IANS Cyber Intel – Details, episodes & analysis

August 7th, 2024 Security Briefing with IANS Faculty ⁠Dave Shackleford⁠ and ⁠Shannon Lietz

This Episode Details:

• Azure’s DDoS Outage - Microsoft experienced a major outage in its Azure service at the end of July, which it later attributed to an ongoing DDoS attack. Numerous Azure and M365 services were impacted, including Entra, Intune, Purview, Azure Policy and more.
• Malware Delivery via Cloudflare Tunnels - Cloudflare Tunnels (similar to VPN tunnels from Cloudflare) have been heavily involved in malware dissemination campaigns. Numerous actors have used these through the TryCloudflare free service to distribute remote access trojans (RATs) like VenomRAT and Xworm.
• ISP DNS Poisoning for Chinese Malware Delivery - A Chinese threat actor (known commonly as StormBamboo, Evasive Panda and StormCloud) has been using DNS poisoning attacks against ISPs to deliver malware through fake automatic updates. Organizations querying the legitimate automatic update domains were seeing malware delivery through modified responses.

With ⁠⁠IANS Research⁠⁠, get security expertise at speed. IANS Research is a clear-headed resource for decision making and articulating risk, providing experience-based security insights for Chief Information Security Officers and their teams.

Any views or opinions presented in this document are solely those of the Faculty and do not necessarily represent the views and opinions of IANS. Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our written reports, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by the client in connection with such information, opinions, or advice.

July 10th, 2024 with IANS Faculty ⁠Jessica Hebenstreit and ⁠Shannon Lietz⁠

This Episode Details:

• Phone Numbers Leaked in Twilio Breach - On July 1, 2024, Twilio posted a security alert on their site indicating the Authy service had a security incident following an announcement by the ShinyHunters hacking group in late June on BreachForums where they disclosed the leaked data for 33M Authy users.
• Critical Vulnerabilities in Rockwell Automation PanelView Plus - The Microsoft Defender for IoT research team was able to identify and surface vulnerabilities in PanelView Plus, determined during an investigation where application behavior and the lack of encryption raised concerns.
• HealthEquity Suffers Data Breach - On July 2, 2024, HealthEquity filed a Form 8-K with the SEC that declared a cybersecurity incident and detailed a compromise of a partner’s account and data leak of protected health information (PHI) for its customers.

June 5th, 2024 with IANS Faculty Dave Shackleford and Wolfgang Goerlich

This Episode Details:

• Snowflake Incident and the Data Breach Fallout - Snowflake, a cloud analytics and storage company, suffered an incident which led to a compromise of multiple Snowflake tenants from that point on.
• Microsoft Warns of Online OT Device Attacks - Microsoft’s threat intelligence team has found that attackers have increased their focus on exposed OT devices since late 2023, potentially leading to a wider range of compromise scenarios.
• SOHO Routers—a New Attack Surface? - In a newly published research report from Lumen Technologies, a strain of malware they’ve dubbed Chalubo was apparently responsible for a huge attack against small office and home office (SOHO) routers in 2023. This malware incident took place over a 72-hour period between October 25 and 27, rendered the infected devices permanently inoperable.

May 1st, 2024 Security Briefing with IANS Faculty Wolfgang Goerlich and Jessica Hebenstreit

Kaiser Notifies Millions of Data Breach - 13.4 insured people and patients will be receiving breach notices that their protected health information may have been compromised - considered the largest health-related data breach of 2024 to date.

Criminals Exploit CrushFTP Vulnerability - Adversaries are exploiting a vulnerability in CrushFTP to gain remote code execution (RCE). The vulnerability (CVE-2024-4040) combines server-side template injection with a virtual file system sandbox escape to allow attackers to read and execute files as root on Linux systems hosting CrushFTP.

Brokewell Malware Takes Over Android Devices - Discovered and documented by researchers at ThreatFabric, Brokewell is malware running on Android phones and devices.

With ⁠IANS Research⁠, get security expertise at speed. IANS Research is a clear-headed resource for decision making and articulating risk, providing experience-based security insights for Chief Information Security Officers and their teams.

Any views or opinions presented in this document are solely those of the Faculty and do not necessarily represent the views and opinions of IANS. Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our written reports, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by the client in connection with such information, opinions, or advice.

March 13th, 2024 Security Briefing with IANS Faculty Dave Shackleford and Jennifer Minella

This Episode Details:

• Microsoft Source Code Stolen - Microsoft has revealed that the Russian 'Midnight Blizzard' hacking group gained access to source code and internal systems with harvested authentication tokens and credentials.
• Chinese Cranes: Possible Espionage? - In March of 2023, the U.S. Pentagon reported that Chinese-manufactured cranes in U.S. ports may contain monitoring equipment used in long-range espionage. After a yearlong investigation, these concerns are proving to be accurate.

With ⁠IANS Research⁠, get security expertise at speed. IANS Research is a clear-headed resource for decision making and articulating risk, providing experience-based security insights for Chief Information Security Officers and their teams.

Any views or opinions presented in this document are solely those of the Faculty and do not necessarily represent the views and opinions of IANS. Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our written reports, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by the client in connection with such information, opinions, or advice.

February 28th, 2024 Security Briefing with IANS Faculty Jessica Hebenstreit and Dave Shackleford

This Episode Details:

• Change Healthcare Impacted by Cyber Attack - Explore the impacts of Change Healthcare's recent BlackCat breach.
• I-Soon Hackers for Hire Used by Chinese Government Agencies - Last week, leaks surfaced on Github that various Cinese government agencies have been using hackers for hire as part of an ongoing campaign to break into foreign governments and telecoms.
• NIST CST 2.0 - In addition to the original five core pillars of NIST CSF, "govern" was added with the goal of helping organizations incorporate cybersecurity risk management into enterprise risk management.

With ⁠IANS Research⁠, get security expertise at speed. IANS Research is a clear-headed resource for decision making and articulating risk, providing experience-based security insights for Chief Information Security Officers and their teams.

Any views or opinions presented in this document are solely those of the Faculty and do not necessarily represent the views and opinions of IANS. Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our written reports, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by the client in connection with such information, opinions, or advice.

February 14th, 2024 Security Briefing with IANS Faculty Jake Williams and Gal Shpantzer

This Episode Details:

• Shim Secure Boot Bypass Vulnerability - New vulnerabilities in the Shim service are being used to securely boot on Linux. Impacted systems that use HTTP boot services risk full compromise of the device.
• New Fortinet Vulnerabilities - Following the announcement of CVE-2024-21762 from Fortinet, CUSA quickly added the vulnerability to its Known Exploited Vulnerabilities list, indicating it has reports of threat actors using it in the wild.
• Additional Ivanti Disclosures - Ivanti has disclosed additional security vulnerabilities in it's Pulse line of VPN products.

With ⁠IANS Research⁠, get security expertise at speed. IANS Research is a clear-headed resource for decision making and articulating risk, providing experience-based security insights for Chief Information Security Officers and their teams.

Any views or opinions presented in this document are solely those of the Faculty and do not necessarily represent the views and opinions of IANS. Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our written reports, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by the client in connection with such information, opinions, or advice.

February 7th, 2024 Security Briefing with IANS Faculty Jessica Hebenstreit and Jennifer Minella

This Episode Details:

• China Targeting U.S. Infrastructure - The director of the FBU discolsed that China's "Volt Typhoon" group is ramping up hacking operations aimed at critical infrastructure in the United States in the event of a conflict over Taiwan.
• Ivanti: CISA Sets 48-hour Deadline for Removal - The CIA issued a directive that gave federal agencies using Ivanti Connect Secure or Ivanti Policy Secure solutions less than 48 hours to disconnect all instances and take specific steps to put it back into production.
• Cloudflare Hacked With Stolen Okta Auth Tokens - The Okta breach of 2023 left in it's wake lost tokens and service account credentials related to Cloudflare, since a victim of nation-state actor infiltration. This is how they addressed it.

With IANS Research, get security expertise at speed. IANS Research is a clear-headed resource for decision making and articulating risk, providing experience-based security insights for Chief Information Security Officers and their teams.

Any views or opinions presented in this document are solely those of the Faculty and do not necessarily represent the views and opinions of IANS. Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our written reports, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by the client in connection with such information, opinions, or advice.

The CISO job market has been slow in 2024 – largely due to conservative job movement caused by challenging macroeconomic conditions, but signs of improvement are emerging for 2025.

Want to learn more? Download the summary version of IANS' 2024 CISO Compensation Benchmark Report here.

In this webinar, IANS Faculty Steve Martano and Senior Research Director Nick Kakolowski will share insights from the recently published 2024 IANS and Artico Search CISO Compensation Survey and discuss how CISOs can best navigate the marketplace.

Join the session to hear:

• A detailed breakdown of CISO compensation benchmarking data and how to use it to assess your market value
• The market conditions causing the slowdown
• Strategies for CISOs to differentiate themselves in this challenging environment
• Strategic guidance on how best to prepare for increased job movement in 2025

With ⁠IANS Research⁠, get security expertise at speed. IANS Research is a clear-headed resource for decision making and articulating risk, providing experience-based security insights for Chief Information Security Officers and their teams.

Any views or opinions presented in this document are solely those of the Faculty and do not necessarily represent the views and opinions of IANS. Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our written reports, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by the client in connection with such information, opinions, or advice.

December 4th, 2024 Security Briefing with IANS Faculty ⁠Wolfgang Goerlich⁠ and ⁠Jake Williams

This Episode Details:

• Cloudflare’s Missing Logs - On November 14, Cloudflare made changes to an internal service that resulted in the loss of 55% of all logs pushed to customers over a 3.5 hour period. Users of the “Cloudflare Logs” service were impacted by what can only be described as a cascading failure.

• LogoFAIL Actively Exploited - Last week, researchers discovered code named BootKitty that was using the LogoFAIL vulnerability to exploit UEFI and load malware at boot time. Malware deployed in this manner loads before any security products and breaks the “secure boot” paradigm.

• RomCom’s Firefox Zero Days - Security firm ESET has identified that the Russian-attributed threat actor group RomCom is using an exploit chain of two zero-day vulnerabilities in Firefox to exploit targets across Europe and North America. The exploits do not require user interaction (zero-click).

With ⁠IANS Research⁠, get security expertise at speed. IANS Research is a clear-headed resource for decision making and articulating risk, providing experience-based security insights for Chief Information Security Officers and their teams.

Any views or opinions presented in this document are solely those of the Faculty and do not necessarily represent the views and opinions of IANS. Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our written reports, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by the client in connection with such information, opinions, or advice.