The US Suffers Multiple Attacks By Russian Hackers

The National Security Agency, the Department of Homeland Security Cybersecurity and Infrastructure Security Agency, and the FBI has released a joint alert statement, warning that nation-state threat actors from Russia are actively targeting and exploiting five publicly known vulnerabilities to compromise US networks.
 
According to the US government nation-state threat actors with ties to Russia are actively exploiting five publicly known vulnerabilities to compromise a range of entities within the US and its allies. The Biden administration says it has been clear that the US wants a stable relationship with Russia. But now the Biden administration is taking actions to impose costs on Russia for actions by its government and intelligence services against the US.
 
The news followed the Biden Administration’s sanctions against the Russian government, which formerly attributed SolarWinds supply-chain attack to the country’s foreign service: the Russian Foreign Intelligence Service (SVR) actors, also known as APT29, Cozy Bear, and The Dukes. “The US Intelligence Community has high confidence in its assessment of attribution to the SVR,” according to the White House statement. “The SVR’s compromise of the SolarWinds software supply chain gave it the ability to spy on or potentially disrupt more than 16,000 computer systems worldwide.”
 
The US National Security Agency (NSA) the Cybersecurity, the Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI), has recently said that nation-state actors are using five vulnerabilities that affect VPN solutions, collaboration-suite software and virtualisation technologies to attack US and allied national-security and government networks. 
 
The NSA say that the attack, which is ongoing is directed by by the Russian Foreign Intelligence Service (SVR) who are exploiting five publicly known vulnerabilities. 
 
“NSA, CISA, and FBI strongly encourage all cybersecurity stakeholders to check their networks for indicators of compromise related to all five vulnerabilities and the techniques detailed in the advisory and to urgently implement associated mitigations. 
“NSA, CISA, and FBI also recognise all partners in the private and public sectors for comprehensive and collaborative efforts to respond to recent Russian activity in cyberspace”, says the NSA.
 
According to the NSA,the hackers are conducting “widespread scanning and exploitation against vulnerable systems in an effort to obtain authentication credentials to allow further access.” According to the NSA, the following are under widespread attack in cyber-espionage efforts:

The 5 Vulnerabilities Being Actively Exploited

CVE-2018-13379:   A directory traversal vulnerability in Fortinet FortOS allows unauthenticated attackers to access and download system files, by sending specially crafted HTTP resource requests. 
 
CVE-2019-9670:  This bug is an XML External Entity Injection (XXE) vulnerability in the mailbox component of the Synacore Zimbra Collaboration Suite.  Attackers can exploit it to gain access to credentials to further their access or as an initial foothold into a target network. 
 
CVE-2019-11510:   In Pulse Secure VPNs, a critical arbitrary file-reading flaw opens systems to exploitation from remote, unauthenticated attackers looking to gain access to a victim’s networks. 
 
CVE-2019-19781:  This critical directory-traversal vulnerability in the Citrix Application Delivery Controller (ADC) and Gateway that can allow remote code-execution. 
 
CVE-2020-4006:   And finally, a command-injection vulnerability in VMWare Workspace One Access, Access Connector, Identity Manager and Identity Manager Connector allows arbitrary command execution on underlying operating systems. 

The NSA recommended several best practices to protect organisations from attack:

• Update systems and products as soon as possible after patches are released.
• Assume a breach will happen; review accounts and leverage the latest eviction guidance available.
• Disable external management capabilities and set up an out-of-band management network.
• Block obsolete or unused protocols at the network edge and disable them in client device configurations.
• Adopt a mindset that compromise happens: Prepare for incident response activities.
 
NSA:       The White House:     Threatpost:      Health IT Security:      Cyber News Group:      Image: Unsplash
 
You Might Also Read:
 
Western Nations Face A ‘moment of reckoning’ Over Cyber Security:
 
« MI5 Joins Instagram
Two-Factor Authentication Matters More Than Ever »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Cambray Solutions

Cambray Solutions

Cambray Solutions specializes in locating and securing technical professionals, managers, and executives.

Subex

Subex

Subex leverages its award-winning telecom analytics solutions in areas such as Revenue Assurance, Fraud Management, Asset Assurance and Partner Management, and IoT Security.

Asoftnet

Asoftnet

Asoftnet are specialists in IT security, IT forensics, IT service, websites, applications and mobile solutions.

Seconize

Seconize

Seconize empowers enterprises to proactively manage their cyber risks, prioritize remediations, optimize security spending and ensure compliance.

Level Effect

Level Effect

Level Effect is developing new capabilities to bring a unique perspective on proactive network defense and advanced security analytics.

BetaDen

BetaDen

BetaDen provides a revolutionary platform for businesses to develop next-generation technology, such as the internet of things and industry 4.0.

ANSEC IA

ANSEC IA

ANSEC is a consultancy practice providing independent Information Assurance and IT Security focussed services to customers throughout the UK, Ireland and internationally.

LeadingIT

LeadingIT

Leading IT provides IT support, cloud computing, email support, cybersecurity, networking and firewall services to Chicagoland businesses.

Packetlabs

Packetlabs

Packetlabs specializes in penetration testing services and application security.

LANCOM Systems

LANCOM Systems

LANCOM Systems is the leading European manufacturer of secure, reliable and future-proof networking (WAN, LAN, WLAN) and firewall solutions for the public and private sectors.

Venari Security

Venari Security

Venari is an award-winning cybersecurity SaaS provider that has developed an ETA (Encrypted Traffic Analysis) platform which fundamentally changes the way encrypted traffic is analysed.

Memcyco

Memcyco

Memcyco is a provider of cutting-edge digital trust technologies to empower brands in combating online brand impersonation fraud, and preventing fraud damages to businesses and their clients.

Troye Computer Systems

Troye Computer Systems

Troye provide a complete range of digital workspace solutions that empower people to do their very best work in a safe and secure manner anywhere, anytime, using any device.

Icon Information Systems (ICONIS)

Icon Information Systems (ICONIS)

ICONIS is an integrated infrastructure and service provider, offering unified Information Technology (IT) solutions globally.

PDI Technologies

PDI Technologies

PDI Technologies helps convenience retail and petroleum wholesale businesses around the globe increase efficiency and profitability by securely connecting their data and operations.

SecureDApp

SecureDApp

SecureDApp is a blockchain security company that specialises in offering comprehensive security solutions to companies operating in the web3 space.