TECHBOARD #3: Ransomware Disrupts Japanese Cloud Provider, Attackers Breach Ivanti VPN Without Authentication

Real-World Hacks

A ransomware attack on cloud provider IDC Frontier disrupted services for 495 organizations. The attack affected four IDCF Cloud zones operated by the Japanese provider. IDC Frontier initially warned that some customer data might be unrecoverable, raising concerns about the availability of cloud backups.

According to IDC Frontier's updated statement, the situation later improved somewhat, with snapshots preserved for 194 of the 495 affected customers. The remaining customers must rely on their own backups to recover their data. Although the backup service was restored on October 18, this did not mean that all affected systems had been recovered.

The incident highlights a fundamental limitation of cloud infrastructure: the cloud is not immune to compromise, and a snapshot is not necessarily a secure backup. If attackers compromise a provider's infrastructure, they may put both production data and recovery mechanisms at risk.

Czech online grocery retailer Rohlik suffered a breach of customer support communications, including sensitive information. An attacker compromised a customer support platform and accessed names, contact details, and records of customer conversations and phone calls. Some customers had also disclosed passwords or payment information during these interactions. Rohlik confirmed that its authentication and payment systems had not been compromised. However, the stolen conversations could be used to make fraudulent phone calls far more convincing.

An attacker accessed records covering 8.8 million people from Denmark's Central Person Register (CPR) through an external supplier's account. According to The Register, the individual claiming responsibility gained access through an account protected by the password "123456". Approximately 14 million automated queries were made between September 10 and 20. The suspicious activity was not discovered until October 2, when a government employee noticed an invoice reflecting unusually high activity.

Vulnerability Watch

Attackers exploited a chain of three zero-day vulnerabilities to compromise a fully patched Ivanti VPN appliance. Security researchers at Volexity observed active exploitation beginning on October 3. The targeted appliance was running version 22.8R2.4, which was fully up to date at the time. By chaining the vulnerabilities, attackers were able to execute code with root privileges without authentication.

The initial exploit took advantage of a mismatch between URL-based access controls and request routing determined by the X-DSCGI-PATH HTTP header. This allowed attackers to reach a protected CGI script. They then exploited a race condition involving file uploads and deletion. Privilege escalation to root was achieved by temporarily modifying a library in memory and manipulating the DSCache configuration trusted by a privileged service.

Notably, the attackers did not need to maintain a persistent webshell. After executing their commands, they reversed the in-memory modifications and deleted logs, potentially avoiding detection even by Ivanti Integrity Checker. They then searched for domain credentials, LAPS passwords, and BitLocker recovery keys.

Microsoft patched a record 1,411 vulnerabilities, including three zero-days. One of them, CVE-2026-96951, was being actively exploited to bypass Mark of the Web protections. The other two had already been publicly disclosed. The update also introduced stricter handling of NTLMv1. Unless the BlockNtlmSSO setting is configured, Windows now blocks NTLMv1 for single sign-on. This may disrupt Wi-Fi, Ethernet, or VPN connectivity in environments that still rely on NTLMv1. The behavior is an intentional security change, not a software bug.

A PAN-OS vulnerability allows an authenticated attacker to gain root privileges on a firewall. CVE-2026-0322 affects the management interfaces of Palo Alto Networks firewalls and Panorama. The vendor has confirmed limited exploitation in the wild. Organizations should prioritize patching affected systems and restricting access to device management interfaces.

AI/LLM News

Attackers are beginning to hide instructions for AI agents inside HTTP headers, where they remain invisible to users browsing a website. Researchers at Signals Corps analyzed 217 million web responses and identified AI-targeted headers on 7,959 websites. Thirty contained prompt injection attempts, 22 of which were jokes. These instructions can influence an AI model only if the tool passes the headers to the model and the agent's instructions grant the website sufficient authority.

CITADELO NEWS

BitLocker encryption does not always guarantee data security when an attacker has physical access to a device. Our article on BitLocker security explores vulnerabilities and attack techniques that can undermine the protection of encrypted drives.

Industrial systems continue to lag significantly behind in cybersecurity maturity. Our article on OT security explains why IT/OT segmentation, secure remote access, and carefully planned penetration testing are essential for protecting industrial environments.

Could Your Infrastructure Withstand a Similar Attack?

Even fully updated systems may contain vulnerabilities that allow attackers to gain access to corporate networks. Citadelo's penetration testing services help identify security weaknesses before attackers can exploit them.