FireEye Breach

THE THREAT (Executive Summary):

On December 8^th, FireEye disclosed that they were the victim of a nation-state attack. During their investigation, they discovered that an attacker targeted and accessed certain Red Team assessment tools FireEye used to test their customers’ security. These tools mimic the behavior of known cyber threat actors and fortunately, this disclosure did not include tools to exploit zero-day vulnerabilities or unknown techniques.

FireEye has developed and publicly released approximately 300 countermeasures, aimed at arming the security community at large to defend against the attacks they authored. eSentire has implemented new detection content based on information shared by FireEye. We will continue to monitor the situation and deploy new detection content as necessary.

What we’re doing about it:

• Additional esNETWORK rules have been deployed to identify tools executing against customer environments to supplement existing detection coverage
• esENDPOINT file hashes are being periodically queried and checked against Indicators of Compromise provided by FireEye
• esLOG and esENDPOINT rules are being evaluated for new and refined detection opportunities
• MVS customers – Coverage is provided for 15 of 16 CVEs identified by FireEye. Coverage for CVE-2019-8394 will be available in short order.
• eSentire will be conducting a live webinar on this topic on Thursday December 17th at 11am ET.

What you should do about it:

• Ensure anti-virus signatures are up to date
• MVS customers should review scan reports for the presence of vulnerable systems. These reports can be reviewed by accessing the latest vulnerability reports on the eSentire Insight Portal. MVS Cloud customers can also access reports by accessing their Tenable.io instance or eSentire Insight Portal. Non-MVS customers should review vulnerability scan reports for the presence of vulnerable systems.
• Ensure systems are fully up-to-date to mitigate against known exploits

Additional Information:

Prioritized CVEs by FireEye:

CVE-2019-11510 - Pulse Secure SSL VPNs

CVE-2020-1472 - Microsoft Active Directory

CVE-2018-13379 - Fortinet Fortigate SSL VPN

CVE-2018-15961 - Adobe ColdFusion

CVE-2019-0604 - Microsoft SharePoint

CVE-2019-0708 - Windows Remote Desktop Services

CVE-2019-11580 - Atlassian Crowd

CVE-2019-19781 - Citrix Application Delivery Controller and Citrix Gateway

CVE-2020-10189 - ZoHo ManageEngine Desktop Central

CVE-2014-1812 - Windows

CVE-2019-3398 - Confluence

CVE-2020-0688 - Microsoft Exchange

CVE-2016-0167 - Microsoft Windows

CVE-2017-11774 - Microsoft Outlook

CVE-2018-8581 - Microsoft Exchange Server

CVE-2019-8394 - ZoHo ManageEngine ServiceDesk Plus