Cyber Intelligence Weekly: The 3 New Ideas You Need to Know this Week (Issue 156 – September 1, 2024)

Dear Friends and Colleagues,

Welcome to our weekly newsletter where we share some of the major developments on the future of cybersecurity that you need to know about. Make sure to follow my LinkedIn page as well as Echelon’s LinkedIn page to receive updates on the future of cybersecurity!

To receive these and other curated updates to your inbox on a regular basis, please sign up for our email list here: https://echeloncyber.com/ciw-subscribe

Before we get started on this week’s CIW, I’d like to highlight that our team will be at CrowdStrike Fal.Con in Las Vegas next month, Sept. 16-19 at the ARIA in Las Vegas!

??We're thrilled to share our on-site team will be there and ready to share valuable insights and network — be on the lookout for yours truly, David Faraone , Paul Interval , and Greg DeLeonardis !

We look forward to sharing insights at #FalCon! Learn more about the event here: https://lnkd.in/eqjkKcbg

?

Away we go!

1.?Chinese Hackers Exploit Zero-Day Vulnerability to Infect ISPs and Steal Customer Credentials

Researchers have uncovered a significant cyberattack, likely orchestrated by Chinese state-sponsored hackers, targeting U.S.-based Internet Service Providers (ISPs) through a zero-day vulnerability. The flaw, found in Versa Director, a virtualization platform used by ISPs to manage complex networks, has been actively exploited since at least June 2024. The attackers used this vulnerability to deploy a custom web shell, dubbed "VersaMem," enabling them to gain remote administrative control over the affected systems and steal customer credentials.

The zero-day vulnerability, tracked as CVE-2024-39717, involves an unsanitized file upload flaw that allows attackers to inject malicious Java files into Versa Director systems with elevated privileges. Once in control, the attackers can capture credentials as they are entered by customers, compromising downstream users' security. The attack vector was notably sophisticated, involving the use of compromised small office and home office (SOHO) routers to initiate the breach.

Despite the severity of the attack, the malware used in this campaign, VersaMem, is currently undetected by major antivirus platforms. The malware operates entirely in memory, which reduces the likelihood of detection and makes it difficult to identify and remove. The researchers at Black Lotus Labs, who discovered the exploit, have linked the tactics used in these attacks to Volt Typhoon, a notorious Chinese hacker group known for targeting critical infrastructure.

Organizations using Versa Director are urged to review the indicators of compromise detailed in Black Lotus Labs' report to determine if their systems have been affected. The vulnerability has been patched as of August 2024, but the impact of the breach is still being assessed, with ongoing concerns about the security of critical infrastructure.

?

2.?ALBeast Vulnerability in AWS ALB Exposes Thousands of Applications

Miggo Research recently identified a critical configuration-based vulnerability, named ALBeast, that affects applications utilizing AWS Application Load Balancer (ALB) for authentication. This flaw, discovered in April 2024, poses a significant security risk, enabling attackers to bypass authentication and authorization mechanisms, potentially leading to unauthorized access and data breaches. The vulnerability could compromise the confidentiality, integrity, and availability of the impacted applications, making it a serious concern for businesses relying on AWS ALB for secure operations.

The ALBeast vulnerability arises from the way ALB handles token signing and verification. Attackers can exploit this flaw by creating their own ALB instance, signing a token under their control, and then tricking the victim's application into accepting this forged token. Despite AWS updating its documentation and adding new security measures, including verifying the token signer and restricting traffic to the ALB, Miggo Research has identified over 15,000 potentially vulnerable applications that have not yet implemented these changes.

AWS has stated that the issue is not a vulnerability in ALB itself but rather a result of misconfiguration by customers. However, Miggo Research emphasizes that without the necessary configuration updates, applications remain at risk. This situation highlights the challenges of the shared responsibility model, where cloud providers and customers share security duties. The discovery of ALBeast serves as a wake-up call for organizations to review and update their security practices to protect against such vulnerabilities.

Miggo Research urges all AWS customers using ALB's authentication feature to follow the newly recommended best practices, including verifying token signers and restricting access to ALB-only traffic. The company also offers support and scanning services to help identify and mitigate potential vulnerabilities.

?

3.?FBI Warns of Iranian Collaboration with Ransomware Gangs Targeting U.S. and Allies

The FBI, along with the Defense Department and the Cybersecurity and Infrastructure Security Agency (CISA), has issued a stark warning about Iran’s involvement in cyberattacks targeting organizations in the United States, Israel, Azerbaijan, and the United Arab Emirates. The advisory, released on Wednesday, reveals that Iranian government-linked hackers have been collaborating with ransomware gangs to compromise networks across various sectors, including education, finance, healthcare, and defense.

These Iranian cyber actors, known in the private sector by names such as Pioneer Kitten, Rubidium, and Lemon Sandstorm, have been active since 2017. They have focused on gaining and maintaining access to victims' networks, often selling this access on criminal marketplaces or directly partnering with ransomware operations like NoEscape, Ransomhouse, and AlphV. The hackers are known for being intentionally vague about their origins, often disguising their activities as independent criminal actions.

In addition to ransomware attacks, the Iranian group has been conducting a broader campaign to steal sensitive technical data, particularly from organizations in Israel and Azerbaijan. The advisory notes that these actors have a history of exploiting known vulnerabilities in widely used products, such as those from Ivanti, Citrix, and Palo Alto Networks, to gain initial access to target systems. Once inside, they typically disable security software, create backdoor accounts, and collaborate with ransomware affiliates to maximize their impact.

The advisory emphasizes the importance of patching specific vulnerabilities that the group has been known to exploit and encourages organizations to report any cyber incidents to the FBI and CISA. This alert comes amid increasing concerns about Iran's cyber operations, particularly in light of recent alleged attacks on the campaigns of both U.S. presidential candidates.

Thanks for reading!

About us: Echelon is a full-service cybersecurity consultancy that offers wholistic cybersecurity program building through vCISO or more specific solutions like penetration testing, red teaming, security engineering, cybersecurity compliance, and much more! Learn more about Echelon here: https://echeloncyber.com/about