Ransomware Gangs Use LockBit's Fame to Intimidate Victims in Latest Attacks

CVE-2020-3259 is an information-disclosure vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software, caused by a buffer-tracking error when the device parses invalid URLs. An unauthenticated, remote attacker can trigger it by sending a crafted GET request to the web services interface, which allows retrieval of the device's memory contents and disclosure of confidential information. Only devices with specific AnyConnect and WebVPN configurations are affected, but those configurations are common on ASA/FTD firewalls deployed as enterprise edge and remote-access VPN gateways. Exploitation is confirmed in the wild: CISA added the bug to its Known Exploited Vulnerabilities catalog on 2024-02-15 with known ransomware use, and the Akira ransomware group (which the FBI says has extorted $42 million across roughly 250 attacks since March 2023) is actively exploiting it, with LockBit also scanning for vulnerable Cisco ASA devices. EPSS assigns a 71.8% probability of exploitation within 30 days, and no public proof-of-concept code is known.

Do: Upgrade affected ASA and FTD devices to the fixed releases listed in Cisco's security advisory for CVE-2020-3259; if patching is delayed, disable or restrict the web services interface (WebVPN/AnyConnect) to trusted source networks. Per the CISA KEV required action, apply vendor mitigations or discontinue use where mitigations are unavailable. Prioritize internet-facing VPN gateways and hunt for exploitation indicators (anomalous GET requests to the web services interface) given active Akira and LockBit targeting.

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website.

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an authentication weakness (CWE-288) that allows an unauthenticated, remote attacker to conduct brute-force attacks against the SSL VPN login interface to guess valid username and password combinations, and to establish a clientless SSL VPN session as an unauthorized user under certain configurations. The attack is triggered simply by sending repeated or crafted authentication attempts to an internet-facing remote-access VPN endpoint, and vendor guidance centers on the group-lock and vpn-simultaneous-logins settings. A successful attempt gives the attacker VPN access, typically allowing them to reach the internal network as a legitimate user, which makes the flaw a common foothold for follow-on attacks including ransomware. Any organization operating a Cisco ASA or FTD with remote-access/clientless SSL VPN exposed to the internet is affected. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2023-09-13 with known ransomware use, and EPSS assigns it a 25.6% probability of exploitation within 30 days (98th percentile).

Do: Apply the mitigations in the Cisco advisory: configure group-lock and per-user vpn-simultaneous-logins restrictions as directed, and update ASA/FTD to the fixed releases listed there; if the device is end-of-support/unsupported, discontinue or isolate it. Prioritize internet-facing VPN concentrators given the KEV listing and known ransomware use, and review VPN logs for unusual failed-login bursts and unexpected clientless SSL VPN sessions.

Veeam Backup & Replication (VBR) contains a missing-authentication flaw (CWE-306) in its Cloud Connect component that lets an unauthenticated network attacker obtain encrypted credentials stored in VBR's configuration database. It is triggered simply by connecting to the exposed service, because the function that serves credential material performs no authentication check; no privileges or user interaction are required (CVSS 3.1: 7.5, network vector). With the recovered credentials, an attacker can gain access to backup infrastructure hosts, which has been used as an entry point and pivot for ransomware operations. Any organization running Veeam Backup & Replication is potentially affected, with the greatest risk where the VBR/Cloud Connect service is reachable from the internet. Exploitation is confirmed: CISA added the bug to its KEV catalog on 2023-08-22 with known ransomware use, the Cuba ransomware group has been observed stealing credentials through this exploit, and EPSS assigns a 77.6% near-term exploitation probability (100th percentile).

Do: Apply the fixes Veeam provides in its security advisory immediately — per CISA's KEV listing, patch per vendor instructions or discontinue use — prioritizing internet-facing Cloud Connect servers. After patching, rotate all credentials stored in the configuration database, since they should be considered exposed, and review those accounts for signs of misuse. Restrict network access to the VBR service from untrusted networks and check servers for exploitation indicators such as unexpected connections to the service or anomalous logins with stored credentials.

Fortinet FortiClient EMS — the central management server for FortiClient endpoint deployments — contains a SQL injection flaw (CWE-89) in versions 7.0.1 through 7.0.10 and 7.2.0 through 7.2.2. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) shows it can be triggered remotely with no credentials and no user interaction: an unauthenticated attacker sends specially crafted packets to the vulnerable management server and can execute unauthorized code or commands. Successful exploitation effectively yields remote code execution on the EMS server and access to its database, enabling follow-on actions such as credential theft, abuse of endpoint management functions, and ransomware deployment. Any organization running the affected EMS versions is exposed, especially where the management server is reachable from the internet. Exploitation is confirmed in the wild: CISA added the bug to the KEV catalog on 2024-03-25 with known ransomware use, and EPSS assigns a ~98.4% probability of exploitation within 30 days (100th percentile).

Do: Upgrade FortiClient EMS to the fixed releases per Fortinet's advisory for this CVE (7.2.3 and 7.0.11 or later, i.e., beyond the 7.2.2 and 7.0.10 affected ranges); the CISA KEV required action is to apply vendor mitigations or discontinue use if mitigations are unavailable. Until patched, limit exposure of the EMS web interface to untrusted networks and hunt for signs of compromise — anomalous requests to the management console, unexpected database or admin activity, and follow-on ransomware behavior — since exploitation with known ransomware use is confirmed.

VMware ESXi is vulnerable to an authentication bypass (CWE-305) when the host is configured to use Active Directory for user management. An attacker who has sufficient Active Directory permissions can delete the AD group tied to ESXi administration (typically the default 'ESXi Admins' group) and then re-create it, causing ESXi to treat the re-created group as the original administrator group. This grants the actor full access to the ESXi host without needing ESXi credentials themselves. Only ESXi hosts that were joined to and configured with Active Directory for user management are affected; hosts using local authentication are not. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-07-30 with known ransomware use, and EPSS assigns a high 26.8% probability of exploitation in the next 30 days (98th percentile).

Do: Apply the security updates or mitigations published in the vendor's (VMware/Broadcom) advisory for your ESXi release, per the CISA KEV required action. As interim mitigation, protect the configured AD admin group (default 'ESXi Admins') from deletion or re-create it with the original identity, and restrict AD permissions that allow arbitrary group deletion. Since ransomware use is known, audit AD logs for deletion/re-creation of the 'ESXi Admins' group and verify integrity of any AD-joined ESXi hosts.

Veeam Backup & Replication contains a deserialization of untrusted data flaw (CWE-502) that allows an unauthenticated attacker to send a maliciously crafted serialized payload to the product's network-facing service and achieve remote code execution, with no privileges or user interaction required (CVSS 3.1: 9.8). Successful exploitation yields full code execution on the backup server with high impact on confidentiality, integrity and availability, and is especially valuable to attackers because backup infrastructure typically stores credentials and ransomware operators seek to destroy or encrypt backups before attacking production systems. Any organization running Veeam Backup & Replication is in scope; the provided data does not specify exact affected version ranges, so consult Veeam's advisory for the affected/fixed builds. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-10-17 with known ransomware use, a public proof-of-concept has been published by watchTowr, EPSS estimates a 90.4% probability of exploitation within 30 days (100th percentile), and the exploit has been reused in Frag ransomware attacks.

Do: Apply Veeam's security updates immediately (the vendor released fixes for 18 flaws, including 5 critical ones); per the KEV required action, apply mitigations per Veeam's instructions or discontinue use if mitigations are unavailable. Until patched, restrict network access to the backup server from untrusted networks and remove unnecessary internet exposure. Given confirmed ransomware exploitation, also hunt for signs of compromise on backup servers and review backup job integrity and stored credentials.

CVE-2024-40766 is an improper access control flaw (CWE-284) in SonicWall SonicOS management access that can allow unauthorized access to protected resources and, under specific conditions, crash the affected firewall. It is network-exploitable without privileges or user interaction per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and affects Gen 5 and Gen 6 appliances as well as Gen 7 devices running SonicOS 7.0.1-5035 or older. A successful attacker gains unauthorized access to resources behind or on the appliance and can potentially take the firewall offline, creating opportunities for follow-on attacks such as VPN account compromise and ransomware deployment. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-09 with known ransomware use, and recent reporting ties Akira ransomware activity — including MFA bypass on SonicWall VPNs affecting over 100 accounts — to this legacy bug combined with password reuse. No public PoC is known, but EPSS assigns an ~18.2% probability of exploitation within 30 days (97th percentile).

Do: Upgrade Gen 7 appliances to SonicOS 7.0.1-5037 or later (the fixed release beyond the affected 7.0.1-5035) and move Gen 5/6 devices to the latest SonicOS release SonicWall supports for those generations; per CISA KEV guidance, apply vendor mitigations or discontinue use if patching is not possible. Restrict WAN-side management and SSLVPN access to trusted sources, audit VPN accounts for password reuse, rotate credentials and any locally stored recovery codes, and review logs for signs of Akira-related compromise such as MFA bypass or disabled EDR agents.