Week of March 18, 2024: Volt Typhoon Warning and a Wave of Breach Disclosures

The week of March 18, 2024 brought a joint U.S.-allied warning on Chinese state-sponsored Volt Typhoon activity targeting critical infrastructure alongside a cluster of breach disclosures at France Travail, Nissan Oceania, Fujitsu, and Radiant Logistics. CISA also pushed out updated DDoS defense guidance and an Ivanti patch advisory, while Skyhigh Security named a new chief executive.

CISA and allies warn critical infrastructure leaders about Volt Typhoon

On March 19, 2024, CISA joined the NSA, FBI, and international partners including the UK's NCSC-UK and Australia's ACSC to release a joint fact sheet on PRC-sponsored Volt Typhoon activity, warning critical infrastructure leaders that the group was pre-positioning on IT networks using living-off-the-land techniques ahead of potential disruptive attacks. The guidance urged organizations to prioritize specific defensive actions and pointed to earlier CISA advisories on identifying and mitigating LOTL techniques tied to the same actor. (CISA)

Radiant Logistics discloses cybersecurity incident affecting Canadian operations

Radiant Logistics disclosed in an SEC Form 8-K that on or about March 14, 2024, its monitoring tools detected a cybersecurity incident tied to its Canadian operations. The logistics firm isolated the affected network, engaged forensics specialists, and reported that the incident caused service delays for Canadian customers while U.S. and other international operations continued without disruption. As of the March 19, 2024 filing date, Radiant said the incident had not been determined reasonably likely to materially affect its financial condition or results of operations. (SEC EDGAR)

Fujitsu finds malware on systems, investigates possible data breach

Fujitsu Limited disclosed that malware had been found on several of its company computers, raising the possibility that files containing personal and customer information had been compromised or exfiltrated. The Japanese IT services provider said it disconnected the affected machines, increased monitoring of other business systems, and notified potentially affected individuals and customers as well as the Japanese Personal Information Protection Commission. Fujitsu did not disclose when the compromise was discovered, a timeline for the intrusion, or the type of malware involved, and said its investigation into the breach remained ongoing. (Help Net Security)

Nissan Oceania confirms breach affected around 100,000 people

Nissan Oceania confirmed that a data breach first disclosed in December 2023 affected roughly 100,000 individuals, including current and former employees, dealers, and customers across its Nissan, Mitsubishi, Renault, Skyline, Infiniti, LDV, and RAM finance businesses. The regional division said about 10% of those notified had some form of government identification compromised, including 4,000 Medicare cards, 7,500 driver's licenses, 220 passports, and 1,300 tax file numbers, with the remainder affected through loan documents, employment records, and personal details. The Akira ransomware group had earlier claimed responsibility for the intrusion. (Help Net Security)

France Travail breach may have exposed data of 43 million people

French national unemployment agency France Travail and Cap emploi disclosed a data breach that may have exposed personal data belonging to as many as 43 million people, including jobseekers registered over the previous 20 years. Cybermalveillance reported that attackers carried out the intrusion between February 6 and March 5, 2024, impersonating Cap emploi advisors to access systems and stealing names, dates and places of birth, social security numbers, email and postal addresses, and phone numbers. Passwords and banking details were not affected, and affected users were to be informed via email or their personal online profile. (Help Net Security)

CISA flags Ivanti fixes for Neurons for ITSM and Standalone Sentry

CISA alerted organizations on March 21, 2024 that Ivanti had released security updates for Neurons for ITSM and Standalone Sentry addressing two vulnerabilities that a cyber threat actor could exploit to take control of an affected system. The advisory identified CVE-2023-46808, an authenticated remote file write flaw in Neurons for ITSM, and CVE-2023-41724, a remote code execution vulnerability in Standalone Sentry, and urged users and administrators to apply the vendor's patches promptly given Ivanti's recent history of exploited appliance vulnerabilities. (CISA)

CISA, FBI and MS-ISAC update joint DDoS guidance

On March 21, 2024, CISA, the FBI, and the Multi-State Information Sharing and Analysis Center released an updated joint guide titled Understanding and Responding to Distributed Denial-of-Service Attacks. The refreshed guidance broke down volumetric, protocol, and application DDoS techniques and urged network defenders and critical infrastructure leaders to review the material to strengthen defenses against the threat. The agencies pointed organizations toward CISA's Capacity Enhancement Guides for additional operational recommendations and best practices tailored to common DDoS-related challenges. (CISA)