Week of January 6, 2025: Treasury-BeyondTrust Breach and Ivanti VPN Zero-Day Dominate

Security leaders spent the week of January 6, 2025 tracking fallout from the Treasury Department's breach via compromised BeyondTrust instances, a newly disclosed Ivanti Connect Secure zero-day added to CISA's Known Exploited Vulnerabilities catalog, and a confirmed data breach at the UN's aviation agency ICAO. CISA also added three actively exploited Mitel and Oracle flaws to its KEV catalog, while a SecurityScorecard report highlighted gaps in European corporate cybersecurity ahead of the EU's DORA compliance deadline.

CISA Issues Update on Treasury Department Breach

On January 6, CISA issued an update on a cybersecurity incident affecting the US Department of the Treasury, saying it was working with the Treasury Department and BeyondTrust to understand and mitigate the impacts. CISA stated that, at that time, there was no indication other federal agencies had been affected and that it would continue monitoring the situation and coordinating with federal authorities. The update underscored the sensitivity of the incident involving a third-party remote-support vendor used across federal networks. (CISA)

Treasury Confirmed Sole Agency Hit in BeyondTrust Compromise

Help Net Security reported on January 7 that CISA confirmed the Treasury Department was the only US federal agency affected by the breach involving compromised BeyondTrust Remote Support SaaS instances. The report referenced a December 30 New York Times account of a Treasury letter to lawmakers describing the intrusion as linked to a China state-sponsored advanced persistent threat and affecting workstations in the Office of Financial Research and the Office of Foreign Assets Control. BeyondTrust said its forensic investigation was nearing completion, with no additional affected customers identified since the initial cluster was discovered. (Help Net Security)

CISA Adds Mitel MiCollab and Oracle WebLogic Flaws to KEV Catalog

On January 7, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: two Mitel MiCollab path traversal flaws, CVE-2024-41713 and CVE-2024-55550, and an Oracle WebLogic Server vulnerability, CVE-2020-2883. The addition required federal civilian executive branch agencies to remediate the flaws under Binding Operational Directive 22-01. CISA also pointed administrators toward Palo Alto Networks threat material covering CVE-2024-0012 and CVE-2024-9474, two firewall vulnerabilities exploited as zero-days in November 2024. (CISA)

Ivanti Connect Secure Zero-Day Added to CISA's KEV Catalog

On January 8, CISA added CVE-2025-0282, a vulnerability in Ivanti Connect Secure, to its Known Exploited Vulnerabilities Catalog following evidence of active exploitation. Ivanti had released security updates for Connect Secure, Policy Secure, and ZTA Gateways addressing CVE-2025-0282 and a second flaw, CVE-2025-0283, warning that a cyber threat actor could exploit the first to take control of an affected system. CISA urged organizations to hunt for malicious activity, apply patches, and report findings to its 24/7 Operations Center. (CISA)

Mandiant Traces Ivanti VPN Zero-Day Exploitation to Mid-December

Help Net Security reported on January 9 that Mandiant researchers traced exploitation of the Ivanti Connect Secure vulnerability CVE-2025-0282 back to mid-December 2024, earlier than its January 8 public disclosure. Mandiant found the SPAWN malware family, including an installer, tunneler, SSH backdoor, and log-tampering utility, on compromised appliances, alongside two previously unseen tools named DRYHOOK and PHASEJAM. The researchers linked the activity to China-nexus espionage clusters UNC5337 and UNC5221, which had exploited Ivanti zero-days in past years, and warned of likely widespread, opportunistic follow-on exploitation. (Help Net Security)

UN Aviation Agency ICAO Confirms Recruitment Data Breach

The UN's International Civil Aviation Organization confirmed on January 6 that it was investigating a potential information security incident after a threat actor offered 42,000 documents for sale on an underground forum. By January 8, ICAO confirmed the incident involved approximately 42,000 recruitment application data records spanning April 2016 to July 2024, including names, email addresses, dates of birth, and employment history. The agency said the compromised data did not include financial information, passwords, or passport details, and that the breach was limited to its recruitment database. (Help Net Security)

Only 26% of Europe's Top 100 Firms Earn High Cybersecurity Rating Ahead of DORA

A SecurityScorecard report published January 6 found that only 26% of Europe's top 100 companies achieved an A rating for cybersecurity resilience, with the EU's Digital Operational Resilience Act deadline set for January 17, 2025. The report found 98% of European companies had experienced third-party breaches in the past year, while 18% reported direct breaches, and that A-rated companies were 13.8 times less likely to experience a breach than F-rated ones. Energy sector companies had the lowest ratings, with 75% receiving a C grade or below. (Help Net Security)