February 24, 2024 - Red N Security

Hello all,

This week saw several shadows of potential digital apocalypse spread across the cyberverse. AT&T triggered a meltdown in cellular traffic, the Chinese had a major leak exposing some of their activity, LockBit Ransomware group was unplugged, and ConnectWise’s rapid action stopped the death of western culture as we know it (I could be exaggerating a bit but read on).

The volume of news and other can appear overwhelming, the best strategy is to read the Notable Callouts below and then skim the full list of linked news item titles that follow for things that pertain to you or your environment or simply interest you, and then selecting them for more information. So, let’s get to it. And don’t forget, our site, https://red-n-security.com also has searchable archives of past newsletters.

Notable Callouts:

AT&T was making some back-end networking changes in the wee hours of Thursday morning and managed to take down cell activity for much of their customer base and several other carriers for a good portion of the day. We’re still waiting for a technical triage of what occurred, but it was probably DNS. It is always DNS.
The Chinese Ministry of Public Security had a rather insecure thing happen. One of their contractors, iSoon apparently had someone leak a bunch of documents that show how China has been spying on other countries, giving a glimpse into the Middle Kingdom’s extensive espionage apparatus.
ConnectWise revealed two vulnerabilities in their ScreenConnect software on Monday February 19th and advised their customers to patch immediately. The most severe vulnerability was “embarrassingly easy” to exploit according to some researchers, granting full control of the server. Recognizing the apocalyptic potential of this hole, the Security community rose up en masse to identify and notify organizations that were vulnerable. Huntress Labs was early out of the gate with analysis and had named this flaw SlashAndGrab, providing detailed forensics and incident reports. ConnectWise, to their credit, took the magnanimous step of making the update patch free, even to companies with expired licenses. And in another extraordinary move, after seeing that there were still unpatched ScreenConnect versions communicating on the internet, ConnectWise invalidated those licenses, effectively stopping further propagation. Nevertheless, some damage has already been done and there are a good number of companies and devices that have been successfully attacked, with crypto miners, back-doors, and ransomware being unleashed. Among those hit, Optum Healthcare is a likely victim. More on that below.
LockBit Ransomware group had much of their nefarious operation killed and subsequently exposed by the good guys this week in operation “Cronos”. US, British, and other international authorities worked together to unlock the bits of this prolific plague. Over 14,000 accounts associated with the dirtbags were shut down on services such as Mega, Toutanova, and Protonmail. And at least 3 of their affiliates were arrested in both the Ukraine and Poland by mid-week. The take-down has resulted in a treasure-trove of information about their operation, decryption keys, and clues leading to identifying the inhuman scum behind this evil organization. In the linked articles, there is a lot more information about LockBit to peruse.
Microsoft Outlook patched a flaw that would have allowed for a 1-click (or zero) RCE. If you haven’t updated yours yet, please do so quickly.
Mozilla released security updates for Firefox and Thunderbird. There were a lot of them, so if you use either, update soon.

In Ransomware, Malware, and Vulnerabilities News:

CrowdStrike’s 2024 Global Threat Report is out with some scary statistics about what is happening in the world of cyber. It is worth downloading and reading.
Akira Ransomware is still having great success exploiting Cisco AnyConnect CVE 2022-3259. That is neraly 2 years old. Anyone that hasn’t patched that and has their AnyConnect on the public internet is criminally negligent in this author’s opinion.
Optum Healthcare aka Change Healthcare was apparently hit by a cyberattack, forcing United Healthcare to sever their connection to them, causing chaos in Pharmacies across America who cannot access orders. Early reports are that this may be related to the ScreenConnect vulnerability and a LockBit Ransomware variant still in operation.

In Other News Events of Note and Interest:

Nvidia has a problem that most companies wish they had – they cannot make enough product to keep up with demand. They’re having to resort to ensuring that they “allocate fairly”.
ValiDrive is a free tool from GRC.com. The author purchased 12 inexpensive drives from Amazon, then tested them. All turned out to be fraudulently claiming to be 1TB drives, but were in fact only capable of holding 64GB or so before simply throwing the remaining data away. ValiDrive will let you know if you can reliably store data on your removable drive and if it truly has the capacity it claims.

In Cyber Insurance News:

Personal Cyber Insurance is starting to become more mainstream. You can do everything right, … “but the fact remains that as careful you may be, you can fall victim to a cyberattack through no fault of your own” perhaps it is time to consider this inexpensive addition for your peace of mind in this cyber minefield called the internet.

The continually connected world can be quite disruptive at times. This morning, while at church, I received an alert that an account compromise was in progress. I stepped out and contacted one of my team who quickly shut down that particular liege of Lucifer. It was done, but it took me a while to move past that event and to participate in the service. It makes me wonder, how much peace of mind do we lose to the ever-on, always connected and available, ubiquitous digital matrix we’re enmeshed in? I look forward to the day when automated systems can handle the day-to-day routine dirtbag script kiddie attack. Or am I confused and am actually thinking of the paradise of the next life?

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Cyber Insurance News