US Federal Cyber Incidents Go Up

US Federal Cybersecurity Incidents Rose 9.9% in 2023

Ukrainian Police Arrest Suspected Conti, LockBit Developer

BlackBasta Gang May Have Exploited Microsoft Flaw

Researchers from Symantec’s Threat Hunter Team said in a Wednesday blog post that the cybercriminal group associated with Black Basta ransomware may have exploited a now-patched Windows flaw despite Microsoft’s conviction that it wasn’t used in the wild.

The Cardinal cybercrime group, also tracked as Storm-1811 and UNC4393, apparently used a tool to exploit CVE-2024-26169, an elevation of privilege vulnerability in the Windows Error Reporting Service. Symantec said it spotted a compile date of Feb. 27, weeks before Microsoft published a patch on March 12.

The tool took advantage of an apparently now-patched characteristic of werkernel.sys, a Windows file that manages error reporting functions. The flaw allowed hackers to create and control a subkey in the Windows registry, inserting a pathname to a malware executable into the registry field reserved for a debugging script. Hackers could create the subkey because werkernel.sys used a “null security descriptor” when generating registry keys, meaning it didn’t assign an object owner and primary group to the parent key but automatically assigned subkey ownership to the current user – in this case, the attacker.

Symantec attributes the activity to Cardinal based on similarities between the detected group’s tactics, techniques, and procedures and those described in a recent Microsoft report that details Black Basta activity. The similarities included “use of Quick Assist, ScreenConnect, malicious batch files, and suspicious cURL behavior,” said Dick O’Brien, principal intelligence analyst, Symantec, in an email.

Microsoft’s June 2024 Patch Tuesday includes updates for 51 security flaws, featuring 18 remote code execution vulnerabilities and one publicly disclosed zero-day. The update also covers 25 elevation of privilege vulnerabilities, three information disclosure vulnerabilities and five denial of service vulnerabilities.

The zero-day vulnerability, tracked as CVE-2023-50868, is a vulnerability in DNSSEC validation “where an attacker could exploit standard DNSSEC protocols intended for DNS integrity by using excessive resources on a resolver,” Microsoft said. Mitre created the CVE in February. Major DNS implementations including BIND, PowerDNS and Unbound have already released patches.

Other significant fixes include multiple Microsoft Office RCE vulnerabilities, notably in Microsoft Outlook. Microsoft also patched seven Windows Kernel privilege elevation flaws that could allow local attackers to gain system privileges.

SolarWinds published an update of its platform that addresses several high-severity vulnerabilities, including an issue reported by a NATO penetration tester. The update includes fixes for three new security defects and multiple bugs in third-party components.

It also includes fixes for a medium-severity flaw in Angular and 10 high- and medium-severity issues in OpenSSL, some dating back seven years.

SolarWinds also released a hotfix for CVE-2024-28995, a high-severity directory traversal vulnerability in Serv-U. This flaw, which has a CVSS score of 8.6, allows attackers to read sensitive files on the host machine. SolarWinds did not report that any of the vulnerabilities were exploited in the wild.

JetBrains patched a critical vulnerability in its IntelliJ-based IDEs, version 2023.1 and onward that could lead to disclosure of access tokens on GitHub.

Discovered on May 29, this flaw affected popular IDEs such as IntelliJ, PyCharm, WebStorm and PhpStorm, used by over 10 million developers globally. JetBrains updated all affected IDEs and the GitHub plug-in and removed older plug-in versions from the JetBrains Marketplace. Developers are advised to revoke any GitHub tokens used by the plug-in and check OAuth and personal access token settings for compromised tokens. JetBrains previously warned of severe vulnerabilities in its TeamCity servers that could enable authentication bypass and path traversal (see: JetBrains’ TeamCity Bugs Could Lead to Server Takeover).

Researchers at the Alan Turing Institute said an April study that appeared to find that GPT-4 powered agents can autonomously develop exploits of reported security vulnerabilities likely suffered from bad methodology.

The study says that artificial intelligence agents in 87% of cases used CVE descriptions to hack websites and had more success with vulnerabilities that ranked lower on the CVSS scale.

The institute report says it’s not clear whether the agents developed the vulnerabilities or merely identified them through a web search. Although some of the CVEs became public after the data cutoff data for the large language model’s training data, it turns out the agents were equipped with web-searching tools. “Subsequent work has shown that for 11 of the vulnerabilities, a publicly available exploit was found,” the report states.

“This throws doubt on the original paper’s claim that the LLM-agents can autonomously write the exploits as an emergent behavior, suggesting they most likely searched for the exploit online instead.”

AI can be helpful in threat mitigation, such as by uncovering vulnerabilities through fuzzing, mapping target networks and scanning assets, the report says.

Santander Bank advised customers to change their passwords following a data breach that apparently involved customer information files belonging to customers in Spain, Chile and Uruguay (see: Hacker Sells Apparent Santander Bank Customer Data).

El Confidencial reported Wednesday that the bank has notified customers that data including names and birthdates are part of the leaked data set but that data allowing hackers to directly access customer bank accounts are not. It nonetheless advised a password change in case the password might be easy to guess based on the leaked information.

Santander attributed the breach to an incident at a third-party database provider but did not give its name.

A RansomHub ransomware attack on U.K.-based auction house Christie’s last month led to the theft of information of 45,798 individuals, far fewer than the 500,000 claimed by the attackers, reported The Register. The breach occurred between May 8 and May 9 and resulted in the exfiltration of some stored data. The compromised data included names and ID document numbers. Christie’s did not pay the ransom since negotiations with RansomHub collapsed before data exposure.

Bitdefender’s 2024 Cybersecurity Assessment Report reveals a significant shift in the cybersecurity landscape, with 3 in 5 respondents indicating they will be looking for a new job within the next year, representing a 25% increase from last year’s results.

The survey polled over 1,200 IT professionals – 70% of whom said that they often work on weekends “due to the security concerns that my company faces.” Nearly one-quarter said there are too many systems to manage effectively, and 71% of respondents said they feel that security solutions have not lived up to the promised hype, an increase from 54% last year.

Other Coverage From Last Week

With reporting from Information Security Media Group’s David Perera in Washington, D.C., and Akshaya Asokan in southern England.