Week of February 12, 2024: Prudential Discloses Breach, Fortinet Zero-Day Exploited

The week of February 12, 2024 brought a material cybersecurity incident disclosure from Prudential Financial, CISA's addition of an actively exploited critical Fortinet FortiOS vulnerability to its Known Exploited Vulnerabilities catalog, and Microsoft's February Patch Tuesday addressing two in-the-wild zero-days. CISA also published a joint advisory on a former-employee account compromise at a state government organization and, with federal partners, issued guidance on protecting election mail from hazardous materials.

Prudential Financial Discloses Cybersecurity Incident in SEC Filing

Prudential Financial disclosed in a February 12, 2024 Form 8-K filing with the SEC that it detected a cybersecurity incident on February 5, after a threat actor gained unauthorized access to certain company systems beginning February 4. The insurer said administrative and user data tied to employees and contractors appeared affected, while the investigation at the time of filing found no evidence customer or client data had been taken. Prudential reported the matter to law enforcement and notified regulators, stating the incident had not yet been determined to be reasonably likely to materially affect its financial results. (U.S. Securities and Exchange Commission (EDGAR))

CISA and MS-ISAC Detail Former-Employee Account Compromise at State Agency

CISA and the Multi-State Information Sharing & Analysis Center published a February 15 joint advisory detailing how a threat actor used the retained credentials of a former employee of a state government organization to authenticate to an internal VPN access point and run LDAP queries against a domain controller. Investigators used CISA's Untitled Goose Tool to review Azure and Microsoft Defender for Endpoint logs and found no evidence the actor moved from the on-premises environment into the organization's Azure environment. The advisory urged organizations to disable departing employees' accounts promptly and enforce multifactor authentication. (CISA)

CISA Adds Cisco ASA/FTD and Exchange Flaws to Known Exploited Vulnerabilities Catalog

CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog on February 15: CVE-2020-3259, an information disclosure flaw in Cisco ASA and FTD software, and CVE-2024-21410, a privilege escalation vulnerability in Microsoft Exchange Server. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog entries by set deadlines, and CISA urged all organizations to prioritize patching both vulnerabilities given their history as frequent attack vectors for malicious cyber actors targeting enterprise networks. (CISA)

Critical Fortinet FortiOS Flaw Found Under Active Exploitation

Fortinet disclosed critical FortiOS remote code execution vulnerabilities CVE-2024-21762 and CVE-2024-23313 on February 12, warning that the out-of-bounds write flaw affecting SSL VPN functionality was being exploited in the wild. CISA confirmed active exploitation by adding CVE-2024-21762 to its Known Exploited Vulnerabilities catalog, though details of the attacks remained undisclosed. Fortinet provided fixed versions for FortiOS, FortiProxy, FortiPAM and FortiSwitchManager, and recommended disabling SSL VPN as a workaround for organizations unable to patch immediately. (Help Net Security)

Microsoft's February Patch Tuesday Fixes Two Exploited Zero-Days

Microsoft's February 13 Patch Tuesday addressed 72 CVE-numbered vulnerabilities, including two zero-days already being exploited: CVE-2024-21412, a SmartScreen bypass used by the Water Hydra group to deliver DarkMe malware via spoofed Internet Shortcut files, and CVE-2024-21351, a separate SmartScreen bypass allowing code injection. CISA added both to its Known Exploited Vulnerabilities catalog on February 13. Researchers also flagged CVE-2024-21410, an Exchange Server privilege escalation bug capable of exposing NTLM credentials, for priority patching. (Help Net Security)

CISA Adds Exploited Roundcube Webmail Flaw to KEV Catalog

CISA added CVE-2023-43770, a persistent cross-site scripting vulnerability in Roundcube Webmail, to its Known Exploited Vulnerabilities Catalog on February 12 after confirming active exploitation. The flaw, patched by Roundcube in September 2023, allows attackers to run malicious scripts through specially crafted links in plain-text email messages, potentially leading to information disclosure. Roundcube vulnerabilities have previously been used in cyberespionage campaigns against government and state organizations, underscoring the webmail platform's attractiveness to threat actors. (CISA)

CISA, FBI, EAC and USPIS Issue Election Mail Hazardous Materials Guidance

CISA, the FBI, the U.S. Election Assistance Commission, and the U.S. Postal Inspection Service released joint guidance on February 14 covering election mail handling procedures to protect against hazardous materials. The resource addressed safe handling of suspicious mail and response steps for potential exposure to fentanyl, anthrax, and ricin, citing prior incidents involving hazardous letters sent to election offices in California, Georgia, Nevada, Oregon, and Washington in 2023. The agencies urged election offices to adopt the recommended procedures ahead of the 2024 election cycle. (CISA)