Security Community

Who: • Hacker targeting PowerSchool, a K-12 education tech provider. • Over 62.4 million students and 9.5 million teachers reportedly affected. What: • Threat actor used stolen credentials to access PowerSchool’s PowerSource customer portal. • Leveraged a maintenance tool to download student and teacher data from PowerSIS databases. • Exfiltrated data includes Social Security Numbers, medical records, and grades (varies by district). • PowerSchool paid a ransom to prevent the public leak of stolen data. Impact: • 6,505 school districts across the U.S., Canada, and other regions affected. • Largest affected districts include Toronto District School Board, Dallas ISD, and Peel District School Board. • PowerSchool claims over three-quarters of impacted individuals did not have Social Security Numbers exposed. • Data exposure risks identity theft, financial fraud, and reputational harm. Mitigation: • PowerSchool is offering: • Two years of free identity protection and credit monitoring for affected individuals. • Notification assistance to stakeholders, including state attorneys general and impacted districts. • Customers urged to monitor PowerSchool’s dedicated public update site for developments. Read the full article HERE

Who: • Threat actors linked to Black Basta ransomware and potentially FIN7/Sangria Tempest. • Groups tracked as STAC5143 and STAC5777 identified by Sophos. What: • Attackers use email bombing followed by posing as IT support in Microsoft Teams calls. • Victims are tricked into granting remote access via Microsoft Teams or installing malware. • Malware used includes: • Java archive (JAR) files and Python scripts (RPivot backdoor). • Malicious DLLs (e.g., nethost.dll, winhttp.dll) sideloaded through legitimate software. • Techniques include keylogging, credential harvesting, and network reconnaissance. • Final stage likely involves data theft and ransomware deployment. Impact: • Compromises systems via remote control, enabling data theft and lateral network movement. • Black Basta ransomware deployment observed, signaling potential for severe organizational disruptions. • Uses default Microsoft Teams settings and Quick Assist for hands-on control. • Victims' sensitive documents and credentials targeted for exploitation. Mitigation: • Block external domains from initiating messages and calls in Microsoft Teams. • Disable Microsoft Quick Assist on critical systems. • Monitor and restrict access to external file-sharing services like SharePoint and Azure Blob Storage. Read the full article HERE

What: • Attackers gained unauthorized access to management interfaces of FortiGate firewalls, creating super admin accounts, altering configurations, and setting up SSL VPN access. • Exploitation involved DCSync techniques for credential extraction and lateral movement. • Vulnerability affects FortiOS (versions 7.0.0–7.0.16, 7.2.0–7.2.12) and FortiProxy (versions 7.0.0–7.0.19, 7.2.0–7.2.12). • CVE-2024-55591 has a critical CVSS score of 9.6. Impact: • Widespread, opportunistic targeting with no specific sector focus. • Attackers used crafted requests via Node.js websocket to gain super-admin privileges. • Victims' networks were compromised, enabling attackers to extract credentials, create accounts, and manipulate firewall policies. • Organizations with exposed firewall management interfaces are at significant risk. Mitigation: • Upgrade to patched firmware: • FortiOS 7.0.17 or above, 7.2.13 or above. • FortiProxy 7.0.20 or above, 7.2.13 or above. • Restrict public access to firewall management interfaces and limit to trusted users. Read the full article HERE