US CISA Breached by Hackers

Uploaded on 2024-03-14 in FREE TO VIEW, TECHNOLOGY--Hackers

Hackers breached the systems run by the US Cybersecurity and Infrastructure Security Agency (CISA) and these were hacked in February by hackers using bugs in Ivanti products.

And the CISA has now confirmed two of its internal systems were breached by a threat actor that exploited flaws in Ivanti products used by the US cyber security agency.

Ivanti appliances have been under sustained attack this year from multiple threat groups, including at least one cyber group from China.

Since January, the vendor has issued patches for 5 problems affecting its Connect Secure, Policy Secure, and Neurons for Zero Trust Access products.

The day before CISA confirmed two of its systems were breached, Check Point researchers identified a new threat group, called Magnet Goblin, as the latest cyber gang observed abusing the bugs to attack Connect Secure appliances.

“About a month ago CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses," a CISA spokesperson said in a statement supplied to media over the weekend.

“The impact was limited to two systems, which we immediately took offline. We continue to upgrade and modernise our systems, and there is no operational impact at this time.”

The breach was first reported by The Record, a news site by cyber security firm Recorded Future. Citing a source with knowledge of the situation, The Record said the CISA systems that hackers breached were the Infrastructure Protection (IP) Gateway and the Chemical Security Assessment Tool (CSAT).

The IP Gateway was officially renamed the CISA Gateway in 2020 and is a web portal used to collect, analyze, and disseminate government information about critical infrastructure. Similarly, CSAT is a portal for information about chemical facilities.

CISA declined to confirm or deny whether the two portals were the systems taken offline as a result of the breach.

“This is a reminder that any organisation can be affected by a cyber vulnerability and having an incident response plan in place is a necessary component of resilience,” the agency’s spokesperson said.

CISA said organisations should review an Advisory Notice it issued with several partner agencies on Feb. 29 regarding the Ivanti vulnerabilities.

The advisory said that organisations might not detect breaches because threat actors were able to deceive Ivanti’s internal and external Integrity Checker Tool (ICT).

As a result, CISA and its partner agencies said they “strongly urge all organizations to consider the significant risk of adversary access to, and persistence on, Ivanti Connect Secure and Ivanti Policy Secure gateways when determining whether to continue operating these devices in an enterprise environment."

Meanwhile, Check Point researchers said their tracking of “the recent wave of Ivanti exploitation” resulted in the discovery of a threat actor they called Magnet Goblin, a financially motivated gang adept at leveraging 1-day vulnerabilities, bugs that have been disclosed but not yet patched.

Two earlier vulnerabilities prompted CISA to order all federal civilian agencies in the US to disconnect Ivanti Connect Secure and Policy Secure products by February 2. CISA later updated its advisory on February 9 to say that products could be turned back on after they were patched.

__________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.