Lebih Banyak Kegilaan Serangan Bahan Bakar Zero-Days Ivanti VPN saat Patch Akhirnya Diluncurkan

Ivanti akhirnya mulai menambal sepasang kerentanan keamanan zero-day yang diungkapkan pada 10 Januari di peralatan Connect Secure VPN-nya. Namun, hari ini mereka juga mengumumkan dua bug tambahan di platform, CVE-2024-21888 dan CVE-2024-21893 — yang terakhir juga sedang dieksploitasi secara aktif di alam liar.

Ivanti telah merilis patch putaran pertamanya untuk himpunan awal zero-day (CVE-2024-21887 dan CVE-2023-46805) tetapi hanya untuk beberapa versi; perbaikan tambahan akan diluncurkan dengan jadwal yang bervariasi dalam beberapa minggu mendatang, kata perusahaan itu dalam pemberitahuan terbarunya hari ini. Sementara itu, Ivanti telah memberikan mitigasi yang harus segera diterapkan oleh organisasi yang belum ditambal agar tidak menjadi korban eksploitasi massal oleh aktor-aktor yang disponsori negara Tiongkok dan penjahat dunia maya yang bermotivasi finansial.

Beberapa Serangan Pencurian Data Jangkar Malware Khusus

Bahwa eksploitasi terus berlanjut. Menurut Mandiant, ancaman persisten tingkat lanjut (APT) yang didukung Tiongkok yang disebut sebagai UNC5221 telah berada di balik banyak eksploitasi sejak awal Desember. Namun aktivitas secara umum telah meningkat pesat sejak CVE-2024-21888 dan CVE-2024-21893 diumumkan pada awal bulan Januari.

“In addition to UNC5221, we acknowledge the possibility that one or more related groups may be associated with the activity,” Mandiant researchers said in analisis serangan siber Ivanti released today. “It is likely that additional groups beyond UNC5221 have adopted one or more of [the] tools [associated with the compromises].”

Untuk itu, Mandiant mengeluarkan informasi tambahan mengenai jenis malware yang digunakan UNC5221 dan pelaku lainnya dalam serangan terhadap VPN Aman Ivanti Connect. Sejauh ini, implan yang mereka amati di alam liar meliputi:

“Nation-state actors UNC5221 have successfully targeted and exploited vulnerabilities in Ivanti to steal configuration data, modify existing files, download remote files, and reverse tunnel within networks,” says Ken Dunham, cyber-threat director at Qualys Threat Research Unit, who warns Ivanti users to be on the lookout for supply chain attacks on their customers, partners, and suppliers. “Ivanti is likely targeted due [to] the functionality and architecture it provides actors, if compromised, as a networking and VPN solution, into networks and downstream targets of interest.”

In addition to these tools, Mandiant researchers flagged activity that uses a bypass for Ivanti’s initial stopgap mitigation technique, detailed in the original advisory; in these attacks, unknown cyberattackers are deploying a custom cyber-espionage Web shell called “Bushwalk,” which can read or write to files to a server.

“The activity is highly targeted, limited, and is distinct from the post-advisory mass exploitation activity,” according to the researchers, who also provided extensive indicators of compromise (IoCs) for defenders, and YARA rules.

Ivanti dan CISA merilis panduan mitigasi terbaru kemarin bahwa organisasi harus menerapkan.

Dua Bug Zero-Day Tingkat Keparahan Tinggi yang Baru

Selain meluncurkan patch untuk bug yang sudah berumur tiga minggu, Ivanti juga menambahkan perbaikan untuk dua CVE baru ke dalam saran yang sama. Mereka:

Only exploits for the latter have circulated in the wild, and the activity “appears to be targeted,” according to Ivanti’s advisory, but it added that organizations should “expect a sharp increase in exploitation once this information is public — similar to what we observed on 11 January following the 10 January disclosure.”

Qualys TRU’s Dunham says to expect attacks from more than just APTs: “Multiple actors are taking advantage of vulnerability exploitation opportunities prior to organizations patching and hardening against attack Ivanti is weaponized by nation-state actors and now likely others — it should have your attention and priority to patch, if you’re using vulnerable versions in production.”

Para peneliti juga memperingatkan bahwa hasil dari kompromi dapat berbahaya bagi organisasi.

“These [new] Ivanti high-security flaws are serious [and particularly valuable for attackers], and should be patched immediately,” says Patrick Tiquet, vice president of security and architecture at Keeper Security. “These vulnerabilities, if exploited, can grant unauthorized access to sensitive systems and compromise an entire network.”

• Konten Bertenaga SEO & Distribusi PR. Dapatkan Amplifikasi Hari Ini.
• PlatoData.Jaringan Vertikal Generatif Ai. Berdayakan Diri Anda. Akses Di Sini.
• PlatoAiStream. Intelijen Web3. Pengetahuan Diperkuat. Akses Di Sini.
• PlatoESG. Karbon, teknologi bersih, energi, Lingkungan Hidup, Tenaga surya, Penanganan limbah. Akses Di Sini.
• PlatoHealth. Kecerdasan Uji Coba Biotek dan Klinis. Akses Di Sini.
• Sumber: https://www.darkreading.com/endpoint-security/more-ivanti-vpn-zero-day-bugs-attack-frenzy-patches-rolling