Phishing for the News - Daily - January 9, 2025

Phishing for the News

Here are some key points from today's SecureResearch Cyber Intelligence Briefs:

Critical Priority Updates

• Multiple critical vulnerabilities were found in Ivanti endpoint management and security products. These vulnerabilities allow for remote code execution and complete system takeover.
• A zero-day vulnerability in Ivanti Connect Secure VPN is being actively exploited. This enables unauthorized network access and could lead to data breaches.
• Critical flaws in SonicWall SMA 100 series appliances could allow attackers to execute code remotely and compromise the devices.
• The Fancy Product Designer WordPress plugin has two critical vulnerabilities and no patches are available.
• A new flaw in Ivanti Connect Secure is being used in zero-day attacks to install malware on appliances.
• A critical CRLF injection vulnerability in the GFI KerioControl firewall is being actively exploited.
• SonicWall is urging administrators to immediately patch an exploitable SSL-VPN bug which could allow attackers to gain administrative access.

Emerging Threat Patterns

• Hacktivists are targeting Ukrainian infrastructure, including internet service providers.
• Researchers neutralized over 4,000 web backdoors by registering expired domains.

Theme-Based Analysis

• There is a trend of remote code execution vulnerabilities in endpoint management and security tools. Organizations should patch immediately and monitor for Indicators of Compromise.
• Zero-day vulnerabilities are being exploited in enterprise VPNs. Organizations should prioritize patching, review access controls, and assess for compromise.
• Privilege escalation and security policy bypass flaws are also trending. Organizations should implement the principle of least privilege and proactively test security policies.

Strategic Recommendations

• Organizations should immediately patch the critical Ivanti and SonicWall vulnerabilities.
• Exposure to the Ivanti Connect Secure VPN zero-day should be assessed, and organizations should monitor for compromise.
• Privileged access controls and security policies should be reviewed for bypass risks.
• Attack surface monitoring should be expanded to include enterprise security and management tools.
• Proactive threat hunting should be conducted to identify potential breaches and IoCs.

For more information in the SecureResearch Daily Cyber Intelligence Brief, email [email protected]