Dropbox files notice of breach with SEC

https://www.sec.gov/Archives/edgar/data/1467623/000146762324000024/dbx-20240429.htm

At the very least, the actor(s) was able to obtain hashed passwords, OAUTH tokens, some MFA, phone numbers and API keys. They noticed this on April 24, 2024 according to the 8-K filed with the SEC

The investigation is continuing… AKA change passwords and inventory your data so you are prepared to evaluate your risk

Police bust accuses 37 of being cyber criminals that stole identities, credit card numbers and pin codes; seize LabHost site on Dark Web

Police bust cyber gang accused of worldwide fraud (msn.com)

Palo Alto updates patching guidance for command injection vulnerability

https://security.paloaltonetworks.com/CVE-2024-3400

This is a command injection vulnerability that enabled an unauthenticated attacker to execute code with root privileges. POC has been released publicly.

Device telemetry does not need to be enabled for PAN-OS firewalls to be exposed to attacks related to this vulnerability.

You can verify whether you have a GlobalProtect gateway or GlobalProtect portal configured by checking for entries in your firewall web interface (Network > GlobalProtect > Gateways or Network > GlobalProtect > Portals).

https://unit42.paloaltonetworks.com/cve-2024-3400

VPN brute force attacks: Your logs are full of them (guaranteed)

https://www.bleepingcomputer.com/news/security/cisco-warns-of-large-scale-brute-force-attacks-against-vpn-services

Make sure you are using MFA for every account that has remote access and check all remote access points; not just VPNs.

Not April Fools: Duo (Cisco) MFA service breached… via phishing scheme

https://www.darkreading.com/cyberattacks-data-breaches/cisco-duo-multifactor-authentication-service-breached

https://app.securitymsp.cisco.com/e/es?s=4673582&e=2785&elqTrackId=EF815608FCE191E1D3FAAE7B0376C832&elq=bd1c1886a59e40c09915b029a74be94e&elqaid=112&elqat=1

Customer Advisory

CVE-2024-3400: Volexity warns of Zero-day exploitation of Palo Alto device vulnerability in GlobalProtect feature over versions of PAN-OS.

Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)

Patches are available for the varied versions of PAN-OS

CISA: Weakness in Chirp Systems may pose problems for “smart lock” homes.

https://krebsonsecurity.com/2024/04/crickets-from-chirp-systems-in-smart-lock-key-leak

Domain controllers crashing after March updates? Uninstalling KB5035855 and KB5035857 may help

https://www.bleepingcomputer.com/news/microsoft/new-windows-server-updates-cause-domain-controller-crashes-reboots

Russian actors “all up in” Microsoft’s business; accesses source code. Is this anything new?

https://www.independent.co.uk/news/world/americas/microsoft-russia-hackers-b2510319.html

SQL Injection vulnerability in Ivanti endpoint Manager is patched

https://www.bankinfosecurity.com/ivanti-patches-critical-endpoint-security-vulnerability-a-24046