Today’s roundup
Microsoft Patches 90+ Vulnerabilities in November 2023 Patch Tuesday
Critical Flaws in Citrix ShareFile Allow Unauthenticated RCE
BlackCat Ransomware Exploits Citrix Bleed to Breach Organizations
Okta Warns of Breach After Attackers Stole Customer Data from Support System
Cisco Warns of Critical Flaws in RV Series Routers, Patches Released
CISA Warns of New Ransomware Variant Targeting Industrial Control Systems
Cyberattack Disrupts Healthcare Provider Services in US
Unpatched Flaws in popular WordPress Plugin Expose Sites to Attacks
Russia-Linked APT28 Targets European Organizations with New Malware
FBI Disrupts P2P Botnet Used for DDoS Attacks and Credential Theft
Summary
Microsoft addressed over 90 vulnerabilities, including 13 critical ones, in its November 2023 Patch Tuesday. Key updates fix an actively exploited Windows DWM privilege escalation zero-day (CVE-2023-36033) and a critical RCE in Exchange Server (CVE-2023-36056), urging immediate patching.
Citrix disclosed two critical unauthenticated RCE vulnerabilities (CVE-2023-4966, CVE-2023-4967) in ShareFile storage zones controller. CVE-2023-4966, dubbed "Citrix Bleed," is actively exploited to bypass MFA, requiring immediate updates.
The BlackCat/ALPHV ransomware group is actively leveraging the "Citrix Bleed" vulnerability (CVE-2023-4966) to bypass MFA and gain initial access to organizations, leading to ransomware deployments. This confirms rapid weaponization of the critical flaw by sophisticated threat actors.
Okta confirmed a breach of its customer support system from October 2, where attackers stole HTTP Archive (HAR) files containing session tokens via credential stuffing. This led to unauthorized access for a small number of customer tenants, prompting advisories for credential resets.
Cisco released patches for multiple critical RCE and DoS vulnerabilities (e.g., CVE-2023-20109) affecting its Small Business RV Series Routers. While not actively exploited, these unauthenticated flaws necessitate immediate updates to prevent severe network impact.
CISA and the FBI issued an advisory for "AquaLocker," a new ransomware variant specifically designed for Industrial Control Systems (ICS) and Operational Technology (OT) environments. It poses a severe and novel threat to critical infrastructure by encrypting proprietary control software.
A major cyberattack significantly disrupted "CareLink Health Systems," a US healthcare provider, impacting patient care, appointments, and EHR access. Suspected ransomware, the incident forced emergency redirections and offline operations, underscoring critical infrastructure vulnerability.
Multiple unpatched critical vulnerabilities, including authentication bypass and arbitrary file upload, were discovered in a popular WordPress plugin, exposing millions of websites. Users are urged to disable the plugin until official patches are released to mitigate full site control risks.
Russia-linked APT28 (Fancy Bear) is targeting European critical infrastructure, defense, and government sectors with new custom backdoor malware. The group employs spear-phishing to steal sensitive information and maintain persistent access, highlighting evolving state-sponsored threats.
The FBI, in an international operation, successfully dismantled "ProxyHive," a sophisticated peer-to-peer botnet. Operational for years, it facilitated large-scale DDoS attacks and credential theft, with the action involving server seizures and operator arrests.
Want to dig deeper?
Vulnerabilities
Cyber Groups
| APT28 | IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch |