Week of January 3, 2022: FTC puts Log4j patching on notice, and FinalSite ransomware takes schools offline

What mattered to security leaders in the first week of January 2022? The US Federal Trade Commission warned that it would use its full legal authority against companies that failed to remediate the Log4j flaw, and a ransomware attack on the school web host FinalSite knocked sites for thousands of schools offline. The FBI also described a FIN7 campaign that mailed booby-trapped USB devices to US businesses.

The FTC tells companies to fix Log4j or face enforcement

On January 4 the Federal Trade Commission published a warning that companies and their vendors relying on Log4j needed to act to reduce the risk of harm to consumers and to avoid FTC legal action. It pointed to Equifax, where the agency's complaint said a failure to patch a known vulnerability exposed the personal information of 147 million consumers, and noted that Equifax agreed to pay $700 million to settle with the FTC, the CFPB and all fifty states. For security leaders, the warning turned an engineering backlog into a regulatory exposure. (US Federal Trade Commission)

FinalSite ransomware disrupts websites for thousands of schools

FinalSite, a software-as-a-service provider of website design, hosting and content management for K-12 districts and universities, suffered a ransomware attack that disrupted access to websites for thousands of schools worldwide. The company says it serves more than 8,000 schools and universities in 115 countries. Districts first saw their sites go unreachable on Tuesday, January 4, while FinalSite's status page described only errors and performance issues. It is an early 2022 example of concentration risk in a single SaaS supplier. (BleepingComputer)

FBI: FIN7 mailed malicious USB devices to defense, transport and insurance firms

An updated FBI flash alert said the financially motivated FIN7 group had mailed packages containing "BadUSB" devices to US businesses, through USPS and UPS, to deploy ransomware. Transportation and insurance companies were targeted from August 2021 and defense firms from November 2021. The packages impersonated Amazon or the US Department of Health and Human Services and carried fake letters or gift cards. Once plugged in, the device registered as a keyboard, which is why device-control policies on USB human interface devices matter. (BleepingComputer)

Sygnia details "Elephant Beetle," a patient financial-theft group

Incident response firm Sygnia published research on a group it named Elephant Beetle, which it had tracked for two years. The group entered through legacy Java applications on Linux machines, spent months studying victims' internal financial systems with more than 80 tools and scripts, and then hid small fraudulent transactions among normal activity, stealing millions of dollars over time. Sygnia said the group was chiefly focused on Latin America. (Help Net Security)

VMware fixes a take-over flaw in Workstation, Fusion and ESXi

CISA flagged VMware Security Advisory VMSA-2022-0001, which addressed a vulnerability in Workstation, Fusion and ESXi that an attacker could exploit to take control of an affected system. CISA urged administrators to apply the updates and workarounds. (CISA)

WordPress 5.8.3 closes multiple vulnerabilities

CISA also pointed site owners to a WordPress security release: versions from 3.7 through 5.8 were affected by multiple vulnerabilities, some of which could cause a denial of service, and the fix was an upgrade to WordPress 5.8.3. Marketing and communications sites built on WordPress often sit outside central patching, so this is the kind of notice worth routing to their owners. (CISA)