The China-nexus cyberthreat actor has been operating since at least 2019 and has notched victims in multiple countries.
Former deputy national cyber director DeRusha lands at Google Cloud
The post Former deputy national cyber director DeRusha lands at Google Cloud appeared first on CyberScoop.
New MOVEit Auth Bypass Vulnerability Under Attack Now, Patch Immediately
Progress Software’s popular MOVEit Transfer and MOVEit Cloud-managed, file transfer solutions, have been found to contain a critical authentication bypass vulnerability (CVE-2024-5806).
The vulnerability, which exists in the products’ SFTP module, can allow attackers to bypass authentication and gain unauthorized access to sensitive data.
Researchers at watchTowr first disclosed the vulnerability and published a detailed technical analysis.
They found that an attacker could trick the system into granting access without proper credentials by manipulating certain parameters during the SSH authentication process.
Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan
Exploit code for the vulnerability was released publicly mere hours after Progress Software issued a security bulletin acknowledging the flaw. This has led to a surge in attack attempts against vulnerable MOVEit installations.
Last year, MOVEit Transfer was the target of a massive cyber attack campaign by the Cl0p ransomware group, which exploited a zero-day SQL injection vulnerability to breach dozens of organizations and steal sensitive data.
Given MOVEit’s popularity for transferring critical business information, security experts fear this new vulnerability could lead to similar wide-scale attacks.
Progress Software has released patches for MOVEit Transfer versions 2024.0.2, 2023.1.6, and 2023.0.11, as well as MOVEit Gateway versions 2024.0.1 and later.
The company “strongly recommends all MOVEit Transfer and MOVEit Cloud customers apply these patches immediately.”
Researchers at Rapid7 have confirmed they could reproduce the exploit and achieve an authentication bypass against vulnerable, unpatched versions of both MOVEit Transfer and MOVEit Gateway. They advise organizations to treat this vulnerability with high priority.
Security professionals are urging all organizations using MOVEit Transfer or MOVEit Cloud to patch their systems without delay.
Applying vendor-provided security updates is critical to close off this attack vector before threat actors can exploit it to gain a foothold. Delaying patching could expose sensitive data to unauthorized access and theft.
As more details of this vulnerability come to light, it’s clear that speed is of the essence when applying mitigations. Organizations should refer to Progress Software’s security bulletin for the latest patching instructions and guidance to protect their MOVEit deployments from this critical flaw.
Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free
The post New MOVEit Auth Bypass Vulnerability Under Attack Now, Patch Immediately appeared first on Cyber Security News.
Microsoft Faces EU Charges Over ‘Abusive’ Bundling
The European Union has issued competition charges against Microsoft, accusing it of illegally linking Teams with Office.
The Julian Assange Saga Is Finally Over
WikiLeaks founder Julian Assange has agreed to plead guilty to one count of espionage in US court on Wednesday, ending a years-long legal battle between the US government and a controversial publisher.
Fresh MOVEit Bug Under Attack Mere Hours After Disclosure
The high-severity CVE-2024-5806 allows cyberattackers to authenticate to the file-transfer platform as any valid user, with accompanying privileges.
Indonesia Refuses to Pay $8M Ransom After Cyberattack
More than 200 regional and national government agencies have been impacted by the ransomware attack, and few of them are once again operational.
Threat Actor May Have Accessed Sensitive Info on CISA Chemical App
An unknown adversary compromised a CISA app containing the data via a vulnerability in the Ivanti Connect Secure appliance this January.
WordPress Supply Chain Attack Spreads Across Multiple Plug-ins
Injected malicious JavaScript code gives attackers administrator rights on websites, and fills sites with SEO spam.
Key Takeaways From the British Library Cyberattack
Knowledge institutions with legacy infrastructure, limited resources, and digitized intellectual property must protect themselves from sophisticated and destructive cyberattacks.