Week of July 25, 2022: CISA Flags New KEV and Log4Shell Exploit; Everbridge Names New CEO

Security leaders tracked CISA's addition of a new entry to the Known Exploited Vulnerabilities Catalog alongside its detailed report on continued Log4Shell exploitation of an unpatched VMware Horizon server, while Mozilla and the Samba Team issued separate patches for actively exploitable flaws. Elsewhere, IBM put the average cost of a data breach at an all-time high of $4.35 million, WithSecure detailed a Facebook Business account hijacking campaign called DUCKTAIL, and Everbridge named David Wagner as its new President and CEO.

CISA Adds New Vulnerability to Known Exploited Vulnerabilities Catalog

On July 29, 2022, CISA added one additional vulnerability to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The addition fell under Binding Operational Directive 22-01, which requires federal civilian executive branch agencies to remediate catalog entries by set deadlines. CISA urged all organizations, not just federal agencies, to prioritize patching catalog vulnerabilities as part of routine vulnerability management. The update gave security teams another deadline-driven item to track against exploitation reported in the wild. (CISA)

CISA Details Log4Shell Exploitation of Unpatched VMware Horizon Server

CISA published a Malware Analysis Report on July 28, 2022 describing an incident it responded to between May and June 2022, in which attackers exploited the Log4Shell vulnerability on a VMware Horizon server that had not received available patches or workarounds. CISA analyzed five malware samples recovered from the compromised network, including PowerShell downloaders and scheduled-task XML files used for persistence, along with a Python-based scanning tool. The report reinforced that Log4Shell exploitation remained an active threat against unpatched internet-facing systems well into mid-2022. (CISA)

Mozilla Patches Firefox and Firefox ESR Vulnerabilities

Mozilla released security updates addressing vulnerabilities across Firefox 103, Firefox ESR 91.12, and Firefox ESR 102.1. CISA flagged the updates on July 27, 2022, noting that an attacker could exploit some of the flaws to take control of an affected system. The agency encouraged users and administrators to review Mozilla's advisories and apply the available updates, a routine but notable reminder for security teams managing browser patch cycles across distributed workforces that week. (CISA)

Samba Team Issues Security Updates for Multiple Versions

The Samba Team released security updates covering several versions of Samba, addressing five vulnerabilities tracked as CVE-2022-2031, CVE-2022-32742, CVE-2022-32744, CVE-2022-32745, and CVE-2022-32746. CISA highlighted the advisories, warning that an attacker could exploit one of the flaws to take control of an affected system. The agency directed administrators to Samba's official security announcements for patch and workaround guidance, adding another file-sharing component to the week's patch priorities for infrastructure teams. (CISA)

Everbridge Names David Wagner President and CEO

Everbridge announced on July 26, 2022 that David Wagner had been appointed President and Chief Executive Officer, effective immediately, and would join the company's Board of Directors. Wagner succeeded Co-CEOs Patrick Brickley and Vernon Irvin, who returned to their prior roles as Chief Financial Officer and Chief Revenue Officer respectively. Wagner previously led Zix Corporation, a cloud-based security and compliance provider, from 2016 until its sale to OpenText in December 2021, and earlier spent 20 years in leadership roles at Entrust. (Help Net Security)

IBM: Average Data Breach Cost Hits $4.35 Million

IBM Security released its 2022 Cost of a Data Breach Report on July 27, 2022, finding the global average cost of a data breach had reached an all-time high of $4.35 million for studied organizations, based on Ponemon Institute analysis of 550 breaches occurring between March 2021 and March 2022. The report found 83% of studied organizations had experienced more than one breach, phishing was the costliest initial attack vector at $4.91 million on average, and organizations with mature security automation saved $3.05 million in breach costs compared to those without it. (Help Net Security)

WithSecure Uncovers DUCKTAIL Campaign Hijacking Facebook Business Accounts

WithSecure researchers disclosed on July 26, 2022 an ongoing operation it named DUCKTAIL, which used an infostealer to target individuals with administrative access to Facebook's Ads and Business platform. The malware stole browser cookies to hijack authenticated Facebook sessions and take over Business accounts, with high confidence attributed to a Vietnamese threat actor pursuing financial gain. Targets were scouted and phished through LinkedIn, with victims typically holding managerial, digital marketing, digital media, or human resources roles. WithSecure had shared its findings with Meta before publication. (Help Net Security)