Cybersecurity RSS

On May 31, 2023, Progress Software disclosed CVE-2023-34362 — a critical SQL injection vulnerability in MOVEit Transfer. By the time the advisory was published, Cl0p had already been exploiting it for weeks.

The attack pattern:

• Zero-day SQLi — unauthenticated SQL injection in MOVEit’s web interface allowed arbitrary code execution
• Web shell deployment — Cl0p dropped a web shell named “human2.aspx” for persistent access
• Mass data exfiltration — automated scripts extracted files from every accessible MOVEit server before anyone noticed
• Extortion without encryption — Cl0p didn’t deploy ransomware; they stole data and threatened to publish it

Scale of the breach:

• 2,500+ organizations confirmed breached
• 90+ million individuals affected
• Shell, British Airways, BBC, Johns Hopkins, U.S. government agencies, multiple state DMVs
• Estimated $10B+ in total damages

Why MOVEit matters: It demonstrated that file transfer appliances (MOVEit, GoAnywhere, Accellion) are prime targets because they sit on network perimeters, handle sensitive data, and often aren’t patched quickly. Cl0p developed a repeatable playbook: find zero-days in file transfer tools, mass-exploit them before patches exist, and extort victims with stolen data. They’ve done it three times now.

In May 2023, Microsoft and the Five Eyes intelligence alliance publicly attributed Volt Typhoon to China’s state-sponsored cyber operations. But the group had been active since at least mid-2021, quietly compromising critical infrastructure across the United States.

What makes Volt Typhoon different:

• Living-off-the-land (LOTL) — instead of deploying custom malware, Volt Typhoon uses built-in Windows tools (PowerShell, WMI, netsh, certutil) to blend in with normal admin activity
• Pre-positioning, not espionage — the goal isn’t data theft. It’s maintaining persistent access that could be weaponized during a Taiwan conflict to disrupt U.S. military logistics and civilian infrastructure
• SOHO router botnets — compromised small office/home office routers (Cisco, Netgear, ASUS) serve as operational relay nodes, making traffic appear to originate from legitimate U.S. IP addresses
• Multi-year persistence — in some cases, Volt Typhoon maintained access for 5+ years undetected

Targets confirmed by CISA/FBI:

• Water and wastewater systems
• Energy sector (electric utilities, pipelines)
• Transportation systems
• Communications infrastructure
• U.S. territories including Guam (critical for Pacific military operations)

The strategic implication: FBI Director Christopher Wray called it “the defining threat of our generation.” Volt Typhoon represents a shift from cyber espionage to cyber pre-positioning for wartime disruption. The Chinese government is building the capability to “flip a switch” and cause real-world damage to American infrastructure during a crisis.

In January 2024, Microsoft disclosed that Midnight Blizzard had compromised its corporate email systems starting in late November 2023. The attackers specifically targeted email accounts of Microsoft’s senior leadership, legal, and cybersecurity teams.

How they got in:

• Password spray — low-and-slow credential stuffing against a legacy, non-production test tenant account
• No MFA — the test tenant didn’t have multi-factor authentication enabled
• OAuth app abuse — used the compromised test account to create malicious OAuth applications with elevated permissions
• Lateral movement — the OAuth apps were used to access Microsoft corporate email mailboxes

What was accessed:

• Email accounts of senior leadership and executives
• Cybersecurity team emails (including correspondence about Midnight Blizzard itself)
• Legal team communications
• Some source code repositories (disclosed in March 2024 follow-up)
• Customer communications (some federal agencies notified)

The bigger picture: Midnight Blizzard wasn’t after financial data. They wanted to know what Microsoft knew about them — a classic counter-intelligence operation. The fact that Microsoft, with its massive security team, was compromised via a legacy test account with no MFA is a sobering reminder that forgotten infrastructure is the attacker’s best friend.

The breach led to a Congressional hearing and CSRB investigation. Microsoft responded with the “Secure Future Initiative” (SFI), making security its top corporate priority above all other features.

On March 29, 2024, Microsoft engineer Andres Freund noticed that SSH logins on his Debian sid system were taking 500ms longer than expected. His investigation uncovered one of the most sophisticated supply chain attacks ever attempted.

The social engineering campaign (2021–2024):

• 2021 — “Jia Tan” (likely a state-sponsored persona) begins submitting legitimate patches to the XZ Utils project
• 2022 — Sock puppet accounts pressure the solo maintainer (Lasse Collin) to accept Jia Tan as co-maintainer, citing slow patch reviews
• 2023 — Jia Tan gains commit access and release authority
• Feb 2024 — Malicious code inserted into XZ Utils 5.6.0 and 5.6.1 release tarballs (not visible in the Git repository)
• Mar 29, 2024 — Andres Freund discovers the backdoor by noticing a 500ms SSH latency regression

How the backdoor worked:

• Malicious build scripts in the tarball (not in Git) modified the XZ library during compilation
• The modified library was loaded by systemd, which links against liblzma
• When OpenSSH (via systemd) processed SSH connections, the backdoor intercepted authentication
• Specific SSH keys would bypass authentication entirely — giving the attacker root shell access

The near-miss: The backdoored versions had already been included in Fedora 40 beta, Debian sid/testing, and several other rolling-release distributions. If it had reached stable releases of major distros, it would have provided a backdoor into millions of servers worldwide.

“This might be the best-executed supply chain attack we’ve seen described in the open, and it’s a nightmare scenario.” — Alex Stamos, SentinelOne CISO

Modern ransomware isn’t a single hacker in a basement. It’s a multi-billion dollar criminal industry operating with the sophistication of a Silicon Valley startup — complete with recruitment, customer support, and revenue sharing.

How RaaS works:

• Operators build and maintain the ransomware payload, negotiate infrastructure, and run leak sites
• Affiliates gain initial access, deploy the ransomware, and exfiltrate data. They keep 70-80% of ransom payments
• Initial access brokers (IABs) sell network access to affiliates for $500–$50,000 per organization
• Double extortion — encrypt AND steal data, threatening to publish if ransom isn’t paid

Major RaaS operations:

• LockBit — the most prolific ransomware group from 2022-2024. Over 1,700 attacks. Disrupted by Operation Cronos (FBI/NCA) in February 2024, but LockBitSupp attempted a comeback
• BlackCat/ALPHV — first major ransomware written in Rust. Responsible for the $22M Change Healthcare attack. Pulled an exit scam on their own affiliates in March 2024
• Cl0p — specializes in zero-day exploitation of file transfer tools (Accellion, GoAnywhere, MOVEit). Data theft without encryption
• Black Basta — suspected Conti successor. Heavy targeting of healthcare and manufacturing

The economics: Total ransomware payments exceeded $1.1 billion in 2023 (Chainalysis data). The average ransom payment was $568,000. But the total cost to victims (downtime, remediation, reputation) is estimated at 10-15x the ransom amount.

Law enforcement has gotten more aggressive with takedowns and sanctions, but the RaaS model is resilient: when one group is disrupted, affiliates simply move to another platform.

Launched in November 2021 via Binding Operational Directive 22-01, the CISA KEV catalog solved a real problem: there are 200,000+ CVEs, but only a fraction are actually exploited in the wild. How do you prioritize?

How KEV works:

• CISA adds vulnerabilities that have confirmed active exploitation in the wild
• Each entry includes a remediation due date (typically 2-3 weeks for critical vulns)
• Federal civilian agencies (FCEB) are legally required to patch by the deadline
• The catalog is publicly available — any organization can use it for prioritization

Why KEV matters more than CVSS:

• CVSS scores rate theoretical severity. KEV tracks actual exploitation
• A CVSS 7.5 vulnerability in KEV is more urgent than a CVSS 9.8 that nobody’s exploiting
• Only ~4% of all CVEs are ever exploited in the wild. KEV identifies which ones
• Organizations using KEV for prioritization reduce their real-world risk more effectively than CVSS-only approaches

The impact: Since launch, KEV has driven measurable improvement in federal patching timelines. It’s also been widely adopted by private sector organizations as a baseline for vulnerability management programs. Many organizations now treat “is it in KEV?” as the first triage question for any new vulnerability.

KEV isn’t perfect — it only includes vulnerabilities CISA has confirmed as exploited, so it can lag behind real-time threat activity. But as a prioritization signal, it’s the best publicly available indicator of what attackers are actually targeting right now.

Critical infrastructure — water, power, gas, transportation — runs on Operational Technology (OT) and Industrial Control Systems (ICS) that were designed decades ago with zero security considerations. Now they’re connected to the internet, and threat actors have noticed.

Notable OT/ICS attacks (2021–2025):

• Unitronics PLCs (Nov 2023) — Iranian-linked CyberAv3ngers compromised internet-exposed Unitronics Vision Series PLCs at multiple U.S. water utilities, including Aliquippa, PA. Default passwords, no authentication
• Colonial Pipeline (May 2021) — DarkSide ransomware shut down the largest fuel pipeline in the eastern U.S. for 6 days, causing widespread gas shortages
• Oldsmar Water Plant (Feb 2021) — attacker accessed the SCADA system via TeamViewer and attempted to increase sodium hydroxide (lye) to dangerous levels
• Sandworm / Ukraine power grid — Russian GRU caused multiple power outages in Ukraine using INDUSTROYER and CRASHOVERRIDE malware targeting ICS protocols

Why OT security is uniquely hard:

• Systems can’t be easily patched (24/7 operations, vendor approval required, legacy OS)
• Protocols (Modbus, DNP3, OPC) have no built-in authentication or encryption
• “Air gaps” rarely exist in practice — IT/OT convergence creates pathways
• Safety systems (SIS) may themselves be vulnerable to attack
• Incidents can cause physical harm: chemical releases, power outages, explosions

CISA has made OT/ICS security a top priority, releasing advisories and free assessment tools. But the fundamental problem remains: critical infrastructure is defended by underfunded teams using equipment that was never designed to be networked.

Every major government in the world buys zero-day exploits. The question is from whom, for how much, and what they do with them.

The exploit market tiers:

• Bug bounty programs (Apple, Google, Microsoft) — $20K–$250K. The “legitimate” channel. Vendors fix the bug
• Exploit brokers (Zerodium, Crowdfense, Operation Zero) — $100K–$2.5M. Buy exploits and resell to government clients. The bug stays unpatched
• Offensive security firms (NSO Group, Intellexa, Candiru) — build turnkey surveillance products using exploit chains. Sell access as a service
• Government CNE programs (NSA TAO, GCHQ, Unit 8200) — develop exploits internally and acquire from brokers

Current public pricing (Zerodium):

• iPhone zero-click full chain: $2,500,000
• Android zero-click full chain: $2,500,000
• Chrome RCE + sandbox escape: $500,000
• Windows zero-click RCE: $1,000,000
• Signal/WhatsApp RCE: $1,500,000

The NSO Group controversy: NSO Group’s Pegasus spyware was found on phones of journalists, human rights activists, and political dissidents across 50+ countries. The U.S. placed NSO on the Entity List (trade blacklist) in 2021. Apple and WhatsApp have sued NSO. Despite this, similar firms continue to operate with government contracts worldwide.

The exploit market creates a perverse incentive: the most valuable vulnerabilities are the ones that stay unpatched the longest. This puts exploit brokers in direct opposition to the security community’s goal of fixing bugs quickly.

Threat intelligence isn’t just “feeds of bad IPs.” It’s a discipline that combines data from multiple sources to understand who is attacking you, how they operate, and what you can do about it.

The essential platforms:

• MITRE ATT&CK — a knowledge base of adversary tactics, techniques, and procedures (TTPs). Maps how real threat groups operate, from initial access through exfiltration. Used to build detection rules, assess gaps, and communicate about threats in a common language
• VirusTotal — a malware analysis platform (owned by Google/Alphabet). Upload a file or hash to check it against 70+ antivirus engines. The intelligence layer (VT Intelligence) lets you hunt for malware campaigns, track infrastructure, and pivot between indicators
• Shodan — a search engine for internet-connected devices. Indexes every public IP, identifying what software/hardware is running. Defenders use it to find their own exposed assets; researchers use it to measure vulnerable populations
• Censys — similar to Shodan but with a focus on TLS certificates and cloud infrastructure. Excellent for mapping organizational attack surfaces
• GreyNoise — differentiates between targeted attacks and background internet noise (mass scanners, botnets). Helps analysts focus on real threats

How defenders use these together:

• Detection engineering: Map ATT&CK techniques to log sources, write detection rules for each technique
• Threat hunting: Use ATT&CK to hypothesize where an adversary might be, then search logs for evidence
• Incident response: Submit malware samples to VT, check C2 infrastructure on Shodan/Censys, map activity to known ATT&CK groups
• Attack surface management: Continuously scan your own infrastructure with Shodan/Censys to find exposed services before attackers do

The democratization of threat intelligence has been one of the biggest improvements in cybersecurity over the past decade. Tools that were once available only to government agencies or large enterprises are now free or affordable for any defender.