Week of January 22, 2024: HPE's Midnight Blizzard Breach and Tietoevry's Akira Attack

Security leaders faced a nation-state email intrusion disclosure from Hewlett Packard Enterprise, an Akira ransomware attack that halted services at Finnish IT provider Tietoevry's Swedish datacenter, and two new entries, an Atlassian Confluence flaw and an Apple WebKit zero-day, added to CISA's Known Exploited Vulnerabilities catalog during the week of January 22, 2024. The same week brought a CISO change at F5, a public proof-of-concept for a Fortra GoAnywhere MFT authentication bypass, a scraped Trello user dataset offered for sale, and joint US-UK-Australia guidance on securing AI system use.

HPE Discloses Nation-State Email Breach in SEC Filing

Hewlett Packard Enterprise disclosed in a Form 8-K filed January 24, 2024 that it was notified in December 2023 of unauthorized access to its cloud-based email environment by a suspected nation-state actor tracked as Midnight Blizzard, also known as Cozy Bear. The company said the actor exfiltrated data beginning in May 2023 from a small percentage of mailboxes belonging to staff in cybersecurity, go-to-market and other functions, and linked the activity to an earlier incident involving SharePoint files reported in June 2023. HPE said the incident had not had a material impact on operations as of the filing date. (SEC EDGAR)

F5 Names Samir Sherif as Chief Information Security Officer

F5 announced the appointment of Samir Sherif as senior vice president and chief information security officer, effective as the company's new security leader. Sherif previously served as CISO at Absolute Software and Imperva and earlier led application security at Citigroup. He succeeds Gail Coury, who is retiring from the CISO role on March 1 after three years leading F5's enterprise security program. F5 said Sherif will oversee cybersecurity strategy, product security standards and resilience efforts across the company. (Help Net Security)

Akira Ransomware Attack Disrupts Tietoevry's Swedish Datacenter

Finnish IT firm Tietoevry suffered a ransomware attack between January 19 and January 20, 2024, that hit one part of a Swedish datacenter and disrupted services for several customers, including a cinema chain, retailers, and public-sector systems in the Uppsala Region. The company isolated the affected platform, said other infrastructure was unaffected, and began investigation and recovery. By January 25, 2024, Tietoevry confirmed the intrusion involved Akira ransomware and said restoration could take days to weeks given the number of customer-specific systems needing rebuild. (Help Net Security)

CISA Adds Actively Exploited Atlassian Confluence Flaw to KEV Catalog

CISA added CVE-2023-22527, an Atlassian Confluence Data Center and Server template injection vulnerability, to its Known Exploited Vulnerabilities Catalog on January 24, 2024, citing evidence of active exploitation. The listing triggered the Binding Operational Directive 22-01 remediation clock for federal civilian agencies, which must patch catalog entries by a specified due date. CISA urged all organizations, not just federal agencies, to prioritize remediation of this vulnerability as part of routine vulnerability management practices. (CISA)

Apple Patches Actively Exploited WebKit Zero-Day, CISA Adds It to KEV

Apple shipped security updates on January 22, 2024 for iOS, iPadOS, macOS, Safari, watchOS and tvOS that fixed CVE-2024-23222, a WebKit type confusion flaw that could let a threat actor take control of an affected system. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on January 23, 2024 based on evidence of active exploitation, and encouraged users and administrators to apply Apple's updates, including iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, macOS Monterey 12.7.3, Safari 17.3, watchOS 10.3, and tvOS 17.3. (CISA)

CISA, NCSC-UK and Allies Publish Joint Guidance on Secure AI Use

On January 23, 2024, CISA joined the Australian Signals Directorate's Australian Cyber Security Centre, the UK's National Cyber Security Centre, the FBI, the NSA and several other national agencies in releasing joint guidance called Engaging with Artificial Intelligence, led by ACSC, on how to use AI systems securely. The document outlined AI-related threats including data poisoning, input manipulation, generative AI hallucinations, privacy risks and model stealing, and offered steps organizations can take to manage those risks when engaging with AI systems. (CISA)

Scraped Data From 15 Million Trello Accounts Surfaces for Sale

In mid-January 2024 a seller advertised a dataset containing more than 15 million Trello user records, including emails, usernames and full names, on a dark web forum, with Atlassian confirming on January 23, 2024 that its investigation found no evidence of unauthorized access to Trello's systems. The company said a threat actor combined a pre-existing list of email addresses with publicly available Trello profile information obtained through the service's REST API, and it has since required authentication for that lookup function. (Help Net Security)

Public Exploit Released for Fortra GoAnywhere MFT Auth Bypass

On January 23, 2024, researchers published a technical analysis and proof-of-concept exploit for CVE-2024-0204, an authentication bypass in Fortra's GoAnywhere MFT that lets an unauthorized user create an administrator account through the product's admin portal. Fortra had already fixed the flaw in version 7.4.1, released December 7, 2023, and published a public advisory on January 22, 2024, but researchers warned the bug was easy to exploit and the Shodan search engine still showed more than 1,800 internet-exposed admin portals. (Help Net Security)