Sans News bites for February 9, 2024

Hello folks,

Ivanti is in the news again with a CVSS score of at least an 8 with another vulnerability in their VPN software, the Lastpass saga was discussed at the end, persistent access was maintained for at least 5 years in our infrastructure and more.

Here are the headlines.

• Chinese State-Sponsored Cyber Espionage Group Maintained Persistent Access in US Critical Infrastructure System
• APT Threat Actors are Exploiting Known Vulnerabilities in FortiOS
• Ivanti, Again

According to the notes on Ivanti, this is their fifth flaw in only the first 2 months of this calendar year. Is it time you recognize that it might be time to say good-bye?

Here is what is in the rest of the news.

• • JetBrains Patches Critical Vulnerability in On-Prem TeamCity
• Fix Released for Linux Shim Bootloader Vulnerability
• US Cryptomining Operations Must Report Energy Use
• Multiple Vulnerabilities in Canon Printers
• Dutch Military Network Infected with Remote Access Trojan
• Google Threat Analysis Group Report on Commercial Surveillance Vendors
• Fraudulent LastPass App Removed from App Store

As for Team City, this is at least an 8 on the CVSS score and if you’re using the product in the cloud, you’re fine. If not, take your server offline until you patch it.

We covered this on our blog when it comes to Lastpass. I know that I have the right copy as I got it years ago, and this is why I ask who owns the app so I can make sure I get the correct one.

blog post

Would you like to read the Sans Newsletter for February 9, 2024? Here’s the link to the February 9, 2024                                                         Vol. 26, Num. 11 issue and we’ll be in touch!