Week of December 16, 2024: CISA Cloud Directive and BeyondTrust Zero-Day

The week of December 16, 2024 brought CISA's Binding Operational Directive 25-01 ordering federal agencies to harden cloud configurations and new guidance urging senior officials to encrypt mobile communications after Chinese government-linked telecommunications intrusions. The same week, BeyondTrust patched a critical remote-access flaw tied to a customer-instance compromise, Fortinet fixed a takeover bug in FortiManager, Amnesty International detailed a Cellebrite-enabled spyware campaign against journalists in Serbia, and Arctic Wolf agreed to acquire BlackBerry's Cylance endpoint security business.

CISA Orders Federal Agencies to Lock Down Cloud Configurations

On December 17, 2024, CISA issued Binding Operational Directive 25-01, requiring federal civilian agencies to identify specific cloud tenants, deploy assessment tools, and align their cloud environments with CISA's Secure Cloud Business Applications configuration baselines. The directive followed cybersecurity incidents that highlighted risks from misconfigurations and weak security controls in cloud services. CISA Director Jen Easterly said malicious actors were increasingly targeting cloud environments and evolving their tactics to gain initial access, and urged organizations beyond the federal civilian enterprise to adopt the same guidance to reduce cyber risk. (CISA)

CISA Urges High-Profile Officials to Encrypt Mobile Communications After PRC Spying

On December 18, 2024, CISA released Mobile Communications Best Practice Guidance in response to cyber espionage activity by People's Republic of China government-affiliated actors targeting commercial telecommunications infrastructure. The guidance addressed individuals in senior government or political positions who are likely targets for interception. CISA said these highly targeted individuals should assume all communications between mobile devices and internet services are at risk of interception or manipulation, and recommended consistent use of end-to-end encryption to protect calls and messages from compromise. (CISA)

CISA Adds Exploited BeyondTrust Flaw to KEV Catalog

On December 19, 2024, CISA added CVE-2024-12356, the BeyondTrust Privileged Remote Access and Remote Support command injection vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The addition triggered Binding Operational Directive 22-01 remediation deadlines for federal civilian executive branch agencies, while CISA urged all organizations to prioritize timely patching of catalog vulnerabilities as part of routine vulnerability management practice given the risk such flaws pose as frequent attack vectors for malicious actors. (CISA)

Fortinet Fixes Takeover Flaw in FortiManager

On December 20, 2024, CISA alerted organizations that Fortinet had released a security update addressing a vulnerability in FortiManager that a remote cyber threat actor could exploit to take control of an affected system. CISA directed users and administrators to review Fortinet Security Bulletin FG-IR-24-425 and apply the necessary updates, underscoring continued attention to vulnerabilities in widely deployed network management platforms used across enterprise and government environments to centrally administer firewall and security infrastructure. (CISA)

Amnesty Links Serbian Authorities to Cellebrite-Enabled Spyware Campaign

An Amnesty International report published December 16, 2024, said Serbian police and intelligence officers used Cellebrite forensic extraction software to unlock the phones of journalists and activists and install previously unknown Android spyware called NoviSpy. The unlocking exploited a since-patched Qualcomm chipset zero-day, CVE-2024-43047. Amnesty documented cases including journalist Slaviša Milanov and activist Nikola Ristić, and said the spyware communicated with servers on an IP range associated with Serbia's Security Information Agency. Cellebrite said it was investigating the claims. (Help Net Security)

Arctic Wolf to Acquire BlackBerry's Cylance Endpoint Business for $160 Million

On December 17, 2024, Arctic Wolf and BlackBerry announced a definitive agreement for Arctic Wolf to acquire BlackBerry's Cylance endpoint security assets for $160 million of cash, subject to adjustments, plus approximately 5.5 million common shares of Arctic Wolf. BlackBerry is expected to receive about $80 million of cash at closing and about $40 million one year later. The deal adds Cylance's AI-based endpoint protection to Arctic Wolf's open-XDR Aurora platform, while BlackBerry's Secure Communications portfolio remains unaffected. (Help Net Security)