CISA confirms it was breached by attackers using Ivanti flaws, some systems taken offline
Two major systems were breached, CISA admits
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
One of the organizations compromised through a recently-discovered flaw in Ivanti products was, ironically enough, the US government’s Cybersecurity and Infrastructure Security Agency (CISA).
Confirmation of the breach came from CISA itself, as well as from an anonymous source “with knowledge of the situation”, with a CISA spokesperson tellingThe Recordthe organization “identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses”.
“The impact was limited to two systems, which we immediately took offline. We continue to upgrade and modernize our systems, and there is no operational impact at this time,” the spokesperson said. As they shared no further details, the publication spoke to an anonymous source familiar with the matter, who claimed that the systems breached, and subsequently turned off, included the Infrastructure Protection (IP) Gateway, and the Chemical Security Assessment Tool (CSAT).
Ivanti’s 2024 woes
The former holds “critical information” about the interdependency of U.S. infrastructure, while the latter holds “private sector chemical security plans”. CSAT holds “some of the country’s most sensitive industrial information”, the publication further claimed, saying that includes the Top Screen tool for high-risk chemical facilities, Site Security Plans, and the Security Vulnerability Assessment.
Unfortunately, we don’t know if this was a ransomware attack, and if the attackers actually stole any of the sensitive data allegedly stored on these endpoints. Furthermore, the identity of the attacks is also unknown, but if it was ransomware, it’s most likely either LockBit, BlackCat (ALPHV), or Cl0p.
News of security flaws in Ivanti products first broke in early January 2024, when the company announced addressing a critical vulnerability in its Endpoint Management Software (EPM), allowing for remote code execution (RCE). In the weeks to come, Ivanti found a handful of additional flaws, which were later found to be abused en-masse, by different threat actors looking to deploy variousmalwareand infostealers.
More from TechRadar Pro
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
Google puts Nvidia on high alert as it showcases Trillium, its rival AI chip, while promising to bring H200 Tensor Core GPUs within days
