Week of April 15, 2024: Frontier Breach Disclosure, Akira Ransomware Advisory

Security leaders watched Frontier Communications file an SEC 8-K over a material cybersecurity incident, CISA and international partners issue a joint advisory on Akira ransomware, and Palo Alto Networks confirm that attacks on its CVE-2024-3400 firewall flaw were escalating even after an earlier mitigation was found ineffective. The week also brought a Cisco Duo telephony-provider breach, a new AuditBoard CISO appointment, critical Ivanti Avalanche patches, and joint U.S.-allied guidance on securely deploying AI systems.

Frontier Communications Discloses Material Cybersecurity Incident

On April 14, 2024, Frontier Communications Parent, Inc. detected that a third party had gained unauthorized access to portions of its information technology environment. The company said containment measures, including shutting down certain systems, caused an operational disruption that could be considered material, and it filed an 8-K with the SEC citing Item 1.05. Frontier's investigation determined the intruder was likely a cybercrime group that obtained personally identifiable information. By the filing date the company said it had contained the incident and restored its core IT environment while continuing to investigate with outside cybersecurity experts and law enforcement. (SEC EDGAR)

CISA, FBI, Europol, and NCSC-NL Issue Joint Akira Ransomware Advisory

CISA, the FBI, Europol's European Cybercrime Centre, and the Netherlands' NCSC-NL released a joint #StopRansomware advisory on Akira ransomware, detailing tactics, techniques and indicators of compromise drawn from FBI investigations as recent as February 2024. The advisory described Akira's evolution from a Windows-focused threat to a Linux variant targeting VMware ESXi virtual machines, with actors deploying a Rust-based Megazord encryptor alongside the original C++ Akira malware. The agencies said Akira had affected a wide range of businesses and critical infrastructure organizations across North America, Europe, and Australia, with proceeds reaching approximately $42 million. (CISA)

Palo Alto Networks Confirms Telemetry Mitigation Ineffective for CVE-2024-3400

Palo Alto Networks confirmed that disabling device telemetry does not protect PAN-OS firewalls from attacks exploiting CVE-2024-3400, a critical command injection flaw in GlobalProtect gateway configurations, reversing earlier guidance on a workaround. The company said it was tracking an increasing number of attacks leveraging the vulnerability and released updated threat signatures along with a CLI command to help customers check for indicators of compromise. Researchers including WatchTowr Labs and Volexity published analysis and proof-of-concept details during the week, while Rapid7 later described the issue as a two-vulnerability exploit chain. (Help Net Security)

AuditBoard Names Richard Marcus as Chief Information Security Officer

AuditBoard announced an expansion of its executive team, naming Richard Marcus as Chief Information Security Officer after he previously served as the company's VP of Information Security. In the newly created role, Marcus was given responsibility for IT security across AuditBoard's product, infrastructure, and corporate functions, along with the company's internal risk and compliance initiatives. The announcement also named Anthony Plachy as General Counsel and Jeff Harper as Chief Human Resources Officer, as AuditBoard said demand for its connected risk platform was driving continued global growth following more than $200 million in annual recurring revenue the prior year. (Help Net Security)

Ivanti Patches Critical Avalanche Vulnerabilities

Ivanti released Avalanche version 6.4.3, fixing 27 vulnerabilities in its enterprise mobile device management solution, including two critical heap overflow flaws tracked as CVE-2024-29204 and CVE-2024-24996. The bugs, located in the WLAvalancheService and WLInfoRailService components, could let a remote unauthenticated attacker execute arbitrary commands on the underlying Windows system without any user interaction. Ivanti said it was not aware of any customers being exploited by the flaws prior to public disclosure. Security firm Tenable, which reported CVE-2024-29204, published additional technical detail on how the vulnerability could be triggered over TCP port 1777. (Help Net Security)

CISA and Five Eyes Partners Publish AI Deployment Security Guidance

The National Security Agency's Artificial Intelligence Security Center published a joint Cybersecurity Information Sheet on deploying AI systems securely, co-sealed by CISA, the FBI, and cyber agencies from Australia, Canada, and New Zealand. The guidance set out best practices for organizations operating externally developed AI systems, aiming to improve confidentiality, integrity, and availability, ensure mitigations for known AI vulnerabilities, and provide methods to protect, detect, and respond to malicious activity against AI systems and related data and services. CISA pointed organizations toward companion guidance on secure AI system development. (CISA)