Week of June 24, 2024: Indonesia Data Center Ransomware, Croatia Hospital Cyberattack

The week of June 24, 2024 brought a ransomware disruption of Indonesia's temporary national data center, a cyberattack on Croatia's largest hospital, and new critical flaws in Progress MOVEit alongside a fresh CISA Known Exploited Vulnerabilities Catalog update. Security leaders also saw CISA issue seven industrial control system advisories, a public proof-of-concept for a critical Fortra FileCatalyst bug, and new survey data showing CISOs growing more comfortable with risk.

CISA Adds Three Actively Exploited Flaws to KEV Catalog

On June 26, 2024, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a code injection flaw in GeoSolutionsGroup JAI-EXT (CVE-2022-24816), a Linux kernel use-after-free bug (CVE-2022-2586), and a cross-site scripting flaw in Roundcube Webmail (CVE-2020-13965). Federal civilian agencies were required to remediate under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching these vulnerabilities as part of routine vulnerability management practice. (CISA)

Progress Patches Critical MOVEit Authentication Bypass Flaws

Progress Software quietly fixed two authentication bypass vulnerabilities in its MOVEit managed file transfer product: a critical flaw in MOVEit Gateway's SFTP module (CVE-2024-5805) and a high-risk flaw in MOVEit Transfer (CVE-2024-5806). Researchers at WatchTowr Labs said the company had privately urged customers to apply hotfixes before public disclosure. Exploitation attempts against CVE-2024-5806 began within a day of disclosure, and Progress later raised its severity to critical after identifying a related flaw in a third-party component, advising customers to also block inbound RDP access to MOVEit Transfer servers. (Help Net Security)

Brain Cipher Ransomware Disrupts Indonesia's National Data Center

A LockBit variant called Brain Cipher disrupted a temporary national data center supporting more than 200 Indonesian government agencies, with attackers demanding an $8 million ransom that the government said it would not pay. The attack reportedly began June 17, 2024, deactivating Windows Defender before deleting file systems and disabling storage services on June 20. Separately, the LockBit gang claimed to have breached the US Federal Reserve and threatened to leak 33 terabytes of banking data, though it later released documents attributed to a different bank instead. (Help Net Security)

CISA Issues Seven Industrial Control System Advisories

CISA released seven Industrial Control Systems advisories on June 27, 2024, covering products from TELSAT, SDG Technologies, Yokogawa, and four affecting Johnson Controls' Illustra Essentials Gen 4 line. The advisories detailed current security issues, vulnerabilities, and exploits surrounding ICS deployments and offered mitigation guidance for administrators. CISA encouraged asset owners across critical infrastructure sectors to review the technical details and apply recommended fixes to reduce exposure to attacks targeting operational technology environments. (CISA)

PoC Exploit Published for Critical Fortra FileCatalyst Flaw

A critical SQL injection vulnerability in Fortra FileCatalyst Workflow, tracked as CVE-2024-5276, received a public proof-of-concept exploit after being patched, Tenable researchers disclosed on June 27, 2024. The flaw let unauthenticated attackers with anonymous access create administrative accounts and modify or delete data in the application database, though not exfiltrate it. The vulnerability affected all FileCatalyst Workflow versions through 5.1.6 Build 135 and was fixed in build 139, with no in-the-wild exploitation reported at disclosure time. (Help Net Security)

Survey Finds CISOs Growing More Comfortable With Risk

A Netskope survey of more than 1,000 CISOs published June 28, 2024 found that 57% reported their appetite for risk had increased over the past five years, with just 16% describing their current risk appetite as low. A majority said shifting threat dynamics were creating tension with CEOs and other C-suite members, describing themselves as walking a tightrope between business goals and security needs. Fifty-nine percent said they now view themselves primarily as business enablers rather than protectors. (Help Net Security)