Spanish Telecom Breached; UN Aviation Recruitment Data Stolen; Slovakian Land Agency Struggling After Cyberattack

In today's threat environment, implementing Multi-Factor Authentication (MFA) is now table stakes for all systems, but in particular sensitive systems, whether they are internal or external-facing. MFA should now be viewed in the same regard as seatbelts in a car, and those that don't use MFA viewed in the same way as those who don't wear seat belts

Strong authentication, multi-factor and resistant to fraudulent reuse, is both essential and efficient. Well-chosen and implemented, it is more convenient than so-called strong passwords, whose convenience goes down as their strength goes up.

The breach resulted in exfiltration about 2.3GB of documents, tickets and data. Make sure you're tied into credential breach notification for proactive password changing, or better still, move away from reusable passwords. As this internal Jira system was breached with compromised credentials, I would ask what other controls should have been in place to prevent external access to an internal system.

Credential harvesting has been on the rise over the last couple years. It is perhaps the easiest means for an evildoer to access an organization and compromise. Multi-factor authentication (MFA) has proven to be effective in mitigating loss of passwords. It’s a best practice as part of Implementation Group 1 of the CIS Critical Security Controls.

The ICAO statement that the breach does not affect the security of airtraffic is solely based on the compromised system not being connected to any aviation systems. However, this does not consider whether the stolen data could be used to disrupt air traffic in the future. It is also unclear if this was a targeted attack or if ICAO just got caught in a threat actor vacuuming up data spilled by careless employment application systems, regardless of where the data originated.

While the compromise is unfortunate, it would be helpful to understand what “…additional security measures [were implemented] to protect its systems from future attacks.” This way we all learn and can offer better protection against cyber-attacks.

Deciding whether one is a likely target of choice is fundamental to choosing one's risk tolerance and security policy. Most large enterprises should assume that they are targets of choice for so-called APTs and that they must be prepared to resist resourceful and persistent attacks.

This appears to be work of the Natohub threat actor, who is claiming to have released the information. ICAO is reaching out to the affected individuals directly. While it is common to have resume/CV data online, during an application or background check additional sensitive data is combined with that information, and as an individual you should be prepared in case that data gets compromised. As an employer, make sure you have contingency plans for the compromise of these systems, which are often outsourced these days, to include notification, ID monitoring/restoration for individuals as well as having your responsibilities and liabilities clearly defined. Include your legal team.

One question executive management might well ask is "what is the expected mean time to recovery from a ransomware attack." The answer to the question would be useful in choosing between prevention and recovery.

This appears to be another politically motivated attack; in this case indications are it came from the Ukraine. The bigger concern is how long it will take to restore systems. Make sure that you have clear understanding of your RTO and RPO, and that both your backups and team are sufficient (training, experience and equipment) to meet these. Be sure you've executed restorations, not just tabletops, which included running dummy transactions. You don't want to figure this out when the chips are down.

The security of any government systems, even those not essential to national security, may be essential to public trust and confidence and should be managed accordingly.

There is no shortage of political wrangling around foreign investment and control of US companies and assets, which will drive a lot of high level conversations about what is behind the attack. There was also a similarly motivated attack targeting the Office of Foreign Assets Control (OFAC). The trick will be focusing on remediation and prevention of recurrence. The Treasury compromise leveraged an API key for the BeyondTrust remote support agent as well as a corresponding zero-day. Have you considered the risks of any remote support/assistance agents you have on systems, to include factoring in not only working from home but also changes relating to a zero-trust environment? Check in on that ubiquitous MFA implementation as well as your monitoring and response capabilities. Compare what information you're capturing against OMB's M-21-31 logging levels for possible gaps.

CVE-2024-50603, improper handling of user parameters, has a CVSS score of 10.0. When the Aviatrix Controller is deployed to AWS, it allows privilege escalation by default. You need to take three steps here. First, upgrade to the latest version; second, restrict access to the controller regardless of how implemented; and lastly, forensicate your environment looking for the IOCs in the Wiz blog.

Given that exploit code has existed for a week and that the controller operates with elevated privileges makes this a must patch immediately.