Storm Watch by GreyNoise Intelligence

Forecast = Advanced Persistent Thunderstorms

In this episode of Storm⚡️Watch, we dive deep into the evolving landscape of cybersecurity in 2024. The episode kicks off with a thought-provoking roundtable discussion, pondering the potential theme song of 2024, setting the tone for a year that's already shaping up to be full of significant cybersecurity developments. We then transition into a comprehensive analysis of recent cybersecurity events and trends that are shaping the digital world.

First on the agenda is the international police operation that successfully disrupted the notorious Lockbit cybercrime gang, a significant victory in the ongoing battle against cybercrime. This is followed by an exploration of the Justice Department's court-authorized disruption of a botnet controlled by the Russian GRU, highlighting the global efforts to combat state-sponsored cyberthreats. The episode also delves into the discovery of new vulnerabilities within SolarWinds' software, some of which are unauthorized, underscoring the persistent challenges in securing widely used software platforms.

The discussion then shifts to a series of high-profile hacks and leaks, including the Shanghai Anxun/I-SOON hack/leak and a significant state government leak and hack, illustrating the diverse nature of cyber threats facing organizations today. The episode emphasizes the critical need for security vendors to adopt Software Bill of Materials (SBOMs) and a resilient Software Development Life Cycle (SDLC), through the lens of Eclypsium's teardown of Ivanti.

Additionally, the episode features Rezonate's guide to hardening Okta's security posture, offering practical advice for enhancing cybersecurity defenses. In company news, GreyNoise celebrates the appointment of a new CEO and shares insights from the Grimoire blog on CVE-2021-44529, further demonstrating the company's commitment to advancing cybersecurity knowledge.

The episode concludes with a roundup of recent tags, active campaigns, and a discussion on the Known Exploited Vulnerabilities (KEV) catalog from CISA, providing listeners with a comprehensive overview of the current cybersecurity landscape and actionable insights for enhancing their security posture.

Episode Slides >>

Storm Watch Homepage >>

Learn more about GreyNoise >>

In this episode of Storm⚡️Watch, we explore the captivating toothbrush scandal that's been stirring discussion within the infosec community. We dissect the narrative surrounding three million malware-infected smart toothbrushes allegedly manipulated into orchestrating a Swiss DDoS attack, an incident that has gained traction on platforms like InfoSec Exchange and Tom's Hardware.

We then delve into the serious implications of Google's latest Spyware Report and the subsequent joint statement from various governments on the efforts to counter the proliferation and misuse of commercial spyware. These documents shed light on the alarming state of surveillance and the actions being taken at the highest levels to address these concerns.

The episode continues with an analysis of the Volt Typhoon and a critical infrastructure blog post by Censys, highlighting the vulnerabilities in critical infrastructure security. This discussion is particularly timely given the recent compromise of U.S. critical infrastructure by state-sponsored actors, as reported by CISA and Lawfare Media.

Canon's recent security update is also on our radar, with the company patching seven critical vulnerabilities in small office printers. This serves as a reminder of the ever-present need for vigilance in the realm of cybersecurity.

We also cover CISA's guidance on 'Living Off The Land' tactics and the innovative 'Living Off The False Positives' project, which offers a fresh perspective on managing false positives in security monitoring.

For those interested in malware tracking, we discuss Censys' Beginner's Guide to Tracking Malware Infrastructure, a valuable resource for anyone looking to enhance their threat intelligence capabilities.

GreyNoise's contributions to the fight against ransomware are highlighted through their blog post detailing the tagging system used to battle these threats. Additionally, we touch upon the Flipper Zero controversy in Canada and the open-source SDR tech debate, as well as the latest happenings in the GreyNoise Community Forum and the Centripetal webcast.

We wrap up the episode with a look at the recent tags and active campaigns visualized on GreyNoise's platform and a roundup of the Known Exploited Vulnerabilities (KEV) catalog by CISA.

Episode Slides >>

Storm Watch Homepage >>

Learn more about GreyNoise >>

In this episode of Storm⚡️Watch, we delve into a variety of pressing cybersecurity topics, starting with a light-hearted roundtable discussion on our dream locations for the next DEFCON conference. We then move on to applaud Cloudflare for their exemplary response to a recent security breach, highlighting the importance of transparency and swift action in the face of cyber threats. The episode also covers the AnyDesk breach, shedding light on the incident and the company's response, underscoring the ever-present need for robust security measures.

The conversation takes a serious turn as we discuss the CISA directive for Ivanti, mandating the shutdown of systems to mitigate vulnerabilities, a move that emphasizes the critical nature of software security in maintaining national cybersecurity. The episode also explores the alarming rise of deepfake technology, illustrated by a recent scam that defrauded a company of $25 million, and the clandestine world of fake ID creation by AI neural networks on the site OnlyFake.

We delve into the technical with a look at the ICANN .internal proposal, a significant development that could impact the structure of the internet's domain name system. The episode also highlights recent vulnerabilities in Jenkins reported by Censys, providing listeners with crucial information to protect their systems.

GreyNoise's contributions to the cybersecurity community are showcased through discussions on our latest blog posts, an open forum event, and a joint webcast with Centripetal, offering insights and opportunities for engagement with cybersecurity experts.

The episode wraps up with a look at recent tags and active campaigns on the GreyNoise platform, providing a snapshot of the current cybersecurity landscape.

Episode Slides >>

Storm Watch Homepage >>

Learn more about GreyNoise >>

In the latest episode of Storm⚡️Watch, we delve into the pressing issue of ransomware payments, which are on a notable decline as victims increasingly choose not to pay.

The conversation then turns to the alarming frequency of cyberattacks that often go unnoticed by the public, and highlights one recent breach in the municipality where a major U.S. court case is occurring. We highlight several incidents at organizations across the globe, emphasizing the pervasive nature of these security breaches.

We also dissect the sobering findings from the Dragos Industrial Ransomware Report for Q4, which reveals the increasing number of groups involved in ransomware attacks. This report underscores the challenges faced by industries in safeguarding their operations against such threats.

A surprising revelation comes from Germany, where a job posting for a Windows 3.11 administrator for a rail line brings to light the outdated and insecure systems still in use, which pose significant security risks.

The episode doesn't shy away from discussing major breaches, including the recent attacks on HPE and Microsoft, and the potential spillover effects these could have on the broader tech ecosystem.

We also explore Cert Spotter, a Certificate Transparency log monitor from SSLMate that alerts you when an SSL/TLS certificate is issued for one of your domains.

The team covers two recent blogs by Censys researchers, and takes a look at GreyNoise tags that are linked to ransomware gang activity.

Lastly, we briefly note CISA's new Water and Wastewater Sector Incident Response Guid,e and touch upon the latest trends and active campaigns in the cybersecurity landscape, as well as a roundup of known exploited vulnerabilities, providing listeners with a comprehensive overview of the current state of cyber threats.

Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

In the latest episode of GreyNoise Labs Storm⚡️Watch, we delve into a variety of cybersecurity topics that are crucial for professionals to stay abreast of. We kick off with a discussion on the World Economic Forum's Cybersecurity Outlook for 2024, providing insights into the anticipated challenges and strategies for the coming year. This is followed by an analysis of the Allianz Global Risk Barometer Redux 2024, which highlights the evolving landscape of cyber threats and their implications for global risk management.

The episode also introduces LogBoost, a tool designed to enhance log analysis, which is essential for identifying and mitigating security incidents. We then shift our focus to a recent vulnerability in VMware's VCenter, as reported by Censys, and discuss its potential impact on virtual infrastructure security.

GreyNoise's own research is featured prominently, with a deep dive into the F5 Big IP Remote Code Execution (RCE) vulnerabilities. We also revisit the last GreyNoise Tag Webinar, which offers a comprehensive understanding of GreyNoise tags and their application in cybersecurity. Additionally, we review the 2023 GreyNoise Retrospective Internet Exploitation Report, which provides a retrospective look at the past year's internet exploitation trends.

To keep our listeners informed on the latest cyber threats, we cover the most recent tags and active campaigns as observed by GreyNoise, offering a real-time perspective on the threat landscape. Lastly, we round up the episode with a discussion on the Known Exploited Vulnerabilities (KEV) catalog from CISA, which is an essential resource for cybersecurity professionals to prioritize their defensive efforts.

Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm⚡️Watch, we delve into a variety of cybersecurity topics, with a running theme of the vital need for Multi-Factor Authentication (MFA). We kick off with introductions and a roundtable discussion, followed by an exploration of a mass crypto-miner takedown, with insights drawn from reports by the Ukrainian Cyber Police and Bleeping Computer.

We then discuss the Ivanti debacle, referencing a blog post by Volexity. This is followed up by the note of two X account hacking events (SEC & Mandiant), as reported by The Register and Security Affairs. The NSA's warning about AI-enhanced phishing is also on our agenda, with sources from NBC News and Infosec Exchange.

We tap back to ancient Stuxnet news, the malware that cost a billion dollars, based on an article by Graham Cluley (there are some new twists to this tale). We also delve into the broad implications of the Orrick breach, as reported by Security Week.

In our tool spotlight, we feature Cyberwatch, a GitHub project by Casualtek. We also discuss a blog posts from Censys, about a Juniper vulnerability and encourage folks to attend the "Stop Predicting, Start Protecting" lunch-and-learn.

From GreyNoise, we highlight the second 2024 Tag Webinar and 2023 GreyNoise Internet Exploitation Retrospective Report.

We wrap up with a roundup of known exploited vulnerabilities from CISA.

Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm⚡️Watch podcast, we kick off the new year with a lively roundtable discussion. Our special guest for this episode is Andrew Morris, who brings a unique perspective to our conversation (given that he's, like, our CEO & Founder). Given Morris' propensity for "hot takes", this should be a doozy of an interview.

A significant part of our post-interview discussion revolves around the loanDepot breaches that occurred in 2023 and the start of 2024. We delve into the details of these incidents, providing insights into the cybersecurity implications and the broader impact on the industry. We also discuss the odds that little Suzie is homeless at this point.

As we look ahead to the rest of 2024, we discuss several key topics. We examine the controversial stance of 23andMe, who blamed negligent breach victims for their own misfortune. We also discuss a thought-provoking article from The Economist, which suggests that ransomware could cripple entire countries, not just companies. Furthermore, we explore the disinformation landscape in the US political sphere for 2024, highlighting the potential for global disinformation and misinformation campaigns.

Tool Time shows how you, too, can be a cyber reporter by surfing the SEC EDGAR website for required breach reporting.

We engage in our usual shameless self-promption as we discuss the latest blog posts from Censys and GreyNoise, including a deep dive into the SnakeYAML deserialization vulnerability. We also discuss our first 2024 Tag Webinar, which offers a detailed exploration of GreyNoise tags.

We wrap up the episode by discussing recent tags, active campaigns, and anomalies. We also highlight the wealth of information available on the CISA website, particularly focusing on the catalog of known exploited vulnerabilities and the massive KEV Drop this week.

Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm⚡️Watch, we kick off with our usual intros and roundtable discussion between co-hosts Kimber Duke, Emily Austin, Glenn Thorpe, and boB Rudis. ​ The show continues with a celebration of the FBI's confirmation that ALPHV has, indeed, been taken down. ​ Moving on, a significant development this week is the effective implementation date of new SEC cyber reporting rules. These rules mandate that companies report "material cybersecurity incidents" to their investors. The rules went into effect this week, and VF Corporation was one of the first to report under these new guidelines. VF Corporation suffered a significant cyberattack on December 13, 2023, which has had a major impact on its operations, particularly its ability to fulfill orders during the holiday rush. We also discuss the hot-off-the-presses Xfinity breach announcement. ​ Looking ahead, we delve into our predictions for the cybersecurity landscape in 2024 (make sure to check out our companion blog post, "Weathering 2024: Storm Watch Predictions for the Year Ahead"). ​ In Tool Time, we also discuss ZOOM's Vulnerability Impact Scoring System (VISS), a resource that helps organizations assess their vulnerability to cyber threats. ​ In the realm of recent vulnerabilities, we review Censys's blog post about the JetBrains TeamCity Remote Code Execution (RCE) vulnerability (CVE-2023-42793). We also showcase a deep dive into the Apache Struts2 RCE vulnerability (CVE-2023-50164) in our blog post, "A Day in the Life of a GreyNoise Researcher." ​ In another deep dive, Ron Bowes of GreyNoise Labs digs deep into F5 BIG-IP systems, where he explored how threat actors are baiting these systems. You can read all about those findings in our blog post, "Mining the Undiscovered Country with GreyNoise EAP Sensors: F5 BIG-IP Edition."

We note three new tags, including a WordPress Backup Migration RCE (CVE-2023-6553), the 3CX CRM SQL Injection (CVE-2023-49954), and the WuzhiCMS SQL Injection (CVE-2018-11528). ​ Finally, we wrap up with a discussion on the CISA's recent advisories. The first is a design alert urging manufacturers to eliminate default passwords, aptly titled "NO KEV!" The second is a joint advisory on Play Ransomware, providing crucial information to help organizations protect themselves against this threat.

Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

In this episode of Storm⚡️Watch by GreyNoise Intelligence, we discuss the rumored takedown of the ALPHV/BlackCat ransomware site, which has been offline for days, fueling speculation that law enforcement may have finally caught up with the prolific ransomware group. ​ We then delve into the North Korea-linked Lazarus Group's exploitation of the Log4j vulnerability in a global campaign targeting companies in the manufacturing, agriculture, and physical security sectors. This deep-dive Breaking News segment will shed some light on why attackers are still going after this two-year old weakness, and also discuss how attackers are using modern programming languages to gain efficiencies and thwart detections. ​ In our Tool Time segment, we explore the AWS Kill Switch, an open-source incident response tool for quickly locking down AWS accounts and IAM roles during a security incident. ​ Our Shameless Self-Promotion segment drops details on upcoming GreyNoise webinars, Censys' new service tier, and a GreyNoise Labs blog on use of GreyNoise EAP sensors for novel exploitation discovery for CVE-2023-47246. ​ Along with our CISA KEV roundup we provide a short readout on their Fourth Quarter Cybersecurity Advisory Committee Meeting and new CISA, jointly published guide on "The Case for Memory Safe Roadmaps". ​

Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>

Welcome to the latest episode of Storm⚡️Watch, where we delve into the most recent cybersecurity events and trends. We are also joined by our friends at Trinity Cyber.

In this episode, we're excited to announce the arrival of TAGSMAS! This is a special event where we celebrate the power of tags in cybersecurity and how they can help us better understand and respond to threats.

We start the show with the team over at Trinity Cyber, with an in-depth discussion about what they do and how they and GreyNoise partner to keep organizations (and humans) safe.

The episode continues with a security bulletin from New Relic, who recently identified unauthorized access to their staging environment. This environment provides insights into customer usage and certain logs, but does not store customer telemetry and application data. The unauthorized access was due to stolen credentials and social engineering related to a New Relic employee account. The unauthorized actor used the stolen credentials to view certain customer data within the staging environment. Customers confirmed to be affected by this incident have been notified and given recommended next steps. Importantly, there is no evidence of lateral movement from the staging environment to customer accounts in the separate production environment or to New Relic's production infrastructure.

Next, we discuss a phishing campaign targeting WordPress users. The campaign tricks victims into installing a malicious backdoor plugin on their site. The phishing email claims to be from the WordPress team and warns of a Remote Code Execution vulnerability on the user's site with an identifier of CVE-2023-45124, which is not currently a valid CVE. The email prompts the victim to download a "Patch" plugin and install it. If the victim downloads the plugin and installs it on their WordPress site, the plugin is installed with a slug of wpress-security-wordpress and adds a malicious administrator user with the username wpsecuritypatch. The malicious plugin also includes functionality to ensure that this user remains hidden.

In our shameless self-promotion segment, we highlight some of our recent work at GreyNoise Labs. We've been busy analyzing and documenting various cybersecurity threats and trends, and we're excited to share our findings with you. Be sure to check out our latest posts on the GreyNoise blog and sign up for our Noiseletter to stay up-to-date with our latest research.

We also discuss some recent vulnerabilities, including a Google Skia Integer Overflow Vulnerability (CVE-2023-6345), an ownCloud graphapi Information Disclosure Vulnerability (CVE-2023-49103), and two Apple Multiple Products WebKit vulnerabilities (CVE-2023-42917 and CVE-2023-42916). These vulnerabilities highlight the ongoing need for robust cybersecurity measures and the importance of staying informed about the latest threats.

Finally, we discuss a recent CISA alert about the Iranian military organization IRGC. IRGC-affiliated cyber actors using the persona "CyberAv3ngers" are actively targeting and compromising Israeli-made Unitronics Vision Series programmable logic controllers (PLCs). These PLCs are commonly used in the Water and Wastewater Systems (WWS) Sector and are additionally used in other industries including, but not limited to, energy, food and beverage manufacturing, and healthcare. The PLCs may be rebranded and appear as different manufacturers and companies. The authoring agencies urge all organizations, especially critical infrastructure organizations, to apply the recommendations listed in the Mitigations section of this advisory to mitigate risk of compromise from these IRGC-affiliated cyber actors.

Thank you for joining us for this episode of Storm⚡️Watch. We look forward to bringing you more insights into the world of cybersecurity in our next episode.

Episode Slides >>

Join our Community Slack >>

Learn more about GreyNoise >>