Week of September 5, 2022: Vice Society Ransomware Alert, Go-Ahead Cyberattack

Security leaders tracked a joint FBI-CISA-MS-ISAC advisory on Vice Society ransomware targeting K-12 schools, a dozen new entries in CISA's Known Exploited Vulnerabilities Catalog, and patches for Cisco SD-WAN vManage and NVIDIA DPDK flaws. UK transport operator Go-Ahead Group disclosed a cyber security incident on its network, while researchers exposed a new EvilProxy phishing-as-a-service kit built to bypass multifactor authentication.

FBI, CISA, MS-ISAC Warn of Vice Society Targeting Schools

On September 8, 2022, the FBI, CISA, and the Multi-State Information Sharing and Analysis Center published a joint advisory on Vice Society, an intrusion and extortion group that had disproportionately targeted the education sector, including K-12 school districts, with ransomware. The agencies noted the group used compromised credentials, deployed Hello Kitty/Five Hands and Zeppelin ransomware variants, and exploited the PrintNightmare vulnerability to escalate privileges. They warned attacks could increase as the new school year began and urged organizations to patch known exploited vulnerabilities, train users on phishing, and enforce multifactor authentication. (CISA)

CISA Adds Twelve Vulnerabilities to Known Exploited Vulnerabilities Catalog

On September 8, 2022, CISA added twelve new vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The agency reiterated that Binding Operational Directive 22-01 requires federal civilian executive branch agencies to remediate catalog entries by set deadlines, and it urged all organizations to prioritize timely remediation of the listed flaws as part of routine vulnerability management. CISA said it would continue expanding the catalog as it identified vulnerabilities meeting the established criteria for known exploitation risk. (CISA)

Cisco Patches SD-WAN vManage and NVIDIA DPDK Flaws

On September 9, 2022, CISA advised that Cisco had released security updates addressing vulnerabilities across multiple products, including SD-WAN vManage Software's unauthenticated access to messaging services and a flaw in the NVIDIA Data Plane Development Kit affecting Cisco products. CISA warned that a remote attacker could exploit some of the vulnerabilities to gain control of an affected system and encouraged administrators to apply the available updates promptly. (CISA)

CISA Issues Four Industrial Control Systems Advisories

On September 8, 2022, CISA released four Industrial Control Systems advisories covering products from MZ Automation, Baxter, Hillrom, and PTC Kepware. The advisories addressed current security issues, vulnerabilities, and exploits affecting infusion pumps, medical device management systems, and industrial communication software, and CISA encouraged operators and administrators to review the technical details and apply the recommended mitigations. (CISA)

CISA Publishes Five More ICS Advisories

On September 6, 2022, CISA released five additional Industrial Control Systems advisories covering Triangle Microworks, AVEVA Edge, Cognex's 3D-A1000 Dimensioning System, Hitachi Energy's TXpert Hub CoreTec 4, and an update to Delta Electronics DOPSoft 2. The advisories provided technical detail on vulnerabilities and exploits affecting industrial software and hardware used across manufacturing and energy environments, and CISA urged asset owners to review the recommended mitigations. (CISA)

UK Transport Operator Go-Ahead Group Discloses Cyber Incident

The Go-Ahead Group, one of the UK's largest bus and rail operators, disclosed that it was managing a cyber security incident after detecting unauthorized activity on its network. The company did not specify what data or systems were affected. Commentary accompanying the disclosure noted that such incidents have periodically struck the UK transport sector, with attackers seeking to interrupt journeys and access customer and employee data, and pointed to capacity constraints many mid-sized security teams face when investigating alerts. (Help Net Security)

EvilProxy Phishing-as-a-Service Surfaces on Dark Web Forums

Researchers at Resecurity identified a new phishing-as-a-service offering called EvilProxy being advertised on dark web forums, using reverse proxy and cookie injection techniques to bypass multifactor authentication and hijack session cookies. Investigators traced attacks against employees of Fortune 500 companies and noted the kit targeted major consumer and developer platforms, including Google, Microsoft, GitHub, and PyPI, raising concern that productized MFA-bypass tooling was becoming accessible to a wider range of criminal actors for a monthly subscription fee. (Help Net Security)