Week of August 26, 2024: Volt Typhoon exploits a Versa Director zero-day, and CISA profiles RansomHub

What mattered to security leaders in the week of August 26, 2024? Lumen's Black Lotus Labs attributed zero-day exploitation of Versa Director, a platform service providers use to run SASE for customers, to the Chinese state-backed group Volt Typhoon, and CISA with the FBI published two ransomware advisories, one on RansomHub and one on Iran-linked actors who sell network access to affiliates. LinkedIn named former Twitter security chief Lea Kissner as its CISO, and Dick's Sporting Goods disclosed an intrusion it judged not material.

Volt Typhoon linked to Versa Director zero-day against service providers

Attackers exploited CVE-2024-39717, a file upload flaw in Versa Director, to plant a custom web shell called VersaMem on US managed service providers and harvest credentials for access to their downstream customers. Black Lotus Labs said it saw exploitation at four US victims and one outside the US in the ISP, MSP and IT sectors as early as June 12, 2024, and attributed it with moderate confidence to Volt Typhoon. Versa released fixed versions and hardening guidance on Monday, August 26. Service providers' management planes are a direct path into many customer networks at once. (Help Net Security)

CISA and FBI publish a #StopRansomware advisory on RansomHub

On August 29 CISA, the FBI, MS-ISAC and HHS released a joint advisory on RansomHub, a ransomware-as-a-service operation formerly known as Cyclops and Knight. It lists indicators of compromise, techniques and detection methods drawn from FBI investigations and third-party reporting as recent as August 2024, and notes that RansomHub had drawn high-profile affiliates from LockBit and ALPHV. Affiliate movement between brands means detections tuned to one ransomware name can miss the same operators under another. (CISA)

Iran-linked Pioneer Kitten sells access to ransomware affiliates, agencies warn

A day earlier, CISA, the FBI and the Defense Department's Cyber Crime Center warned about actors tracked as Pioneer Kitten, UNC757, Parisite, Rubidium and Lemon Sandstorm, who target US and foreign organizations across many sectors. FBI investigations as recent as August 2024 connect them to the Government of Iran and an Iranian IT company, and describe operations that obtain network access and then work with affiliates to deploy ransomware. The advisory urged critical infrastructure operators to apply its mitigations. (CISA)

LinkedIn appoints Lea Kissner as chief information security officer

LinkedIn announced on August 28 that Lea Kissner had joined as its new CISO. The company said Kissner brings more than 17 years of information security and privacy experience at Google, Apple and Twitter. Kissner takes over security for a Microsoft-owned platform whose own brand is built on member trust in how their data is handled. (LinkedIn)

Dick's Sporting Goods reports unauthorized access but calls it immaterial

In an 8-K filed August 28 under Item 8.01 rather than Item 1.05, Dick's Sporting Goods said it discovered unauthorized third-party access on August 21 to systems that included some confidential information. It activated its response plan, brought in outside experts, notified federal law enforcement, and said it had no knowledge of business disruption. The retailer stated it believed the incident was not material and would reassess under Item 1.05 if facts changed. (Dick's Sporting Goods (SEC EDGAR))

CISA moves incident reporting to a new services portal

CISA announced on August 29 that its cyber incident reporting form now lives in a new CISA Services Portal that supports login.gov credentials. Reporters can save and update submissions, share them with colleagues or clients for third-party reporting, and search and filter past reports, and a collaboration feature allows informal discussion with CISA staff. The agency also published a voluntary reporting guide explaining who should report, when and how. (CISA)

SonicWall fixes a critical access control flaw in its firewalls

SonicWall patched CVE-2024-40766, an improper access control flaw in SonicOS management access with a CVSS v3 score of 9.3, which could give remote attackers unauthorized access to resources and in some conditions crash the appliance. Gen 5 and Gen 6 firewalls and Gen 7 devices on SonicOS 7.0.1-5035 or older were affected. No exploitation had been reported as of August 26; the suggested workaround was limiting management access to trusted sources or disabling WAN management from the internet. (Help Net Security)