Media Coverage

Security researchers are observing exploitation attempts for the CVE-2023-22527 remote code execution flaw vulnerability that affects outdated versions of Atlassian Confluence servers.

Threat monitoring service Shadowserver reports today that its systems recorded thousands of attempts to exploit CVE-2023-22527, the attacks originating from a little over 600 unique IP addresses. The service says that attackers are trying out callbacks by executing the ‘whoami‘ command to gather information about the level of access and privileges on the system.

The total number of exploitation attempts logged by The Shadowserver Foundation is above 39,000, most of the attacks coming from Russian IP addresses. Shadowserver reports that its scanners currently detect 11,100 Atlassian Confluence instances accessible over the public internet. However, not all of those necessarily run a vulnerable version.

DDoS or denial of access attack against BGP sessions is well known but not common in cyberspace. In June of last year, FIRST recorded 2 such cases where two of the organization’s BGP sessions were successfully attacked by a DDoS attack (TCP port 179) and both sessions were terminated. The IT security organization Shadowserver and the Shodan service have collected information about +300,000 BGP port 179 sessions that are at risk and could become a target for similar attacks. About 150 such BGP services exposed on the Internet have been found in Latvia. Simultaneous attacks on these services could lead to serious consequences and global “chaos on the Internet”.

Shadowserver unprotected BGP session information panel . Shadowserver notifications now also include two new free BGP session messages – available BGP service and open BGP service .

VMware is warning customers that CVE-2023-34048, a critical vCenter Server vulnerability patched in October 2023, is being widely exploited.

According to a report by the Shadowserver Foundation, there are currently hundreds of VMware vCenter Server instances exposed to the Internet that are potentially vulnerable. It’s not uncommon for VMware products to be targeted by malicious attackers. The catalog of known exploited vulnerabilities maintained by the US security agency CISA currently includes 21 VMware product flaws .

Network manufacturer Juniper warns customers of a critical vulnerability that could allow an unauthenticated attacker to take over firewalls and switches remotely. The vulnerability (CVE-2024-21591) resides in the J-Web configuration tool in Juniper Networks Junos OS SRX Series and EX Series firewalls and switches. The J-Web interface makes it possible to monitor, configure and manage the device via a browser.

According to the Shadowserver Foundation, the J-Web interface of 8,300 Juniper systems is accessible from the Internet, including 139 in the Netherlands.

The Government, through the National Cybersecurity Center (CNCS), made an automatic notification service for vulnerabilities and exposure in cyberspace available to public and private entities. The new service, which is offered free of charge, aims to help organizations strengthen their cybersecurity and protect their digital assets to promote a safer, more reliable and resilient cyberspace, through timely notifications.

The resource, presented by the National Cyber ​​Incident Response Team (CSIRT-RD), together with the Shadowserver Foundation, is aligned with the Digital Agenda 2030, our National Digital Transformation Strategy. The director of the CNCS, Juan Gabriel Gautreaux, explained that those interested in obtaining the service must subscribe by registering an official and authorized contact of the organization to which they belong and complete a form.

Hackers have been exploiting the two zero-day vulnerabilities in Ivanti Connect Secure disclosed this week since early December to deploy multiple families of custom malware for espionage purposes. Identified as CVE-2023-46805 and CVE-2024-21887, the security issues allow bypassing authentication and injecting arbitrary commands on vulnerable systems.

Today, threat monitoring service Shadowserver has posted on X that its scanners detect 17,100 Invanti CS appliances on the public web, most of them in the United States. However, there is no indication to how many of them are vulnerable.

The team that developed the distributed message streaming data platform Apache RocketMQ discovered that the major vulnerability CVE-2023-33246 they patched in May this year was incompletely patched, and a new version of the program component was provided to patch it.

It is worth noting that according to the Shadowserver Foundation’s investigation, they have currently published the geographical locations of hosts exposed on the Internet to the foundation’s global security situation database, and stated that hackers have passed nearly 400 source IP address to try to exploit the above two vulnerabilities.

The Terrapin attack, a newly identified security threat, jeopardizes nearly 11 million SSH servers that are accessible online. Originating from academic research at Ruhr University Bochum in Germany, this attack specifically targets the SSH protocol, affecting both clients and servers.The attack requires the perpetrator to be in a unique position – an adversary-in-the-middle (AitM) – to intercept and manipulate the handshake.  A report by Shadowserver, a security monitoring platform, highlights the widespread vulnerability of these servers across the globe. Shadowserver’s findings show that the United States has the highest number of vulnerable servers (3.3 million), followed by China (1.3 million), Germany (1 million), Russia (700,000), Singapore (390,000), and Japan (380,000).

Cozy Bear, a threat group linked with the Russian foreign intelligence service (SVR), has been conducting a global hacking campaign targeting servers hosting JetBrains TeamCity software, according to US, UK and Polish government agencies. On December 13, the UK-backed Shadowserver Foundation said it was still detecting 800 unpatched instances of JetBrains TeamCity worldwide. JetBrains’ Russkih commented: “The estimate from the Shadowserver Foundation doesn’t distinguish the instances patched with a dedicated security plugin JetBrains released for customers with older versions (since they only look at the version number). We have already reached out to them to discuss possible improvements.”

Hackers are attempting to leverage a recently fixed critical vulnerability (CVE-2023-50164) in Apache Struts that leads to remote code execution, in attacks that rely on publicly available proof-of-concept exploit code.

It appears that threat actors have just started, according to the Shadowserver scanning platform, whose researchers observed a small number of IP addresses engaged in exploitation attempts.