Week of September 19, 2022: Iran's Albania Wiper Attacks, Uber's Lapsus$ Breach

Security leaders tracking the week of September 19, 2022 saw CISA and the FBI detail a fresh wave of Iranian wiper and ransomware attacks against the Government of Albania, while Uber confirmed its recent breach was tied to the Lapsus$ hacking group. The week also brought a Revolut data breach affecting more than 50,000 customers, a leak of unreleased Grand Theft Auto footage from Rockstar Games, and new CISA guidance on control system defense and BIND 9 vulnerabilities.

CISA and FBI Detail Renewed Iranian Wiper Attacks on Albania

CISA and the FBI published a joint advisory detailing a second wave of destructive cyber operations against the Government of Albania. The advisory said Iranian state actors, identifying as HomeLand Justice, had maintained network access for roughly a year before earlier July attacks that combined ransomware-style encryption with disk-wiping malware. In September 2022 the same actors launched another wave of attacks using similar tactics, techniques, and malware as the July intrusions, which the advisory linked to retaliation for public attribution and severed diplomatic ties between Albania and Iran. (CISA)

CISA and NSA Issue Joint Advisory on Control System Defense

CISA and the National Security Agency published a joint cybersecurity advisory, Control System Defense: Know the Opponent, outlining tactics, techniques, and procedures used by malicious actors against operational technology and industrial control system assets. The advisory built on 2020 and 2021 NSA-CISA guidance and described how cyber actors select targets, gather intelligence, and develop tools before gaining initial access to control systems. CISA and NSA urged critical infrastructure owners and operators to review the guidance and apply recommended mitigations to reduce OT exposure. (CISA)

Revolut Breach Confirmed by Lithuanian Regulator, Over 50,000 Affected

Lithuania's State Data Protection Inspectorate disclosed that Revolut Bank suffered a data breach in which access to its database was obtained through social engineering. The regulator said the personal data of 50,150 customers worldwide, including 20,687 within the European Economic Area, had potentially been compromised, covering names, addresses, email addresses, phone numbers, partial payment card data, and account details. Revolut warned affected users to watch for suspicious contact, and customers subsequently reported receiving SMS phishing messages referencing the incident. (Help Net Security)

CISA Adds New Vulnerability to Known Exploited Vulnerabilities Catalog

CISA added one new vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The addition falls under Binding Operational Directive 22-01, which requires federal civilian agencies to remediate catalog vulnerabilities by set deadlines to protect their networks against active threats. CISA again encouraged all organizations, not just federal agencies, to prioritize timely remediation of catalog vulnerabilities as part of routine vulnerability management practice. (CISA)

Rockstar Games Confirms Intrusion After GTA 6 Footage Leak

Rockstar Games confirmed a network intrusion after in-development footage for the next Grand Theft Auto installment was leaked online by an individual using the handle teapotuberhacker. The leaker claimed to have exfiltrated the material from the company's internal Slack workspaces and threatened to release GTA 5 and GTA 6 source code and assets. Rockstar said it was working to get the leaked videos removed from YouTube while the leaker sought to negotiate a deal rather than release further stolen material. (Help Net Security)

DHS Announces $1 Billion Cybersecurity Grant Program for Governments

The US Department of Homeland Security announced it would award $1 billion in grants to help state, local, and territorial governments address cybersecurity risks and strengthen critical infrastructure resilience. CISA and FEMA will jointly administer the program, with $185 million to be awarded in the current fiscal year and applications due by November 15, 2022. Grantees must show plans covering practices such as multi-factor authentication, enhanced logging, data encryption, and the ability to reconstitute systems from backups. (Help Net Security)

ISC Patches Multiple BIND 9 Denial-of-Service Vulnerabilities

The Internet Systems Consortium released security advisories addressing multiple vulnerabilities in several versions of BIND 9, its widely used Domain Name System software. CISA said a remote attacker could exploit the flaws, tracked as CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, and CVE-2022-38178, to potentially cause denial-of-service conditions. CISA encouraged users and administrators to review the ISC advisories and apply the necessary updates to affected BIND 9 deployments. (CISA)