Media Coverage

Hackers have been exploiting the two zero-day vulnerabilities in Ivanti Connect Secure disclosed this week since early December to deploy multiple families of custom malware for espionage purposes. Identified as CVE-2023-46805 and CVE-2024-21887, the security issues allow bypassing authentication and injecting arbitrary commands on vulnerable systems.

Today, threat monitoring service Shadowserver has posted on X that its scanners detect 17,100 Invanti CS appliances on the public web, most of them in the United States. However, there is no indication to how many of them are vulnerable.

The team that developed the distributed message streaming data platform Apache RocketMQ discovered that the major vulnerability CVE-2023-33246 they patched in May this year was incompletely patched, and a new version of the program component was provided to patch it.

It is worth noting that according to the Shadowserver Foundation’s investigation, they have currently published the geographical locations of hosts exposed on the Internet to the foundation’s global security situation database, and stated that hackers have passed nearly 400 source IP address to try to exploit the above two vulnerabilities.

The Terrapin attack, a newly identified security threat, jeopardizes nearly 11 million SSH servers that are accessible online. Originating from academic research at Ruhr University Bochum in Germany, this attack specifically targets the SSH protocol, affecting both clients and servers.The attack requires the perpetrator to be in a unique position – an adversary-in-the-middle (AitM) – to intercept and manipulate the handshake.  A report by Shadowserver, a security monitoring platform, highlights the widespread vulnerability of these servers across the globe. Shadowserver’s findings show that the United States has the highest number of vulnerable servers (3.3 million), followed by China (1.3 million), Germany (1 million), Russia (700,000), Singapore (390,000), and Japan (380,000).

Cozy Bear, a threat group linked with the Russian foreign intelligence service (SVR), has been conducting a global hacking campaign targeting servers hosting JetBrains TeamCity software, according to US, UK and Polish government agencies. On December 13, the UK-backed Shadowserver Foundation said it was still detecting 800 unpatched instances of JetBrains TeamCity worldwide. JetBrains’ Russkih commented: “The estimate from the Shadowserver Foundation doesn’t distinguish the instances patched with a dedicated security plugin JetBrains released for customers with older versions (since they only look at the version number). We have already reached out to them to discuss possible improvements.”

Hackers are attempting to leverage a recently fixed critical vulnerability (CVE-2023-50164) in Apache Struts that leads to remote code execution, in attacks that rely on publicly available proof-of-concept exploit code.

It appears that threat actors have just started, according to the Shadowserver scanning platform, whose researchers observed a small number of IP addresses engaged in exploitation attempts.

The Department of Water and Sanitation (DWS) has told MyBroadband that it does not use the programmable controllers exploited in a recent attack on a United States water facility. This comes after the Shadowserver Foundation revealed that South Africa was among the countries most impacted by a recent attack on Unitronics programmable logic controllers (PLCs). Shadowserver scanned the Internet for potentially vulnerable controllers following a U.S. Cybersecurity and Infrastructure Security Agency (CISA) advisory.

The Shadowserver Foundation has revealed that South Africa is among the countries most impacted by a recent attack on Unitronics programmable logic controllers (PLCs). This comes after the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory warning that a state-sponsored Iranian hacking group had exploited security weaknesses in the controllers. CISA stated that, in addition to water and wastewater systems, the targeted Unitronics PLCs are also used in energy, food and beverage manufacturing, and healthcare.

Shadowserver said it specifically scanned the default Unitronics TCP port, 20256, on 2 December 2023.

The US government has confirmed that an Iranian hacking group named Cyber Av3ngers has gained access to equipment at water facilities across multiple US states. CISA, the FBI, the NSA, and other agencies say the attacks began as far back as November 22 and exploited PLCs manufactured by Israeli company Unitronics. The group targeted Unitronics PLCs that were still using the default password “1111.” CISA asked US organizations last week to change the default password, enable MFA, and remove the devices from the internet. US officials say the Cyber Av3ngers group is affiliated with the IRGC, an Iranian military and intelligence organization. According to the Shadowserver Foundation, from 500 to 800 Unitronics PLCs are currently exposed on the internet, with the vast majority in Australia and Singapore.

Representatives from governments, international organizations, and private sector gathered in Accra, Ghana today for the inaugural Global Conference on Cyber Capacity Building. The landmark event saw the release of an action framework known as the Accra Call on wednesday, November 29th. The highlight of the first day of the event was the endorsement of the Call by over 30 entities.

It has now been more than six weeks since virtualization and cloud services provider Citrix reported the existence of a particularly critical vulnerability in two of its products, NetScaler ADC and NetScaler Gateway. But, as often happens, equipped organizations are slow to apply the patches. Which delights cybercriminals of all kinds. According to data from Shadowserver , a foundation dedicated to researching malicious activities, there are still around 91 vulnerable instances in France. This is much less than when the flaw was announced on October 10, when 813 instances were identified, but it is still far too many. “These are the most common attacks observed on our honeypots,” warns the foundation.