Week of July 3, 2023: Ransomware halts Japan's busiest port, and JumpCloud invalidates admin API keys

What mattered to security leaders in the week of July 3, 2023? A ransomware infection of the terminal system at the Port of Nagoya, Japan's largest port, halted container handling, and identity platform JumpCloud invalidated its customers' admin API keys while it handled an undisclosed incident. US and Canadian agencies also warned of new Truebot malware variants, and Progress shipped another MOVEit Transfer service pack.

Ransomware stops container operations at the Port of Nagoya

On July 4, around 06:30 local time, ransomware hit the Nagoya Port Unified Terminal System, the central platform that runs every container terminal at a port handling about 10% of Japan's trade and much of Toyota's car exports. Loading and unloading by trailer was cancelled while the system was restored. BleepingComputer said no group had claimed the attack at publication, while The Record reported that the Nagoya Harbor Transportation Association attributed it to LockBit. Toyota said it could not load or unload auto parts. (BleepingComputer, The Record)

JumpCloud invalidates admin API keys over an "ongoing incident"

JumpCloud, a Colorado-based directory-as-a-service provider serving more than 180,000 organizations, emailed administrators that it had invalidated existing admin API keys as a precaution tied to an incident it did not describe. BleepingComputer reported the notice on July 6. Customers relying on the keys, directly or through integrations, had to generate new ones and update those integrations. Because an identity provider sits upstream of many other systems, a forced credential reset like this can break automations across a customer's estate. (BleepingComputer)

CISA, FBI, MS-ISAC and Canada warn of new Truebot variants

On July 6 the four organizations issued a joint advisory on newly identified Truebot malware variants hitting networks in the US and Canada. Attackers spread the malware through phishing emails with malicious redirect links, and newer versions gain initial access by exploiting CVE-2022-31199 in the Netwrix Auditor application, which attackers were still using in May 2023 to deliver Truebot and steal data. The agencies urged patching that flaw as part of broader ransomware defenses. (CISA)

Progress ships a MOVEit Transfer service pack for three more flaws

On July 7 CISA pointed MOVEit Transfer users to a new Progress Software service pack that fixes three newly disclosed vulnerabilities, CVE-2023-36934, CVE-2023-36932 and CVE-2023-36933. CISA said an attacker could use some of them to obtain sensitive information. Teams running MOVEit had one more update to schedule on an internet-facing file-transfer server. (CISA)

EU court backs German order limiting how Meta combines user data

In a Tuesday, July 4 ruling, the Court of Justice of the European Union upheld the German competition authority's 2019 order directing Facebook to change how it tracks users across its services and third-party sites. The court said national antitrust regulators may use the GDPR as a lever to require changes, and that visiting Facebook and its sibling services does not amount to consent to data mining. Privacy and data governance teams gained a clear signal that competition regulators can enforce data protection expectations too. (The Record)

Arm Mali GPU driver flaw joins the exploited-vulnerabilities catalog

On July 7 CISA added CVE-2021-29256, a use-after-free in the Arm Mali GPU kernel driver, to its Known Exploited Vulnerabilities Catalog on evidence of active exploitation. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog entries by set deadlines. For mobile fleet managers, the listing marks Android devices with Mali graphics as worth checking for current patch levels. (CISA)