For providers

Increasingly prevalent state-sponsored intrusions have been partly fueled by escalating activities from both countries' non-state attackers, with Russia commonly tapping hacktivist groups and China partnering with universities and businesses in its malicious cyber operations.

Milan-based private investigations firm Equalize led by former top cop Carmine Gallo was reportedly behind the years-long hacking campaign, which was facilitated by bribes to police officers, remote access trojan compromise, and the breach of the Italian Interior Ministry computer system's maintenance personnel.

Fortinet has updated their security advisory addressing a critical FortiManager vulnerability (CVE-2024-47575) to include additional workarounds and indicators of compromise (IOCs). A remote, unauthenticated cyber threat actor could exploit this vulnerability to gain access to sensitive files or take control of an affected system. At this time, all patches have been released. CISA previously added this vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation, as confirmed by Fortinet. CISA strongly encourages users and administrators to apply the necessary updates, hunt for any malicious activity, assess potential risk from service providers, report positive findings to CISA, and review the following articles for additional information: Fortinet Advisory FG-IR-24-423, CISA alert on the Fortinet FortiManager Missing Authentication Vulnerability, Google Threat Intelligence article Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575).

The Cisco 2024 Consumer Privacy Survey highlights awareness and attitudes regarding personal data, legislation, Gen AI and data localization requirements.

Celebrate the achievements of our partner ecosystem at Cisco Partner Summit 2024. Discover the outstanding performance of our global award winners and their impact on customers and communities.

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

The discoveries included three critical security vulnerabilities and 18 high-severity flaws.

Now a zero-day, the vulnerability enables NTLM hash theft, an issue that Microsoft has already fixed twice before.

At least two people responsible for operating the malware network that infected an estimated 1,200 servers.

A professional-grade tool set, appropriately dubbed "CloudScout," is infiltrating cloud apps like Microsoft Outlook and Google Drive, targeting sensitive info for exfiltration.