SonicWall VPN Firewall VPNS Exposed to Critical Flaws
Over 25,000 SonicWall SSLVPN devices are vulnerable to serious security flaws, according to a recent analysis by cybersecurity firm Bishop Fox. These devices, used to provide secure remote access for businesses, are exposed to the internet and are targeted by attackers, including ransomware groups. Many of the vulnerable devices are running outdated or unsupported firmware, with around 20,000 using software versions that the company no longer supports.
Bishop Fox used internet scanning tools to identify over 430,000 SonicWall devices exposed online, meaning attackers can easily access them and search for weaknesses. Some of the devices are running older Series 4 and 5 firmware, which have reached the end of life and are no longer receiving security updates. Many other devices are using unsupported versions of Series 6 firmware, leaving them open to known exploits.
While improvements have been made since earlier in the year, with fewer vulnerable devices, over 119,000 devices are still at risk. The majority of these are running Series 7 firmware but have not been updated to fix critical security flaws. The findings show that many organizations are slow to patch their devices, leaving them exposed to potential attacks.
CISA Updates KEV with Microsoft and Adobe Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. One is in Microsoft Windows Kernel-Mode Driver (CVE-2024-35250), which can allow attackers to gain high-level system privileges with low effort, making it a serious risk for Windows users. The second is in Adobe ColdFusion (CVE-2024-20767), where an attacker can gain unauthorized access to files, particularly if the admin panel is exposed. Both vulnerabilities have high severity ratings, with scores of 7.8 and 7.4, respectively.
CISA has ordered federal agencies to address these vulnerabilities by early 2025 to prevent potential exploitation. While there have been no reports of active ransomware attacks using these specific flaws, CISA’s guidance is also directed at private organizations, urging them to review and fix any vulnerabilities listed in the catalog. This ongoing effort is part of a broader initiative to strengthen cybersecurity across U.S. infrastructure.
Okta Support Warns of Increased Phishing Attacks
Okta, a major provider of identity and authentication solutions, has warned organizations about a rise in phishing attacks impersonating its support team. These attacks aim to steal Okta credentials, which can allow cybercriminals to access sensitive systems. Okta's own security team, as well as its customers, are frequently targeted by bad actors due to the widespread use of Okta across many large enterprises.
The company has advised users to be vigilant for support-related phishing emails or calls, stressing that legitimate Okta support staff will never ask for passwords or multi-factor authentication (MFA) tokens. Okta has provided customers with a list of legitimate contact details and tips for spotting suspicious messages, such as unusual email addresses, urgent language, and misspelled content. The evolving tactics of these phishing attacks, enhanced by AI tools like ChatGPT, have made it harder to detect traditional phishing signs.
This warning comes after Okta faced a major data breach last year, which compromised information about its customer support system users, underscoring the importance of vigilance against such social engineering attacks.
Defensible Strategies
Learn from those who have been attacked
Large Data Breach Impact Texas Tech University
Texas Tech University has announced that a ransomware attack on its Health Sciences Center and Health Sciences Center El Paso compromised the personal information of over 1.4 million individuals. The cyberattack, which occurred between September 17 and September 29, 2024, resulted in the theft of sensitive data, including names, addresses, Social Security numbers, health insurance details, medical diagnoses, and financial account information. The attack was discovered when the university experienced disruptions to its systems and applications.
While the university has not explicitly confirmed the use of ransomware, the Interlock ransomware group has claimed responsibility, stating they stole around 2.5 terabytes of data, including patient records and medical research. Interlock is known for targeting organizations in healthcare and other sectors using double-extortion tactics, where they encrypt data and demand ransom while also threatening to release it. The university is offering free credit monitoring to affected individuals and has reported the breach to the U.S. Department of Health and Human Services.
This breach is not the only cyberattack targeting Texas Tech University. Earlier in July, another ransomware group, Meow, claimed to have stolen sensitive data from the university, including emails and passwords, and was attempting to sell this information. Despite these ongoing attacks, Texas Tech University is working to secure its systems and assist those affected by the breaches.
A new phishing campaign has been spreading rapidly, using Google Calendar invites to trick users into revealing sensitive information. Attackers spoof Google Calendar notifications, making them appear as legitimate invites from trusted sources. Initially, the phishing attempts included malicious .ics files, but to avoid detection by email security systems, the attackers have now embedded links to Google Drawings and Google Forms. The aim of the attack is to steal user credentials and defraud victims through financial scams, such as credit card fraud or unauthorized transactions.
The campaign targets a massive user base, as Google Calendar is used by over 500 million people worldwide. Researchers have observed over 4,000 phishing emails over a four-week period, with fake invites referencing about 300 well-known brands to make them seem more authentic. Once users click on a disguised link, they are directed to a fraudulent page that mimics a cryptocurrency or bitcoin support site, where they are prompted to enter personal and payment details.
To protect against these types of attacks, experts recommend enabling Google's "known senders" setting in Google Calendar, which alerts users when they receive invites from unfamiliar sources. Additionally, businesses should use advanced email security tools, such as attachment scanning and URL checks, and encourage employees to use multifactor authentication (MFA) and be aware of sophisticated phishing tactics. These steps can help reduce the risk of falling victim to these types of financial scams.
As always, if you have any questions or would like to take a look at phishing training, please reach out to us!