The Hackle Box | July 2024: TeamViewer Attack, Zero-Click Outlook Vulnerability, Ivanti Systems

### Overview In this July 2024 episode of The Hackle Box, hosts Oscar and Pinky discuss recent high-profile cybersecurity incidents, recurring defensive challenges, and active threat actor methodologies. With co-host Eric absent, the discussion centers on the TeamViewer corporate network compromise, critical security fundamentals outlined in CISA guidance, two newly disclosed zero-click Microsoft Outlook remote code execution vulnerabilities, the fallout from Ivanti VPN zero-days including CISA's mitigation decisions, and the rapid attack speeds observed in Akira ransomware deployments.

### Key Topics - **TeamViewer Compromise & Defense-in-Depth:** Analysis of the breach of TeamViewer's internal corporate network, highlighting how network segmentation prevented attacker lateral movement into customer-facing environments. The hosts emphasize defense-in-depth principles, noting that while attackers must succeed across multiple steps to reach exfiltration or encryption, defenders only need to catch an anomaly once to disrupt an attack. - **CISA Top Misconfigurations & Security Fundamentals:** A review of common architectural weaknesses that lead to breaches without requiring expensive tooling, including default configurations (such as standard Active Directory installations), improper privilege separation, lack of comprehensive asset/software inventories, weak or misconfigured MFA implementations, social engineering against help desks, insufficient network share ACLs, and unrestricted code execution. - **Zero-Click Outlook RCE Vulnerabilities:** Discussion of two high-severity remote code execution flaws reported by Morphisec (confirmed by Microsoft in April with patches released in July). The vulnerabilities require zero clicks and can trigger upon viewing or previewing emails under specific conditions, such as coming from a valid Exchange account or a sender in the trusted senders list. The hosts critique Morphisec holding technical exploit details and IOCs until Defcon while patches are already subject to reverse engineering. - **Ivanti Gateway Exploits & CISA Systems Shutdown:** Analysis of authentication bypass and code injection zero-days in Ivanti VPN gateways used to establish persistent backdoors and harvest Active Directory credentials. The hosts discuss CISA's decision to take Ivanti systems offline, the friction between CISA and Ivanti regarding mitigations, and the broader dilemma of recurring edge-device vulnerabilities disrupting remote work operations. - **Akira Ransomware Operations:** A breakdown of Akira's rapid operational tempo, leveraging vulnerable VPNs for initial access, scanning environments with Advanced IP Scanner, using AnyDesk for remote access, and deploying Rclone, FileZilla, and WinRAR for data exfiltration before targeting VMware hypervisors (vmdk files) for encryption.

### Technical Details - **Outlook Vulnerabilities:** Identified as high severity (CVSS ratings discussed around 8.8 and 7.7) zero-click RCE flaws. Exploitation conditions discussed include incoming mail originating from a valid Exchange account or an entity on the trusted senders list, with potential triggering occurring via the Outlook preview pane. - **Ivanti Exploit Chain:** Involved initial authentication bypass combined with code injection to achieve arbitrary code execution and drop backdoors, facilitating domain credential harvesting on integrated Active Directory systems. Staggered vendor patching and insufficient initial mitigation workarounds left gateways exposed to bypasses. - **Akira Ransomware Metrics & Tooling:** Host incident response cases observed dwell times as short as 11 hours from initial compromise to full encryption, with exfiltration occurring within 2 hours. Common attacker tooling includes AnyDesk (remote access), Advanced IP Scanner (internal reconnaissance), Rclone, FileZilla, and WinRAR (data packaging and exfiltration), culminating in hypervisor-level VMware ESXi/vmdk encryption.

### Takeaways - **Segment and Isolate:** Strong network segmentation between corporate operations and critical client/production networks remains essential to contain breaches. - **Prioritize Out-of-Band Patching:** Organizations must urgently deploy July security updates for Microsoft Outlook, as threat actors will patch-diff released fixes to reverse engineer exploits ahead of public conference disclosures. - **Prepare Edge Device Redundancy:** Organizations should evaluate architectural resilience for external gateways—such as considering multi-technology VPN vendors or jump box topologies—to handle situations where internet-facing devices must be taken offline due to unpatched zero-days. - **Audit Fundamentals & Monitor Exfiltration Tools:** Conduct regular audits of privileged accounts, enforce conditional access and FIDO2/authenticator app MFA, and alert immediately on unexpected deployments of AnyDesk, Advanced IP Scanner, Rclone, WinRAR, or FileZilla.