Week of March 14, 2022: Russian actors abuse default MFA settings, and ransomware hits the auto industry

What mattered to security leaders in the week of March 14, 2022? The FBI and CISA described how Russian state-sponsored actors got into a network by abusing a default MFA setting and then exploiting PrintNightmare, and the two agencies also warned satellite communications providers and their customers about possible threats. On the criminal side, ransomware crews went after the automotive supply chain, including Denso and Snap-on.

Russian actors turn a default MFA setting into network access

A joint FBI and CISA advisory published March 15 said that as early as May 2021, Russian state-sponsored actors exploited a misconfigured account at a non-governmental organization that was set to default MFA protocols, which let them enroll a new device for MFA and get into the network. They then exploited the Windows Print Spooler flaw known as PrintNightmare (CVE-2021-34527) to run code with system privileges and reached cloud and email accounts. The agencies' advice was to keep enforcing MFA but guard against fail-open and re-enrollment scenarios and disable inactive accounts consistently across Active Directory and MFA systems. (FBI and CISA)

CISA and FBI warn satellite communications networks

On March 17 CISA and the FBI said they were aware of possible threats to US and international satellite communication networks, and that successful intrusions into SATCOM providers could create risk inside their customers' environments. Under the Shields Up initiative, they asked all organizations to significantly lower their threshold for reporting and sharing signs of malicious activity. A May 10, 2022 update attributed the activity to Russian state-sponsored actors. (CISA and FBI)

Ransomware groups target automakers' suppliers

BleepingComputer reported a run of attacks on the automotive industry. Denso, the automotive components maker, confirmed a cyberattack on March 10 after a new ransomware operation called Pandora began leaking data it said it stole. Snap-on, a tool maker for the transportation industry, was also hit, with its Mitchell 1 subsidiary's repair software suffering an outage, and the Conti group claimed that attack. Dragos separately reported rising Emotet activity aimed at the sector. (BleepingComputer)

Veeam patches two critical remote code execution flaws

Veeam fixed two critical vulnerabilities, CVE-2022-26500 and CVE-2022-26501, in Veeam Backup & Replication that unauthenticated attackers could use to execute code remotely and take control of a vulnerable system. Veeam said more than 450,000 users had downloaded version 11 since its launch in the first quarter of 2021. Backup servers are the last line of recovery against ransomware, which is why flaws in them warrant emergency patching. (Help Net Security)

Trickbot hides its traffic behind hijacked MikroTik routers

Microsoft researchers found that Trickbot operators were taking over MikroTik routers, by trying default passwords, brute-forcing or exploiting CVE-2018-14847, and then changing the password to keep control. The routers were used as proxies between infected machines and Trickbot command servers so the traffic would slip past standard network defenses. Router credentials and firmware belong in the same hygiene program as endpoints. (Help Net Security)

CISA adds 15 exploited vulnerabilities in one batch

On March 15 CISA added 15 vulnerabilities to its Known Exploited Vulnerabilities catalog on evidence that threat actors were actively exploiting them, led by a SonicWall SonicOS buffer overflow and a series of Microsoft Windows privilege escalation bugs from 2019 and earlier, with an April 5, 2022 due date for federal agencies. The batch was a reminder that exploited flaws do not age out. (CISA)