Week of September 4, 2023: CISA Warns on ManageEngine Exploits, Microsoft Explains Stolen Key

The week of September 4, 2023 saw CISA, the FBI, and CNMF detail nation-state exploitation of Zoho ManageEngine and FortiOS at an aeronautical-sector organization, CISA add an Apache RocketMQ flaw to its Known Exploited Vulnerabilities Catalog, and Microsoft explain how a stolen signing key enabled email intrusions at government agencies. UK fence maker Zaun also disclosed a LockBit ransomware breach, while CISA and Cisco issued additional advisories covering Citrix NetScaler webshells, Barracuda ESG backdoors, and multiple Cisco products.

CISA, FBI, CNMF Detail Nation-State Exploitation of ManageEngine and FortiOS Flaws

On September 7, 2023, CISA, the FBI, and U.S. Cyber Command's Cyber National Mission Force published a joint advisory describing an incident at an Aeronautical Sector organization in which nation-state advanced persistent threat actors exploited CVE-2022-47966 to gain unauthorized access to Zoho ManageEngine ServiceDesk Plus, establish persistence, and move laterally. Additional actors exploited CVE-2022-42475 on the organization's firewall device. The advisory noted malicious activity dating to January 2023 and urged organizations to patch known exploited vulnerabilities and monitor for unauthorized remote access. (Cybersecurity and Infrastructure Security Agency (CISA))

CISA Updates Advisory on Citrix NetScaler CVE-2023-3519 Webshell Activity

On September 6, 2023, CISA released an update to its Cybersecurity Advisory on threat actors exploiting CVE-2023-3519, an unauthenticated remote code execution vulnerability in NetScaler (formerly Citrix) Application Delivery Controller and NetScaler Gateway, to implant webshells. The refreshed advisory added new tactics, techniques, and indicators of compromise gathered through the Joint Cyber Defense Collaborative, along with details on an additional victim identified in August 2023. CISA again urged critical infrastructure organizations to prioritize patching the vulnerability. (Cybersecurity and Infrastructure Security Agency (CISA))

LockBit Leaks Data Stolen From UK Security-Fence Maker Zaun

Zaun, a UK manufacturer of fencing systems for military sites and critical utilities, disclosed in reporting published September 5, 2023, that the LockBit ransomware group had breached a legacy Windows 7 PC running manufacturing software and used it to reach the wider network. The company said roughly 10 GB of data, 0.74% of its stored data, was taken, potentially including historic emails, orders, drawings and project files, though it said no classified documents were affected. Zaun notified the NCSC, ICO and a regional cyber crime unit. (Help Net Security)

Microsoft Details How a Signing Key Enabled Chinese Hacking of Government Email

In an explanation published September 7, 2023, Microsoft described how a consumer signing key was captured in a crash dump of an isolated signing system and later moved to its internet-connected corporate debugging environment, where it says attackers likely obtained it after compromising an engineer's corporate account. Microsoft said a token validation issue then let the consumer key be accepted for enterprise mail requests, which allowed access to Microsoft 365 email accounts at government agencies. Microsoft said the underlying race condition and validation gaps have since been corrected. (Help Net Security)

CISA Publishes Malware Analysis of Barracuda ESG Backdoors

On September 7, 2023, CISA released a malware analysis report covering five samples tied to the SUBMARINE, SKIPJACK, SEASPRAY, WHIRLPOOL, and SALTWATER backdoors found on a device compromised through CVE-2023-2868, a former zero-day affecting versions 5.1.3.001-9.2.0.006 of Barracuda Email Security Gateway. The report included indicators of compromise and YARA rules for network defenders and pointed to CISA's earlier alert on related Barracuda backdoors for additional detail on the initial exploit payload. (Cybersecurity and Infrastructure Security Agency (CISA))

Cisco Issues Advisories for BroadWorks and Identity Services Engine Flaws

On September 7, 2023, Cisco published security advisories covering vulnerabilities in BroadWorks, BroadWorks Xtended, and Identity Services Engine's RADIUS handling. CISA said a cyber threat actor could exploit some of the flaws to take control of an affected system or cause a denial-of-service condition, and it encouraged administrators to review the advisories and apply the necessary updates. (Cybersecurity and Infrastructure Security Agency (CISA))