Police bust accuses 37 of being cyber criminals that stole identities, credit card numbers and pin codes; seize LabHost site on Dark Web

Police bust cyber gang accused of worldwide fraud (msn.com)

Palo Alto updates patching guidance for command injection vulnerability

https://security.paloaltonetworks.com/CVE-2024-3400

This is a command injection vulnerability that enabled an unauthenticated attacker to execute code with root privileges. POC has been released publicly.

Device telemetry does not need to be enabled for PAN-OS firewalls to be exposed to attacks related to this vulnerability.

You can verify whether you have a GlobalProtect gateway or GlobalProtect portal configured by checking for entries in your firewall web interface (Network > GlobalProtect > Gateways or Network > GlobalProtect > Portals).

https://unit42.paloaltonetworks.com/cve-2024-3400

VPN brute force attacks: Your logs are full of them (guaranteed)

https://www.bleepingcomputer.com/news/security/cisco-warns-of-large-scale-brute-force-attacks-against-vpn-services

Make sure you are using MFA for every account that has remote access and check all remote access points; not just VPNs.

Not April Fools: Duo (Cisco) MFA service breached… via phishing scheme

https://www.darkreading.com/cyberattacks-data-breaches/cisco-duo-multifactor-authentication-service-breached

https://app.securitymsp.cisco.com/e/es?s=4673582&e=2785&elqTrackId=EF815608FCE191E1D3FAAE7B0376C832&elq=bd1c1886a59e40c09915b029a74be94e&elqaid=112&elqat=1

Customer Advisory

CVE-2024-3400: Volexity warns of Zero-day exploitation of Palo Alto device vulnerability in GlobalProtect feature over versions of PAN-OS.

Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)

Patches are available for the varied versions of PAN-OS

CISA: Weakness in Chirp Systems may pose problems for “smart lock” homes.

https://krebsonsecurity.com/2024/04/crickets-from-chirp-systems-in-smart-lock-key-leak