Week of June 20, 2022: Log4Shell still hits VMware Horizon, and Conti takes its last servers offline

What mattered to security leaders in the week of June 20, 2022? CISA and the US Coast Guard Cyber Command warned on June 23 that state-backed and other attackers were still breaking into unpatched VMware Horizon servers through Log4Shell, and told owners who had not patched promptly to treat those systems as compromised. The Conti ransomware brand switched off its last Tor servers, and Forescout's OT:ICEFALL research disclosed 56 insecure-by-design flaws across ten industrial vendors.

Log4Shell exploitation of VMware Horizon continues six months on

A joint advisory from CISA and Coast Guard Cyber Command, released June 23, said threat actors including state-sponsored APT groups kept exploiting CVE-2021-44228 in VMware Horizon and Unified Access Gateway servers at organizations that had not applied patches. It drew on two incident response engagements and malware samples found on victim networks. The guidance went beyond patching: any affected VMware system that had not been updated promptly after VMware's December 2021 fixes should be treated as compromised, which turns a patch task into an incident investigation. (CISA)

Conti shuts its leak and negotiation servers, but its people move on

The two Tor servers Conti used to leak data and negotiate with victims went offline on Wednesday, June 22, ending the public face of the brand. Conti had begun winding down in May, leaving one member to post older victims' data as a facade. AdvIntel said only the name had died: members had split into smaller cells inside other operations, including Hive, AvosLocker, BlackCat, Hello Kitty and Quantum, while others ran data-extortion groups such as Karakurt and BlackByte. Threat models keyed to the Conti name needed updating for its successors. (BleepingComputer)

OT:ICEFALL reveals 56 insecure-by-design flaws in industrial gear

Forescout's Vedere Labs disclosed OT:ICEFALL, 56 vulnerabilities in operational technology products from ten vendors including Bently Nevada, Emerson, Honeywell, JTEKT, Motorola, Omron, Phoenix Contact, Siemens and Yokogawa. Affected equipment spanned distributed control systems, PLCs, remote terminal units, safety instrumented systems and engineering workstations. Help Net Security described it as one of the largest single disclosures affecting OT devices, and one aimed squarely at weaknesses built into product design rather than coding slips. (Help Net Security)

Mitel VoIP zero-day used as a way in for a suspected ransomware attack

CrowdStrike reported that attackers exploited CVE-2022-29499, a critical remote code execution zero-day rated CVSS 9.8, in Linux-based Mitel MiVoice Connect service appliances to get into a network. The flaw sits in a diagnostic script that fails to validate input, letting unauthenticated attackers inject commands; the intruders then opened a reverse shell, planted a web shell and pulled down the Chisel proxy tool. The attack was stopped, but CrowdStrike assessed it as the start of a ransomware operation. VoIP appliances rarely get the monitoring that servers do. (BleepingComputer)

Yodel confirms a cyber incident that stalls UK parcel deliveries

UK delivery company Yodel confirmed on June 21 that a cyber incident had disrupted its services, delaying parcel distribution and online order tracking; customers said tracking and customer service had been down since the weekend. Yodel did not say when the incident began or what kind it was, and said customer payment data was neither stored nor processed on its systems. It was working with an outside specialist to restore systems and warned customers about unsolicited messages asking for personal details. Rumors of ransomware circulated, but the company did not confirm the cause. (BleepingComputer)

US, UK and New Zealand agencies say keep PowerShell, but lock it down

On June 22 cybersecurity authorities from the United States, New Zealand and the United Kingdom published a joint information sheet arguing that PowerShell should be properly configured and monitored rather than removed or disabled, even though intruders abuse it after gaining access. The recommendations aim to help defenders detect and block malicious use while keeping the tool available to administrators and responders. For teams tempted to ban the shell outright, the guidance offered an official case for logging and constraint instead. (CISA)