Week of September 2, 2024: GRU Unit 29155 Advisory and Transport for London Cyberattack

The week of September 2, 2024 saw a joint US-international advisory on Russian GRU Unit 29155's cyber operations, an ongoing cyber security incident at Transport for London, and Halliburton's disclosure that data had been exfiltrated from its systems. CISA also added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, Microchip Technology confirmed theft of employee data, HackerOne named a new CEO, and researchers disclosed a cryptographic flaw allowing cloning of Yubico security keys.

FBI, CISA, NSA Expose GRU Unit 29155 Cyber Operations

On September 5, 2024, the FBI, CISA, NSA, and international partners published a joint cybersecurity advisory detailing operations attributed to Russian GRU Unit 29155, the 161st Specialist Training Center. The advisory described the unit's deployment of WhisperGate malware against Ukrainian organizations and broader campaigns involving website defacements, infrastructure scanning, data exfiltration, and data leak operations targeting NATO members and allied countries. Authoring agencies recommended organizations prioritize patching known exploited vulnerabilities, segment networks, and enable phishing-resistant multifactor authentication for externally facing services. (CISA)

Halliburton Updates SEC on Material Cybersecurity Incident

In a Form 8-K filed September 3, 2024, Halliburton Company disclosed updates on the material cybersecurity incident it first reported on August 21, 2024, when an unauthorized third party gained access to company systems. Halliburton said it had taken certain systems offline, notified law enforcement, and continued restoring operations while assessing impacted data. The filing stated the company believed the intruder had accessed and exfiltrated information, though it did not consider the incident reasonably likely to materially affect its financial condition or results of operations. (SEC EDGAR)

Transport for London Battles Ongoing Cyber Security Incident

Transport for London notified customers on September 1, 2024 that it was handling an ongoing cyber security incident, with follow-up reporting on September 3, 2024 noting the organization's corporate headquarters back-office systems were mainly affected. TfL said it had taken immediate action to prevent further access and was working with government agencies, while its Underground, Overground, Elizabeth line, DLR, tram, and bus services continued operating normally. The organization stated there was no evidence that customer data had been compromised at that point. (Help Net Security)

Microchip Technology Confirms Employee Data Theft

Microchip Technology confirmed on September 5, 2024 that the cyberattack it disclosed in August 2024 resulted in theft of employee data, including contact information and some encrypted and hashed passwords. The Play ransomware group had claimed responsibility and published some stolen data to pressure payment. Microchip told the SEC that operationally critical IT systems were back online, that it had not identified compromised customer or supplier data, and that it did not believe the incident was reasonably likely to materially affect its financial results. (Help Net Security)

Kara Sprague Named CEO of HackerOne

HackerOne announced on September 3, 2024 that Kara Sprague would succeed Marten Mickos as Chief Executive Officer, effective November 4, 2024. Sprague previously served as EVP and Chief Product Officer at F5, where she led a $1.3 billion application security and delivery product business, and earlier held roles at McKinsey, Oracle, and Hewlett-Packard. Mickos said he would remain in a strategic advisory role at HackerOne following the transition. (Help Net Security)

Cryptographic Flaw Lets Attackers Clone YubiKey Security Keys

On September 4, 2024, Yubico published an advisory disclosing a cryptographic vulnerability, dubbed EUCLEAK by NinjaLab researchers, that could allow cloning of YubiKey 5 Series, YubiKey Bio Series, Security Key Series, and YubiHSM 2 devices running firmware prior to specific patched versions. Yubico said exploitation would require physical possession of the device, account-specific knowledge, and specialized equipment, and that affected devices with vulnerable firmware could not be remotely updated. The flaw primarily affected FIDO authentication use cases. (Help Net Security)