Week of October 28, 2024: CISA's RDP Phishing Alert and Sophos's China Counter-Op

CISA opened the week of October 28, 2024 by reviewing its CrowdStrike outage response, releasing its first International Strategic Plan, and warning of a large-scale RDP spearphishing campaign tied to Fortinet's actively exploited FortiManager flaw. The same days brought Sophos's disclosure of a five-year counter-operation against China-linked attacks on perimeter devices, a Dutch-led takedown of the Redline and Meta infostealer services, and a mass ransomware wave against thousands of exposed CyberPanel servers.

Black Basta Affiliates Expand Phishing to Microsoft Teams

On October 28, 2024, researchers reported that Black Basta ransomware affiliates were posing as help desk staff on Microsoft Teams to trick employees into installing remote monitoring tools after flooding inboxes with spam. ReliaQuest said attackers created external Entra ID tenants with names resembling support or admin accounts and added targeted users to one-on-one Teams chats to gain initial access and deploy credential-stealing malware. Organizations were advised to restrict communication from external Teams tenants and tighten anti-spam policies. (Help Net Security)

Dutch-Led Operation Magnus Disrupts Redline and Meta Infostealers

On October 28, 2024, the Dutch National Police and international partners announced the disruption of the Redline and Meta infostealer operations under the name Operation Magnus, gaining access to the malware's servers, source code, license panels, and Telegram bots. Investigators said they collected usernames, passwords, IP addresses, and registration details for customers of the two services, including VIP users, and seized several domains. The announcement said involved parties would be notified and that legal actions were underway. (Help Net Security)

CISA Details JCDC Role in CrowdStrike Outage Response

On October 29, 2024, CISA published an account of how its Joint Cyber Defense Collaborative coordinated the response to the CrowdStrike software update that disrupted air travel, healthcare, and financial operations worldwide. CISA said JCDC held virtual engagements with more than 1,000 federal agency representatives and worked directly with CrowdStrike to share mitigation guidance and assess the potential for malicious exploitation of the outage, aiming to speed recovery of affected government and critical infrastructure systems. (CISA)

CISA Publishes Its First International Strategic Plan

On October 29, 2024, CISA released its 2025-2026 International Strategic Plan, the agency's first, outlining how it intends to work with foreign partners to protect critical infrastructure the United States depends on. The plan set three goals: strengthening the resilience of foreign infrastructure linked to US systems, deepening integrated cyber defense, and unifying CISA's international coordination activities. The release aligned with the National Security Memorandum on Critical Infrastructure Security and Resilience. (CISA)

Fortinet Updates FortiManager Guidance After Zero-Day Exploitation

On October 30, 2024, CISA highlighted Fortinet's updated advisory for CVE-2024-47575, a critical FortiManager vulnerability that let an unauthenticated attacker reach sensitive files or take control of an affected system. Fortinet added new workarounds and indicators of compromise after CISA previously added the flaw to its Known Exploited Vulnerabilities Catalog based on confirmed active exploitation. CISA said patches were fully available and urged administrators to apply updates, hunt for malicious activity, and assess risk from service providers running the software. (CISA)

Mass Ransomware Campaign Hits Thousands of CyberPanel Servers

On October 30, 2024, researchers reported that attackers exploited two newly disclosed command injection vulnerabilities in the CyberPanel web hosting control panel, CVE-2024-51378 and CVE-2024-51567, to encrypt files on servers with ransomware appending the .psaux extension. Security firm LeakIX said nearly 22,000 vulnerable CyberPanel instances were exposed online, a count that fell to about 400 within a day as instances were wiped or patched. A decryptor for the ransomware was made available to affected administrators. (Help Net Security)

CISA Warns of Large-Scale RDP Spearphishing Campaign

On October 31, 2024, CISA alerted that a foreign threat actor was running a large-scale spearphishing campaign against government and information technology organizations, sending malicious Remote Desktop Protocol attachments that let attackers connect to victims' networks and pursue further access. The agency pointed administrators to related reporting from Microsoft, Amazon, Belgium's Centre for Cybersecurity, and Ukraine's CERT team, and recommended restricting outbound RDP connections, blocking RDP file delivery through email, and adopting phishing-resistant multi-factor authentication such as FIDO tokens. (CISA)

Sophos Details Five-Year Fight Against China-Linked Perimeter Device Attacks

On October 31, 2024, Sophos disclosed a five-year defensive and counter-offensive effort against multiple interlinked China-based nation-state groups that targeted perimeter devices, including Sophos firewalls, with custom malware and novel exploits. The company said the campaigns, which overlapped with tactics used by Volt Typhoon, APT31, and APT41, hit government and critical infrastructure targets across South and Southeast Asia, including a nuclear energy supplier, a national airport, and a military hospital. Sophos urged organizations to patch internet-facing devices and retire unsupported hardware. (Help Net Security)