Week of July 22, 2024: LA County Courts Ransomware and North Korea Espionage Advisory

Security leaders watched a ransomware attack force the closure of all 36 Los Angeles County Superior Court locations and a joint US-allied advisory expose a North Korea-linked espionage and ransomware operation targeting defense and healthcare sectors. The week also brought a material-impact cybersecurity disclosure from Crimson Wine Group, new CISA advisories for BIND 9 and industrial control systems, two additions to the Known Exploited Vulnerabilities Catalog, and CISO-level appointments at Check Point and Sophos.

Ransomware Attack Closes All Los Angeles County Courthouses

The Los Angeles County Superior Court, described as the nation's largest trial court, closed all 36 courthouses after detecting a ransomware attack on its computer systems. Officials said the intrusion, discovered that Friday, was unrelated to the CrowdStrike software update that had disrupted Windows systems worldwide days earlier. The outage affected the My Jury Duty portal, the court's website, and case-management systems. Courthouses reopened the following Tuesday, though officials warned of continued delays. A preliminary investigation found no evidence that court users' data had been compromised, and officials declined to say whether a ransom was paid. (Los Angeles Times)

FBI, CISA and Allies Detail North Korean Espionage and Ransomware Group

The FBI, CISA, NSA, US Cyber National Mission Force, the Department of Defense Cyber Crime Center, South Korea's National Intelligence Service and National Police Agency, and the UK's National Cyber Security Centre issued a joint advisory on a North Korean state-sponsored group operating under the Reconnaissance General Bureau's 3rd Bureau. The group, publicly tracked as Andariel and Onyx Sleet, targets defense, aerospace, nuclear, and engineering organizations to collect technical data supporting Pyongyang's military and nuclear programs, and separately funds its espionage through ransomware operations against US healthcare entities using tools such as Mimikatz and web shells deployed via known vulnerabilities. (CISA)

CISA Adds Internet Explorer and Twilio Authy Flaws to Exploited Vulnerabilities List

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2012-4792, a Microsoft Internet Explorer use-after-free flaw, and CVE-2024-39891, an information disclosure vulnerability in Twilio's Authy application. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog vulnerabilities by their assigned due dates to protect federal networks against active threats. CISA said it would continue adding vulnerabilities that meet the established criteria and urged all organizations, not just federal agencies, to prioritize timely remediation of catalog entries as part of routine vulnerability management practices. (CISA)

ISC Patches Four Denial-of-Service Flaws in BIND 9

The Internet Systems Consortium released security advisories addressing four vulnerabilities in multiple versions of its BIND 9 DNS software, which CISA flagged for administrators to review. The flaws included CVE-2024-4076, an assertion failure tied to stale cache data; CVE-2024-1975, a SIG(0) resource-exhaustion issue; CVE-2024-1737, a database slowdown triggered by large numbers of resource records; and CVE-2024-0760, which could destabilize a server under a flood of DNS messages over TCP. CISA said a threat actor could exploit any of the four to cause a denial-of-service condition and encouraged administrators to apply the necessary updates. (CISA)

Crimson Wine Group Confirms Material Impact From June Cybersecurity Incident

Napa-based Crimson Wine Group updated its earlier disclosure of a June 30 cybersecurity incident, determining that the intrusion had likely had a material impact on its business operations. The company said an unauthorized third party had accessed internal information systems and exfiltrated files potentially containing sensitive personal information, prompting it to shut down certain systems and disrupt operations while investigating with external cybersecurity experts. Crimson Wine said it had substantially restored affected systems and resumed normal operations, did not believe the incident would materially affect its overall financial condition, and planned to notify affected parties and regulators. (SEC EDGAR)

Check Point Names Nadav Zafrir CEO as Security Executive Moves Continue

Check Point Software announced that Nadav Zafrir, previously co-founder and managing partner at venture firm Team8, would become Chief Executive Officer, succeeding Gil Shwed, who moved into the role of Executive Chairman. The same week, Sophos named Teresa Anania, who joined from Zendesk, as its new Chief Customer Officer, and Commvault appointed Pranay Ahlawat, formerly of Boston Consulting Group, as its first Chief Technology and AI Officer. Ransomware-protection firm BlackFog also added a President, Chief Revenue Officer, and Vice President of Strategic Sales as part of a week of senior cybersecurity and technology leadership changes. (SecurityWeek)

CISA Issues Four Industrial Control Systems Advisories

CISA released four Industrial Control Systems advisories covering products from National Instruments and Hitachi Energy, including IO Trace and LabVIEW software, the AFS/AFR Series products, and an update to IED Connectivity Packages and PCM600 products. The advisories provided technical details on current security issues and exploits affecting the named ICS products and offered mitigations for users and administrators. The release came two days before CISA issued a separate pair of advisories covering Siemens SICAM products and a Positron broadcast signal processor, part of a steady weekly cadence of ICS vulnerability disclosures. (CISA)