Week of August 22, 2022: 0ktapus Phishing Fallout and New CISA KEV Additions

Security leaders tracked a large-scale phishing campaign that Group-IB linked to earlier Twilio and Cloudflare incidents, alongside a critical remote-code-execution flaw in GitLab that required urgent patching. CISA added new entries to its Known Exploited Vulnerabilities Catalog twice during the week, updated its Zimbra exploitation advisory, pushed guidance on post-quantum cryptography, and flagged Cisco security updates, while the Python Package Index warned of a phishing campaign compromising legitimate package maintainer accounts.

CISA Added a Known Exploited Vulnerability to Its Catalog

On August 22, 2022, CISA added a newly identified vulnerability to its Known Exploited Vulnerabilities Catalog after determining evidence of active exploitation. The addition triggered obligations under Binding Operational Directive 22-01, which requires federal civilian executive branch agencies to remediate cataloged flaws by set deadlines. CISA reiterated that while the directive applies only to federal agencies, it urged all organizations to treat catalog entries as a priority in their vulnerability management programs, noting that such vulnerabilities remain a frequent vector for malicious cyber actors. (CISA)

CISA Added Ten Exploited Vulnerabilities to Its Catalog

On August 25, 2022, CISA added ten additional vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The update fell under Binding Operational Directive 22-01, obligating federal civilian executive branch agencies to remediate the newly listed flaws by CISA-set deadlines. CISA again urged all organizations, not just federal agencies, to prioritize timely remediation of catalog vulnerabilities as part of routine vulnerability management, noting the flaws remain a frequent attack vector for malicious cyber actors targeting the federal enterprise. (CISA)

Cisco Patched Multiple Products Against Remote Takeover Flaws

Cisco released security updates on August 25, 2022 for vulnerabilities affecting its ACI Multi-Site Orchestrator, FXOS, and NX-OS software. CISA warned that a remote attacker could exploit some of the flaws to take control of an affected system and pointed administrators to Cisco's advisories for each product line. CISA encouraged users and administrators to review the ACI Multi-Site Orchestrator, FXOS, and NX-OS advisories and apply the necessary updates promptly to reduce exposure to exploitation attempts against affected network infrastructure. (CISA)

CISA Updated Advisory on Zimbra Exploitation

CISA and the Multi-State Information Sharing and Analysis Center updated joint advisory AA22-228A on August 22, 2022, covering threat actors exploiting multiple CVEs against the Zimbra Collaboration Suite. Originally issued August 16, 2022, the update added new detection signatures to help defenders identify compromise activity tied to the ongoing exploitation. CISA encouraged organizations running Zimbra to review the latest version of AA22-228A and apply the recommended mitigations to reduce exposure to the exploited flaws. (CISA)

0ktapus Phishing Campaign Tied to Twilio, Cloudflare Breaches Detailed

Group-IB disclosed on August 25, 2022 that phishing attacks previously reported at Twilio and Cloudflare were part of a broader campaign it named 0ktapus, which compromised 9,931 accounts across more than 130 organizations. The attackers impersonated Okta's identity and access management login pages and used text messages to harvest credentials and one-time MFA codes, with activity dating back to at least March 2022. Group-IB said victim organizations were notified of compromised accounts and that findings were shared with international law enforcement agencies. (Help Net Security)

GitLab Patched Critical Remote Code Execution Flaw

GitLab disclosed on August 24, 2022 that it had fixed a critical remote code execution vulnerability, tracked as CVE-2022-2884, affecting both the Community and Enterprise editions of its DevOps platform. The flaw could let an authenticated user achieve code execution through the Import from GitHub API endpoint, and it affected multiple version ranges starting from 11.3.4. GitLab said the issue was reported through its bug bounty program with no evidence of exploitation in the wild, and it urged administrators running on-premises instances to upgrade immediately or disable GitHub import as a stopgap. (Help Net Security)

CISA Released Guidance on Post-Quantum Cryptography Preparedness

CISA published a new CISA Insight on August 24, 2022 titled Preparing Critical Infrastructure for Post-Quantum Cryptography, outlining potential impacts of quantum computing on the 55 National Critical Functions and steps owners and operators should begin taking now. The guidance incorporated findings from an assessment of quantum vulnerabilities affecting those functions and identified three NCF areas to prioritize for public-private engagement. CISA pointed critical infrastructure and government network owners to its Post-Quantum Cryptography Roadmap, which recommends inventorying cryptographic technologies and updating acquisition policies ahead of the transition. (CISA)

PyPI Warned of Phishing Campaign Compromising Legitimate Packages

The Python Package Index warned on August 25, 2022 that a phishing campaign had compromised maintainer accounts for legitimate projects and pushed malware through package updates, naming exotel, spam, and deep-translator among the affected releases. PyPI said the malicious releases were removed and the associated maintainer accounts temporarily frozen, and separately took down several hundred typosquatting packages following the same pattern. The phishing emails directed victims to a fake login page mimicking PyPI's site, and the organization urged affected users to reset passwords and two-factor recovery codes. (Help Net Security)