Week of March 21, 2022: Lapsus$ hits Okta, Microsoft; CISA adds 66 KEVs

Security leaders spent the week of March 21, 2022 absorbing confirmation that the Lapsus$ extortion gang had reached into Microsoft and Okta, a Biden administration warning to harden critical infrastructure against possible Russian retaliation, and a joint CISA-FBI-DOE advisory detailing years of Russian targeting of the Energy Sector. The same week brought a 66-entry expansion of CISA's Known Exploited Vulnerabilities Catalog, a fresh FBI/FinCEN advisory on AvosLocker ransomware, and patch releases from VMware, giving defenders a dense run of advisories and incident disclosures to work through.

CISA Adds 66 Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA added 66 vulnerabilities to its Known Exploited Vulnerabilities Catalog on March 25, 2022, citing evidence of active exploitation. The update fell under Binding Operational Directive 22-01, which requires federal civilian executive branch agencies to remediate catalog entries by set deadlines to protect their networks against active threats. CISA urged all organizations, not only federal agencies, to prioritize timely remediation of the newly listed vulnerabilities as part of routine vulnerability management, reinforcing a practice many security leaders had already tied to enterprise risk reduction that week. (CISA)

FBI and FinCEN Issue Advisory on AvosLocker Ransomware

The FBI and the Treasury Department's Financial Crimes Enforcement Network issued a joint advisory on March 22, 2022, outlining indicators of compromise tied to AvosLocker ransomware. The advisory described AvosLocker as a ransomware-as-a-service affiliate operation that had targeted organizations across multiple U.S. critical infrastructure sectors, including Financial Services, Critical Manufacturing, and Government Facilities. CISA encouraged organizations to review the advisory and apply the recommended mitigations, giving defenders fresh indicators of compromise to hunt for within their environments that week. (CISA)

Microsoft and Okta Confirm Lapsus$ Intrusion Impact

Microsoft and Okta confirmed on March 23, 2022, that the Lapsus$ extortion gang had gained unauthorized access tied to their systems. Microsoft said the group obtained portions of its source code through a single compromised account, while Okta disclosed that attackers had accessed the laptop of a support engineer working for a third-party contractor, Sitel, during a window in January. Okta said the access could have affected a small percentage of its customer base, handing CISOs a supply-chain incident to track into the following weeks. (Help Net Security)

Biden Warns Critical Infrastructure Operators to Harden Defenses

President Joe Biden urged private-sector critical infrastructure operators on March 22, 2022, to harden their defenses, citing evolving intelligence that the Russian government was exploring options for cyberattacks. Deputy National Security Advisor Anne Neuberger followed with a briefing noting that classified sessions had been held with companies in sectors considered most at risk, while stopping short of confirming any specific target. The advisory also referenced the unattributed attack on satellite provider Viasat and pointed operators toward existing CISA guidance on shoring up networks. (Help Net Security)

VMware Patches Carbon Black App Control Vulnerabilities

VMware released security updates on March 24, 2022, to address multiple vulnerabilities in its Carbon Black App Control software, warning that a remote attacker could exploit the flaws to take control of an affected system. CISA advised administrators to review VMware Security Advisory VMSA-2022-0008 and apply the necessary patches, adding another endpoint-protection product to the list of software security teams needed to patch that week alongside a separate Drupal core update. (CISA)

Deepwatch Names David Stoicescu as CISO

Deepwatch named David Stoicescu as its chief information security officer, part of a batch of IT leadership moves reported on March 21, 2022, that also included new marketing, data-security, and advisory-board hires at Perimeter 81, Imperva, and CyberSaint. Stoicescu's appointment put him in charge of advancing the managed security provider's information security programs as the company continued building out its executive bench that week. (Help Net Security)

Novel Backdoor Campaign Targets French Organizations

Researchers reported on March 21, 2022, that an advanced threat actor was using novel methods to backdoor organizations in France's construction, real estate, and government sectors. The campaign began with GDPR-themed phishing emails carrying a macro-enabled Word document, then used steganography to hide PowerShell and Python scripts inside images, plus the Chocolatey package manager, to install a backdoor nicknamed Serpent. Researchers said it was the first time they had observed a threat actor use Chocolatey in an attack chain, a technique CISOs had not previously had to defend against. (Help Net Security)