Week of March 27, 2023: 3CX Supply Chain Attack and New KEV Additions

Security leaders faced a trojanized 3CXDesktopApp supply chain compromise, ten new entries added to CISA's Known Exploited Vulnerabilities catalog, and continued ransomware exploitation of IBM Aspera Faspex's CVE-2022-47986 during the week of March 27, 2023. Apple shipped a broad round of patches, OpenAI confirmed a ChatGPT data leak affecting billing details, Microsoft unveiled its Security Copilot tool, and CISA joined nine allied governments in a statement on protecting civil society from transnational cyber repression.

3CX Desktop App Hit by Supply Chain Compromise

CISA issued an alert on March 30, 2023 describing a supply chain attack against 3CXDesktopApp, a widely used voice and video conferencing application, after the Windows desktop client was found trojanized. The agency said attackers could use the compromised software to stage multi-staged intrusions and urged organizations to review analysis from CrowdStrike, SentinelOne, Broadcom, Palo Alto Networks, Tenable, VMware, Volexity, Trend Micro, Zscaler, and Fortinet, and to hunt for listed indicators of compromise. The incident highlighted how a single widely deployed enterprise app could become an attack vector reaching many customers at once. (CISA)

CISA Adds Ten Vulnerabilities to KEV Catalog

On March 30, 2023, CISA added ten vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, including two older Internet Explorer memory-corruption flaws, the Samba remote code execution bug CVE-2017-7494, two Fortra Cobalt Strike flaws, an Apple iOS/iPadOS/macOS out-of-bounds write bug, two Arm Mali GPU kernel driver issues, a Linux kernel use-after-free flaw, and a Chrome use-after-free bug. Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate the listed vulnerabilities by CISA's specified due dates. (CISA)

Apple Ships Security Updates Across Its Product Line

On March 28, 2023, Apple released security updates across its product line, including macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4, macOS Big Sur 11.7.5, macOS Monterey 12.6.4, and Studio Display firmware 16.4. CISA encouraged administrators to apply the updates, warning that some of the fixed vulnerabilities could let an attacker take control of an affected device. The release gave enterprise IT teams a broad patch list spanning desktop, mobile, and peripheral firmware to work through during the week. (CISA)

Ransomware Actors Keep Exploiting IBM Aspera Faspex Flaw

Help Net Security reported on March 30, 2023 that ransomware operators continued exploiting CVE-2022-47986, a critical YAML deserialization flaw in IBM Aspera Faspex file-transfer software that allows remote code execution and carries a CVSS score of 9.8. SentinelOne had linked the flaw to IceFire ransomware attacks against organizations in Turkey, Iran, Pakistan, and the United Arab Emirates, and Rapid7 said it was aware of at least one additional recent compromise. Enterprises running unpatched Faspex servers on their network perimeter remained exposed to file-transfer breaches tied to the vulnerability. (Help Net Security)

Microsoft Unveils AI-Powered Security Copilot

On March 29, 2023, Microsoft unveiled Security Copilot, an AI-powered tool intended to help security operations center analysts investigate incidents, analyze code snippets, and review alerts from other security tools through natural-language prompts. The tool draws on data from Microsoft Defender, Sentinel, Purview, and Intune alongside external sources, and lets analysts pin findings to a shareable summary board. Microsoft said Security Copilot was entering private preview and acknowledged it would not always produce fully accurate answers, relying on user feedback to improve its responses over time. (Help Net Security)

CISA and Allies Launch Dialogue on Civil Society Cybersecurity

On March 30, 2023, CISA joined the governments of Australia, Canada, Denmark, Estonia, France, Japan, New Zealand, Norway, and the United Kingdom in a joint statement establishing the Strategic Dialogue on Cybersecurity of Civil Society Under Threat of Transnational Repression. The participating governments committed to identifying actions to defend human rights defenders, journalists, dissidents, and advocacy groups from state-linked cyber targeting, and to convene regularly to share insight on threats facing high-risk communities and coordinate international cybersecurity support for civil society over the coming year. (CISA)