Week of January 8, 2024: Ivanti zero-days under active exploitation and SEC's X account hijacked

Security leaders spent the week of January 8, 2024 responding to actively exploited Ivanti Connect Secure and Policy Secure zero-days added to CISA's Known Exploited Vulnerabilities Catalog, while the SEC's own X account was hijacked to post a fake Bitcoin ETF approval. The same week brought a First American Financial regulatory filing on its December cybersecurity incident, a critical Cisco Unity Connection advisory, Microsoft's January Patch Tuesday, and a new CISO appointment at Vanta.

Ivanti Connect Secure and Policy Secure zero-days exploited, added to KEV Catalog

CISA and Ivanti disclosed that an authentication bypass flaw and a command injection flaw in Connect Secure and Policy Secure gateways were being actively exploited against all supported 9.x and 22.x versions. CISA urged immediate application of Ivanti's workaround and review of outside research on the vulnerabilities, and added both CVEs to its Known Exploited Vulnerabilities Catalog, triggering a remediation deadline for federal civilian agencies under Binding Operational Directive 22-01. (CISA)

First American Financial details Q4 revenue hit from December cybersecurity incident

First American Financial Corporation filed an amended Form 8-K describing unauthorized activity identified on its information technology systems, which led the company to isolate systems from the internet on December 20, 2023. The filing stated that certain fourth-quarter 2023 transactions were delayed or moved to other providers and that related revenue recognition would shift into the first quarter of 2024, alongside one-time expenses tied to the incident. (SEC EDGAR)

SEC's X account hijacked to post fake Bitcoin ETF approval

The US Securities and Exchange Commission's X account was compromised and used to post a false announcement claiming the agency had approved Bitcoin ETFs for listing on national exchanges. The post briefly moved Bitcoin's price before being removed. X's safety team attributed the takeover to an unidentified party gaining control of a phone number linked to the account, and the SEC confirmed multi-factor authentication had not been enabled at the time. (Help Net Security)

Cisco patches critical Unity Connection file-upload flaw

Cisco issued a security advisory for CVE-2024-20272 in Cisco Unity Connection, a messaging and voicemail platform, warning that an unauthenticated threat actor could exploit the flaw to upload arbitrary files and take control of an affected system. CISA flagged the advisory the same day, encouraging administrators to review the bulletin and apply the necessary updates to the unified messaging software. (CISA)

Microsoft's January Patch Tuesday fixes two critical Windows flaws

Microsoft's January Patch Tuesday release addressed 49 CVE-numbered vulnerabilities, including two rated critical: a Kerberos security feature bypass, CVE-2024-20674, that could let an attacker impersonate a Kerberos authentication server, and a Hyper-V remote code execution flaw, CVE-2024-20700. None of the fixed vulnerabilities were reported as previously publicly disclosed or under active exploitation at the time of release. (Help Net Security)

CISA adds six actively exploited vulnerabilities to KEV Catalog

CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, spanning Adobe ColdFusion, Apache Superset, Apple products, D-Link devices and Joomla!. The addition triggers remediation deadlines for federal civilian executive branch agencies under Binding Operational Directive 22-01, and CISA again urged all organizations to prioritize fixing catalog vulnerabilities as part of routine vulnerability management. (CISA)