Week of December 2, 2024: PRC Telecom Hack Guidance and ENGlobal Ransomware Disclosure

CISA and international partners published hardening guidance after a PRC-affiliated actor compromised major global telecom networks, while ENGlobal disclosed in an SEC filing that attackers had encrypted data on its IT systems. The agency also added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, Cisco patched an NX-OS image verification bypass flaw, European police dismantled the Matrix encrypted chat service, and Solana's web3.js library was briefly backdoored in an npm supply chain attack.

CISA, NSA, FBI Issue Hardening Guidance After PRC Telecom Breach

On December 3, 2024, CISA joined the NSA, FBI, and international partners to publish joint guidance titled Enhanced Visibility and Hardening Guidance for Communications Infrastructure. The guidance responded to a PRC-affiliated threat actor's compromise of major global telecommunications providers, described as a "broad and significant cyber espionage campaign" that affected a limited number of individuals involved in government or political activity. The agencies urged network defenders to patch vulnerable devices, strengthen visibility, and apply secure-by-design principles to reduce opportunities for intrusion. (CISA)

ENGlobal Discloses Ransomware Incident Affecting IT Systems

ENGlobal Corporation, a Texas-based engineering and automation contractor serving the energy sector and federal agencies, disclosed in a Form 8-K filed December 2, 2024 that it identified a cybersecurity incident on November 25, 2024. The filing stated a threat actor accessed the company's IT system and encrypted some data files. ENGlobal began an internal investigation, engaged external cybersecurity specialists, and restricted IT access to essential business operations while it continued to assess whether the incident would materially affect its financial condition. (SEC EDGAR / ENGlobal Corporation)

CISA Adds CyberPanel Flaw to Known Exploited Vulnerabilities Catalog

On December 4, 2024, CISA added CVE-2024-51378, a CyberPanel incorrect default permissions vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog entries by the specified due date. CISA again urged all organizations, not only federal agencies, to prioritize timely remediation of catalog vulnerabilities as part of standard vulnerability management practice. (CISA)

CISA Flags Three Actively Exploited Vulnerabilities, Including Zyxel Firewalls

On December 3, 2024, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2023-45727 affecting North Grid Proself, CVE-2024-11680 affecting ProjectSend, and CVE-2024-11667 affecting Zyxel firewalls. CISA also pointed administrators to Palo Alto threat intelligence on Operation Lunar Peek tied to separate CVEs. Federal civilian agencies are required under Binding Operational Directive 22-01 to remediate catalog vulnerabilities by their due dates to protect networks against active threats. (CISA)

Cisco Patches NX-OS Image Verification Bypass Flaw

On December 5, 2024, CISA highlighted Cisco security updates addressing a vulnerability in NX-OS software that could let a cyber threat actor take control of an affected system. The flaw, described by Cisco as an NX-OS Software Image Verification Bypass Vulnerability, prompted CISA to urge administrators to review Cisco's advisory and apply the available updates promptly to affected network switches running the software. (CISA)

Police Dismantle Matrix Encrypted Chat Service Used by Criminals

On December 3, 2024, a joint French-Dutch investigation team, supported by Germany, Italy, Lithuania, and Spain, took down the Matrix encrypted communications platform. The operation led to three arrests in France and Spain, the seizure of over 40 servers across Europe, 145,000 euros in cash, roughly half a million euros in cryptocurrency, 970 telephones, and 4 vehicles. The service had more than 8,000 paying user accounts, mostly located in Southern Europe, according to the Dutch Police. (Help Net Security)