Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 08-Feb-2024 01:57:50 JST Kevin Beaumont

   • GreyNoise

   ⚠️ Patch Cisco AnyConnect/ASA

   I've just been looking at data from @greynoise and other firms.

   There has been a significant uptick in scanning for Cisco AnyConnect VPN devices. 95% of the IPs doing it are tagged as malicious, not researchers or IoT search engines.

   Additionally, there is a ballooning of exploitation attempts, which appear to be attempts to remotely fingerprint version numbers.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 08-Feb-2024 02:04:02 JST Kevin Beaumont

     in reply to

     Ransomware linked groups appear to have joined the AnyConnect train in anger at the beginning of February.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 08-Feb-2024 02:04:58 JST Kevin Beaumont

     in reply to

     It builds on this situation with Akira, LockBit have also joined the fun. https://www.kyberturvallisuuskeskus.fi/en/news/finnish-organisations-targeted-akira-ransomware

   • Embed this notice
     Seth Mos (databeestje@noc.social)'s status on Thursday, 08-Feb-2024 03:16:11 JST Seth Mos

     in reply to

     • GreyNoise

     @GossiTheDog @greynoise We see a massive jump in scans on our PA since this weekend. From 200-500 to 5-10k. Mostly Bulgaria

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 08-Feb-2024 03:20:40 JST Kevin Beaumont

     in reply to

     Here's an example AnyConnect CVE, which started being yeeted this week (saml strings in GET request). 100% tagged as malicious in GreyNoise.

   • Embed this notice
     Fafner [_KeyZee_] (f_kz_@infosec.exchange)'s status on Thursday, 08-Feb-2024 05:16:21 JST Fafner [_KeyZee_]

     • ludiofines

     @ludiofines @GossiTheDog Walt to see if your company appears on RansomLook 😝just kidding , no public checker ftm :(

   • Embed this notice
     ludiofines (ludiofines@cyberplace.social)'s status on Thursday, 08-Feb-2024 05:17:11 JST ludiofines

     • Fafner [_KeyZee_]

     @F_kZ_ @GossiTheDog i was already thinking about that last week tbh. let's see...

   • Embed this notice
     brsn (brsn@infosec.exchange)'s status on Thursday, 08-Feb-2024 07:04:16 JST brsn

     in reply to

     @GossiTheDog do you know which CVE this is?

   • Embed this notice
     SIEM Shady (cdubbs@infosec.exchange)'s status on Thursday, 08-Feb-2024 07:04:16 JST SIEM Shady

     in reply to

     • brsn

     @brsn @GossiTheDog Is this in reference to the older CVE-2020-3259?