Week of July 8, 2024: AT&T Breach Disclosure and APT40 Advisory

Security leaders watched AT&T disclose unauthorized access to customer data from a third-party cloud platform, while CISA and international partners published a joint advisory detailing the PRC state-sponsored APT40 group's tradecraft. The same week brought a CISA red team report on defense-in-depth gaps at a federal agency, a ransomware incident disrupting Florida's health department records system, and a fresh Secure by Design alert from CISA and the FBI on OS command injection flaws.

AT&T Discloses Breach of Customer Data

AT&T issued a public statement describing unauthorized access to customer data that had been stored on a third-party cloud platform. The company published recommendations and resources intended to help affected customers understand the incident and protect their personal information. CISA posted an alert directing users and administrators to AT&T's own notice for further details and guidance, underscoring the breach's reach across the telecom giant's customer base and the ongoing effort to assist those impacted. (CISA)

AT&T Breach Fallout Spreads to Snowflake

AT&T's regulatory filing revealed that hackers had tapped into a cloud platform housing customer records, gaining access to call and text metadata covering a six-month span in 2022. An AT&T spokesperson identified the cloud service as belonging to Snowflake, deepening scrutiny of the vendor's security practices following earlier breaches tied to several of its other corporate clients. Snowflake shares slipped modestly as the disclosure renewed investor attention on the cloud data company's incident response. (CNBC)

CISA and Allies Detail PRC APT40 Tradecraft

CISA worked with Australia's ACSC, the NSA, FBI, UK NCSC, and cybersecurity agencies from Canada, New Zealand, Germany, South Korea, and Japan to release a joint advisory on APT40, a PRC Ministry of State Security-linked group also referred to as Kryptonite Panda or GINGHAM TYPHOON. The advisory described the group's ability to rapidly adapt proof-of-concept exploits for newly disclosed vulnerabilities in widely used software and urged organizations to apply the guidance to identify and remediate intrusions. (CISA)

CISA Red Team Report Flags Federal Agency Defense Gaps

CISA released a cybersecurity advisory describing a SILENTSHIELD red team assessment conducted against a Federal Civilian Executive Branch organization in early 2023. The report detailed how the team gained initial access through an unpatched web server and later compromised the Windows environment via phishing and unsecured credentials, eventually reaching tier zero assets. CISA said the exercise highlighted the need for defense-in-depth, better log collection, and a move away from denylist-only detection approaches. (CISA)

Ransomware Disrupts Florida Health Department Vital Records

A ransomware incident affecting the Florida Department of Health disrupted the agency's online Vital Statistics system, impeding the issuance of death and birth certificates. The RansomHub group claimed on the dark web to have stolen 100 gigabytes of data and threatened to publish it if unpaid, though Florida law bars state and local agencies from paying ransomware extortion. Funeral directors were forced to complete death certificates by hand while the system remained affected. (Government Technology)