Week of July 15, 2024: Faulty CrowdStrike update grounds Windows fleets, and Bassett files a ransomware 8-K

What mattered to security leaders in the week of July 15, 2024? On Friday, July 19, a defective CrowdStrike Falcon sensor update sent Windows machines around the world into crash loops, grounding flights and taking broadcasters offline, and CISA warned that criminals were already exploiting the chaos with phishing. Earlier, Bassett Furniture filed an Item 1.05 disclosure after attackers encrypted data and halted its factories, and CISA formally appointed Jeff Greene as its top cybersecurity executive.

A faulty CrowdStrike update crashes Windows hosts worldwide

A bad update for CrowdStrike Falcon sensors made hundreds of thousands, possibly millions, of Windows computers and servers inoperable on July 19, disrupting transport, broadcast, finance and retail across Europe, Australia and the US. Sky News went off air and Delta, United and American Airlines paused flights. Affected hosts looped into a blue screen, and the published workaround required booting into Safe Mode or the recovery environment and deleting a specific channel file, often by hand at each machine. The outage turned vendor update control into a board-level resilience question. (Help Net Security)

CISA warns that attackers are exploiting the outage

CISA issued its first alert on the outage at 11:30 a.m. EDT on July 19, saying it was working with CrowdStrike, state and local partners, critical infrastructure and international counterparts. Updates to the alert warned that threat actors were using the outage for phishing and other malicious activity and pointed to guidance from the UK, Australian and Canadian cyber centres. Help desks fielding frantic recovery calls were an obvious target for social engineering. (CISA)

Bassett Furniture halts manufacturing after encryption attack

In an 8-K filed on July 15 under Item 1.05, Bassett Furniture said it detected unauthorized activity on part of its IT systems on July 10 and that the attacker encrypted some data files. Its containment steps included shutting systems down, and it was not operating its manufacturing facilities at the time of filing. Stores and e-commerce stayed open, but fulfilment was impaired. The company said the incident was reasonably likely to keep materially affecting operations until recovery was complete, and it did not believe consumer personal data was compromised. (Bassett Furniture Industries (SEC EDGAR))

CISA formally appoints Jeff Greene and Trent Frazier

On July 17 CISA named Jeff Greene Executive Assistant Director for Cybersecurity and Trent Frazier Assistant Director for Stakeholder Engagement; both had been serving in acting roles. Greene previously led the Aspen Institute's global cybersecurity policy program as senior director and before that was Chief for Cyber Response and Policy at the White House National Security Council. Frazier had been deputy in the stakeholder engagement division. Greene's post oversees the agency's cybersecurity division, which issues most of the alerts and advisories CISOs track. (CISA)

Serv-U, vCenter and Adobe Commerce flaws added to the KEV catalog

CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on July 17: an XML external entity flaw in Adobe Commerce and Magento Open Source (CVE-2024-34102), a path traversal bug in SolarWinds Serv-U (CVE-2024-28995) and incorrect default file permissions in VMware vCenter Server (CVE-2022-22948). Teams running internet-facing file-transfer or vCenter servers had reason to move these to the top of the queue. (CISA)

FIN7 sells an upgraded EDR killer to ransomware crews

SentinelOne researchers reported that FIN7 had improved AvNeutralizer, also called AuKill, a tool built to disable endpoint detection. The new version abuses a built-in Windows driver together with trusted Process Explorer drivers to knock out some protected processes, and it had been used in ransomware intrusions since April 2023. Several sellers believed to belong to the FIN7 cluster offered it on underground forums, and multiple ransomware groups used it. Defenders should alert on tampering with their own security agents. (Help Net Security)

Void Banshee used a Windows MSHTML zero-day to spread Atlantida

Trend Micro's Zero Day Initiative said an APT group it calls Void Banshee exploited CVE-2024-38112, a Windows MSHTML flaw that Microsoft had just patched, as a zero-day against targets in North America, Europe and Southeast Asia. Lures posing as PDF books launched internet shortcut files that invoked the disabled Internet Explorer engine and led to Atlantida infostealer malware. Retired browser components still present on Windows machines remain exploitable attack surface. (Help Net Security)