Week of January 15, 2024: CISA's Ivanti Emergency Directive and Microsoft's Email Breach

Security leaders faced a dual emergency in the week of January 15, 2024: CISA ordered federal civilian agencies to mitigate actively exploited Ivanti Connect Secure and Policy Secure flaws through Emergency Directive 24-01, while Microsoft disclosed that a nation-state threat actor had accessed senior leadership email accounts. The same week brought a joint water-sector incident response guide from CISA, FBI and EPA, a new Androxgh0st malware advisory, and fresh additions of Citrix NetScaler, Chromium, and Ivanti mobile-management vulnerabilities to CISA's Known Exploited Vulnerabilities Catalog.

CISA Issues Emergency Directive on Ivanti Connect Secure and Policy Secure Flaws

On January 19, 2024, CISA issued Emergency Directive 24-01 after observing widespread and active exploitation of two vulnerabilities, CVE-2023-46805 and CVE-2024-21887, in Ivanti Connect Secure and Ivanti Policy Secure appliances. The directive ordered all Federal Civilian Executive Branch agencies to implement vendor mitigations, report indications of compromise, and apply updates within 48 hours of their release. CISA Director Jen Easterly said the flaws posed "significant, unacceptable risks to the security of the federal civilian enterprise," and the agency urged every organization running the affected products to adopt the same mitigations. (CISA)

Microsoft Discloses Nation-State Email Breach Affecting Senior Leadership

In a Form 8-K filed January 19, 2024, Microsoft disclosed that on January 12, 2024, it detected a nation-state associated threat actor had accessed email accounts beginning in late November 2023, exfiltrating information from a small number of employee inboxes, including members of its senior leadership team and staff in cybersecurity and legal functions. Microsoft said it removed the threat actor's access by January 13, 2024, notified law enforcement, and was still examining the scope of the compromise. The company stated the incident had not yet had a material impact on its operations. (SEC EDGAR)

CISA, FBI and EPA Publish Water Sector Incident Response Guide

On January 18, 2024, CISA, the FBI, and the EPA released a joint Incident Response Guide for the Water and Wastewater Systems Sector, developed with contributions from more than 25 WWS Sector organizations spanning industry, nonprofit, and government partners. The guide walked utilities through four stages of cyber incident response, offered clear guidance for reporting incidents, and connected operators with no-cost federal training and vulnerability scanning resources. Officials said the sector faced frequent targeting by malicious cyber actors and urged every WWS entity to incorporate the guidance into incident response planning. (CISA)

CISA and FBI Detail Androxgh0st Malware Indicators of Compromise

On January 16, 2024, CISA and the FBI released a joint advisory, AA24-016A, detailing indicators of compromise and tactics tied to threat actors deploying Androxgh0st malware. The malware built a botnet that scanned for and exploited vulnerable web applications, targeting .env files to steal credentials for cloud and communications services such as Amazon Web Services, Microsoft Office 365, SendGrid, and Twilio. The advisory listed three exploited CVEs, including a Laravel deserialization flaw, and recommended organizations patch known exploited vulnerabilities and review which servers remain exposed to the internet. (CISA)

CISA Adds Citrix NetScaler and Chromium Flaws to Exploited Vulnerabilities Catalog

On January 17, 2024, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a buffer overflow and a code injection flaw in Citrix NetScaler ADC and NetScaler Gateway, tracked as CVE-2023-6549 and CVE-2023-6548, and an out-of-bounds memory access vulnerability in Google Chromium V8, CVE-2024-0519. The agency required Federal Civilian Executive Branch agencies to remediate the flaws by set deadlines under Binding Operational Directive 22-01 and encouraged all organizations to prioritize patching given the frequent use of such vulnerabilities as attack vectors. (CISA)

Ivanti Mobile Management Flaw Added to CISA's Known Exploited Vulnerabilities List

On January 18, 2024, CISA added CVE-2023-35082, an authentication bypass vulnerability in Ivanti Endpoint Manager Mobile and MobileIron Core, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The addition came the same week CISA separately directed federal agencies to mitigate a different pair of actively exploited Ivanti Connect Secure and Policy Secure flaws, underscoring sustained attacker interest in Ivanti's remote access and mobile management products. CISA again urged all organizations, not only federal civilian agencies bound by Binding Operational Directive 22-01, to remediate catalog vulnerabilities promptly. (CISA)

CISA Publishes ICS Advisory for AVEVA PI Server

On January 18, 2024, CISA released an Industrial Control Systems advisory, ICSA-24-018-01, covering AVEVA PI Server, providing technical details on current vulnerabilities and recommended mitigations for the widely used industrial data historian platform. The advisory formed part of CISA's regular ICS bulletin cycle for the week, alongside guidance for other operational technology products, and CISA encouraged users and administrators running AVEVA PI Server to review the advisory and apply the mitigations to reduce exposure to exploits targeting ICS environments. (CISA)