Top cybersecurity threats for August 2023

Top takeaways:

• The Norwegian National Cyber Security Centre announced a state-sponsored threat actor exploited an Ivanti zero-day vulnerability in an attack on the Norwegian government
• Researchers at Ivanti and Rapid7 discovered two more Ivanti vulnerabilities, and warned that the three could be chained in attacks
• The VTRAC has no intelligence about other victims of the zero-day bug

According to SecurityWeek.com, the Norwegian government announced that a zero-day vulnerability in cybersecurity vendor Ivanti's Endpoint Manager (EPMM) product (also known as MobileIron Core) enabled threat actors to compromise 12 government departments. The Cybersecurity and Infrastructure Security Agency (CISA) said the campaign, revealed in late July, dated as far back as April at least, with possible chaining observed between the zero-day (CVE-2023-35078) and another Ivanti vulnerability (CVE-2023-35081). The former allowed remote attackers to obtain Personally Identifiable Information (PII), add an administrative account, and change the configuration because of an authentication bypass. The latter enabled actors with EPMM administrator privileges to write arbitrary files with the operating system privileges of the EPMM web application server. Both have been patched.

Ivanti and Rapid7 labeled the chained vulnerability CVE-2023-35082 and —described it as a remote unauthenticated API access vulnerability in MobileIron Core 11.1 and older. Researchers warned that it could allow an attacker to write malicious webshell files to the appliance, which could then be executed by an attacker. Some affected products are now out of support so no new patches will be released.  The VTRAC has not identified additional victims of the original zero-day attack.