Week of May 6, 2024: Black Basta Advisory, Key Tronic and Brandywine SEC Filings

The week of May 6-12, 2024 opened with two public companies, Key Tronic and Brandywine Realty Trust, disclosing cybersecurity incidents to the SEC, while DHS and CISA reshuffled the Cyber Safety Review Board's membership. CISA also joined federal partners and allied cyber agencies to publish a Black Basta ransomware advisory and secure-by-design procurement guidance, as Google patched an actively exploited Chrome zero-day and Zscaler pushed back on claims of a significant breach.

CISA, FBI, HHS Warn of Black Basta Ransomware Targeting Healthcare

On May 10, 2024, CISA joined the FBI, HHS, and MS-ISAC to publish a joint advisory on Black Basta ransomware, a ransomware-as-a-service variant active since April 2022. The advisory said affiliates had targeted over 500 private industry and critical infrastructure entities across North America, Europe, and Australia, including healthcare organizations. CISA urged defenders to apply the advisory's mitigations to reduce the likelihood and impact of Black Basta and other ransomware intrusions. (CISA)

Key Tronic Discloses Cybersecurity Incident Disrupting IT Systems

Key Tronic Corporation disclosed in a May 9, 2024 Form 8-K that it detected unauthorized third-party access to portions of its IT systems on May 6, 2024. The electronics manufacturer activated its incident response procedure, engaged external cybersecurity experts, and notified law enforcement. The intrusion disrupted business applications supporting operations and corporate functions, including financial and operating reporting systems, though the company said it did not believe the incident was reasonably likely to have a material impact on its financial condition. (SEC EDGAR)

DHS and CISA Reshuffle Cyber Safety Review Board Membership

On May 6, 2024, DHS and CISA announced four departures and four new additions to the Cyber Safety Review Board, including incoming members Jamil Jaffer, NSA's David Luber, Red Canary's Katie Nickels, and SentinelOne's Chris Krebs. Departing members included Luta Security's Katie Moussouris, Verizon's Chris Novak, CIS's Tony Sager, and Palo Alto Networks' Wendi Whitmore. Luber replaced Rob Joyce as the NSA's federal representative following Joyce's retirement, while Robert Silvers and Heather Adkins were reappointed as Chair and Deputy Chair for a second term. (CISA)

Five Eyes Agencies Issue Secure-by-Design Procurement Guidance

On May 9, 2024, Australia's ACSC joined CISA, Canada's CCCS, the UK's NCSC, and New Zealand's NCSC-NZ to release joint guidance on choosing secure and verifiable technologies for procurement. The document offers organizations internal and external considerations and sample questions for evaluating secure-by-design practices at each stage of procuring digital products and services. It also directs software manufacturers on steps to align development processes with secure-by-design principles, as the agencies encouraged broad adoption across government and industry buyers. (CISA)

Zscaler Disputes Claims of Significant Breach After Dark-Web Listing

On May 8, 2024, a threat actor calling itself InteIBroker advertised access to an unnamed major cybersecurity company for $20,000, prompting speculation it was Zscaler. Zscaler responded the next day, saying it had found an isolated test environment on a single internet-exposed server that was not hosted on its infrastructure and contained no customer data. The company said there was no connectivity to its production or corporate environments and took the server offline for forensic analysis by an outside incident-response firm. (Help Net Security)

Google Patches Actively Exploited Chrome Zero-Day

Google fixed a Chrome zero-day, CVE-2024-4671, in stable desktop builds released May 10, 2024, after an anonymous researcher reported a use-after-free flaw in the browser's Visuals component with an exploit already circulating in the wild. Successful exploitation could let an attacker achieve arbitrary code execution in the context of the logged-in user. Google pushed the fix to version 124.0.6367.201/.202 for Mac and Windows and 124.0.6367.201 for Linux, urging administrators to update promptly given the active exploit. (Help Net Security)