Week of August 8, 2022: Cisco Confirms Ransomware Breach, Twilio Discloses Phishing Incident

Security leaders faced two significant incident disclosures during the week of August 8, 2022: Cisco confirmed that a ransomware-linked actor had breached its corporate network via a compromised employee Google account, while Twilio disclosed that phished employee credentials had exposed a limited number of customer accounts. The week also brought CISA and FBI guidance on Zeppelin ransomware, an actively exploited Microsoft zero-day patched on Patch Tuesday, additional Known Exploited Vulnerabilities Catalog entries, and a new CISA election-security toolkit.

Cisco Confirms Corporate Network Breach Tied to Yanluowang-Linked Actor

Cisco confirmed that an attacker gained access to its corporate network after compromising an employee's personal Google account where Cisco credentials had been synced via a browser. The intruder bypassed multifactor authentication using voice phishing and MFA-fatigue tactics, escalated privileges, and moved through the environment before Cisco's security team detected and evicted them. Cisco's Talos team said the incident was contained to IT systems, with no impact to products, services, or supply chain operations, and linked the activity to an actor tied to Yanluowang ransomware. (Help Net Security)

Twilio Discloses Data Breach After Employee Phishing Campaign

Twilio disclosed that its employees were targeted by SMS phishing messages impersonating its IT department, which asked recipients to update passwords through fraudulent links. Attackers captured Okta credentials and one-time codes, then used them to access internal systems and a limited number of customer accounts. Twilio said it identified the unauthorized access on August 4, 2022, notified affected customers, and brought in an outside forensic firm to investigate the incident's scope and origin. (Help Net Security)

CISA and FBI Warn of Zeppelin Ransomware Tactics

CISA and the FBI released a joint cybersecurity advisory on Zeppelin ransomware, a ransomware-as-a-service variant active since 2019 that has targeted defense contractors, educational institutions, manufacturers, technology firms and especially healthcare organizations. The advisory noted actors gain access through RDP exploitation, SonicWall firewall vulnerabilities and phishing, then spend one to two weeks mapping victim networks before deploying ransomware and exfiltrating data. Indicators of compromise and mitigation guidance were published to help network defenders reduce ransomware risk. (CISA)

Microsoft Patches Actively Exploited MSDT Zero-Day

Microsoft's August 2022 Patch Tuesday addressed vulnerabilities across its product line, including an actively exploited zero-day in the Windows Support Diagnostic Tool tracked as CVE-2022-34713, which allows remote code execution when a victim opens a specially crafted file. The release also fixed three critical elevation-of-privilege flaws in Microsoft Exchange and an unauthenticated remote code execution bug affecting SMB clients and servers. CISA urged administrators to review Microsoft's Security Update Guide and apply the patches without delay. (Help Net Security)

CISA Adds More Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA added two more vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, continuing a pattern of catalog updates issued on August 8, 9 and 11, 2022. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog entries by CISA's specified due dates, and the agency again urged all organizations to prioritize timely patching of these vulnerabilities as part of routine vulnerability management. (CISA)

CISA Releases Election-Security Toolkit Through JCDC

CISA, working through its Joint Cyber Defense Collaborative, released a toolkit of free cybersecurity resources aimed at state and local election officials, election vendors and government staff responsible for election infrastructure. The resources focus on assessing risk and defending against phishing, ransomware and distributed denial-of-service attacks that commonly target election systems. CISA encouraged election community stakeholders to adopt the toolkit to strengthen the cybersecurity and resilience of U.S. election infrastructure. (CISA)

Cisco Fixes RSA Private Key Leak in ASA and Firepower Software

Cisco released a security update addressing an RSA private key leak vulnerability in Adaptive Security Appliance Software and Firepower Threat Defense Software, which could let a remote attacker obtain sensitive information. CISA flagged the advisory, tracked as cisco-sa-asaftd-rsa-key-leak-Ms7UEfZz, and urged administrators running the affected firewall and threat-defense platforms to apply Cisco's patches promptly to prevent exposure of cryptographic key material. (CISA)