homepage
Menu
Open menu

SANS NewsBites

Secure Your Business Partners and Employees: Globe Life Subsidiary Ransomware Attack Likely Cause of Data Leak; Fraudulently Hired IT Workers Demand Ransom for Stolen Data; ESET Partner's Domain Spoofed to Deliver Wiper

October 22, 2024  |  Volume XXVI - Issue #81

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2024-10-17

Globe Life Says Threat Actor is Attempting to Extort Funds Following Data Breach

In an October 17 filing with the US Securities and Exchange Commission, Texas-based insurance company Globe Life disclosed that 'an unknown threat actor' contacted them, demanding payment in exchange for not releasing customer data. Globe Life believes the data Òcan be traced to the Company's subsidiary, American Income Life Insurance Company.'

Editor's Note

Most likely a ransomware attack on the subsidiary company. This reinforces the need for the parent, Globe Life in this case, to enforce and monitor a cybersecurity program across the entirety of the company and its subsidiaries. The cyber incident only adds fuel to the fire on lack of management controls.

Curtis Dukes
Curtis Dukes

The threat actor is releasing personal and health data to short sellers and plaintiffs' attorneys in an attempt to impact claims and policies, rather than executing a traditional ransomware or extortion attack. This follows reports in June of improperly implemented access controls which would allow access to sensitive data; Globe Life is not commenting on their possible connection. Names, email addresses, phone numbers, addresses, SSNs and heath data were stolen, but no financial information was exfiltrated.

Lee Neely
Lee Neely

2024-10-20

Fraudulent IT Employees Turn to Extortion

Analysts in the Secureworks Counter Threat Unit (CTU) have documented a pattern of fraudulent employment, data theft, and now extortion by alleged North Korean operatives posing as IT contractors. The structure of the scheme and certain technical details, including use of Astrill VPN IP addresses, align with previous efforts by a known threat group to "generate revenue for the North Korean regime" through "theft of intellectual property with the potential for additional monetary gain through extortion." One example timeline showed an employee being hired, exfiltrating proprietary information, being terminated for poor performance, and then sending evidence of the stolen data alongside demands for a "six-figure ransom." Investigators show how these agents interfere in the provision of equipment, either insisting on using personal machines or re-routing their company computers to be delivered to a facilitator at a laptop farm to provide a "credible IP address space." The report also suggests collaboration among agents: providing references, filling their conspirators' empty positions, potentially sharing the employee identities, and/or managing multiple identities each while avoiding or counterfeiting webcam use. CTU stresses caution and verification in companies' hiring processes, and asks employers to be on the lookout for unusual or frequent changes in addresses and banking details.

Editor's Note

KnowBe4 shed light on this set of TTPs back in July when it fell victim to fraudulent employment. One surefire way to avoid this scam is to require in-person interviews and do not deviate from well-established security practices for remote workers.

Curtis Dukes
Curtis Dukes

This parallels fraud schemes associated with the Nickel Tapestry threat group, who are motivated to make money for North Korea. Consider carefully in-person validation of new-hires and/or applicants. Besides vetting, use restraint in granting access to sensitive data.

Lee Neely
Lee Neely

2024-10-21

ESET Partner's Domain Spoofed to Send Wiper Malware

A domain belonging to one of ESET's partners based in Israel was spoofed and used to send malicious emails containing wiper malware. The impersonation attack claimed to be from ESET Advanced Threat Defense Team warning that state-sponsored threat actors were targeting the recipients' devices and offering advanced antivirus software to protect the recipients' devices. ESET said the malicious messages were blocked within 10 minutes; an investigation is underway.

Editor's Note

This is what we need protective DNS for. Coupled with our existing attachment filtering/vetting, it's one more tool in our belt to thwart BEC. You still need EDR, blocking of bad/malicious sites, and even mechanisms for users to report suspicious email. In this case the stakes are high as the payload is a data wiper. Regardless of the impact, implement as many technical levels as possible to reduce the likelihood such a payload makes it to the targeted user.

Lee Neely
Lee Neely

2024-10-22

DoD Publisheds CMMC Program Final Rule

Certification (CMMC) Program Final Rule (implementing the Code of Federal Regulations (CFR) Part 32 Part 170) to the Federal Register. Through this Final Rule, the CMMC Program will take effect on December 16th, 2024, which means voluntary CMMC Level 2 Certification Assessments can commence for defense contractors who have implemented the NIST SP 800-171 standard for protecting Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). Are you ready? The Cyber AB and Cybersecurity Assessor and Instructor Certification Organization (CAICO) will be.

Keep up with the plans for CMMC Program implementation and register for the monthly CMMC Ecosystem town halls at https://cyberab.org

Learn more about the CMMC Program at https://dodcio.defense.gov/CMMC/

View this recently released CMMC overview presentation: https://dodcio.defense.gov (PDF)

The Rest of the Week's News

2024-10-17

Microsoft Lost More Than Two Weeks of Cloud Customers' Security Logs

Microsoft has notified some customers that it has lost more than two weeks of security logs. The missing data are due to 'a bug in one of Microsoft's internal monitoring agents result[ing] in a malfunction in some of the agents when uploading log data to our internal logging platform.' The issue, which was first reported by Business Insider on October 4 (paywall), affects certain cloud products, including Microsoft Entra, Sentinel, Defender for Cloud, and Purview. The incident comes a year after Microsoft was criticized for withholding log information from some US federal government agencies; that information could have helped identify serious intrusions sooner. In September 2023, Microsoft began providing log data to customers with lower-cost cloud services.

Editor's Note

This issue highlights that while migrating to the cloud can bring many benefits, it can also from a security aspect bring many negatives. Relying on a third party to ensure the security logs for your systems in their environment are available and accurate is something you need to put on your risk register. You also need to look at what other mitigating controls you can put in place to manage that risk, such as alerts being raised when traffic from certain log sources falls below a certain known normal rate or stops altogether, or implementing third party tools to augment the vendor's own solution.

Brian Honan
Brian Honan

The lost data will make it harder to determine if you've had nefarious access to your resources during the two week window of September 2-19. Consider having monitoring that alerts when logs aren't flowing or there is a noticeable change in volume.

Lee Neely
Lee Neely

In particular the missing Entra logs may be a problem for some organizations. Ask yourself why you didn't detect the missing logs and how to detect issues like this in the future.

Johannes Ullrich
Johannes Ullrich

2024-10-21

Some Chrome Extensions Not Longer Supported Following Move to New Extension Specification

As part of its move to the Manifest V3 extension specification, Google has begun ending support for some older, albeit popular extensions, including the uBlock Origin ad blocker. The Chrome Web Store's uBlock Origin page reads, 'This extension may soon no longer be supported because it doesn't follow best practices for Chrome extensions.'

Editor's Note

Hmm, call me cynical but when I read this story, I see a browser developed by a company that relies on advertising and is disabling adblockers. Adblockers are a key defence against web-based malware attacks. I have worked on incidents where the initial compromise was via a malicious web advertisement. If you haven't done so already, ensure your perimeter and end-point defences include the ability to block web adverts.

Brian Honan
Brian Honan

This is a bad look for Google as they generate enormous revenue from serving up advertisements, yet no longer support a well-known ad blocker extension. Yes, move to MV3 is a net win as it removes support for remotely-hosted code and execution of arbitrary strings, but Google should be flexible as to not draw more attention to itself and its business practices.

Curtis Dukes
Curtis Dukes

Some sites are claiming that uBlock Origin works best in Firefox, which is a bummer if you're looking to have the same ad block extension in both browsers. Consider an alternative, AdBlock plus, or installing a proxy such as Privproxy or Pi-Hole to provide the services you're used to.

Lee Neely
Lee Neely

2024-10-21

Study Finds Vulnerabilities in E2EE Cloud Storage

Researchers at ETH Zurich have published a paper outlining serious flaws in the end-to-end-encrypted (E2EE) services of several major cloud storage providers, many of which are severe enough and simple enough to execute to "directly oppose the marketing promises of the platforms, [and] create a deceptive and false premise for customers." The study focuses on five companies: Sync, pCloud, Icedrive, Seafile, and Tresorit, which collectively serve about 22 million users. Given that threat actors control a malicious server, all studied providers are vulnerable to varying numbers of "attacks and leakages," including unauthenticated key material and public keys; protocol downgrade; link-sharing leakage; unauthenticated encryption and chunking; tampering with files, file names, and metadata; file and folder injection; and leakage of plaintext information, metadata, and directory structure. The companies were notified of the report in April, 2024, but uneven responses given to ETH Zurich and to journalists indicate only some intend to fix the vulnerabilities, and Icedrive openly has no plans to do so.

Editor's Note

These vulnerabilities are no big surprise, and most "end-to-end" encrypted systems suffer from these issues. You often implicitly trust that code loaded from the trusted site is implementing the end-to-end encryption as intended. A malicious actor able to manipulate the endpoint will be able to alter the code to bypass the end-to-end encryption implementation.

Johannes Ullrich
Johannes Ullrich

So you picked E2EE so the cloud provider would not have access to your data, but did you vet their implementation? While these attacks largely depend on a MitM, it's not clear you'd be able to detect that middleman, given the complexity of the E2EE implementation, let alone all the moving parts in cloud storage. If you're using one of the identified providers, make sure you're on the fixed implementation. If you have a different one, consider contacting the researchers to schedule analysis.

Lee Neely
Lee Neely

2024-10-21

Cisco DevHub Offline after Data Breach

Cisco has "disabled public access" to DevHub, an environment providing customers access to code and other developer resources, after claims of a data breach surfaced online. The data alleged to have been exfiltrated and posted for sale may include "source code, API tokens, hardcoded credentials, certificates, and other secrets belonging to some large companies, including Microsoft, Verizon, T-Mobile, AT&T, Barclays, and SAP," though the company's official report characterizes the contents of the breach as "a small number of files that were not authorized for public download," explicitly ruling out Personally Identifiable Information (PII) and financial data, barring further discoveries. Cybersecurity professionals commenting on the breach emphasize that any stolen data, no matter how apparently significant, can be leveraged in unpredictable ways for intelligence or exploitation in future attacks, potentially allowing attackers to "pivot to more sensitive systems" from public-facing ones.

Editor's Note

Last week, threat actors were spotted offering this information for sale on the DarkWeb. The takeaway is to validate the security of your public facing services, not only ensuring they are patched and secure, but also that they can survive an attack.

Lee Neely
Lee Neely

2024-10-21

Casio Says Deliveries Delayed Due to Ransomware Attack

Japanese electronics company Casio is struggling to recover from an October 5 ransomware attack. Casio confirmed the attack on October 11 and said at the time that some data have been compromised and some of their systems had been rendered unusable. Casio has temporarily stopped accepting items for repair.

Editor's Note

Beyond production impacts, the personal information of contract and temporary employees was pilfered, along with some data from interviewees/job candidates. Casio is expecting remediation to extend into November.

Lee Neely
Lee Neely

2024-10-18

CISA Adds Critical Veeam Flaw to Known Exploited Vulnerabilities Catalog

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical deserialization of untrusted data vulnerability in various Veeam products to their Known Exploited Vulnerabilities (KEV) catalog. The flaw was initially disclosed in early September; CISA says that ransomware groups are now actively exploiting the vulnerability. Federal Civilian Executive Branch (FCEB) agencies have until November 7 to mitigate the issue.

Editor's Note

CVE-2024-40711, unauthenticated RCE flaw, CVSS score 9.8, affects all versions of Veeam backup version 12 & 12.1 (build 12.1.2.172 and below). The solution is to upgrade to version 12.2 (build 12.2.0.334 or higher).

Lee Neely
Lee Neely

2024-10-21

Swiss Vocational School is Recovering from Ransomware Attack

A vocational school in the Swiss canton of Schaffhausen experienced a cyberattack on October 2. The Berufsbildungszentrum (BBZ) Schaffhausen said that the attackers gained initial access to the institution's systems through a gap in their firewall. BBZ Schaffhausen has not responded to the ransom demand. Officials are investigating the scope of the attack.

Editor's Note

A 'gap in their firewall' is mostly likely attributable to poor configuration management. The Center for Internet Security offers free benchmark guidance for several commercial firewalls (Cisco, Checkpoint, Fortinet, etc.), to help you configure to a known security standard.

Curtis Dukes
Curtis Dukes

This is the latest in a string of attacks targeting German-speaking schools in the region, leveraging flaws in their perimeter. Make sure you're testing, validating, and updating ALL of your boundary control devices regularly.

Lee Neely
Lee Neely

Internet Storm Center Tech Corner

A Network Nerd's Take on Emergency Preparedness

https://isc.sans.edu/diary/A+Network+Nerds+Take+on+Emergency+Preparedness/31356

HM Surf Vulnerability Access to Camera Exploited CVE-2024-44133

https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/

Fortinet releases patches for undisclosed critical FortiManager vulnerability

https://www.helpnetsecurity.com/2024/10/21/fortimanager-critical-vulnerability/

ScienceLogic Vulnerability

https://rackspace.service-now.com/system_status?id=detailed_status&service=4dafca5a87f41610568b206f8bbb35a6

https://docs.sciencelogic.com/latest/Content/Web_Admin_and_Accounts/System_Administration/sys_admin_system_upgrade.htm

Microsoft 365: Partially incomplete log data due to monitoring agent issue

https://m365admin.handsontek.net/multiple-services-partially-incomplete-log-data-due-to-monitoring-agent-issue/

End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem

https://brokencloudstorage.info/paper.pdf

ESET Branded Malware

https://x.com/ESETresearch/status/1847192384448172387

Synology Update

https://www.synology.com/en-us/security/advisory/Synology_SA_24_17

Spring Framework Update CVe-2024-38819 CVE-2024-38820

https://spring.io/blog/2024/10/17/spring-framework-cve-2024-38819-and-cve-2024-38820-published

Grafana Security Release CVE-2024-9264

https://grafana.com/blog/2024/10/17/grafana-security-release-critical-severity-fix-for-cve-2024-9264/