X-Force Exchange - Collection Feed

Summary At approximately 0330 eastern time in the United States, over 70 thousand AT&T users reported interruptions in their mobile, internet, and home phone services. There outage is not currently being attributed any any cyber attacks. Threat Type Critical Infrastructure Outage Overview AT&T is currently investigating a network outage affecting over 70 thousand of their customers. The outage reportedly began at about 0330 eastern time. Initial reports claimed that this outage also affected T-Mobile and

Summary In the latest developments, FBI Director Christopher Wray warned of Chinese hackers targeting US infrastructure and stated that the nation state sponsored group dubbed Volt Typhoon is “the defining threat of our generation.” Threat Type Nation State Threat Overview -Updated 2/1/2024- On December 12, 2023, X-Force issued an alert notifying recipients that we were monitoring a developing story on a threat from China to U.S. Critical Infrastructure. On January 31, 2024, this situation received a rather

Summary A critical vulnerability in VMWare’s Cloud Director Appliance has been disclosed. The flaw is described as an authentication bypass and carries with it a CVSSv3 score of 9.8. The vendor has provided a workaround to mitigate this threat. Threat Type Vulnerability Overview X-Force is following the disclosure of an authentication bypass vulnerability in VMWare’s Cloud Director Appliance. This flaw is being tracked as CVE-2023-34060 and carries with it a CVSSv3 score of 9.8. The vulnerability only a

Summary ***UPDATE #1, October 23, 2023*** Cisco has addressed the two vulnerabilities including the below stated CVE-2023-20198 as well as CVE-2023-20273. Below you will find the versions that have been updated and the status of other versions that have not yet been released. ***ORIGINAL SUMMARY*** An unknown threat actor has been detected exploiting a previously unknown flaw in the Web User Interface of Cisco IOS XE software. Exploitation of this vulnerability, that was thought to have been patched, can gr

Summary curl version 8.4.0 has been released. According to the developers of curl, this version mitigates a vulnerability that has been present in curl for over 10 years and has not, to this point, been exploited. This vulnerability has been disclosed as a SOCKS5 heap buffer overflow and is currently rated HIGH. Threat Type Vulnerability Overview The developers of curl have released version 8.4.0 of the software. This update was designed to mitigate at least two previously undisclosed vulnerabilities, one o

Summary ***Updated September 28, 2023*** The 0-day vulnerability in the MOVEit file transfer software that was taken advantage of by the Clop ransomware group continues to make headlines. These disclosures are not new attacks, they are the result of the bad actor group parsing through the stolen data, discovering, and informing victims that had not yet been found in the data. ***Updated June 16, 2023*** A 0-day vulnerability in the MOVEit file transfer software was taken advantage of by the Clop ransomware

Summary The U.S. HHS’ Health Sector Cybersecurity Coordination Center (HC3) has released an alert about the Rhysida ransomware group and their latest attacks. Threat Type Attack Campaign Overview According to a recent report from the U.S. HHS’ Health Sector Cybersecurity Coordination Center (HC3), “a new ransomware group – Rhysida – which is conducting high-impact attacks across multiple industry sectors.” The group was first identified in May 2023 and appears to be a ransomware-as-a-service operation or R

Summary A zero-day vulnerability has been disclosed in NetScaler ADC and NetScaler Gateway. Citrix has released security updates to address this vulnerability along with others of lesser severity ratings. Purportedly, this vulnerability has been exploited in the wild. Threat Type Vulnerability Overview Citrix has released a security advisory containing updates to address three recently disclosed vulnerabilities in NetScaler ADC and NetScaler Gateway. The most sever of the three is being tracked as CVE-202

Summary According to a Microsoft blog and other reputable sources, an unpatched zero-day vulnerability exists in multiple Windows and Office products that has been exploited in a phishing campaign targeting NATO. Threat Type Vulnerability Overview -Update #01 - 07/13/2023 IOC's added. -Original Post- Microsoft has published a blog detailing their investigation into the exploitation of a zero-day vulnerability in their products. According to the investigation, an attacker exploiting this flaw with a “high-c

Summary ***UPDATED OVERVIEW with PoC and CVSS Score*** Progress, the vendor that provides MOVEit, has released a fix for additional vulnerabilities in their product, once of which being a critical SQL injection flaw. Threat Type Vulnerability Overview ***UPDATE #1, July 11, 2023*** A proof-of-concept (PoC) has been reported for MOVEit's CVE-2023-36934. At this time, there is no further information on the PoC. In addition to the above, the vulnerability has been assessed and now carries a CVSSv3 score 9.1, c

Summary X-Force is monitoring reports of a series of firmware updates published to address a critical pre-authentication remote code execution vulnerability (CVE-2023-27997) in Fortinet’s SSL VPNs. Threat Type Vulnerability Overview Update 02- 07/03/2023 According to a recent article from Bleeping Computer, while a fix has been made available since June 11, 2023, over 300 thousand internet facing FortiGate appliances are still vulnerable to this flaw. Fortinet released fixes for this vulnerability before d

Summary X-Force is monitoring a report of firmware updates published to address a critical deserialization remote code execution vulnerability (CVE-2023-33299) in Fortinet’s FortiNAC products. Threat Type Vulnerability Overview X-Force is monitoring a critical vulnerability in Fortinet’s FortiNAC products. The vulnerability, if exploited, could allow for an unauthenticated user to execute unauthorized code or commands through specifically crafted requests to the tcp/1050 service. The vulnerability is rated

Summary Progress, the vendor that provides MOVEit, has disclosed a new, critical vulnerability in its MOVEit file transfer program. Threat Type Vulnerability Overview ***UPDATE #1 - June 19, 2023*** Progress has released an update to their original advisory. The vulnerability has been assigned CVE-2023-35708 and a patch has been made available. See the updated advisory here for additional information. Original Post A new privilege escalation and unauthorized access vulnerability in Progress’ MOVEit Tran

Summary IBM X-Force is monitoring a zero-day vulnerability in Barracuda Email Security Gateway (ESG) appliances. This vulnerability has been seen being exploited in the wild. Threat Type Vulnerability Overview IBM X-Force is monitoring the disclosure of a vulnerability in the email attachment screening module from Barracuda. CVE-2023-2868 was initially discovered on May 19, 2023 and has since been patched. At this time, the vulnerability does not have a CVSS score but looks to be critical as exploitation le

Summary A series of Remote Code Execution (RCE) vulnerabilities on select Cisco Small Business Switches have been disclosed. Proof-of-Concept (PoC) exploit code has been made public. Threat Type Vulnerability Overview IBM X-Force is monitoring the disclosure of four vulnerabilities in select Cisco Small Business Switches running vulnerable firmware. The vulnerabilities, successfully exploited could lead to RCE. A list of vulnerable products is available here. CVE-2023-20159, CVE-2023-20160, CVE-2023-20161,

Summary Sophos has released an update to mitigate three vulnerabilities in the Sophos Web Appliance (SWA). The most important of these three flaws is rated as critical and if exploited could lead to the execution of arbitrary code. Threat Type Vulnerability Overview **Update 04/25/2023** According to multiple sources, now that the patch for this vulnerability has been reverse engineered, functional Proof of Concept (POC) exploit code has been released. The POC code is available now to the public on Github

Summary On March 30, several reports were published on a supply chain attack on 3CXDesktop’s App. The actual attack was first observed by SentinelOne, Crowdstrike, and Sophos on March 22, 2023. These companies released blogs detailing the attacks. Threat Type Attack Campaign Overview --Update 04/05/2023-- On April 1, 2023, Nick Galea, CEO, 3CX posted an update on the situation. The update primarily reinforces what has already been reported by multiple reputable sources. The company is still working with l

Summary Microsoft has released a patch for a zero-day vulnerability that has purportedly been used by bad actor groups linked to Russian Military Intelligence to compromise multiple European organizations over the past year. Threat Type Vulnerability Overview In the most recent Microsoft monthly security fix rollout, a critical elevation of privilege vulnerability was patched. According to multiple reliable sources, this vulnerability has been used multiple times by Russian bad actor groups with ties to Ru

Summary Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service. Threat Type Vulnerability Overview Cisco has issued an advisory for certain models of its IP phone lineup due to vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform arbitrary code execution or cause a denial of service. Affected phones include

Summary VMware has released a fix for two critical vulnerabilities in VMware Aria Operations for Logs. The vulnerabilities both have a CVSS score of 9.8. Threat Type Vulnerability Overview On Tuesday, January 25, VMware released updates/upgrades for two critical vulnerabilities in its vRealize Log Insight (now VMware Aria Operations for Logs) software that could allow attackers to gain remote access via non-upgraded appliances. Both CVE-2022-31704 and CVE-2022-31706 have CVSS scores of 9.8 indicating a high