Week of December 23, 2024: CISA KEV Addition, LockBit Developer Charged

Security leaders closed out December 2024 watching CISA add an actively exploited USAHERDS flaw to its Known Exploited Vulnerabilities Catalog while the Justice Department unsealed charges against an alleged LockBit ransomware developer. The same week brought a new Pentagon cybersecurity innovation post, fresh survey data on service-disruption readiness and mobile phishing trends, and a reminder from an open-source MFA-bypass framework that session-based authentication remains under pressure.

CISA Adds USAHERDS Credential Flaw to Known Exploited Vulnerabilities Catalog

On December 23, 2024, CISA added CVE-2021-44207, a use-of-hard-coded-credentials vulnerability in Acclaim Systems' USAHERDS software, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The listing triggers remediation deadlines for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01, which governs how federal networks must address catalog entries. CISA again urged all organizations, not just federal agencies, to treat timely patching of catalog vulnerabilities as a core part of vulnerability management practice. (CISA)

DOJ Unseals Charges Against Alleged LockBit Ransomware Developer

The US Department of Justice unsealed charges against Rostislav Panev, a dual Russian and Israeli national accused of working as a core LockBit developer from the group's 2019 inception through at least February 2024. Panev, arrested in August 2024 and held in Israel pending extradition, faces 41 counts including conspiracy to commit fraud, wire fraud, and extortion. The DoJ said LockBit and its affiliates struck more than 2,500 victims worldwide and extracted at least $500 million in ransom payments, figures that frame the scale CISOs track when assessing ransomware-as-a-service risk. (Help Net Security)

Survey: 88% of Executives Expect Another Major Service Disruption

A PagerDuty-commissioned survey of 1,000 IT and business executives in the US, UK, Australia and Japan, published December 26, 2024, found that 88% believed another major incident would occur within the next 12 months. The study also found 86% of executives said they had been prioritizing security spending at the expense of readiness for broader service disruptions, and 83% said the July global IT outage caught them off guard, prompting many organizations to revisit incident-management planning heading into 2025. (Help Net Security)

Lookout Report: iOS Devices Targeted More by Phishing Than Android in Q3 2024

A Lookout mobile threat report published December 26, 2024, found enterprise-focused credential theft and phishing attempts rose 17% quarter-on-quarter, with malicious app detections up 32% QoQ. The report found iOS devices were targeted by phishing threat actors at a rate of 18.4% compared with 11.4% for Android during the third quarter of 2024. Researchers also disclosed new mobile surveillanceware tools tied to China- and Russia-based APT groups, including Gamaredon, reinforcing mobile endpoints as an entry point into enterprise cloud systems. (Help Net Security)

Open-Source Evilginx Framework Spotlights MFA-Bypass Phishing Risk

On December 23, 2024, Help Net Security profiled Evilginx, an open-source man-in-the-middle framework that phishes login credentials and session cookies to let attackers bypass two-factor authentication. Creator Kuba Gretzky said the tool, which proxies HTTP traffic between a target and a legitimate site, was the first publicly available project to expose MFA weaknesses on high-profile platforms including Google. The coverage served as a reminder for security teams that reverse-proxy phishing kits remain a persistent threat to session-based authentication defenses. (Help Net Security)