Brief #7: Cyber Threats Target Law Firms, Ports, and More

TL;DR

• Massive Cybersecurity Breach Hits Top US Law Firms
• Ransomware Attack Paralyzes Japan's Largest Port
• Cisco's Unpatched Flaw: A Crack in Cloud Encryption
• Rising TrueBot Malware Attacks: A Cybersecurity Alarm
• French Surveillance Law: A New Era of Digital Policing

Massive Cybersecurity Breach Hits Top US Law Firms

• Three of the US biggest law firms, Kirkland & Ellis, KL Gates, and Proskauer Rose, have been targeted in a massive global data theft.
• The ransomware group Clop, also known as TA505, has claimed responsibility for the hack, which also targeted 50 other multinational corporations.
• The law firms were exposed due to a vulnerability in MoveIT software, used for file transfers.
• The breach could potentially affect more than 16 million individuals worldwide.

The recent cybersecurity breach that hit three of the largest US law firms underscores the growing threat of cyberattacks on the legal sector. The firms were targeted as part of a broader global data theft operation by the ransomware group Clop, also known as TA505.

The breach was facilitated by a vulnerability in the MoveIT software, a tool used by these firms for file transfers. This highlights the critical importance of regularly updating and patching software to address potential security vulnerabilities.

The timing of the attack, during the Memorial Day weekend, is a signature move of the Clop group, demonstrating their strategic approach to launching attacks when security monitoring may be reduced.

The scale of this breach, potentially impacting over 16 million individuals, underscores the severe consequences of such cyberattacks. It serves as a stark reminder for law firms and other organizations to prioritize cybersecurity, given the sensitive nature of the data they handle.

The incident also raises questions about the role of ransomware negotiation teams and the ethics of paying ransom demands. With the Clop group known to demand millions in extortion fees, the debate around the best strategies to respond to such attacks continues.

Ransomware Attack Paralyzes Japan's Largest Port

• Japan's largest maritime port, the Port of Nagoya, was hit by a ransomware attack, disrupting cargo operations.
• The ransomware, suspected to be from Russian hackers, caused a system outage at the port's container terminal.
• The Nagoya Harbor Transportation Authority expects operations to resume on Thursday morning.
• This is the first reported ransomware attack on a Japanese port, raising concerns about the impact on the local economy and supply chain, including the auto industry.

The ransomware attack on the Port of Nagoya, Japan's busiest shipping port, underscores the growing threat of cyberattacks on critical infrastructure. The attack, which is suspected to have originated from Russian hackers, caused a significant disruption in cargo operations, highlighting the potential economic impact of such incidents.

The ransomware used in the attack is believed to be LockBit, a type of malware associated with Russian-speaking hackers. This malware encrypts data on the victim's systems, rendering them inaccessible until a ransom is paid. The attack on the Port of Nagoya marks the first time a Japanese port has been targeted in this manner, raising concerns about the vulnerability of the country's critical infrastructure to cyber threats.

Cisco's Unpatched Flaw: A Crack in Cloud Encryption

• Cisco has disclosed a high-severity flaw (CVE-2023-20185) in its data center switching gear that could allow threat actors to read and modify encrypted traffic.
• The vulnerability affects the Application Centric Infrastructure (ACI) Multisite CloudSec encryption on Cisco Nexus 9000 series fabric switches.
• There are no patches available yet for this vulnerability. Cisco advises customers using the affected switches to disable the CloudSec encryption feature.
• An attacker with an on-path position between the ACI sites could exploit this vulnerability by intercepting intersite encrypted traffic and using cryptanalytic techniques to break the encryption.

The vulnerability, tracked as CVE-2023-20185, affects the Application Centric Infrastructure (ACI) Multisite CloudSec encryption on Cisco Nexus 9000 series fabric switches.

This flaw allows threat actors to read and modify encrypted traffic, posing a significant risk to data confidentiality and integrity. An attacker with an on-path position between the ACI sites could exploit this vulnerability by intercepting intersite encrypted traffic and using cryptanalytic techniques to break the encryption.

What makes this situation more concerning is that there are currently no patches available for this vulnerability. Cisco has advised customers using the affected switches to disable the CloudSec encryption feature and to contact their support organization to evaluate alternative options.

Rising TrueBot Malware Attacks: A Cybersecurity Alarm

• Cybersecurity agencies warn of new TrueBot malware variants targeting companies in the US and Canada, exploiting a critical vulnerability (CVE-2022-31199) in the Netwrix Auditor server.
• TrueBot malware, linked with cybercriminal collectives Silence and FIN11, is deployed to extract data and disseminate ransomware, jeopardizing numerous infiltrated networks.
• The malware gains initial access by exploiting the cited vulnerability, then installs TrueBot and the FlawedGrace remote access trojan (RAT) to escalate privileges and establish persistence.
• The shift to exploiting the CVE-2022-31199 vulnerability for initial access allows cyber threat actors to carry out attacks on a broader scale within infiltrated environments.

The TrueBot malware, linked with cybercriminal collectives Silence and FIN11, has evolved to pose a significant threat to cybersecurity. The malware targets companies in the US and Canada, exploiting a critical vulnerability (CVE-2022-31199) in the widely used Netwrix Auditor server. Once the vulnerability is exploited, TrueBot and the FlawedGrace remote access trojan (RAT) are installed to escalate privileges, establish persistence, and conduct additional operations.

The shift in delivery vector, from primarily malicious email attachments to exploiting the CVE-2022-31199 vulnerability, allows cyber threat actors to carry out attacks on a broader scale within infiltrated environments. This strategic shift underscores the evolving nature of cyber threats and the need for continuous vigilance and robust security measures.

The US government and other cybersecurity agencies have issued advisories and recommended mitigations, including applying patches to the Netwrix Auditor remote code execution flaw. Organizations are urged to implement these measures to reduce the likelihood and impact of TrueBot activity and other ransomware-related incidents.

French Surveillance Law: A New Era of Digital Policing

• France's parliament has approved a new clause in the justice reform bill that allows police to remotely activate cameras and microphones in internet-connected devices to surveil suspects.
• The law applies to suspects involved in crimes punishable by a minimum of five years in jail.
• Critics argue that this law transforms digital tools into police auxiliaries, posing a serious problem in societies.
• The law comes amidst ongoing protests in France, raising concerns about its timing and potential misuse.

The newly passed French law marks a significant shift in the landscape of digital surveillance. It allows police to remotely access cameras, microphones, and GPS on suspects' devices, including phones, laptops, and cars. This law applies to suspects involved in crimes punishable by a minimum of five years in jail, and it requires judge approval for any surveillance, limiting the duration to six months.

However, critics argue that this law effectively transforms personal digital tools into police auxiliaries, raising serious privacy concerns. The law comes amidst ongoing protests in France, further fueling concerns about its potential misuse.