Federal warnings about exposed industrial control systems have gone largely unheeded across the United States, even as critical infrastructure faces mounting pressure from coordinated attacks. Today's security briefing covers persistent vulnerabilities in water systems, novel CPU-level attacks, significant vendor patches, and a major guilty plea in a high-profile extortion campaign.
A comprehensive scan of internet-connected industrial equipment has identified approximately 4,400 exposed programmable logic controllers, with particular concern surrounding 22 units located in cities that have recently experienced water system attacks. These controllers, which manage critical infrastructure operations, continue to operate on public networks despite repeated government advisories about the risks of internet exposure. Source: Despite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed online
The exposed devices create significant security gaps in water distribution and treatment facilities nationwide. The persistence of these vulnerabilities suggests that many organizations have not implemented adequate network segmentation or access controls to protect their operational technology infrastructure from external threats.
Security researchers have discovered a novel speculative execution side-channel attack called TONTOU that successfully circumvents existing mitigations for Spectre v2 vulnerabilities. The attack demonstrates the ability to leak sensitive information, including Linux password hashes, from affected systems by exploiting weaknesses in current processor-level defenses. Source: New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes
This discovery highlights the ongoing challenge of securing hardware-level vulnerabilities and suggests that organizations relying solely on existing Spectre v2 patches may face continued exposure to sophisticated attackers capable of exploiting CPU architecture weaknesses.
Cisco has released security updates addressing twelve vulnerabilities affecting Catalyst SD-WAN and IOS XE Software, including three flaws with a CVSS score of 9.8. The vulnerabilities impact both SD-WAN software regardless of device configuration and IOS XE Software running in autonomous or controller modes, affecting a broad range of network infrastructure deployments. Source: Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.8 CVSS Score Bugs
Organizations operating Cisco networking equipment should prioritize patching these critical flaws to prevent potential unauthorized access and network compromise. The breadth of affected platforms underscores the importance of maintaining current patch management processes across enterprise network infrastructure.
Connor Riley Moucka, a 26-year-old from Kitchener, Ontario, has pleaded guilty to computer fraud and conspiracy charges related to the extortion of more than 165 organizations using Snowflake cloud storage. Moucka also admitted to stealing call and text history records affecting more than 100 million AT&T customers during his criminal activities. Source: Canadian Man Pleads Guilty in Snowflake Extortions
The guilty plea represents a significant development in the prosecution of one of 2024's most consequential cybercrime threat actors and underscores the vulnerabilities that persist in cloud service environments when organizations fail to implement adequate authentication and access controls.
The morning's threat landscape reflects a consistent pattern: critical vulnerabilities persist in both legacy industrial systems and modern cloud infrastructure, while hardware-level attacks continue to evolve beyond existing defenses. Organizations must prioritize vulnerability management, implement defense-in-depth strategies, and maintain vigilance against both emerging and established threat vectors.
Source articles and extracted indicators (defanged where appropriate).
