Week of November 6, 2023: Ransomware disrupts ICBC's US arm, and Clop affiliate exploits a SysAid zero-day

What mattered to security leaders in the week of November 6, 2023? A ransomware attack on ICBC Financial Services, the US broker-dealer of the Industrial and Commercial Bank of China, disrupted systems used in US Treasury trading, while CISA published guidance on Citrix Bleed, the NetScaler flaw ransomware crews were exploiting. Microsoft also caught the Clop-linked group Lace Tempest exploiting a zero-day in SysAid's on-premises IT service software.

Ransomware attack on ICBC Financial Services disrupts Treasury trading

ICBC Financial Services said it suffered a ransomware attack on November 8, US Eastern Time, that disrupted certain systems, which it disconnected and isolated. Help Net Security reported that the incident disrupted trades in the US Treasury market and that several outlets, including the Financial Times and Bloomberg, named LockBit as responsible. ICBC said it cleared Treasury trades from November 8 and repo financing trades from November 9, and that its head office and New York branch were not affected. (Help Net Security)

CISA issues Citrix Bleed guidance as exploitation continues

On November 7 CISA released guidance on CVE-2023-4966, the NetScaler ADC and Gateway vulnerability known as Citrix Bleed, citing active, targeted exploitation and warning it could let an attacker take control of an affected system. CISA told organizations to patch unmitigated appliances, hunt for malicious activity and report findings. In coverage of the ICBC incident, researcher Kevin Beaumont said more than 5,000 organizations had still not patched the flaw. (CISA, Help Net Security)

Clop-linked Lace Tempest exploits a SysAid zero-day

Microsoft Threat Intelligence spotted limited attacks exploiting CVE-2023-47246, a critical path traversal flaw in SysAid's on-premises IT support software, and alerted the Israeli vendor on November 2. Microsoft attributed the activity to Lace Tempest, a ransomware affiliate known for deploying Cl0p and for earlier zero-day campaigns against MOVEit Transfer, Accellion and GoAnywhere. SysAid told on-premises customers to move to version 23.3.36 and check for signs of compromise. (Help Net Security)

Attackers probe Confluence for a database-reset flaw

GreyNoise observed exploitation attempts against CVE-2023-22518, a critical Atlassian Confluence flaw that lets unauthenticated attackers reset an instance's database, and the Shadowserver Foundation saw more than 30 IP addresses testing for it. Atlassian had shipped fixes on October 31 and later confirmed a customer report of an active exploit. The bug does not allow data theft, but Atlassian warned compromised customers could face significant data loss. Confluence owners with internet-facing instances had a strong case for emergency patching. (Help Net Security)

Sumo Logic investigates access through a compromised AWS credential

Security analytics vendor Sumo Logic disclosed on Tuesday, November 7, that it found evidence of a potential security incident on November 3, in which a compromised credential was used to access one of its AWS accounts. The company said it had seen no impact on its networks or systems and that customer data remained encrypted. It still advised customers to rotate Sumo Logic API access keys, installed collector credentials, third-party credentials stored with the service and user passwords. (Help Net Security)

Mandiant ties a 2022 Ukrainian power outage to Sandworm

Mandiant published an analysis attributing a late-2022 disruption of part of Ukraine's power grid to Sandworm, the GRU-linked group. The attackers used living-off-the-land techniques against operational technology to trigger an outage that coincided with missile strikes. Sandworm reached the OT side through a hypervisor hosting a SCADA management instance for the substation environment and may have had SCADA access for up to three months. Utilities running virtualized OT management have a concrete scenario to test against. (Help Net Security)

CISA and NSA publish SBOM consumption practices

On November 9 CISA, the NSA and partners in the Enduring Security Framework released "Securing the Software Supply Chain: Recommended Practices for Software Bill of Materials Consumption." The guide covers managing open source software and SBOMs, and its practices can be applied across acquisition, deployment and operations. CISA urged defenders to discuss the recommendations with their software vendors, which gives procurement teams a checklist for SBOM requests. (CISA)