January 16 2024 Cyber Threat Intelligence Briefing
This weeks' briefing covers.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Two Zero-Day Vulnerabilities Impacting Ivanti Connect Secure and Policy Secure Gateways
Note: These vulnerabilities remain under active exploitation, and Kroll experts are investigating. If further details are uncovered by our team, updates will be made to the Kroll Cyber Risk blog. Two zero-day vulnerabilities have been discovered in Ivanti Connect Secure (ICS), formerly known as Pulse Connect Secure and Ivanti Policy Secure gateways.
SYSTEMBC Command and Control Server Demonstration
Throughout Q2 and Q3 2023, we observed an increased use of the malicious “SYSTEMBC” tool to maintain access in a compromised network. In this video, Kroll Threat Intelligence expert, Dave Truman, provides an initial walkthrough of our research into SYSTEMBC, focusing in its C2 server.
CVE-2023-39336: Remote Code Execution Vulnerability Found in Ivanti EPM
Ivanti released a patch for a critical vulnerability discovered in Ivanti Endpoint Manager (EPM) that could allow for remote code execution (RCE). This vulnerability is being tracked as CVE-2023-39336 with a CVSS score of 9.6 (Critical), which is not yet actively exploited. All versions of Ivanti EPM prior to Service Update 5 are impacted. Ivanti credits security researcher hir0t for the responsible disclosure.
January 3 2024 Cyber Threat Intelligence Briefing
This weeks' briefing covers: Dive deeper: Additional Resources: July 11 2023 Cyber Threat Intelligence Briefing: July 10 2023 Cyber Threat Intelligence Briefing.
CVE-2023-50164: Remote Code Execution Vulnerability Discovered in Apache Struts
Apache has released an advisory for a critical vulnerability discovered in Struts versions 2.0.0-2.3.37(EOL), 6.0.0-6.3.0.1 and 2.0.0-2.5.32. This vulnerability is being tracked as CVE-2023-50164 with a CVSS score of 9.8 (Critical) and is reportedly being actively exploited. Impacted versions are affected by a file upload and directory traversal vulnerability that can lead to remote code execution.
The Rise of QR Code Phishing Attacks and How To Tackle Them
Kroll forensic examiners and threat intelligence analysts identified a new phishing tactic targeting individuals using QR codes. Victims receive phishing emails impersonating Microsoft, letting them know that additional security measures are required and asking victims to scan the QR code in the body of the email or the email attachment.
MDR vs MSSP vs SIEM: The Evolving Threat Detection Landscape
Effective threat detection is critical to achieving a mature cybersecurity posture. Yet with so many threat detection options on the market, from managed detection and response (MDR) to managed security service providers (MSSPs) to security information and event management (SIEM), choosing the most effective one for your organization can be challenging.
Webinar Replay: Q3 2023 Threat Landscape: Kroll Top 10 Malware Strains
Kroll actively tracks malware command and control infrastructure, submissions to public sandboxes and active incident response (IR) and managed detection and response (MDR) case data to generate lists of the most active malware strains for comparison.
Webinar Replay: Q3 2023 Threat Landscape: BEC Attacks Continue to Surge Across Sectors
“In Q3, we did see an uptick in incidents impacting the manufacturing and construction sector largely led by business email compromise (BEC) or email compromise attacks. One of the reasons for this uptick in BEC attacks has to do with the reliance on third parties and suppliers.” – Laurie Iacono.