Week of November 25, 2024: Blue Yonder Ransomware Hits Starbucks, New CISA KEV Entry

Security leaders tracked the fallout from Blue Yonder's ransomware attack on Starbucks and grocery chains, CISA's addition of an actively exploited Array Networks flaw to its Known Exploited Vulnerabilities Catalog, newly disclosed remote-code-execution flaws in Palo Alto and SonicWall VPN clients, and ESET's discovery of the first Linux UEFI bootkit, Bootkitty. The week also brought a CISO appointment at SSH Communications Security, a multinational cybercrime crackdown under Operation Serengeti, and fresh details on a RomCom zero-day exploit chain targeting Firefox and Windows.

CISA Adds Array Networks Flaw to Known Exploited Vulnerabilities Catalog

CISA added CVE-2023-28461, an improper authentication vulnerability affecting Array Networks AG and vxAG ArrayOS, to its Known Exploited Vulnerabilities Catalog on November 25, 2024, citing evidence of active exploitation. The addition triggers Binding Operational Directive 22-01, which requires federal civilian agencies to remediate the flaw by a set deadline. CISA urged all organizations, not just federal agencies, to treat timely patching of catalog entries as a core part of vulnerability management, noting that these vulnerability types remain frequent attack vectors for malicious cyber actors. (CISA)

CISA Issues Six ICS Advisories Covering Schneider Electric, Hitachi Energy, Philips

CISA released six Industrial Control Systems advisories on November 26, 2024, addressing products from Schneider Electric, Hitachi Energy and Philips. The advisories covered Schneider Electric's PowerLogic PM55xx/PM8ECC and P5 meters, its EcoStruxure Control Expert and Process Expert software with Modicon M340 and M580 PLCs, Hitachi Energy's MicroSCADA Pro/X SYS600 and RTU500 Scripting Interface, and an updated advisory for Philips Vue PACS. CISA encouraged ICS operators and administrators to review the advisories for technical details and mitigations relevant to their environments. (CISA)

Blue Yonder Ransomware Attack Disrupts Starbucks and Grocery Chains

Supply chain software vendor Blue Yonder continued responding through the week of November 25 to a ransomware attack it first disclosed on November 21, 2024, that hit its managed services hosted environment. The vendor, which serves more than 3,000 customers across 76 countries, said it was working with external cybersecurity firms on recovery. A Starbucks spokesperson told CNN the attack forced the coffee chain to use manual processes to pay employees, while grocery chains Albertsons and Kroger also rely on Blue Yonder's platform. (Help Net Security)

Researchers Disclose RCE Flaws in Palo Alto and SonicWall VPN Clients

AmberWolf researchers disclosed on November 26, 2024, two vulnerabilities in corporate VPN client update mechanisms that could let attackers remotely execute code on users' devices. CVE-2024-5921 affects Palo Alto Networks' GlobalProtect app on Windows, macOS and Linux, stemming from insufficient certificate validation, while CVE-2024-29014 affects SonicWall's NetExtender client for Windows. Palo Alto fixed the issue in GlobalProtect app 6.2.6 for Windows, though macOS and Linux remained unpatched at disclosure, and SonicWall had already patched NetExtender Windows versions 10.2.341 and later. (Help Net Security)

INTERPOL-Led Operation Serengeti Nets Over 1,000 Cybercrime Arrests Across Africa

INTERPOL and AFRIPOL announced on November 26, 2024, that Operation Serengeti, conducted across 19 African countries between September 2 and October 31, led to 1,006 arrests and the dismantling of 134,089 malicious infrastructures tied to ransomware, business email compromise, digital extortion and online scams. The operation identified over 35,000 victims and cases linked to nearly $193 million in financial losses worldwide, with funding from the UK's Foreign, Commonwealth and Development Office, the German Federal Foreign Office and the Council of Europe. (Help Net Security)

ESET Finds First UEFI Bootkit Targeting Linux Systems

ESET Research disclosed on November 27, 2024, the discovery of Bootkitty, the first UEFI bootkit designed for Linux systems, which was uploaded to VirusTotal as a proof-of-concept rather than deployed in active attacks. Bootkitty aims to disable the Linux kernel's signature verification and preload unknown ELF binaries through the init process, and it patches integrity-verification functions in memory to boot regardless of whether UEFI Secure Boot is enabled. ESET said the find shows UEFI bootkits are no longer confined to Windows systems. (Help Net Security)