlike REPTILE, which only provides an interactive access with rootkit functionalities, MEDUSA exhibits capabilities of logging user credentials from the successful authentications, either locally or remotely, and command executions," Mandiant noted. "These capabilities are advantageous to UNC3886 as their modus operandi to move laterally using valid credentials."

Also delivered on the systems are two backdoors named MOPSLED and RIFLESPINE that take advantage of trusted services like GitHub and Google Drive as command-and-control (C2) channels.

MOPSLED, a likely evolution of the Crosswalk malware, is a shellcode-based modular implant that communicates over HTTP to retrieve plugins from a GitHub C2 server, while RIFLESPINE is a cross-platform tool that makes use of Google Drive to transfer files and execute commands.

Mandiant said it also spotted UNC3886 deploying backdoored SSH clients to harvest credentials post the exploitation of 2023-20867 as well as leveraging Medusa to set up custom SSH servers for the same purpose.

"The threat actor's first attempt to extend their access to the network appliances by targeting the TACACS server was the use of LOOKOVER," it noted. "LOOKOVER is a sniffer written in C that processes TACACS+ authentication packets, performs decryption, and writes its contents to a specified file path."

Some of the other malware families delivered during the course of attacks aimed at VMware instances are below -

*   A trojanized version of a legitimate TACACS daemon with credential-logging functionality
*   VIRTUALSHINE, a VMware VMCI sockets-based backdoor that provides access to a bash shell
*   VIRTUALPIE, a Python backdoor that supports file transfer, arbitrary command execution, and reverse shell capabilities
*   VIRTUALSPHERE, a controller module responsible of a VMCI-based backdoor

Over the years, virtual machines have become lucrative targets for threat actors owing to their widespread use in cloud environments.

"A compromised VM can provide attackers with access to not only the data within the VM instance but also the permissions assigned to it," Palo Alto Networks Unit 42 said. "As compute workloads like VMs are generally ephemeral and immutable, the risk posed by a compromised identity is arguably greater than that of compromised data within a VM."

Organizations are advised to follow the security recommendations within the Fortinet and VMware advisories to secure against potential threats.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Chinese Cyber Espionage Group Exploits Fortinet, Ivanti and VMware Zero-Days

With the requirement that all vulnerabilities first get reported to the Chinese government, once-private vulnerability research has become a goldmine for China's offensive cybersecurity programs.

Source: Zoonar GmbH via Alamy Stock Photo

China's cybersecurity experts over the past decade have evolved from hesitant participants in global capture-the-flag competitions, exploit contests, and bug bounty programs to dominant players in these arenas — and the Chinese government is applying those spoils toward stronger cyber-offensive capabilities for the nation.

In 2014, for example, Keen Team was the sole Chinese hacking group to take home a prize — scoring 13% of the purse — from the Pwn2Own exploit contest. But by 2017, seven China-based teams collected 79% of the prize money from the contest, according to data from the report, "From Vegas to Chengdu Hacking Contests, Bug Bounties, and China's Offensive Cyber Ecosystem," published last week. The following year, China banned participation in Western contests, gauging the vulnerability information too important to national security.

Its civilian hackers have directly benefited China's cyber-offensive programs and are one example of the success of China's cybersecurity pipeline, which the government created through its requirement that all vulnerabilities be directly reported to government authorities, says Eugenio Benincasa, senior researcher at the Center for Security Studies (CSS) at ETH Zurich, and the author of the report.

"By strategically positioning itself as the final recipient in the vulnerability disclosure processes of civilian researchers, the Chinese government leverages its civilian vulnerability researchers, among the best globally, on a large scale and at no cost," he says.

The open source intelligence report comes as the United States, Australia, Japan, South Korea, and other nations in the Asia-Pacific region have struggled to improve cyber defenses against Chinese advance persistent threat (APT) groups. Earlier this year, high-profile US government officials warned that China was compromising critical infrastructure to pre-position its military hackers for future conflicts. And, in the recently uncovered "Operation Crimson Palace," three different threat teams in China conducted coordinated attacks against a Southeast Asia government agency.

**A Robust Cyber Pipeline**

Starting with university capture-the-flag competitions and ending with exploits that enable military cyber operations, China's pipeline for training civilian hackers highlights the benefits of the country's focus on practical cybersecurity. China's cyber-offensive capability has also significantly benefited from the enforcement of its vulnerability disclosure rule, the Regulations on the Management of Security Vulnerabilities in Network Products (RMSV). Both programs are part of China's overall Military-Civil Fusion (MCF) initiative.

Flow chart showing the pipeline for cybersecurity expertise and vulnerability information. Source: ETH Zurich's "From Vegas to Chengdu Hacking Contests, Bug Bounties, and China’s Offensive Cyber Ecosystem" paper

Focusing its burgeoning numbers of technical graduates on finding vulnerabilities helps amplify its offensive capabilities, says Chris Wysopal, chief technology officer at software security firm Veracode.

"There is a scale difference there. ... They have a large number of technical graduates, and that is being harnessed to find vulnerabilities in \[Western products, such as\] Google Android," he says. "This shows that the incentives are working in their favor, and there's evidence of that."

Two groups of hackers exist within China's cyber-offensive ecosystems. The first group includes vulnerability researchers and offensive security specialists who have distinguished themselves by competing in bug bounty programs and hacking contests, such as the Pwn2Own contest and the Tianfu Cup, which was established as a China-based alternative to Pwn2Own.

The second group consists of the contracted or professional hackers who weaponize vulnerabilities for use in attacks on specific targets. Exploits developed by the first group have often been used by the second, a fact discussed in the iSoon leak earlier this year.

In the past, vulnerability research teams were typically associated with technical groups at large firms, such as Qihoo 360, which has at least 19 teams; the Ant Group, which hosts nine teams; and Tencent, which has at least seven research groups. Today, the researchers often are part of boutique cybersecurity firms.

China's civilian hackers initially obtained training by participating in Western capture-the-flag contests and exploit-development competitions, such as Pwn2Own, as well as bug bounty programs. China now has domestic versions of most of these initiatives and programs, often with the financial backing of top-tier national technical universities.

**Cybersecurity Superstars**

A handful of researchers have made significant contributions to China's programs, highlighting China's reliance on a small group of researchers, according to the report.

More than 50% of Google Android vulnerabilities, for example, are credited to Qihoo 360's Security Response Center (360 SRC), naming Han Zinuo as one of the contributors. When Zinuo moved to cybersecurity firm Oppo, 360 SRC's submissions dropped and Oppo's increased, the research paper stated. Similarly, another researcher, Yuki Chen, accounted for 68% of Qihoo 360's Vulcan researcher group's submissions to Microsoft, and when he moved to boutique firm Cyber Kunlun in 2020, the former firm saw a significant drop in vulnerabilities to Microsoft's bug bounty program, while the latter saw a surge.

Overall, the number of vulnerabilities reported by Chinese firms to the big three US software companies — Apple, Google, and Microsoft — declined starting in 2020. While this could suggest that Chinese firms were no longer reporting the vulnerabilities they discovered, it also coincided with increasing sanctions from the United States, such as the blacklisting of Qihoo 360 in May 2020 due to its links to the Chinese military, the report stated.

"This decrease \[in vulnerability reports has\] raised concerns about the potential loss of a significant channel for vulnerability reporting within the global ecosystem," the report said.

**Downsides for Defense**

Because Chinese teams have curtailed their participation in Western hacking competitions, they have arguably made the competitions less effective as a defensive strategy. In 2022 and 2023, for example, no teams attempted to hack either Apple's iPhone or Google's Pixel at the Pwn2Own competition — that was the first time in 15 years for Apple's iPhone — indicating that China now considers any exploits its experts find as too valuable to demonstrate publicly.

"The notable absence of Chinese hacking teams that specialized in targeting these devices explains this break far better than assuming that the iPhone and Pixel have become unbreachable," the research paper stated. "Concurrently, these vulnerabilities are highly likely evaluated by China's security agencies for potential use in cyber malicious operations."

Even showing such exploits without any accompanying details runs the risk of directing attackers to rediscover vulnerabilities, says Dustin Childs, head of threat awareness for the Zero Day Initiative at Trend Micro, which runs the Pwn2Own competition.

"They have already been demonstrated onstage, so threat actors know they aren’t wasting their time reversing a patch for some that may end up non-exploitable," he says. "This is why we invite vendors to participate in the contest."

Private organizations that deal in exploits act as a bellwether for the vulnerability market. Exploit seller Zerodium currently offers a $2.5 million payday for any hacker that finds a zero-click exploit chain for Google Android and $2 million for a similar attack on iOS.

**China's Own Hacking Competitions**

Meanwhile, China is further divorcing itself from the global information infrastructure, moving its infrastructure to domestically developed technology. Unsurprisingly, its cybersecurity pipeline is following suit, with some major exploit competitions focusing increasingly on Chinese products.

In the long term, China will have to follow two paths, Benincasa says.

"We are observing an interesting shift in China's hacking competitions toward focusing more on their own products, while at the same time maintaining a strong interest in Western ones," he says, adding, "China's strategic intent \[is\] to maintain a presence in international products for offensive purposes, given the expertise of its hackers in targeting Western products, while simultaneously focusing on domestic products for defensive purposes as it gradually reduces reliance on US vendors."

**About the Author(s)**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Tag

#zero_day