CCTR.15.April.24
More Ivanti bugs and PWNing Satellite operation centers
Last updated
More Ivanti bugs and PWNing Satellite operation centers
Last updated
Ivanti has issued security updates to fix four vulnerabilities affecting Connect Secure and Policy Secure Gateways, which could potentially lead to code execution and denial-of-service (DoS) attacks. These vulnerabilities impact all supported versions. As of now, there have been no reported attacks exploiting these vulnerabilities in the wild. However, it's worth noting that earlier this year, the Cybersecurity and Infrastructure Security Agency (CISA) cautioned about 🐼 hi threat actors targeting known vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Additionally, CISA itself was hacked using one of them. Ref 🔹The Korean National Satellite Operations Center 🛰️ was targeted in a cyber attack late last year, prompting an investigation by the Korean National Intelligence Service. This incident poses significant risks of satellite control manipulation and data theft. It has been confirmed that a multipurpose practical satellite, serving as a reconnaissance satellite, and a public satellite were compromised during this attack. The full extent of the compromise remains unknown (cough!!🤫). Considering the high value of satellite data in both the space industry and national security, such breaches are of utmost concern. Ref Threat actors often target home users due to their lack of resources and knowledge in defending against attacks, unlike enterprises. Despite smaller financial gains compared to corporate targets, individual victims possess valuable data like credit cards and personal information and their corporate system credentials. Proofpoint observed the distribution of information-stealing malware, such as Vidar, StealC, and Lumma Stealer, via YouTube. Malicious videos, disguised as pirated software or game cracks, lead users to malware-infected links. These videos often target younger users with popular games, exploiting their vulnerability. Ref WordPress and Magento CMS are popular e-commerce platforms, which unfortunately make stores built on them prime targets for cyber attackers. In this recent campaign, malicious code disguised as a Google Analytics script is used to infect WordPress websites. Once activated, the malicious script performs potentially harmful activities such as credit card theft, data theft, unauthorized access, or spreading more malware. Attackers commonly use this tactic to hide the true nature of the code. It is crucial for 🇦🇺Australian e-commerce organisations to exercise caution against such abuses. Ref
