Week of February 26, 2024: Ivanti Exploitation Warning and Cencora Breach Disclosure

Security leaders watched CISA and international partners escalate warnings on active exploitation of Ivanti Connect Secure and Policy Secure gateways, Russian SVR cloud intrusion tactics, and updated Phobos and ALPHV Blackcat ransomware advisories. Pharmaceutical services firm Cencora disclosed a data exfiltration incident to the SEC the same week, alongside fresh Cisco NX-OS and industrial control system advisories from CISA.

Five Eyes Warn of Active Exploitation Across Ivanti Connect Secure and Policy Secure

On February 29, 2024, CISA joined the FBI, MS-ISAC, and cyber agencies from Australia, the UK, Canada, and New Zealand in warning that threat actors continued to exploit a chain of Ivanti Connect Secure and Policy Secure vulnerabilities to bypass authentication and run commands with elevated privileges. The advisory noted that Ivanti's Integrity Checker Tool could be deceived and warned attackers might retain root-level persistence even after a factory reset, urging organizations to assume credentials on affected devices were compromised. (CISA)

ALPHV Blackcat Advisory Updated With New Healthcare-Focused Indicators

On February 27, 2024, CISA, the FBI, and the Department of Health and Human Services issued an update to their joint advisory on ALPHV Blackcat ransomware, adding fresh indicators of compromise and tactics, techniques, and procedures tied to the group's affiliates. The agencies noted that ALPHV Blackcat affiliates had primarily targeted the healthcare sector and encouraged network defenders to review the refreshed advisory and report related incidents to CISA's Operations Center or the FBI's CyWatch line. (CISA)

CISA Adds Microsoft Streaming Service Flaw to Known Exploited Vulnerabilities Catalog

CISA added CVE-2023-29360, an untrusted pointer dereference flaw in Microsoft Streaming Service, to its Known Exploited Vulnerabilities Catalog on February 29, 2024, citing evidence of active exploitation. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog entries by assigned due dates, and CISA again urged all organizations, not only federal agencies, to prioritize timely patching of catalog vulnerabilities as part of routine vulnerability management practice. (CISA)

Cisco Issues NX-OS Advisories Covering MPLS and BGP Denial-of-Service Flaws

CISA highlighted two Cisco security advisories on March 1, 2024, covering vulnerabilities in Cisco NX-OS Software that could let a threat actor trigger a denial-of-service condition. The flaws affected MPLS encapsulated IPv6 handling and external Border Gateway Protocol processing on NX-OS devices. CISA encouraged administrators running the affected software to review Cisco's advisories and apply the available updates to reduce exposure to disruption of switching and routing infrastructure. (CISA)

Cencora Discloses Data Exfiltration From Its Information Systems

Pharmaceutical services company Cencora, Inc. disclosed in a Form 8-K that on February 21, 2024 it learned data had been exfiltrated from its information systems, with some of it potentially containing personal information. The filing, dated February 27, 2024, said the company immediately began containment steps and launched an investigation with law enforcement, cybersecurity experts, and external counsel, and that as of the filing date the incident had not been determined to carry a material impact on operations. (SEC EDGAR)

CISA Publishes Two More ICS Advisories Covering Delta Electronics and MicroDicom

CISA released two Industrial Control Systems advisories on February 29, 2024, covering Delta Electronics' CNCSoft-B software and the MicroDicom DICOM Viewer used in medical imaging environments. The advisories provided technical details on the identified vulnerabilities and recommended mitigations for asset owners running the affected products, continuing a steady cadence of ICS-focused guidance aimed at operators of industrial and healthcare-adjacent technology during the week. (CISA)