Week of July 10, 2023: Storm-0558 Outlook Breach Advisory and Revolut's $20M Fraud

The week of July 10, 2023 brought a joint CISA-FBI advisory on Storm-0558's access to Exchange Online Outlook data, Microsoft's July Patch Tuesday addressing four actively exploited zero-days, and Apple's emergency fix for an exploited WebKit flaw. Security leaders also tracked new reporting on a $20 million payment-system fraud at Revolut, a leadership change atop IronNet, and the European Commission's adoption of the EU-U.S. Data Privacy Framework adequacy decision.

Microsoft's July Patch Tuesday Fixes Four Exploited Zero-Days

On July 11, 2023, Microsoft released 130 patches for its July Patch Tuesday, including fixes for four vulnerabilities under active exploitation: CVE-2023-32046, CVE-2023-32049, CVE-2023-35311, and CVE-2023-36874. Microsoft did not ship a patch for CVE-2023-36884, an Office and Windows HTML remote-code-execution flaw abused in targeted attacks against defense and government entities in Europe and North America, and instead published mitigation guidance while a fix remained pending. CISA separately urged administrators to review Microsoft's Security Update Guide and apply the available fixes. (Help Net Security)

Apple Ships Emergency Fix for Exploited WebKit Zero-Day

On July 11, 2023, Apple released Rapid Security Response updates addressing CVE-2023-37450, an actively exploited WebKit vulnerability that could be triggered by malicious web content and lead to arbitrary code execution on iPhones, iPads, and Macs. A companion fix shipped for Safari on macOS Big Sur and Monterey. Apple briefly pulled the updates after they interfered with some websites, then reissued corrected versions on July 13, 2023. CISA added the flaw to its Known Exploited Vulnerabilities Catalog that same day. (Help Net Security)

CISA Adds Five Actively Exploited Vulnerabilities to KEV Catalog

On July 11, 2023, CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, covering Microsoft Windows MSHTML, Windows Defender SmartScreen, Outlook, Windows Error Reporting Service, and Netwrix Auditor. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies were required to remediate the listed flaws by CISA's specified due dates, and the agency urged all organizations to prioritize the same fixes as part of routine vulnerability management practice. (CISA)

Revolut's $20 Million Payment-System Fraud Surfaces Publicly

Help Net Security reported on July 10, 2023 that the Financial Times had disclosed organized criminal groups exploited a flaw in Revolut's payment systems, taking more than $20 million of the company's own money rather than customer funds. The issue stemmed from differences between European and US payment systems that caused Revolut to erroneously refund declined transactions. The scheme reportedly ran for several months in early 2022 and was uncovered after a US partner bank told the fintech it was holding less cash than expected. (Help Net Security)

IronNet Names Linda Zecher as Chief Executive Officer

On July 12, 2023, IronNet's Board of Directors appointed Linda Zecher as Chief Executive Officer effective immediately, with then-Chief Financial Officer Cameron Pforr moving into a newly created President role. Founder and former CEO Keith Alexander remained Chairman in a non-executive capacity. The leadership change coincided with a Take Private Letter Agreement between IronNet and a joint venture formed by C5 Capital and Cohen Circle, executed and delivered on July 11, 2023. Zecher previously led Houghton Mifflin Harcourt and held a Microsoft public-sector role. (Help Net Security)

European Commission Adopts EU-U.S. Data Privacy Framework Adequacy Decision

On July 10, 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework, concluding that the United States offers data protection comparable to the EU for personal data transferred to participating US companies. The framework introduced a Data Protection Review Court and limited US intelligence access to data deemed necessary and proportionate. For security leaders managing transatlantic data flows, the decision restored a legal transfer mechanism after the earlier Privacy Shield arrangement was invalidated by the Court of Justice of the European Union. (European Commission)