Brief #70: China's 260K-Device Botnet Thwarted, SolarWinds RCE Flaw, macOS Zero-Click Exploit, AI in Compliance

Happy Sunday!

I hope this Brief finds you well and ready to tackle the week ahead. In this edition, I am covering:

• FBI's successful takedown of a massive China-backed botnet
• A comprehensive guide for choosing the right Security Operations Center model
• The importance of skills-based hiring in addressing the AppSec talent gap

And much more.

Your feedback shapes Mandos Brief and I'd love to hear your thoughts about the content I share.

INDUSTRY NEWS

FBI and Partners Thwart China-Backed 260,000-Device Botnet

• FBI Director Christopher Wray revealed that a China-backed group called Flax Typhoon had built a 260,000-device botnet since 2021, targeting US critical infrastructure, government, and academics.

• The FBI's Cyber National Mission Force (CNMF) and the NSA took control of the botnet's command and control servers, withstanding a DDoS attack and preventing the Chinese team from regaining control, ultimately leading to the botnet's abandonment.

• The botnet utilized customized Mirai malware to exploit vulnerabilities in internet-connected devices, with an SQL database containing 1.2 million records on compromised devices and over 80 subdomains linked to the command-and-control servers.

SolarWinds Patches Critical RCE Flaw in Access Rights Manager

• SolarWinds has released patches for two vulnerabilities in its Active Directory and Azure AD user provisioning tool Access Rights Manager, including a critical CVE-2024-28991 (CVSS score 9.0) that could allow remote code execution.

• Trend Micro's Zero Day Initiative, which reported the issues, explains that CVE-2024-28991 is a deserialization of untrusted data flaw allowing an authenticated attacker to execute code as SYSTEM and bypass authentication.

• The second vulnerability, CVE-2024-28990, is a hardcoded credential flaw that could allow an attacker to bypass authentication and access the RabbitMQ management console.

Malware Abuses Browser Kiosk Mode to Steal Google Credentials

• OALABS researchers discovered a malware campaign that locks users in their browser's kiosk mode on Google's login page, blocking the "ESC" and "F11" keys, to frustrate them into entering and saving their Google credentials.

• Once credentials are saved, the StealC information-stealing malware steals them from the credential store and sends them back to the attacker. This attack method has been used in the wild since at least August 22, 2024, mainly by Amadey, a malware loader, info-stealer, and system reconnaissance tool.

• To exit the kiosk mode, users should avoid entering sensitive information and try hotkey combos like 'Alt + F4', 'Ctrl + Shift + Esc', 'Ctrl + Alt +Delete', 'Alt +Tab', or perform a hard reset. Running a full antivirus scan in Safe Mode is recommended to remove the malware.

CloudImposer: Potential RCE Vulnerability in Google Cloud Platform

• Tenable Research discovered an RCE vulnerability dubbed CloudImposer that could have allowed attackers to run code on millions of Google Cloud Platform (GCP) servers and customer servers, potentially leading to a massive supply chain attack.

• The affected GCP services include App Engine, Cloud Function, and Cloud Composer. Documentation from GCP and the Python Software Foundation could have put customers at risk of a dependency confusion attack.

• Supply chain attacks in the cloud are exponentially more harmful than on-premises, as one malicious package can be deployed to millions of users. Users should analyze their package installation process, specifically the "--extra-index-url" argument in Python, to prevent breaches.