Week of January 29, 2024: FBI dismantles Volt Typhoon's router botnet, and Ivanti gateways get two more flaws

What mattered to security leaders in the week of January 29, 2024? The FBI announced a court-authorized operation that removed Volt Typhoon's KV botnet malware from hundreds of hijacked US small office and home routers, and CISA pressed router makers to design out the flaws the group abuses. Ivanti disclosed two more vulnerabilities in its Connect Secure and Policy Secure gateways, while Cloudflare and AnyDesk each described intrusions into their own systems.

FBI removes Volt Typhoon's KV botnet from hijacked routers

The FBI disrupted the KV botnet, which PRC state-sponsored hackers known as Volt Typhoon used to route activity through hundreds of privately owned US SOHO routers, most of them end-of-life Cisco and NetGear devices that no longer receive patches. The court-authorized operation deleted the malware and cut the routers off from the botnet. FBI Director Christopher Wray said the access supported reconnaissance against communications, energy, transportation and water infrastructure. (Help Net Security)

CISA and FBI tell SOHO router makers to close Volt Typhoon's path

In the third entry of its Secure by Design Alert series, published January 31, CISA and the FBI urged SOHO router manufacturers to eliminate exploitable defects in web management interfaces and to change defaults so updates are automatic, the management interface sits on LAN-side ports, and removing security settings requires a manual override. The agencies tied the guidance directly to Volt Typhoon's compromise of such routers. Buyers can fold these points into requirements for branch and remote-worker equipment. (CISA)

Ivanti discloses two more Connect Secure and Policy Secure flaws

In a January 31 update, CISA pointed to new Ivanti guidance covering two additional vulnerabilities in all supported 9.x and 22.x versions of Connect Secure and Policy Secure: CVE-2024-21888, a privilege escalation bug, and CVE-2024-21893, a server-side request forgery flaw. CISA said either could let an attacker take control of an affected system, and it issued a Supplemental Direction to its emergency directive on Ivanti for federal agencies while urging all organizations to apply the guidance. (CISA)

Cloudflare details a nation-state intrusion enabled by Okta-era credentials

On February 1 Cloudflare disclosed that a suspected nation-state attacker breached its self-hosted Atlassian server, reaching its Confluence wiki, Jira bug database and Bitbucket source code system. The intruder first got in on November 14 and returned on November 22 to set up persistence. The access relied on one token and three service account credentials taken in the October 2023 Okta support breach that had not been rotated. Cloudflare detected the activity on November 23 and cut access the next morning. (BleepingComputer)

AnyDesk confirms production servers were breached

Remote access vendor AnyDesk, which reports 170,000 customers, confirmed on February 2 that attackers gained access to its production systems. BleepingComputer learned that source code and code signing certificates were stolen. AnyDesk said ransomware was not involved, that it had revoked security-related certificates and remediated or replaced systems, and that it was revoking all web portal passwords as a precaution. Organizations that allow AnyDesk had reason to confirm they were running a build signed with the new certificate. (BleepingComputer)

Johnson Controls puts the cost of its ransomware attack at $27 million

In a quarterly report filed with the SEC on January 30, Johnson Controls confirmed that its September 23, 2023 incident involved unauthorized access, data exfiltration and ransomware deployment. It said the net income impact for the quarter ended December 31, 2023 was approximately $27 million, mostly response and remediation expenses net of insurance recoveries. The company was still working to determine what data was taken. (BleepingComputer)

Lurie Children's Hospital takes network systems offline

Lurie Children's Hospital in Chicago, a 360-bed pediatric hospital caring for more than 200,000 children a year, said on February 1 that it was responding to a cybersecurity matter and had taken network systems offline, working with outside experts and law enforcement. The incident affected internet, email and phone services and access to its patient portal, and in some cases delayed care. No major ransomware gang had claimed responsibility when BleepingComputer reported the incident. (BleepingComputer)