Week of December 11, 2023: Russian SVR TeamCity Exploitation and CISA's Secure by Design Push

Security leaders faced a joint U.S.-UK-Poland advisory detailing Russian SVR exploitation of JetBrains TeamCity servers alongside CISA's addition of an actively exploited Unitronics PLC default-password flaw to its Known Exploited Vulnerabilities catalog. The week also brought CISA guidance urging manufacturers to eliminate default passwords and detailing healthcare-sector penetration-test findings, while researchers disclosed the Lazarus Group's Log4Shell-based malware campaign and Microsoft's findings on OAuth application abuse for cryptomining and phishing.

CISA, FBI, NSA and Allies Detail Russian SVR Exploitation of JetBrains TeamCity Flaw

On December 13, 2023, CISA joined the FBI, NSA, Poland's SKW and CERT Polska, and the UK's National Cyber Security Centre in releasing a joint advisory on Russian Foreign Intelligence Service-affiliated actors, tracked as APT29, Cozy Bear and Midnight Blizzard, exploiting CVE-2023-42793 in JetBrains TeamCity servers since September 2023. The agencies said the access could let the group reach source code, signing certificates, and software build and deployment processes, and recommended that organizations which had not promptly patched assume compromise and begin threat hunting using the advisory's indicators of compromise. (CISA)

CISA Publishes Seventeen Industrial Control Systems Advisories

On December 14, 2023, CISA released seventeen Industrial Control Systems advisories covering products from Siemens, Johnson Controls Kantech, Cambium Networks, Unitronics and Philips, among others. The batch included multiple Siemens SIMATIC, SINUMERIK, SCALANCE and RUGGEDCOM advisories alongside an update to a Philips Patient Monitoring Devices advisory first issued in 2020. CISA encouraged asset owners and operators across critical infrastructure sectors to review the technical details and mitigations in each advisory to reduce exposure of vulnerable ICS components. (CISA)

CISA Secure by Design Alert Pushes Manufacturers to Eliminate Default Passwords

On December 15, 2023, CISA published a Secure by Design Alert urging technology manufacturers to eliminate static default passwords in their products by taking ownership of customer security outcomes and building organizational structures to support that goal. The alert was the second in CISA's new Secure by Design Alert series and built on the agency's joint guidance, Shifting the Balance of Cybersecurity Risk. CISA said implementing these principles during design, development and delivery would prevent exploitation of default passwords affecting customer systems at scale. (CISA)

CISA Details Healthcare Sector Risk and Vulnerability Assessment Findings

On December 15, 2023, CISA released Cybersecurity Advisory AA23-349A, detailing a Risk and Vulnerability Assessment it conducted at a large Healthcare and Public Health sector organization in January 2023. The agency said its team could not gain initial access externally or via phishing, but during internal penetration testing the team exploited misconfigurations, weak passwords, and other issues through multiple attack paths to compromise the organization's domain. CISA urged HPH and other critical infrastructure organizations deploying on-premises software to apply the advisory's mitigations to harden networks and reduce domain compromise risk. (CISA)

Lazarus Group Exploited Log4Shell to Deploy Novel DLang Malware

Cisco Talos reported on December 12, 2023 that the North Korea-linked Lazarus group had been exploiting the Log4Shell vulnerability, CVE-2021-44228, in publicly exposed VMware Horizon servers to gain initial access in a campaign dubbed Operation Blacksmith. After gaining access, the group deployed a custom proxy tool named HazyLoad along with credential-dumping utilities and a newly identified DLang-based remote access trojan called NineRAT, which used Telegram for command-and-control communication. Researchers said the activity targeted manufacturing, agricultural and physical security companies globally. (Help Net Security)

Microsoft Details OAuth App Abuse for Cryptomining and Phishing Campaigns

Microsoft Threat Intelligence reported on December 13, 2023 that attackers compromising high-privilege Microsoft accounts had abused OAuth applications to launch cryptomining and phishing operations. In one case, actors deployed virtual machines for cryptocurrency mining through newly created OAuth apps, generating compute fees ranging from 10,000 to 1.5 million USD per targeted organization. In a separate campaign, the actors created around 17,000 multitenant OAuth applications across compromised tenants that were used to send more than 927,000 phishing emails. (Help Net Security)