The Cybersecurity and Infrastructure Security Agency has issued an advisory concerning the exploitation of a vulnerability within select versions of the Adobe ColdFusion web application development platform that resulted in the compromise of two public-facing servers operated by a federal civilian executive branch agency.
CISA said in its Dec. 5 cybersecurity advisory that each server was illegally accessed in two separate incidents in June, though it is not clear if the same malicious actors are behind both breaches.
CISA documented the tactics, techniques and procedures that the malicious actors employed — including the implanting of software tools and the subsequent attempts to harvest user account credentials — and called on network defenders to monitor for similar activity on their systems.
The agency also recommended several other measures to defend against such attacks, including the continuous scanning of internet-facing systems, the implementation of phishing-resistant multifactor authentication, the enforcement of stringent application control and the patching of software affected by the vulnerability.
