Kevin BeaumontApr 13, 2024

PAM provider Delinea, aka Thycotic, had a quiet 5 hour long disruption due to a security incident.

They now have maintenance running for their Secret Server product.

“An endpoint containing a security concern has been identified.”

HT to @matdef

#threatintel

Show threadKevin BeaumontApr 13, 2024
The So What is Delinea Secret Server holds user and system account credentials for orgs, it’s like CyberArk.
Show threadKevin BeaumontApr 13, 2024

Delinea have published IoCs for a security incident in Delinea Secret Server Cloud aka Thycotic. It’s behind a paywall. It’s a vulnerability in their SOAP implementation. No CVE has been assigned, presumably because cloud service. #threatintel

https://support.delinea.com/s/article/KB-010572-How-do-I-remediate-Secret-Server-in-reference-to-the-Secret-Server-SOAP-vulnerability

Show threadÉmilio Gonzalez
@GossiTheDog not affecting on-prem?
Apr 13, 2024 at 7:39pmWeb
Show threadMatDefApr 13, 2024

@res260 @GossiTheDog On prem is affected: https://support.delinea.com/s/article/KB-010572-How-do-I-remediate-Secret-Server-in-reference-to-the-Secret-Server-SOAP-vulnerability

Edit: just realized that it's the same link as above, but can confirm that it contains mitigation instructions.

Show threadfaebudoApr 13, 2024
@matdef @res260 @GossiTheDog
There is some information in their "trust" center: https://trust.delinea.com/?tcuUid=17aaf4ef-ada9-46d5-bf97-abd3b07daae3