Threat Advisory: NSA SVR Advisory Coverage

Summary: The U.S. National Security Agency released an advisory outlining five CVEs that the Russian Foreign Intelligence Service (SVR) is exploiting in the wild, covering VPN solutions, collaboration suite software and virtualization technologies. The advisory formally attributes the SolarWinds supply chain attack to the SVR group, and Cisco Talos notes that all five CVEs are patched, some have working Metasploit modules, and some exploit applications using SSL, so SSL decryption should be enabled in Cisco Secure Firewall and Snort to detect exploitation.
What's compelling: The SVR is the actor the U.S. has now formally tied to SolarWinds, and it is working from a five-CVE toolkit that includes VPN credential theft and private key disclosure - with working Metasploit modules already circulating, the gap between patch availability and exploitation is measured in hours, not weeks.

Read the original at Cisco Talos ↗

Topics: Supply Chain & AppSec
Mentions: CVE-2018-13379 CVE-2019-11510 CVE-2019-19781 CVE-2019-9670 CVE-2020-4006 CVE-2026-20127
Related: Threat Advisory: Pulse Secure Connect Coverage Cyber Risks ·
New Snort rules protect against recently discovered Citrix vulnerability Cyber Risks ·
Fire Eye Breach Detection Guidance Cyber Risks ·