Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 07-Feb-2024 08:27:02 JST Kevin Beaumont

   • GreyNoise

   Two days ago, mass exploitation of Cisco AnyConnect CVE-2020-3580 began, per @greynoise data. It’s another Positive Technologies vuln.

   77 IP addresses are hammering the internet now. https://viz.greynoise.io/query?gnql=tags%3A%22Cisco%20ASA%20XSS%20Attempt%22

   This isn’t to be confused with the other 2020 AnyConnect CVE being used by Akira ransomware group.

   There are now three Cisco ASA vulns being used by Akira and Lockbit. #threatintel

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 07-Feb-2024 09:09:49 JST Kevin Beaumont

     in reply to

     It looks like the IPs involved may be linked to a ransomware group. I think what they're doing is fingerprinting patching status of AnyConnect.

   • Embed this notice
     barunick (barunick@infosec.exchange)'s status on Wednesday, 07-Feb-2024 09:11:53 JST barunick

     in reply to

     • GreyNoise

     @GossiTheDog @greynoise well that’s certainly interesting. Thanks for the heads up! #threatintel

   • Embed this notice
     David Penington (davidpenington@mastodon.au)'s status on Wednesday, 07-Feb-2024 18:09:20 JST David Penington

     in reply to

     @GossiTheDog Does this AnyConnect vulnerability have any association with the CitrixBleed Netscaler vulnerability?