Storm⚡️Watch | Digi Cert's Certificate Revocation, VMware ESXi Vulnerability, and North Korean Espionage
Summary: DigiCert is revoking certificates with less than 24 hours' notice due to a validation issue affecting about 0.4% of its domain validations, potentially impacting thousands of SSL certs and causing outages worldwide starting July 30 at 19:30 UTC. Separately, ransomware operators including Storm-0506 and Storm-1175 are exploiting CVE-2024-37085 in VMware ESXi hypervisors to gain full administrative access and deploy Akira and Black Basta, while North Korean hackers tracked as Anadriel or APT45 target defense and engineering firms in the US, UK, South Korea, Japan and India to steal classified military intelligence.
What's compelling: A 24-hour revocation window on thousands of certificates is an outage scheduled for July 30 at 19:30 UTC, and Microsoft reports incidents targeting ESXi hypervisors have doubled over the past three years - the same hypervisors ransomware crews are using to gain full administrative access.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-37085
- Related
- CVE-2024-37085: VMware ESXi Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Jul 30, 2024