Week of September 25, 2023: Johnson Controls hit by ransomware, and allies warn of BlackTech router implants

What mattered to security leaders in the week of September 25, 2023? Building-systems maker Johnson Controls disclosed a cybersecurity incident that disrupted parts of its business, as reporting tied it to Dark Angels ransomware, and agencies from the United States and Japan warned that the China-linked BlackTech group alters router firmware to move from overseas subsidiaries into headquarters networks. MOVEit breach notices also kept arriving, from the National Student Clearinghouse to Ontario's BORN registry.

Johnson Controls discloses a disruptive cybersecurity incident

On September 27 Johnson Controls International filed a Form 8-K saying a cybersecurity incident had disrupted portions of its internal IT infrastructure and applications, would keep disrupting parts of its operations, and might affect the timing of its fiscal fourth-quarter results. BleepingComputer reported the same day that the attack began over the weekend, that a Dark Angels VMware ESXi encryptor carried a ransom note naming the company, and that the gang demanded $51 million and claimed to have taken over 27 TB of data. (Johnson Controls, SEC Form 8-K, BleepingComputer)

US and Japanese agencies expose BlackTech router firmware tampering

CISA, the NSA and the FBI, with Japan's National Police Agency and its cybersecurity strategy center NISC, published a joint advisory on September 27 about BlackTech, a PRC-linked group able to modify router firmware without detection and abuse routers' domain-trust relationships. The agencies said the actors used compromised routers at global subsidiaries to pivot into corporate headquarters in the United States and Japan, targeting sectors from government to the defense industrial base. Multinationals should treat branch-office network gear as a path into the core. (CISA)

FBI warns of dual ransomware attacks landing within 48 hours

A Private Industry Notification from the FBI, reported on September 28, described affiliates deploying two different ransomware strains against the same victim, a trend observed since July 2023. Variants seen in these attacks included AvosLocker, Diamond, Hive, Karakurt, LockBit, Quantum and Royal. Where such follow-on attacks once came at least 10 days apart, the FBI said most now occur within 48 hours of each other, which shortens the window responders have to evict an intruder before a second encryption. (BleepingComputer)

National Student Clearinghouse MOVEit breach reaches nearly 900 schools

The National Student Clearinghouse, which provides reporting and verification services to about 3,600 North American colleges and 22,000 high schools, said the theft of files from its MOVEit server affected almost 900 colleges and universities. In a notice filed with the California Attorney General, it said it learned on June 20, 2023 that files were taken, including names, dates of birth, Social Security numbers, student IDs and enrollment and degree records. The total number of students affected was not disclosed. (Help Net Security)

BORN Ontario says MOVEit theft exposed data on 3.4 million people

The Better Outcomes Registry & Network, a government-funded perinatal and child registry in Ontario, announced it was among the victims of Clop's MOVEit campaign. Files copied by the attackers held information on approximately 3.4 million people, mostly newborns and pregnancy care patients served between January 2010 and May 2023, including names, addresses, dates of birth and health card numbers. BORN said it learned of the breach on May 31 and notified Ontario's privacy commissioner. (BleepingComputer)

JetBrains fixes a critical TeamCity authentication bypass

JetBrains patched CVE-2023-42793, an authentication bypass in TeamCity On-Premises versions 2023.05.3 and earlier that can lead to remote code execution and control of the CI/CD server. The Sonar researcher who reported it warned that access to the build process would let attackers steal source code and secrets and inject malicious code into releases. Rapid7 said it knew of no exploitation as of September 25. The fix is in version 2023.05.4, with a patch or blocking internet access as fallbacks. (Help Net Security)

Three Apple zero-days added to CISA's exploited list

On September 25 CISA added three Apple flaws to its Known Exploited Vulnerabilities Catalog on evidence of active exploitation: CVE-2023-41991, a certificate validation weakness; CVE-2023-41992, a kernel privilege escalation; and CVE-2023-41993, a WebKit code execution bug. Together they cover the web entry point and the privilege step an attacker needs, so managed iPhone and Mac fleets had reason to confirm the updates landed. (CISA)