Week of April 8, 2024: CISA's Midnight Blizzard Directive and a Palo Alto Zero-Day

Security leaders faced a federal emergency directive over the Russian-linked Midnight Blizzard compromise of Microsoft corporate email, a newly exploited Palo Alto Networks PAN-OS zero-day added to CISA's Known Exploited Vulnerabilities Catalog, and a data-analytics supply-chain scare at Sisense. The same week brought SEC cybersecurity incident disclosures from OraSure Technologies and B. Riley Financial's Targus subsidiary, D-Link NAS flaws added to the KEV list, and a CISO appointment at certificate authority Sectigo.

Palo Alto Networks PAN-OS Zero-Day Added to CISA's KEV Catalog

CISA added CVE-2024-3400, a command injection vulnerability in Palo Alto Networks PAN-OS versions 10.2, 11.0, and 11.1, to its Known Exploited Vulnerabilities Catalog on April 12, 2024. Palo Alto Networks confirmed active exploitation in the wild and published workaround guidance ahead of a full patch. CISA urged administrators to apply the available mitigations immediately and update affected software once fixes became available, citing the flaw's use in ongoing attacks against GlobalProtect gateways. (CISA)

D-Link NAS Flaws With Hardcoded Credentials Join KEV List

CISA added two D-Link vulnerabilities, CVE-2024-3272 and CVE-2024-3273, to its Known Exploited Vulnerabilities Catalog on April 11, 2024, based on evidence of active exploitation. The flaws affect multiple legacy D-Link NAS devices and involve hard-coded credentials paired with a command injection weakness, allowing attackers to execute arbitrary commands. Because the affected models had already reached end-of-life, D-Link said no patches would be issued, leaving replacement as the only durable fix for exposed organizations still running the hardware. (CISA)

Sisense Data Analytics Compromise Prompts CISA Credential Reset Call

CISA disclosed on April 11, 2024, that it was working with private industry partners to respond to a compromise affecting Sisense, a data analytics provider, after independent researchers discovered the incident. The agency urged Sisense customers to reset credentials and secrets potentially exposed to or used to access Sisense services and to report any suspicious activity tied to those credentials. CISA said it was taking an active role in coordinating the response, particularly given Sisense's footprint among critical infrastructure sector customers. (CISA)

OraSure Technologies Discloses Cybersecurity Incident in SEC Filing

OraSure Technologies filed an 8-K on April 10, 2024, disclosing a cybersecurity incident in which an unauthorized third party accessed company data from certain information systems. The diagnostics maker said it engaged cybersecurity experts and external counsel, notified law enforcement, and believed it had contained the intrusion while preserving core financial and operational systems. The filing noted that certain files were exfiltrated, with the company still evaluating the scope of any sensitive information involved and what regulatory notifications might be required. (SEC EDGAR)

B. Riley Subsidiary Targus Discloses Network Intrusion in SEC Filing

B. Riley Financial filed an 8-K on April 8, 2024, disclosing that its subsidiary Targus International had experienced unauthorized access to certain file systems. Targus activated incident response and business continuity protocols with external cybersecurity counsel, and containment measures caused a temporary interruption to its business operations. The filing stated recovery efforts were underway and that the company did not currently expect the incident to materially affect its overall financial condition. Targus notified relevant regulatory authorities and said it would work with law enforcement. (SEC EDGAR)