CISA Systems Hacked: Ivanti Vulnerabilities Exploited, Urgent Security Measures Advised

Quincy Jon, Tech Times 10 March 2024, 10:03 am

Officials from the Cybersecurity and Infrastructure Security Agency (CISA) recently disclosed a successful hack of the agency's systems in February that involved hackers taking advantage of flaws in Ivanti products.

The CISA spokesperson confirmed this security incident, revealing that the agency detected suspicious activities pointing to exploiting Ivanti product vulnerabilities approximately a month ago, as reported by Recorded Future News.

The impact of the CISA breach was contained in two specific systems and swiftly taken offline as part of immediate response measures. Emphasizing the ongoing efforts to modernize and upgrade systems, the spokesperson assured that there is currently no operational impact.

The Impact of the CISA Cyber Breach

According to a person with knowledge, the hacked systems were the Infrastructure Protection (IP) Gateway and the Chemical Security Assessment Tool (CSAT). These two systems held important data about how U.S. infrastructure is interdependent and private sector chemical security plans. CISA has neither confirmed nor denied this information.

CSAT, recognized for storing susceptible industrial data, including tools for high-risk chemical facilities, site security plans, and security vulnerability assessments, was a focal point of the breach.

In this photo illustration a young man types on an illuminated computer keyboard typically favored by computer coders on January 25, 2021 in Berlin, Germany. 2020 saw a sharp rise in global cybercrime that was in part driven by the jump in online retailing that ensued during national lockdowns as governments sought to rein in the coronavirus pandemic. (Photo : Sean Gallup/Getty Images)

In response to the incident, CISA advised enterprises to study a Feb.29 alert warning of actively exploiting Ivanti Connect Secure and Ivanti Policy Secure gateway vulnerabilities. The vulnerabilities are CVE-2023-46805, 2024-21887, and 2024-21893.

"This is a reminder that any organization can be affected by a cyber vulnerability, and having an incident response plan in place is a necessary component of resilience," the CISA spokesperson noted.

The CISA is a Department of Homeland Security component that investigates federal agency cyber thefts and advises commercial critical infrastructure organizations on protection.

The cybercriminals behind the intrusion are unknown. The CISA cyberattack targeted weaknesses in commonly used virtual private networking software from Ivanti, a Utah-based IT company. Hackers stole Ivanti device credentials and, in some circumstances, compromised the domain.

Many governments use Ivanti's mobile endpoint management software, but various flaws have allowed hackers to remotely access victims' identities, phone numbers, and other mobile device details. CISA warned last year that an attacker could create an administrative account to make further configuration modifications to a susceptible machine.

CISA has urged government agencies and private companies to upgrade their software or take other precautions for weeks. This urgent advice follows hackers' widespread use of Ivanti's product vulnerabilities.

Foreign Cybercriminals Possibly Involved

According to a CNN report, sources claim that a Chinese spy organization exploits these weaknesses. The CISA cyber breach incident emphasizes the gravity of the problem and the necessity for immediate action to address government and business cybersecurity concerns.

TechTimes reported that CISA confirmed cyberattacks on multiple agencies exploiting a flaw in Progress Software's business file transfer application, MOVEit Transfer. The Clop ransomware gang, linked to Russia, claimed responsibility for these attacks and notably disclosed the names of compromised companies.

The Department of Energy (DoE) acknowledged two affected institutions and promptly took measures to limit exposure to the vulnerability.