The Hackle Box | May 2024: Police Troll LockBit, Microsoft Holds Execs Accountable for Security

### Overview In this May 2024 episode of *The Hackle Box*, hosts Oscar and Pinky discuss recent high-profile cybersecurity news, incident response observations, and industry challenges. They open by highlighting Mental Health Awareness Month in security before examining vendor vulnerability disclosure practices, targeted social engineering campaigns by Iranian threat actors, Microsoft's new executive accountability policies following regulatory scrutiny, shadow AI adoption driven by workplace burnout, and law enforcement actions against LockBit.

### Key Topics - **Mental Health Awareness Month:** The hosts discuss recognizing burnout and stress in cybersecurity operations, the importance of peer support, taking breaks, and structured wellness initiatives like mental health bingo and meditation apps. - **Citrix Flaw & Vulnerability Disclosure Practices:** Oscar and Pinky critique Citrix's handling of an unauthenticated out-of-bounds memory vulnerability discovered by Bishop Fox. Citrix quietly addressed the issue in NetScaler update 13.1-51.15 without issuing a CVE, leaving network defenders unaware of the need to patch edge devices. - **Vendor Shifts & Broadcom:** The discussion touches on concerns surrounding transparency and licensing changes, referencing Broadcom's acquisition of VMware, rumors regarding CVE accessibility for customers, and Broadcom abruptly terminating Carbon Black's incident response partner licensing program. - **APT42 (DamselFly) Social Engineering:** A detailed breakdown of APT42's highly patient spear-phishing campaigns. Masquerading as journalists or event organizers, the Iranian threat group builds rapport with targets in academic, legal, media, and activist sectors before deploying credential harvesting pages that mimic Microsoft 365, Google, Yahoo, and Citrix. Stolen access may be passed to the affiliated APT35 (Charming Kitten). - **Microsoft Executive Accountability & Basic Hygiene:** Microsoft tied executive compensation directly to meeting security goals after a Department of Homeland Security (DHS) report heavily criticized its security posture following an Exchange Online compromise. Cloud and network remediation plans include automatic key rotation, tenant isolation, zero trust for source code, software inventory tracking, and full network segmentation. - **Burnout and Shadow AI:** Discussing recent reports (including from Wired), the hosts examine how tech layoffs and escalating workloads drive over 70% of surveyed workers across generations to use unauthorized AI tools to keep up with work, introducing data leakage risks. - **Law Enforcement Operation Against LockBit:** US authorities indicted LockBit ringleader Dmitry Khoroshev (alongside Artur Sungatov and Ivan Kondratyev) and seized LockBit infrastructure. Law enforcement publicly trolled the ransomware syndicate by parodying LockBit's leak site with countdown timers and press releases.

### Technical Details - **Citrix Memory Issue:** Bishop Fox reported an unauthenticated out-of-bounds memory flaw in January, acknowledged by Citrix in February. If exploited, an attacker could access memory segments holding HTTP request data and post requests containing credentials. - **APT42 Tactics:** Attackers rely on typosquatted domains imitating services like Dropbox, Google Meet, YouTube, and LinkedIn, as well as evil proxy setups to harvest credentials for data exfiltration. - **Defensive Recommendations:** Organizations should use tools such as DNS Twist and URLCrazy to discover and proactively acquire typosquatted variations of their corporate domains or block them at network ingress points.

### Takeaways - Silent patching and withholding CVEs reduce visibility and leave edge systems like NetScalers unpatched and vulnerable. - Foundations matter: even multitrillion-dollar enterprises can fall behind on basic controls like network segmentation and software asset management. - Organizations must balance policy enforcement with employee support, providing education on secure AI usage and proactive defense against patient social engineering.