Week of June 5, 2023: CL0P's MOVEit Mass-Exploitation and CISA's KEV Additions

The week of June 5, 2023 was dominated by the fallout from CL0P's exploitation of a MOVEit Transfer zero-day, which prompted a joint CISA-FBI advisory alongside fresh Known Exploited Vulnerabilities Catalog additions for Zyxel firewalls and a Chromium flaw. CISA and partner agencies also published guidance on securing remote access software, Verizon released its annual breach report, and a VMware critical patch and a ransomware group's tactical shift added to the week's advisory load.

CISA and FBI Detail CL0P's MOVEit Transfer Exploitation

CISA and the FBI published a joint Cybersecurity Advisory describing how the CL0P ransomware gang, also tracked as TA505, exploited a SQL injection vulnerability in Progress Software's MOVEit Transfer product to deploy a web shell and steal data from victim databases. The advisory detailed indicators of compromise and tactics gathered through FBI investigations and urged organizations to implement mitigations to reduce the likelihood and impact of CL0P and other ransomware incidents. (CISA)

CISA, NSA, FBI and Partners Issue Guide to Securing Remote Access Software

CISA, the NSA, the FBI, MS-ISAC and the Israel National Cyber Directorate released a joint guide covering legitimate uses of remote access software alongside common exploitations and tactics used by malicious actors who abuse such tools for broad, easy access to victim systems. The agencies encouraged organizations to review the recommendations to better detect and defend against adversaries using remote access products as a living-off-the-land technique. (CISA)

Verizon's 2023 DBIR Finds Human Element in Most Breaches

Verizon Business released its 16th annual Data Breach Investigations Report, drawing on 16,312 security incidents and 5,199 confirmed breaches. The report found the human element present in 74% of breaches, ransomware involved in nearly a quarter of all breaches, and a median ransomware loss that had more than doubled over two years to $26,000, giving CISOs fresh benchmarks for budget and training priorities during the reporting period. (Help Net Security)

VMware Patches Critical Command Injection Flaw in Aria Operations for Networks

VMware shipped a security update for Aria Operations for Networks, formerly vRealize Network Insight, addressing multiple vulnerabilities rated in the critical severity range. CISA's alert explained that a malicious actor with network access could leverage a command injection flaw to achieve remote code execution, and it directed administrators to VMware Security Advisory VMSA-2023-0012 to apply the available patches without delay. (CISA)

0mega Ransomware Gang Shifts to SaaS Account Compromise and Data Extortion

Obsidian Security's threat research team attributed an attack on an unnamed company's SharePoint Online environment to the 0mega extortion group, which compromised a Microsoft Global admin service account lacking multi-factor authentication and used it to seize SharePoint and Exchange administrator rights before exfiltrating hundreds of files. The gang then dropped thousands of text files directing the victim toward ransom negotiations over Tor. (Help Net Security)