FireEye Breach Update

As an update from our Wednesday, December 9th, 2020 advisory, eSentire is continuing to closely monitor the situation. eSentire has not observed any indicators of compromise associated with the disclosure of FireEye’s Red Team assessment tools being used maliciously. We have detected numerous routine penetration testing instances using these tools and have alerted appropriately. MVS has been updated to include coverage for all CVE targets identified by FireEye (see below) and we recommend that you continue to review your reports and remediate associated vulnerabilities. We will continue to keep you updated if there are any additional updates. We encourage you to watch the recorded webinar that discusses this topic.

THE THREAT:

On December 14th, FireEye disclosed a global supply chain intrusion campaign based on compromised SolarWinds Orion releases. The compromised releases subsequently masqueraded its traffic as the Orion Improvement Protocol, thereby blending in with legitimate SolarWinds activity to obfuscate the threat actors' activities.

FireEye has developed and publicly released approximately 300 countermeasures, aimed at arming the security community at large to defend against the attacks they authored. eSentire has implemented new detection content based on information shared by FireEye. We will continue to monitor the situation and deploy new detection content as necessary.

What we're doing about it:

• Additional esNETWORK rules have been deployed to identify tools executing against customer environments to supplement existing detection coverage
• esENDPOINT file hashes are being periodically queried and checked against Indicators of Compromise provided by FireEye
• esLOG and esENDPOINT rules are being evaluated for new and refined detection opportunities
• MVS customers – Coverage is provided for all CVEs identified by FireEye
• eSentire has recorded a webinar that covers this topic. Watch it here.

What you should do about it:

• Ensure anti-virus signatures are up to date
• MVS customers should review scan reports for the presence of vulnerable systems. These reports can be reviewed by accessing the latest vulnerability reports on the eSentire Insight Portal. MVS Cloud customers can also access reports by accessing their Tenable.io instance or eSentire Insight Portal. Non-MVS customers should review vulnerability scan reports for the presence of vulnerable systems
• Ensure systems are fully up-to-date to mitigate against known exploits

Additional Information:

Prioritized CVEs by FireEye:

CVE-2019-11510 - Pulse Secure SSL VPNs

CVE-2020-1472 - Microsoft Active Directory

CVE-2018-13379 - Fortinet Fortigate SSL VPN

CVE-2018-15961 - Adobe ColdFusion

CVE-2019-0604 - Microsoft SharePoint

CVE-2019-0708 - Windows Remote Desktop Services

CVE-2019-11580 - Atlassian Crowd

CVE-2019-19781 - Citrix Application Delivery Controller and Citrix Gateway

CVE-2020-10189 - ZoHo ManageEngine Desktop Central

CVE-2014-1812 - Windows

CVE-2019-3398 - Confluence

CVE-2020-0688 - Microsoft Exchange

CVE-2016-0167 - Microsoft Windows

CVE-2017-11774 - Microsoft Outlook

CVE-2018-8581 - Microsoft Exchange Server

CVE-2019-8394 - ZoHo ManageEngine ServiceDesk Plus