The biggest cyber attacks and vulnerabilities from July 2024

KnowBe4 recently hired a software engineer for their internal IT AI team, following a thorough recruitment process, including interviews, background checks, and reference verifications. However, once the new hire received their Mac workstation, they immediately began loading malware. Despite the HR team conducting four video interviews and confirming the individual’s photo matched the application, it was later revealed that the identity was stolen.

The person used a valid US-based identity that was “AI-enhanced.” The EDR software detected the malware and alerted KnowBe4’s Security Operations Center (SOC). Upon contacting the new hire, suspicions quickly arose. KnowBe4 shared their findings with Mandiant and the FBI, uncovering that the new hire was a fake IT worker from North Korea using an AI-generated photo. The case is now part of an active FBI investigation.

A significant phishing campaign exploited a security vulnerability in Proofpoint’s email filtering systems, sending an average of three million spoofed emails daily from January to June. These emails appeared to be from well-known companies like Disney, IBM, Nike, Best Buy, and Coca-Cola, all of which are Proofpoint customers. The fake messages were convincingly authenticated with legitimate Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) signatures, making them appear trustworthy to recipients.

The phishing emails aimed to lure victims into visiting malicious sites that would phish for their credit card details by offering fake subscription renewals at seemingly low prices. Victims who entered their card information were charged over 100 times the advertised amount with no actual service provided. At its peak, the campaign sent 14 million malicious emails daily. Guardio Security discovered the flaw and alerted Proofpoint in May, aiding in mitigating the issue.

In another alarming development, multiple ransomware groups have exploited a recently patched security flaw (CVE-2024-37085) in VMware ESXi hypervisors. The vulnerability, CVE-2024-37085, has a CVSS score 6.8 and allows an authentication bypass via Active Directory integration. Threat actors can gain full administrative access to an ESXi host by re-creating or renaming the configured AD group “ESXi Admins.”

VMware released an advisory about the flaw in late June 2024, highlighting the ease of escalating privileges. Microsoft reported on 29th July that ransomware operators like Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have used this technique to deploy Akira and Black Basta ransomware. The attacks underscore the critical need for timely patching and vigilant security practices in enterprise environments, as proactive measures are crucial in preventing such incidents.

A threat actor on BreachForums claims to have harvested email addresses and associated hashes from over 105 ServiceNow databases by exploiting two recently disclosed critical vulnerabilities. These vulnerabilities, CVE-2024-4879 and CVE-2024-5217, have CVSS scores of 9.3 and 9.2, respectively. Researchers from Resecurity’s HUNTER team warned last week that these flaws were being actively exploited.

The threat actor is selling the stolen data for $5,000. CVE-2024-4879 is an input validation vulnerability in ServiceNow’s “Vancouver” and “Washington DC” versions, allowing unauthenticated remote code execution. CVE-2024-5217 is a similar flaw affecting these and earlier editions. Both vulnerabilities are easy to exploit and require no user interaction. This incident highlights significant security risks and the urgency for organisations to patch these critical flaws.

A threat actor, dubbed Stargazer Goblin, has created a network of over 3,000 GitHub accounts to distribute malware and malicious links, reports Check Point. This network, known as the Stargazers Ghost Network, has been operational since August 2022 and functions as a distribution-as-a-service (DaaS) operation. Victims are lured to phishing repositories, where information-stealing malware such as Atlantida Stealer, Lumma Stealer, Rhadamanthys, RisePro, and RedLine are distributed.

Stargazer Goblin began advertising this service on underground forums in July 2023 and has earned over $100,000, including $8,000 from mid-May to mid-June 2024 alone. The network uses multiple GitHub accounts to star and verify malicious links to appear legitimate. Automation aids in creating phishing templates targeting various social platforms. Many repositories contain download links to external sites, with some hosting password-protected archives to evade GitHub’s scanners.

Finally, a popular hacking forum has seen the leak of a massive file named RockYou2024 (rockyou.txt), containing nearly 10 billion unique plaintext passwords. This compilation includes passwords from both old and recent data breaches. The list is valuable for cyber criminals because it features real-world passwords, making it useful for brute-force attacks against accounts. However, given the list size, direct online attacks could be more practical. It is more suited for offline password cracking by those who have stolen password databases.

The leaked passwords could be combined with other breach data, such as username-password pairs, to exploit reused passwords. If threat actors also have hashed password lists, they might try to match these hashes. Although plaintext passwords simplify attacks compared to pass-the-hash methods, the latter approach is still relevant for vulnerable services. At Cognisys, we have a password cracking service that uses a state-of-the-art machine we call “Kraken” to review password hashes.

In busy workplaces, employees sometimes take shortcuts that can pose serious risks. For example, letting a family member use a work laptop might unintentionally spread malware throughout the company’s network, causing major damage. Such seemingly harmless actions can lead to costly disasters. The World Economic Forum reports that 95% of cyber security incidents stem from human error, making it crucial for us to be cautious and attentive in our actions.

Stay secure, stay informed, and most importantly, stay engaged. Your active participation in the cyber security community is crucial for our collective safety. Why not talk to us about your cyber security requirements?