Since December 16, 2024, Arctic Wolf has observed increased activity in a social engineering campaign associated with Black Basta ransomware. In this campaign, threat actors were observed using Microsoft Quick Assist and Teams to impersonate IT personnel and engage in malicious activities upon contacting victims. This is a continuation of the Black Basta campaign we … December 2024 Uptick in Social Engineering Campaign Deploying Black Basta Ransomware

On December 15, 2024, reports emerged that threat actors have begun attempting to exploit a recently disclosed critical vulnerability in Apache Struts (CVE-2024-53677) shortly after the publication of a Proof-of-Concept (PoC) exploit.  Apache Struts is a widely used open-source web application framework for developing Java-based applications. CVE-2024-53677 is a file upload path traversal vulnerability in … CVE-2024-53677: Exploitation Attempts of Critical Apache Struts RCE Vulnerability Following PoC Release

On December 16, 2024, BeyondTrust published a security advisory outlining a vulnerability impacting their Remote Support (RS) and Privileged Remote Access (PRA) software. The flaw, CVE-2024-12356, is a critical severity command injection vulnerability. If successfully exploited it can allow an unauthenticated remote threat actor to execute underlying operating system commands within the context of the … CVE-2024-12356: Critical Severity Command Injection Vulnerability in BeyondTrust Remote Support (RS) & Privileged Remote Access (PRA)

Since early December 2024, Arctic Wolf has been monitoring threat activity involving the malicious use of management interfaces on FortiGate firewall devices on the public internet. While our investigation into this activity is ongoing and the scope is yet to be fully determined, organizations running these products should ensure that they are adhering to security … Arctic Wolf Observes Targeting of Publicly Exposed Fortinet Firewall Management Interfaces

On December 11, 2024, Cleo released patches addressing the zero-day vulnerability recently observed in attacks targeting Cleo Managed File Transfer (MFT) products.  This vulnerability allowed unauthenticated threat actors to import and execute arbitrary shell commands on Windows and Linux on affected devices by exploiting default settings of the Autorun directory. The fix is included in … Cleo Releases Patches for Cleo MFT Zero-day Vulnerability

On December 7, 2024, Arctic Wolf began observing a novel campaign exploiting Cleo Managed File Transfer (MFT) products across several customer environments. The vulnerability in this campaign involved unauthorized remote code execution (RCE) through the manipulation of the filesystem, and was suspected of being related to CVE-2024-50623. Most intrusions associated with this campaign were observed … Follow-up: Threat Campaign Targeting Cleo MFT Products

On December 10, 2024, Ivanti released updates for three critical-severity vulnerabilities impacting their Cloud Services Application. By chaining the vulnerabilities together, a threat actor could obtain administrative privileges via authentication bypass (CVE-2024-11639), which could then allow for remote code execution (CVE-2024-11172) and/or SQL injection (CVE-2024-11173).  CVE-2024-11639  CVSS: 10.0 – Critical  No Exploitation Detected  Authentication Bypass … Ivanti Patches Multiple Critical-Severity Vulnerabilities in Cloud Services Application

On December 10, 2024, Microsoft released their December 2024 security update, which included patches for 72 newly disclosed vulnerabilities. Among these vulnerabilities, Arctic Wolf has highlighted 16 in this security bulletin affecting Microsoft Windows, including:  15 Remote Code Execution (RCE) vulnerabilities rated as Critical by Microsoft.  1 vulnerability actively exploited in the wild.  Vulnerabilities  Vulnerability  … Microsoft Patch Tuesday: December 2024