Week of February 5, 2024: Volt Typhoon Warning, SouthState Bank Breach Disclosure

The week of February 5, 2024 was dominated by a joint CISA-NSA-FBI advisory warning that the Chinese state-sponsored group Volt Typhoon had pre-positioned itself inside U.S. critical infrastructure networks, alongside SouthState Bank's SEC disclosure of a cybersecurity incident detected on February 6. CISA also pushed out a wave of vendor advisories covering Fortinet FortiOS, Cisco Expressway, VMware Aria Operations for Networks, and JetBrains TeamCity, while adding an actively exploited Chromium flaw to its Known Exploited Vulnerabilities Catalog.

CISA, NSA, FBI Warn of Volt Typhoon Pre-Positioning in U.S. Critical Infrastructure

On February 7, 2024, CISA joined the NSA and FBI, along with agencies from Australia, Canada, the United Kingdom, and New Zealand, to release a joint advisory on the PRC-sponsored group Volt Typhoon. The advisory stated that Volt Typhoon actors sought to pre-position themselves using living off the land techniques on IT networks for disruptive or destructive activity against U.S. critical infrastructure during a potential major crisis or conflict. Confirmed compromises spanned the Communications, Energy, Transportation Systems, and Water and Wastewater Systems sectors across the continental United States and its territories, including Guam. (CISA)

Fortinet Patches Critical FortiOS Flaws, One Possibly Exploited

On February 9, 2024, Fortinet released security updates addressing critical remote code execution vulnerabilities in FortiOS, tracked as CVE-2024-21762 and CVE-2024-23313. CISA stated that a cyber threat actor could exploit these flaws to take control of an affected system, and noted that Fortinet reported CVE-2024-21762 as potentially being exploited in the wild. CISA urged users and administrators to review the FG-IR-24-015 and FG-IR-24-029 advisories and apply the necessary updates without delay to protect FortiOS deployments from takeover. (CISA)

CISA Adds Actively Exploited Chromium Flaw to KEV Catalog

On February 6, 2024, CISA added CVE-2023-4762, a Google Chromium V8 type confusion vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The addition fell under Binding Operational Directive 22-01, which requires Federal Civilian Executive Branch agencies to remediate catalog vulnerabilities by set deadlines. CISA also urged all organizations, not only federal agencies, to prioritize timely remediation of catalog entries as part of routine vulnerability management practice given the elevated risk posed by actively exploited flaws. (CISA)

JetBrains Issues Advisory for Critical TeamCity On-Premises Flaw

On February 9, 2024, JetBrains released a security advisory addressing CVE-2024-23917 in TeamCity On-Premises software used for continuous integration and deployment. CISA warned that a cyber threat actor could exploit the vulnerability to take control of an affected system and encouraged users and administrators to review JetBrains' security issue notice and apply the necessary update or workarounds promptly to protect build and deployment pipelines from compromise. (CISA)

Cisco Patches Vulnerabilities in Expressway Series Collaboration Gateways

On February 8, 2024, Cisco released a security advisory addressing multiple vulnerabilities affecting the Cisco Expressway Series, used by organizations to secure video and unified communications traffic. CISA warned that a cyber threat actor could exploit one of the flaws to take control of an affected system and encouraged users and administrators to review Cisco's advisory and apply the necessary updates to reduce exposure of collaboration infrastructure to compromise. (CISA)

VMware Fixes Multiple Flaws in Aria Operations for Networks

On February 7, 2024, VMware released a security advisory addressing multiple vulnerabilities in Aria Operations for Networks, a network monitoring and analytics platform used across enterprise data centers. CISA stated that a cyber threat actor could exploit one of the vulnerabilities to take control of an affected system and pointed administrators to VMware advisory VMSA-2024-0002 for details on the fixes and recommended updates to apply. (CISA)

SouthState Bank Discloses Cybersecurity Incident in SEC Filing

SouthState Bank, N.A. disclosed in an SEC Form 8-K that it detected a cybersecurity incident on February 6, 2024. The filing stated the company activated incident response and business continuity protocols, isolated parts of its network, and engaged a cybersecurity firm, resulting in some disruption to business processes. Banking regulators and law enforcement were notified. As of the filing date, SouthState said the incident had not had a material impact on operations and had not been determined reasonably likely to materially affect financial condition or results. (SEC EDGAR / SouthState Corporation)