Monatliches Briefing: Sicherheitsvorfälle durch ungepatchte Schwachstellen

31.01.2025

ENTRYZERO
32% der Sicherheitsvorfälle durch Ransomware-Angriffe starten mit ungepatchten Schwachstellen , die zu geschäftskritischen Folgen führen. In unserem wöchentlichen Briefing zu den fünf relevantesten Schwachstellen für Hacker haben wir über Schwachstellen berichtet, die für Bedrohungsakteure von Bedeutung sind. In dieser fortlaufenden Serie werden wir monatliche Rückblicke auf ausgewählte Sicherheitsvorfälle geben, die mit den gemeldeten Schwachstellen in Zusammenhang stehen.
January 2025
Zusammenfassung: AT&T und Verizon, zwei der größten Telekommunikationsanbieter in den USA, wurden im vierten Quartal 2024 Opfer eines Cyberangriffs durch die staatlich geförderte APT-Gruppe Salt Typhoon. Die Angreifer erlangten unbefugten Zugriff auf interne Unternehmensnetze, wodurch möglicherweise sensible Kundendaten und vertrauliche interne Kommunikation offengelegt wurden. Beide Unternehmen betonten, dass ihre Kernnetze sicher blieben, während forensische Untersuchungen und Bedrohungsbewertungen durchgeführt werden, um das volle Ausmaß des Angriffs zu bestimmen. Die Angreifer von Salt Typhoon sind bekannt dafür, unter anderem die folgenden Schwachstellen auszunutzen: CVE-2024-21887, CVE-2023-46805 und CVE-2023-48788
Breach Victim: AT&T and Verizon
Victim Whois: AT&T Inc., headquartered in Dallas, Texas, is a multinational conglomerate and the largest telecommunications provider in the United States. The company delivers mobile, broadband, and enterprise solutions to millions of customers globally. Verizon Communications Inc., based in New York City, is a leading telecommunications conglomerate and a key component of the Dow Jones Industrial Average, providing wireless services, broadband connectivity, and fiber-optic solutions to businesses and consumers worldwide
Breach Date: Q4 2024
Threat Actor: Salt Typhoon is a state-sponsored advanced persistent threat (APT) group known for conducting cyber espionage and targeting critical infrastructure
Impact: Unauthorized access to internal corporate networks, potentially exposing sensitive customer data and confidential internal communications. While both AT&T and Verizon have stated that their core networks remain secure, forensic investigations and threat assessments are ongoing to determine the full scope of the breach
Vulnerability: Selected vulnerabilities associated with Salt Typhoon are:
- CVE-2024-21887: Ivanti Connect Secure and Ivanti Policy Secure Command Injection Vulnerability
- CVE-2023-46805: Ivanti Connect Secure and Ivanti Policy Secure Authentication Bypass Vulnerability
- CVE-2023-48788: FortiClient Enterprise Management Server (FortiClientEMS) SQL Injection Vulnerability
- CVE-2022-3236: Sophos Firewall Code Injection Vulnerability
- CVE-2021-26855: Microsoft Exchange Server Server-Side Request Forgery Vulnerability (ProxyLogon)
Backstory: AT&T and Verizon reaffirm network security following Salt Typhoon cyber intrusion
December 2024
Zusammenfassung: Das US-Finanzministerium, die Exekutivbehörde, die für die Förderung des wirtschaftlichen Wohlstands und die Sicherstellung der finanziellen Sicherheit der Vereinigten Staaten verantwortlich ist, wurde im vierten Quartal 2024 Opfer eines Cyberangriffs. Der Vorfall wurde einem chinesischen staatlich geförderten Advanced Persistent Threat (APT) Akteur zugeschrieben, wie Aditi Hardikar, stellvertretende Sekretärin für Verwaltung im US-Finanzministerium, erklärte. Der Angriff führte zur Kompromittierung von Arbeitsstationen und zum Zugriff auf Dokumente. Das US-Finanzministerium bezeichnete den Angriff als “großen Vorfall”. Die Schwachstellen, die ausgenutzt wurden, betrafen BeyondTrust Privileged Remote Access (PRA) und Remote Support (RS) und beinhalteten eine nicht authentifizierte Remote-Attacke sowie Schwachstellen bei zurückgezogenen API-Schlüsseln und Befehlsinjektionen (CVE-2024-12356, CVE-2024-12686)
Breach Victim: U.S. Treasury Department
Victim Whois: The U.S. Treasury Department is the executive agency responsible for promoting economic prosperity and ensuring the financial security of the United States. It manages federal finances, collects taxes, produces currency, and formulates economic policy. The department also oversees the enforcement of federal finance and tax laws. Established in 1789, it plays a crucial role in advising the President on financial matters and maintaining the stability of the U.S. financial system and combating financial crimes
Breach Date: Q4 2024
Threat Actor: “Based on available indicators, the incident has been attributed to a Chinese state-sponsored Advanced Persistent Threat (APT) actor”, Aditi Hardikar, assistant secretary for management at the U.S. Treasury
Impact: Compromise of workstations and access to documents. The U.S. Treasury deemed the breach a “major incident”, see Chinese Hackers Accessed US Treasury Workstations in ‘Major’ Cybersecurity Incident
Vulnerability: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) | Unauthenticated Remote Attack | Revoked API Key and Command Injection Vulnerabilities | CVE-2024-12356, CVE-2024-12686
Backstory: BeyondTrust suffering a cyberattack in early December
November 2024
Zusammenfassung: Delta Air Lines, eine führende amerikanische Fluggesellschaft, und Amazon, ein globaler E-Commerce- und Technologieriese, wurden Opfer eines Cyberangriffs der Gruppe Nam3L3ss, die durch die Ausnutzung der MOVEit-Transfer-Schwachstelle CVE-2023-34362, einer ungepatchten SQL-Injection-Lücke, ohne Authentifizierung Zugriff erlangte und sensible Mitarbeiterdaten wie Kontaktinformationen sowie Organisationsstrukturen exfiltrierte
Breach Victims: Delta Air Lines & Amazon.com
Victim Whois: Delta Air Lines is a major American airline, founded in 1925 and headquartered in Atlanta, Georgia, with a global network of over 5,000 flights daily. Amazon.com, founded in 1994 and headquartered in Seattle, Washington, is a leading e-commerce and technology company known for its vast online marketplace and cloud services (AWS). Both companies employ hundreds of thousands of people globally
Breach Date: Q4 2024
Threat Actor: Nam3L3ss
Breach Impact: Exfiltrating employee data, including contact information and organizational structures
Threat Actor Initial Access: An unpatched MOVEit Transfer database vulnerable to CVE-2023-34362. The latter is a SQL injection vulnerability that allows unauthenticated access to the MOVEit file transfer utility’s database to remote attackers; see details, PoC
Threat Actor Relevant Vulnerabilities: Selected vulnerabilities associated with Nam3L3ss: CVE-2023-34362 (MOVEit Transfer), among others. The actor claims to rely primarily on any exposed sources, including ransomware leaks
October 2024
Zusammenfassung: Die globale Digitalagentur BORN Group wurde im dritten Quartal 2024 zum Opfer der Bedrohungsakteure IntelBroker. Die Angreifer nutzten eine ungepatchte Schwachstelle im öffentlich zugänglichen Jenkins-Server aus, um SSH-Schlüssel zu stehlen und weitere Angriffe über das GitHub-Repository der BORN Group durchzuführen. Dabei wurden sensible Daten von Kunden sowie persönliche Informationen von etwa 196.000 Personen entwendet
Breach Victim: BORN Group
Victim Whois: BORN Group Inc. is a global digital marketing, commerce, and technology services provider specializing in end-to-end digital transformations for enterprises. Founded in 2011 and headquartered in New York, BORN Group has offices in London, Hong Kong, Singapore and India. BORN Group employs over 1,100 people and has clients like Google, Tata, Red Bull, and TAG Heuer. In 2019, BORN Group was acquired by IT services firm Tech Mahindra
Breach Date: Q3 2024
Threat Actor: IntelBroker
Breach Impact: Exfiltrating sensitive data from multiple clients. Additionally, IntelBroker claims to have compromised the Market database as part of this breach, exposing the personal information of approximately 196,000 individuals
Threat Actor Initial Access: An exposed Jenkins server vulnerable to CVE-2024-23897. The latter allows unauthenticated read of arbitrary files on the Jenkins controller file system. The threat actor used this vulnerability to steal SSH keys from the Jenkins server, which were further used to carry on the attack via the GitHub repository of the BORN group; see details
Threat Actor Relevant Vulnerabilities: Selected vulnerabilities associated with IntelBroker: CVE-2024-23897 (Jenkins), CVE-2024-23897 (Postgresql)
September 2024
Zusammenfassung: Deloitte, eines der weltweit größten Beratungsunternehmen, wurde im dritten Quartal 2024 durch eine ungeschützte und öffentlich zugängliche Apache Solr-Instanz gehackt, wodurch Angreifer sensible Informationen wie E-Mail-Adressen, interne Einstellungen und Intranet-Kommunikation erlangten. Die Schwachstellen resultierten aus ungepatchten Sicherheitslücken sowie Fehlkonfigurationen, wie der Verwendung von Standard-Anmeldeinformationen
Breach Victim: Deloitte
Victim Whois: Deloitte is one of the world’s largest professional services firms, providing consulting, audit, tax, and advisory services to businesses and governments globally. It operates across various industries, helping clients address challenges in areas like technology, strategy, and operations. In 2023, Deloitte generated approximately $64.9 billion in global revenue
Breach Date: Q3 2024
Impact: The threat actor claims to have compromised sensitive information such as email addresses, internal settings, and communications between intranet users
Attack Entry Point: An exposed Apache Solr to the Internet with default configurations leading to unauthorized access up to remote code execution
Threat Relevant Vulnerabilities: Selected vulnerabilities affecting Apache Solr: Default credentials, CVE-2021–44228, CVE-2019-17558, CVE-2019-12409
August 2024
Zusammenfassung: Die Abteilung für Bildung der Stadt Helsinki wurde im zweiten Quartal 2024 Ziel eines Cyber-Angriffs. Die Hacker missbrauchten eine nicht gepatchte Sicherheitslücke eines Remote Access Servers als Angriffspunkt in die Systeme. Nach einer offiziellen Stellungnahme von Hannu Heikkinen, Chief Digital Officer der Stadt, heißt es: „Ein HotfixPatch war verfügbar, um diese Sicherheitslücke zu schließen, jedoch ist es derzeit nicht bekannt, warum dieser Hotfix nicht auf dem Server installiert wurde.“
Breach Victim: City of Helsinki
Affected Unit: Education division
Breach Date: Q2 2024
Official Statement About Root Cause: “A hotfix patch has been available to eliminate this vulnerability, but it is not currently known why this hotfix was not installed on the server”, says the City of Helsinki’s Chief Digital Officer Hannu Heikkinen
Attack Entry Point: Unpatched vulnerability in a remote access server. Details regarding the specific product and vulnerability have not been made public
Threat Relevant Vulnerabilities: Selected vulnerabilities affecting remote access products like VPNs and OpenSSH: CVE-2024-21887, CVE-2024-6387, CVE-2024-21888, CVE-2024-24919, CVE-2023-27997
July 2024
Breach Victim: U.S. Cyber Defense Agency
Affected Unit: CISA, the Cybersecurity and Infrastructure Security Agency, which is a component of the United States Department of Homeland Security responsible for cybersecurity and infrastructure protection across all levels of government, coordinating cybersecurity programs with U.S. states, and improving the government’s cybersecurity protections against private and nation-state hackers
Breach Date: Q1 2024
Impact: Access to critical information about the interdependency of U.S. infrastructure, and the chemical security assessment tool, which houses private sector chemical security plans
Vulnerability: Ivanti Connect Secure and Policy Secure Gateway | Authentication Bypass and Command Injection Vulnerabilities Leading to Remote Code Execution, Unauthenticated Remote Attack | CVE-2023-46805, CVE-2024-21887, CVE-2024-21893
June 2024
Breach Victim: United Health Group
Affected Business Unit: United Health Group’s subsidiary Optum. United Health Group is a health insurance company with a presence across all 50 U.S. states. The organization is the world’s largest healthcare company by revenue. United Health Group formed Optum by merging its existing pharmacy and care delivery services into the single Optum brand. In 2017, Optum accounted for 44 percent of UnitedHealth Group’s profits and as of 2019, Optum’s revenues have surpassed 100 billion $
Breach Date: Q1 2024
Impact: Service outage (a.o. in billing) affecting payment processing, care coordination, and data analytics systems in U.S. hospitals, clinics, and pharmacies
Vulnerability: ConnectWise ScreenConnect | Path Traversal and Authentication Bypass Vulnerabilities Leading to Remote Code Execution, Unauthenticated Remote Attack | CVE-2024-1708 & CVE-2024-1709
May 2024
Breach Victim: Schneider Electric
Affected Business Unit: Schneider Electric’s sustainability division. The latter provides software and consulting services to enterprises and serves a broad swath of organizations in more than 100 countries, including 30% of the Fortune 500, as of 2021
Breach Date: Q1 2024
Impact: Data breach involving terabytes of data and ransom demand
Vulnerability: Fortinet VPN | Fortinet FortiOS Heap-Based Buffer Overflow, Authentication Bypass, and Path Traversal Vulnerabilties | CVE-2023-2799 & CVE-2022-41328 & CVE-2022-42475 & CVE-2022-40684, Qlik Sense Enterprise | Improper Validation of HTTP Request Handler in Qlik Sense Enterprise on Windows Leading to Arbitrary Code Execution, Unauthenticated Remote Attack | CVE-2023-41265 & CVE-2023-41266 & CVE-2023-48365