On July 12, AT&T released a public statement on unauthorized access of customer data from a third-party cloud platform. AT&T also provided recommendations and resources for affected customers.
CISA encourages customers to review the following AT&T article for additional information and follow necessary guidance to help protect personal information.
| The Federal Bureau of Investigation (FBI) is releasing this Private Industry Notification (PIN) to highlight how malicious cyber actors may seek to disrupt power generating operations, steal intellectual property, or ransom information critical for normal functionality to advance geopolitical motives or financial gain within the United States renewable energy industry. With federal and local legislature advocating for renewable energies, the industry will expand to keep pace, providing more opportunities and targets for malicious cyber actors. |
| Historical Cyber Incident Involving the Renewable Energy Industry’s Operations In 2019, a private company, which operates solar assets in the United States, lost visibility into approximately 500 MW of its wind and photovoltaic sites in California, Utah, and Wyoming as a result of a denial-of-service attack that exploited an unpatched firewall. While it was unclear if this specific incident was a deliberate cyberattack targeting this specific company, the incident highlighted the risks posed by a security posture that relies on outdated software. |
| Risks Associated with a Cyber Incident Impacting Solar Infrastructure A cyberattack against a solar panel system—residential or commercial—would likely focus on targeting the system’s operational technology (OT) software and hardware; specifically, malicious cyber actors could attempt to gain control over a solar panel system through the inverters. Inverters are responsible for converting the direct current (DC) energy that the solar panels generate into practical alternating current (AC) electricity. Some inverters have built-in monitoring systems that connect to the Internet, which increases their risk profile. If a malicious cyber threat actor took control of a residential inverter, they could attempt to reduce that solar panel system’s power output or target that home’s battery storage inverter (if one is onsite) to overheat it. |
| While cyberattacks against residential solar infrastructure have been rare historically, malicious cyber threat actors could seek to target microgrids, which local power systems use to operate independently of the larger electrical grid during a power outage. To attain a larger disruption, malicious cyber threat actors could attempt to target inverters at solar farms; however, researchers are working to counter this potential risk through a passive sensor device that can detect unusual activity in the electrical current. |
| This FBI PIN contains threat information, recommendations, and is being provided to assist agencies and organizations in guarding against the persistent malicious actions of cybercriminals. |
| Researchers have been tracking the activity of a newly discovered threat actor group, Unfurling Hemlock, that may have been active for a while due to finding similar characteristics in older campaigns . These threat actors have distributed over 50,000 malware samples, which infect victims’ systems with up to ten different forms of malware at a time, mainly with information stealers and loaders. Researchers have considered these to be a type of “cluster bomb” attack, where each step of the attack includes an additional form of malware. |
| Unfurling Hemlock’s attack begins through a phishing email or an external website that initiates contact with the malware loaders to drop the malware. Upon executing a malicious file named WEXTRACT.EXE, a chain of infections starts, and a series of nested compressed cabinet files begin to unpack malware onto the system. Researchers have found that each cabinet file includes a malware sample and the subsequent compressed file. The final compressed file contains two malware samples. |
| In the observed sample, Unfurling Hemlock was found to drop Mystic Stealer, Amadey, Redline, SmokeLoader, and finally, a second instance of Mystic Stealer and a utility that turns off system protections. Once the final stage has been extracted, the files execute in reverse order, starting with the utility disabling essential security features, such as Windows Defender, automatic updates, and notifications. |
| Recommendations |
| Avoid clicking links and opening attachments in unsolicited emails. Confirm requests from senders via contact information obtained from verified and official sources. Review the Don’t Take the Bait! Phishing and Other Social Engineering Attacks NJCCIC product for more information on common phishing and social engineering attacks. Facilitate user awareness training to include these types of phishing-based techniques. Maintain robust and up-to-date endpoint detection tools on every endpoint. Consider leveraging behavior-based detection tools rather than signature-based tools. Phishing and other malicious cyber activity can be reported to the FBI’s IC3 and the NJCCIC. |
| Build the skills you need to create new opportunities and accelerate your understanding of Microsoft Cloud technologies at a free Microsoft 365 Virtual Training Day from Microsoft Learn. Join us at Manage Microsoft Teams Collaboration Communications Systems to learn how to plan, design, configure, and manage a Teams Collaboration Communications System. You’ll explore the many Teams services, features, and capabilities that simplify collaboration and boost productivity. Note: Participants should have a prior understanding of the basics of Teams as well as networking, telecommunications, audio-visual and meeting-room technologies, and identity and access management. You will have the opportunity to: Learn how to plan, design, and manage Teams Collaboration Communications Systems. Find out how to configure and manage Microsoft Teams Phone, Microsoft Teams Rooms, and Microsoft Teams meetings. Understand how to manage and monitor services through the Teams admin center, Teams Rooms Pro portal, Microsoft Call Quality Dashboard, and Microsoft Teams PowerShell. Learn more about Teams-certified devices and calling plans. Join us at an upcoming two-part Manage Microsoft Teams Collaboration Communications Systems event: Delivery Language: English Closed Captioning Language(s): English | |
| July 10, 2024 | 12:00 PM – 2:45 PM | (GMT-05:00) Eastern Time (US & Canada) July 25, 2024 | 12:00 PM – 2:45 PM | (GMT-05:00) Eastern Time (US & Canada) | |
| Visit the Microsoft Virtual Training Days website to learn more about other event opportunities. | |
NIST’s National Cybersecurity Center of Excellence (NCCoE) has released for public comment a draft of Cybersecurity for the Water and Wastewater Sector: Build Architecture, Operational Technologies Remote Access. The comment period is open through July 15, 2024.
This Technical Note describes the product agnostic remote access reference architectures and presents three remote access example solutions the NCCoE plans to demonstrate as part of the Cybersecurity for the Water and Wastewater Sector: A Practical Reference Design for Mitigating Cyber Risk in Water and Wastewater Systems project. The Technical Note presents a traditional on-premises remote access reference architecture and two example solutions: one for medium to large water and wastewater systems (WWS) and one for very small to small WWS. A cloud-based remote access reference architecture and example solution are also described.
The NCCoE first plans to address the remote access scenario and describing architectures and example solutions which allow authorized access to a water or wastewater utility’s Operational Technology (OT) assets. Subsequent publications will address the other identified risk scenarios and solutions.
Visit NCCoE’s Securing Water and Wastewater Utilities page to learn more about this project and submit comments.
Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution. Mozilla Firefox is a web browser used to access the Internet. Mozilla Firefox ESR is a version of the web browser intended to be deployed in large organizations. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
THREAT INTELLEGENCE:
There are no reports that these vulnerabilities are being exploited in the wild
SYSTEMS AFFECTED:
RISK:
Government:
Businesses:
Home users: Low
TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution. Details of the most critical vulnerabilities are as follows:
Tactic: Initial Access (TA0001):
Technique: Drive-by Compromise (T1189):
Additional lower severity vulnerabilities include:
Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
RECOMMENDATIONS:
We recommend the following actions be taken:
REFERENCES:
Mozilla:
https://www.mozilla.org/en-US/security/advisories/
CVE:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6614https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6615
| Build the skills you need to create new opportunities and accelerate your understanding of Microsoft Cloud technologies at a free Microsoft 365 Virtual Training Day from Microsoft Learn. Join us at Prepare Your Organization for Microsoft Copilot for Microsoft 365 to learn how to implement AI to help ignite creativity, enhance productivity, and strengthen computing and collaboration skills. You’ll learn about the capabilities of Copilot, including how it works, how to configure it, and how to set it up for more powerful searches. You’ll also explore how Copilot works with Microsoft Graph—and your existing Microsoft 365 apps—to provide intelligent, real-time assistance. You will have the opportunity to: Understand the key components of Copilot for Microsoft 365 and how it works. Learn how to extend Copilot with plugins. Get guidance on completing the necessary Copilot technical and business requirements to prepare for implementation. Learn how to assign Copilot licenses, prepare your organization’s Microsoft 365 data for Copilot searches, and create a Copilot Center of Excellence. Join us at an upcoming Prepare Your Organization for Microsoft Copilot for Microsoft 365 event: Delivery Language: English Closed Captioning Language(s): English |
| Visit the Microsoft Virtual Training Days website to learn more about other event opportunities. |
| The Cybersecurity and Infrastructure Security Agency (CISA) has collaborated with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) to release an advisory outlining a People’s Republic of China (PRC) state-sponsored cyber threat group’s activity. The following organizations also collaborated with ASD’s ACSC on the guidance: |
| The National Security Agency (NSA) The Federal Bureau of Investigation (FBI) The United Kingdom’s National Cyber Security Centre (NCSC-UK) The Canadian Centre for Cyber Security (CCCS) The New Zealand National Cyber Security Centre (NCSC-NZ) The German Federal Intelligence Service (BND) and Federal Office for the Protection of the Constitution (BfV) The Republic of Korea’s National Intelligence Service (NIS) and NIS’ National Cyber Security Center (NCSC) Japan’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and National Policy Agency (NPA) |
| The advisory is based on current ACSC-led incident response investigations and shared understanding of a PRC state-sponsored cyber threat group, APT40—also known as Kryptonite Panda, GINGHAM TYPHOON, Leviathan, and Bronze Mohawk in industry reporting. |
| APT 40 has previously targeted organizations in various countries, including Australia and the United States. Notably, APT 40 possesses the ability to quickly transform and adapt vulnerability proofs of concept (POCs) for targeting, reconnaissance, and exploitation operations. APT 40 identifies new exploits within widely used public software such as Log4J, Atlassian Confluence, and Microsoft Exchange to target the infrastructure of the associated vulnerability. |
| CISA urges all organizations and software manufacturers to review the advisory to help identify, prevent, and remediate APT 40 intrusions. Software vendors are also urged to incorporate Secure by Design principles into their practices to limit the impact of threat actor techniques and to strengthen the security posture of their products for their customers. |
| For more information on PRC state-sponsored threat actor activity, see CISA’s People’s Republic of China Cyber Threat. To learn more about secure by design principles and practices, visit CISA’s Secure by Design webpage. |
A vulnerability has been discovered in OpenSSH that could allow for remote code execution. OpenSSH is a suite of secure networking utilities based on the SSH protocol and is crucial for secure communication over unsecured networks. It is widely used in enterprise environments for remote server management, secure file transfers, and various DevOps practices. Successful exploitation of this vulnerability could allow for remote code execution in the context of the unprivileged user running the sshd server. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
THREAT INTELLIGENCE:
There are no reports of this vulnerability being exploited in the wild.
SYSTEMS AFFECTED:
RISK:
Government:
Businesses:
Home users: Low
TECHNICAL SUMMARY:
A vulnerability has been discovered in OpenSSH, which could allow for remote code execution. Details of the vulnerability include:
Tactic: Initial Access (TA0001):
Technique: Exploit Public-Facing Application (T1190):
Successful exploitation of this vulnerability could allow for remote code execution in the context of the unprivileged user running the sshd server. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
RECOMMENDATIONS:
We recommend the following actions be taken:
REFERENCES:
OpenSSH:
http://www.openwall.com/lists/oss-security/2024/07/08/2
Oligo Security:
https://www.oligo.security/blog/critical-openssh-vulnerability-cve-2024-6387-regresshion
RedHat:
https://access.redhat.com/security/cve/CVE-2024-6409
Ubuntu:
https://ubuntu.com/security/CVE-2024-6409
CVE:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6409