Week of May 22, 2023: Five Eyes expose Volt Typhoon, and Barracuda email gateways hit through a zero-day

What mattered to security leaders in the week of May 22, 2023? US agencies and their Five Eyes counterparts published a joint advisory on a Chinese state-sponsored actor dubbed Volt Typhoon that hides inside critical infrastructure networks using built-in administration tools, and Barracuda warned that a zero-day in its Email Security Gateway appliances had been exploited. Ransomware also disrupted the City of Augusta, Georgia, while ABB and Rheinmetall confirmed attacks.

Five Eyes advisory details a PRC actor living off the land

On May 24 CISA, the NSA and the FBI, with cyber agencies from Australia, Canada, New Zealand and the United Kingdom, released a joint advisory on a People's Republic of China state-sponsored actor targeting critical infrastructure. The actor relies on legitimate network administration tools so its activity blends in, slips past many endpoint detection products and leaves little in common log configurations. Help Net Security reported the actor's name as Volt Typhoon and noted guidance to monitor for Event ID 1102, which fires when the audit log is cleared. (CISA, Help Net Security)

Barracuda Email Security Gateway exploited through CVE-2023-2868

Barracuda Networks warned that attackers had exploited CVE-2023-2868, a critical remote command injection flaw in physical Email Security Gateway appliances running versions 5.1.3.001 to 9.2.0.006. The bug sits in how the appliance handles file names inside .tar archives. Barracuda said it identified the flaw on May 19, pushed a patch to every ESG appliance worldwide on May 20, and applied a second containment patch on May 21, notifying customers it believed were affected. (Help Net Security)

Updated #StopRansomware Guide from CISA, FBI, NSA and MS-ISAC

On May 23 the four organizations published a revised #StopRansomware Guide, updating the 2020 edition through the Joint Ransomware Task Force that Congress set up in 2022. The new version adds advice on blocking common initial access routes such as compromised credentials and advanced social engineering, guidance on cloud backups, and threat hunting tips for detection. It serves as a ready checklist for boards asking how prepared an organization is for an extortion event. (CISA)

Rapid7 warns Zyxel firewall flaw is easy to weaponize

Rapid7 published a technical analysis and proof-of-concept for CVE-2023-28771, an already patched command injection bug in Zyxel APT, USG FLEX, VPN and ZyWALL/USG firewalls. A crafted UDP packet sent to port 500 on the WAN interface can yield OS command execution as root, with no authentication, even when no VPN is configured. The researchers said it was not known to be exploited as of May 19 but expected that to change, making perimeter firmware updates urgent. (Help Net Security)

City of Augusta confirms unauthorized access as BlackByte claims the attack

Augusta, Georgia's second-largest city, said computer systems were disrupted starting Sunday, May 21, and that the outage stemmed from unauthorized access to its network. The city did not describe the attack's nature, but the BlackByte ransomware gang listed Augusta as a victim. Officials said they were still establishing whether sensitive data had been accessed, and the mayor said media reports of a $50 million ransom demand were false. (BleepingComputer)

ABB confirms ransomware and data theft

Swiss technology group ABB, a US government contractor, confirmed in a report published by BleepingComputer on May 26 that what it had called an IT security incident was ransomware. The company said an unauthorized third party reached certain systems, deployed ransomware that was not self-propagating and took some data, and that it would contact affected customers, suppliers and individuals. ABB said its forensic work had found no evidence of direct impact on customer systems and that the breach was contained. (BleepingComputer)

Rheinmetall says Black Basta attack hit only its civilian business

German arms and automotive manufacturer Rheinmetall confirmed a Black Basta ransomware attack after the gang posted the company and sample data on its extortion site on May 20. A spokesperson said the intrusion was detected on April 14, affected the civilian business, and did not reach the military side because the group's IT infrastructure is strictly separated. For defense suppliers, it is a live case of segmentation limiting blast radius. (BleepingComputer)