Sunday , October 6 2024

Thousand Cisco devices hacked in IOS XE zero-day attacks

Orange’s CERT Coordination Center discovered over 34.5K Cisco IOS XE devices compromised in CVE-2023-20198 attacks. Hackers have used a newly discovered and very serious software vulnerability to hack and infect more than 10,000 Cisco IOS XE devices with harmful software.

VulnCheck, a threat intelligence company, reported that a severe vulnerability (CVE-2023-20198) is being actively exploited in attacks on Cisco IOS XE systems with the Web User Interface (Web UI) enabled and the HTTP or HTTPS Server feature turned on.

First Half Of 2024 Report
Bangladeshi 32.4% government websites face cyber attack: NAS report

National Attack Surface (NAS) report for the first half of 2024 reveals that 56.6% of cyberattacks in Bangladesh targeted educational...
Read More
First Half Of 2024 Report  Bangladeshi 32.4% government websites face cyber attack: NAS report

Prince Ransomware Hits UK and US

A new ransomware campaign is targeting individuals and organizations in the UK and US. The "Prince Ransomware" attack uses a...
Read More
Prince Ransomware Hits UK and US

CISA warns active exploit of Zimbra & Ivanti endpoint manager Vulns

CISA has issued an urgent alert about critical vulnerabilities being exploited in Synacor’s Zimbra Collaboration and Ivanti’s Endpoint Manager (EPM)....
Read More
CISA warns active exploit of Zimbra & Ivanti endpoint manager Vulns

A summary of “2024 State of Cybersecurity survey” by ISACA

ISACA 2024 survey report reveals that 66% of cybersecurity professionals find their jobs more stressful now than five years ago....
Read More
A summary of “2024 State of Cybersecurity survey” by ISACA

ISACA reveals
64% of Australian cybersecurity professionals feel increasing stress

A recent study by ISACA shows that almost two-thirds of cybersecurity professionals report increasing job stress. The 2024 State of...
Read More
ISACA reveals  64% of Australian cybersecurity professionals feel increasing stress

Researchers detected 31 new Malware in September

In September, cybersecurity experts discovered 31 new ransomware variants that threaten individuals and businesses. These programs encrypt valuable data, making...
Read More
Researchers detected 31 new Malware in September

CRI Release New Ransomware Response Guidance

New guidance on ransomware, released during this week's International Counter Ransomware Initiative (CRI) meeting, encourages victims to report attacks to...
Read More
CRI Release New Ransomware Response Guidance

ALERT
Over 700,000 Routers Vulnerable to Hack for 14 security flaws

Over 14 new security flaws have been found in DrayTek routers for homes and businesses, which could allow attackers to...
Read More
ALERT  Over 700,000 Routers Vulnerable to Hack for 14 security flaws

Patch it now!
Critical Zimbra RCE flaw exploited: Needs Immediate Patching

Hackers are exploiting a recently revealed RCE vulnerability in Zimbra email servers that can be activated by sending specially crafted...
Read More
Patch it now!  Critical Zimbra RCE flaw exploited: Needs Immediate Patching

CISA Warns
Network switch RCE flaw impacts critical infrastructure

CISA warns of two serious vulnerabilities in Optigo Networks ONS-S8 Aggregation Switches, which could allow authentication bypass and remote code...
Read More
CISA Warns  Network switch RCE flaw impacts critical infrastructure

VulnCheck found many infected hosts on internet-facing Cisco IOS XE web interfaces. The company also developed a scanner to identify these infections on affected devices.

“Cisco buried the lede by not mentioning thousands of internet-facing IOS XE systems have been implanted. This is a bad situation, as privileged access on the IOS XE likely allows attackers to monitor network traffic, pivot into protected networks, and perform any number of man-in-the-middle attacks,” said VulnCheck CTO Jacob Baines
.
“If your organization uses an IOS XE system, it’s imperative that you determine if your systems have been compromised and take appropriate action once implants have been discovered. While a patch is not yet available, you can protect your organization by disabling the web interface and removing all management interfaces from the internet immediately.”

VulnCheck has fingerprinted approximately 10,000 implanted systems, but we’ve only scanned approximately half of the devices listed on Shodan/Censys. We didn’t want to commit to a specific number as it’s evolving (increasing) as we continue our activities,” Baines told BleepingComputer.

A Shodan search for Cisco devices with their Web UI enabled (shared by Aves Netsec CEO Simo Kohonen) currently shows more than 140,000 Internet-exposed devices.

 

  Source: Bleepingcomputer

Cisco: Apply mitigation measures and look for breach indicators

On Monday, Cisco disclosed that unauthenticated attackers can exploit the IOS XE zero-day to gain full administrator privileges and take complete control over affected Cisco routers and switches remotely.

The company cautioned administrators to disable the vulnerable HTTP server feature on all internet-facing systems until a patch becomes available.

Cisco detected the CVE-2023-20198 attacks in late September following reports of unusual behavior on a customer device received by Cisco’s Technical Assistance Center (TAC). Evidence of these attacks dates back to September 18, when the attackers were observed creating local user accounts named “cisco_tac_admin” and “cisco_support.”

Moreover, the attackers deployed malicious implants using CVE-2021-1435 exploits and other unknown methods, enabling them to execute arbitrary commands at the system or IOS levels on compromised devices.

“We assess that these clusters of activity were likely carried out by the same actor. Both clusters appeared close together, with the October activity appearing to build off the September activity,” Cisco said.

“The first cluster was possibly the actor’s initial attempt and testing their code, while the October activity seems to show the actor expanding their operation to include establishing persistent access via deployment of the implant.”

The company also issued a “strong recommendation” for administrators to look for suspicious or recently created user accounts as potential signs of malicious activity linked to this threat.

Source: Bleepingcomputer

Check Also

CISA

CISA reveals 2 Industrial Control Systems Advisories

On October 1, 2024, CISA released two advisories regarding Industrial Control Systems (ICS), highlighting current …

Leave a Reply

Your email address will not be published. Required fields are marked *