Week of August 1, 2022: Attack on supplier Advanced disrupts NHS 111, and German chambers go dark

What mattered to security leaders in the week of August 1, 2022? A cyberattack detected on August 4 at Advanced, a British managed service provider whose Adastra software runs 85% of NHS 111 services, caused an outage felt in all four UK nations, and the Association of German Chambers of Industry and Commerce shut down its IT after an attack on August 3. VMware also told customers to patch a critical authentication bypass, CVE-2022-31656, immediately.

Cyberattack on supplier Advanced knocks out NHS 111 referral systems

An attack on managed service provider Advanced, detected on the morning of Thursday, August 4, took down its Adastra patient management system, which 85% of NHS 111 services use, along with other Advanced services. The Welsh Ambulance Service said the outage of the system used to refer NHS 111 patients to out-of-hours GPs was significant and had reached all four UK nations. Advanced's chief operating officer said the company isolated its health and care environments and contained the issue to servers making up 2% of that infrastructure. It showed how one supplier can become a single point of failure for a national service. (BleepingComputer)

Germany's DIHK shuts down all IT systems after a "massive" attack

The Association of German Chambers of Industry and Commerce (DIHK), a coalition of 79 chambers representing more than three million member businesses, switched off all its IT systems, digital services, telephones and email servers after a cyberattack on Wednesday, August 3. Its general manager called the incident massive and said he could not predict how long the emergency shutdown would last, and some services returned gradually after checks. The attack had signs of ransomware, but that had not been confirmed and no gang had claimed it. (BleepingComputer)

Power electronics maker Semikron discloses a ransomware attack

Semikron, a German power electronics manufacturer with over 3,000 employees and eight production sites, said in a statement on Monday, August 1, that a professional hacker group had partially encrypted its IT systems and files and claimed to have stolen data. An alert from Germany's Federal Office for Information Security said the attackers were threatening to leak the data, and a ransom note on an encrypted system pointed to the LV ransomware operation. Semikron says 35% of wind turbines installed each year run on its technology, a reminder of how deep industrial supply chains reach. (BleepingComputer)

VMware: patch the CVE-2022-31656 authentication bypass immediately

VMware released fixes for ten vulnerabilities and singled out CVE-2022-31656 as critical, advising customers to patch or mitigate at once. The flaw affects local domain users in Workspace ONE Access, Identity Manager and vRealize Automation and can let an attacker with network access to the UI gain administrative access without authenticating. There was no sign of exploitation, but the researcher who found it planned to publish a proof of concept, and Tenable said early reports pointed to a bypass of the May fix for CVE-2022-22972. Identity platforms that grant admin rights are an obvious chaining target. (Help Net Security)

Slack resets passwords after a five-year hash exposure bug

Slack said on Thursday, August 4, that it had reset passwords for roughly 0.5% of its users after fixing a bug that sent salted password hashes to other workspace members whenever a user created or revoked a shared invitation link. The issue affected such actions between April 17, 2017, and July 17, 2022, when an independent researcher reported it. Slack said the hashes were not displayed by its clients, that reading them required monitoring encrypted traffic from its servers, and that it had no reason to believe anyone obtained plaintext passwords. (BleepingComputer)

CISA and Australia's ACSC name the top malware strains of 2021

A joint advisory from CISA and the Australian Cyber Security Centre, AA22-216A, listed the most prevalent malware of 2021: Agent Tesla, AZORult, Formbook, Ursnif, LokiBot, MOUSEISLAND, NanoCore, Qakbot, Remcos, TrickBot and GootLoader. Most had been in use for at least five years, and Qakbot and Ursnif for more than a decade, which the agencies said gives defenders a chance to prepare. The mitigations were familiar: patch known exploited flaws, enforce MFA, secure RDP, keep offline backups and train staff on phishing, and an appendix supplied Snort detection signatures. (CISA)