company logo

Product

Our Product

We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.

Solutions

By Industry

BFSI

Healthcare

Education

IT & Telecom

Government

By Role

CISO/CTO

DevOps Engineer

Resources

Resource Library

Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.

Subscribe to Our Weekly Threat Digest

Company

Contact Us

Have queries, feedback or prospects? Get in touch and we shall be with you shortly.

loading..
loading..
loading..
Loading...

Zerologon

Microsoft

loading..
loading..
loading..

Microsoft urges Organizations to Update System which Fixes Zerologon Vulnerability

Zerologon Vulnerability commonly known as CVE-2020-1472 vulnerability was published in an article is a vulnerability in Windows Server Netlogon Remote Protoco...

19-Jan-2021
2 min read

Related Articles

loading..

Apache Ofbiz

Apache OFBiz fixed a critical flaw (CVE-2024-45195) allowing arbitrary code exec...

Apache has addressed a severe security vulnerability in its open-source OFBiz (Open For Business) software. This flaw, tracked as CVE-2024-45195, could allow unauthorized attackers to execute arbitrary code on affected Linux and Windows servers. OFBiz, a versatile suite for customer relationship management (CRM) and enterprise resource planning (ERP) applications, also serves as a Java-based web framework for web development. #### Vulnerability Overview Discovered by Rapid7 researchers, the vulnerability stems from a forced browsing weakness, which exposes restricted paths to unauthenticated direct request attacks. According to Ryan Emmons, a security researcher at Rapid7, this flaw allows attackers to bypass missing view authorization checks in the OFBiz web application, potentially leading to arbitrary code execution on the server. **Proof-of-Concept (PoC) Exploit:** Emmons provided a PoC exploit code in his report, illustrating how an attacker can exploit this vulnerability without valid credentials. #### Remediation The Apache security team has addressed CVE-2024-45195 in OFBiz version 18.12.16 by introducing necessary authorization checks. Users of OFBiz are strongly advised to upgrade to this version to mitigate potential security risks. #### Connection to Previous Vulnerabilities CVE-2024-45195 is identified as a bypass for three earlier OFBiz vulnerabilities: CVE-2024-32113, CVE-2024-36104, and CVE-2024-38856. Emmons' analysis indicates that these vulnerabilities share a common root cause—a controller-view map fragmentation issue—that allows attackers to execute code or SQL queries, resulting in remote code execution without authentication. **Historical Context:** - **CVE-2024-32113:** Patched in May 2024, this vulnerability was noted for being actively exploited in attacks shortly after its disclosure. - **CVE-2024-38856:** This pre-authentication RCE bug was also a focus of SonicWall researchers, revealing technical details in the same timeframe. - **CVE-2024-36104:** Details about this vulnerability were less publicly available but were part of the same vulnerability class. #### Federal and Organizational Response The Cybersecurity and Infrastructure Security Agency (CISA) issued a warning in early August about the exploitation of CVE-2024-32113, shortly after SonicWall's disclosure of CVE-2024-38856. CISA added these vulnerabilities to its catalog of actively exploited flaws, enforcing a binding operational directive (BOD 22-01) for federal agencies to patch their servers within three weeks. **Note:** While BOD 22-01 specifically applies to Federal Civilian Executive Branch (FCEB) agencies, CISA has urged all organizations to prioritize these patches to prevent potential network breaches. #### Ongoing Threats In December, additional exploitation of OFBiz vulnerabilities, including CVE-2023-49070, was reported. Attackers utilized public PoC exploits to target vulnerable Confluence servers, underscoring the importance of prompt patching and continuous monitoring. The patching of CVE-2024-45195 is a crucial update for OFBiz users, addressing a significant security flaw with potential for severe impact. Organizations must act swiftly to apply the latest update to safeguard their systems from exploitation and to ensure compliance with security directives.

loading..   07-Sep-2024
loading..   3 min read
loading..

SonicWall

Access Control

Critical SonicWall CVE-2024-40766 flaw exploited in attacks. Apply patches now t...

A critical access control flaw, **CVE-2024-40766**, impacting SonicWall's firewall devices, is now **actively exploited** in the wild, according to an updated advisory from SonicWall. This vulnerability affects **Gen 5, Gen 6, and Gen 7** devices, with a severity score of **9.3 (CVSS v3)**. SonicWall is urging administrators to immediately apply patches to prevent unauthorized access and potential network disruption. ### Key Details of CVE-2024-40766 Initially disclosed on **August 22, 2024**, the flaw was thought to be limited to **SonicOS management access**. However, a recent update reveals that **SSLVPN** functionalities are also vulnerable. SonicWall warns that threat actors may exploit this flaw to gain unauthorized access to critical network resources and crash firewalls, disabling essential security protections. Although SonicWall hasn't provided specifics about how the flaw is exploited, historical attacks on similar SonicWall vulnerabilities have shown that cybercriminals frequently target **SSLVPN endpoints** due to their exposure on the internet for remote VPN access. ### Compromised Products and Security Patch Releases SonicWall has provided a detailed breakdown of affected devices and the corresponding patches: | **SonicWall Generation** | **Affected Versions** | **Fixed Version** | |--------------------------|----------------------------------------------------|-------------------------------------------------| | **Gen 5** | SonicOS 5.9.2.14-12o and older | SonicOS 5.9.2.14-13o | | **Gen 6** | SonicOS 6.5.4.14-109n and older | 6.5.2.8-2n (SM9800, NSsp 12400, NSsp 12800) <br> 6.5.4.15-116n (Other Gen 6 Firewalls) | | **Gen 7** | SonicOS 7.0.1-5035 and older | Non-reproducible in 7.0.1-5035 and later builds | ### Mitigation and Recommendations SonicWall has issued the following **mitigation strategies** to minimize the risk of exploitation while patches are being applied: 1. **Restrict Firewall Management Access**: Limit management access to trusted internal sources and **disable WAN portal** access from the internet where possible. 2. **Restrict SSLVPN Access**: Restrict **SSLVPN access** to trusted sources and **disable** SSLVPN entirely if not required. 3. **Update Local SSLVPN User Passwords**: For **Gen 5 and Gen 6** devices, SSLVPN users with local accounts should update their passwords immediately. Admins should enable the **"User must change password"** feature for local accounts. 4. **Enable Multi-Factor Authentication (MFA)**: Implement **MFA** for all SSLVPN users, using **Time-based One-Time Passwords (TOTP)** or email-based **OTPs**. Detailed configuration guidance for enabling MFA is available from SonicWall. ### Exploitation in the Wild Although **SonicWall** has not disclosed specific details on how **CVE-2024-40766** is being actively exploited, historical evidence indicates that SonicWall's vulnerabilities are frequently targeted by threat actors. These actors take advantage of their internet exposure for **remote access**, as demonstrated by past incidents, such as the **March 2023** campaign where suspected **Chinese hackers (UNC4540)** targeted unpatched SonicWall devices to deploy custom malware, which persisted through firmware upgrades. Similar exploitation patterns could emerge, as **SSLVPN vulnerabilities** have been historically attractive targets for attackers seeking to compromise corporate networks, bypass firewall protections, and establish persistent footholds in enterprise systems. ### Action Items for Administrators **Immediate patching** is the most effective way to secure your network against this vulnerability. Admins are strongly encouraged to download the latest patch from **MySonicWall.com** and apply it to affected devices. Furthermore, admins should review SonicWall’s recommendations on reducing exposure, enhancing access controls, and enforcing multi-factor authentication for enhanced security. For further details on patches, configurations, and advisories, visit SonicWall's **official advisory** page. **CVE-2024-40766** poses a critical risk to organizations using **SonicWall firewall devices**. As attacks exploiting this vulnerability have already been observed, swift patching and the application of mitigations are essential to prevent unauthorized access, disruption of network defenses, and potential data breaches. Organizations must take immediate action by applying the latest patches, restricting SSLVPN access, and enabling MFA to safeguard against potential attacks. #### Resources: - [SonicWall Advisory Page](https://mysonicwall.com) - [SSLVPN Configuration Guide](https://link_to_sslvpn_configuration)

loading..   06-Sep-2024
loading..   4 min read
loading..

Play Ransomware

Microchip

Play ransomware breaches Microchip Tech, exposing sensitive employee data. Read ...

#### Play Ransomware Hits Microchip Technology: Why a Growing Threat to Critical Infrastructure The notorious **Play ransomware gang** has once again made headlines, claiming responsibility for a **MAJOR CYBERATTACK** on **Microchip Technology Incorporated**, a U.S.-based semiconductor supplier. This ruthless gang has gained infamy for its relentless attacks on critical industries worldwide, using **double extortion tactics** that leave victims with no easy way out. ### Play Ransomware Shuts Down Microchip Technology’s Manufacturing Facilities On **August 17**, Microchip Technology, a major player in the semiconductor industry, discovered it had fallen prey to the **Play ransomware** gang. The attack led to a widespread disruption, affecting multiple manufacturing facilities and forcing the company to take critical systems offline. By August 20, the company disclosed that its operations were severely impacted, halting order processing and shipping as it struggled to contain the damage caused by Play ransomware’s malicious infiltration. Headquartered in Chandler, Arizona, Microchip Technology supports over **123,000 customers** across industrial, automotive, aerospace, and defense sectors, making it a valuable target for cybercriminals. The disruption caused by this **Play ransomware attack** showcases the gang’s growing boldness in targeting not just individual businesses but entire supply chains that power essential industries. ### Play Ransomware Exfiltrates Sensitive Employee Data While initial investigations revealed that no customer or supplier data had been compromised, **Play ransomware operators** managed to exfiltrate sensitive **employee data**, including contact information and encrypted passwords. In a chilling reminder of their capabilities, the attackers claim to have posted some of this stolen data online. Microchip Technology confirmed that it’s working with outside cybersecurity experts to evaluate the extent of the breach and is actively assessing the validity of the attackers’ claims. What makes the **Play ransomware gang** particularly dangerous is their use of **double-extortion tactics**. Not only do they encrypt and lock critical systems, but they also steal sensitive data, leveraging the threat of public disclosure to force companies into paying hefty ransoms. In Microchip’s case, Play has already partially leaked data on the dark web, threatening to release the rest unless the company complies with their demands. ### Play Ransomware’s Growing List of Victims This attack on Microchip Technology is not an isolated incident. Since its emergence in **June 2022**, the **Play ransomware gang** has built a notorious reputation, wreaking havoc across industries and countries. Some of the most notable victims include **Rackspace**, the **City of Oakland**, **Dallas County**, and even the **Belgian city of Antwerp**. In December 2023, the **FBI**, in collaboration with **CISA** and the **Australian Cyber Security Centre (ACSC)**, issued a joint advisory warning about the **Play ransomware threat**, revealing that this group had breached over **300 organizations worldwide** by October 2023. This staggering number highlights the Play gang’s relentless expansion and increasing sophistication, especially as they continue to exploit vulnerabilities in global supply chains. ### Microchip Technology’s Fight Against Play Ransomware Despite the overwhelming challenge, Microchip Technology has taken swift measures to recover from the **Play ransomware attack**. In a filing with the **U.S. Securities and Exchange Commission (SEC)**, the company disclosed that its critical IT systems have been **substantially restored**, allowing them to resume processing customer orders and shipping products. However, Microchip remains in the midst of restoring the full range of impacted systems and continues to evaluate the breach’s full scope with the assistance of external cybersecurity specialists. The Play ransomware gang’s escalating tactics have forced organizations like Microchip Technology into a corner — scrambling to restore operations while simultaneously mitigating the potential fallout from leaked data. Microchip's situation serves as a stark reminder of the grave consequences that come with cyberattacks orchestrated by **Play ransomware**. ### Staggering Impact of Play Ransomware on Critical Industries The fact that **Play ransomware** has managed to infiltrate a key player like **Microchip Technology** highlights the increasing threat this gang poses to critical infrastructure. Their ability to disrupt manufacturing, steal sensitive data, and create chaos for major industries is a testament to their evolving methods and sheer audacity. The semiconductor industry, which supports a broad range of sectors including defense and automotive, is particularly vulnerable to these types of attacks. The **Play ransomware gang’s** hit on Microchip Technology could reverberate across these industries, further emphasizing the need for organizations to adopt stronger cybersecurity measures. As the **Play ransomware threat** continues to expand, it becomes clear that no organization is safe. Cybercriminals like Play are becoming more strategic in their attacks, focusing on industries that are essential to the global economy. The Play gang’s ongoing success in breaching organizations highlights how critical it is for businesses to remain vigilant, proactively investing in robust cybersecurity protocols that go beyond standard defense mechanisms. ### Play Ransomware's Modus Operandi The **Play ransomware** group stands out from other cybercriminal organizations due to its **double-extortion model**. In this case, the gang not only encrypts systems to cripple operations but also exfiltrates valuable data, forcing companies into a no-win situation. For Microchip Technology, the stakes are particularly high, with the gang threatening to leak confidential employee information and potentially disrupt business relationships. Play ransomware’s demands are designed to create maximum pressure on the victim, often leaving companies like Microchip with a difficult choice: pay the ransom or risk seeing sensitive data published on the dark web. This tactic ensures that even if the company has backups or the ability to restore its systems without paying, it still faces the threat of damaging reputational harm. ### Why Play Ransomware Threat Isn't Going Away The attack on Microchip Technology is another chilling reminder of how **Play ransomware** continues to evolve into one of the most formidable threats in the cybersecurity landscape. From **Rackspace** to **Dallas County**, the **Play ransomware gang** has demonstrated time and again that it can breach any industry, any location, and any system — all while avoiding capture. As the **Play ransomware** threat grows, it’s critical that companies across the globe take this danger seriously. Strengthening cybersecurity defenses, conducting regular audits, and preparing comprehensive incident response plans are no longer optional. Businesses must recognize that cybercriminals like Play are becoming more sophisticated, making it all the more vital to stay one step ahead. ### Final Thoughts: Play Ransomware Crisis In the face of such **unrelenting ransomware threats**, the question is no longer if a company will be attacked, but when. **Play ransomware’s assault** on Microchip Technology is a powerful reminder that even the most prominent, technologically advanced companies are vulnerable. This attack — and the many before it — should serve as a call to action for industries everywhere: **The Play ransomware gang isn’t just coming. They’re already here.**

loading..   05-Sep-2024
loading..   6 min read