CISA Cybersecurity Alerts

CISA and the US Coast Guard Cyber Command are releasing this joint Cybersecurity Advisory to warn network defenders that cyber threat actors, including state-sponsored APT actors, have continued to exploit CVE-2021-44228 (Log4Shell) in VMware Horizon and Unified Access Gateway servers to obtain initial access to organizations that did not apply available patches or workarounds.

AA22-174A Alert, Technical Details, and Mitigations

Malware Analysis Report 10382254-1 stix

Malware Analysis Report 10382580-1 stix

CISA’s Apache Log4j Vulnerability Guidance webpage

Joint CSA Mitigating Log4Shell and Other Log4j-Related Vulnerabilities

CISA’s database of known vulnerable services on the CISA GitHub page

See National Security Agency (NSA) and Australian Signals Directorate (ASD) guidance Block and Defend Web Shell Malware for additional guidance on hardening internet-facing systems.

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Learn more about your ad choices. Visit megaphone.fm/adchoices

This joint Cybersecurity Advisory describes the ways in which People’s Republic of China state-sponsored cyber actors continue to exploit publicly known vulnerabilities in order to establish a broad network of compromised global infrastructure. These actors use the network to exploit a wide variety of targets worldwide, including public and private sector organizations.

AA22-158A Alert, Technical Details, and Mitigations

Refer to China Cyber Threat and Advisories, Internet Crime Complaint Center, and NSA Cybersecurity Guidance for previous reporting on People’s Republic of China state-sponsored malicious cyber activity.

US government and critical infrastructure organizations should consider signing up for CISA’s cyber hygiene services, including vulnerability scanning, to help reduce exposure to threats.

US Defense Industrial Base organizations should consider signing up for the NSA Cybersecurity Collaboration Center’s DIB Cybersecurity Service Offerings, including Protective Domain Name System (PDNS) services, vulnerability scanning, and threat intelligence collaboration. For more information on eligibility criteria and how to enroll in these services, email [email protected].

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Learn more about your ad choices. Visit megaphone.fm/adchoices

Malicious cyber actors are exploiting multiple critical vulnerabilities in VMware products. Successful exploitation permits malicious actors to trigger a server-side template injection that may result in remote code execution or escalation of privileges to root level access. CISA has updated this alert with additional indicators of compromise, detection signatures, and threat actor TTPs from trusted third parties to assist administrators with detecting and responding to this activity.

AA22-138B Alert, Technical Details, and Mitigations

AA22-138B.stix

Emergency Directive 22-03 Mitigate VMware Vulnerabilities

VMware Security Advisory VMSA-2022-0011

VMware Security Advisory VMSA-2022-0014

Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others)

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Learn more about your ad choices. Visit megaphone.fm/adchoices

The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Department of the Treasury (Treasury), and the Financial Crimes Enforcement Network (FinCEN) are releasing this joint Cybersecurity Advisory to provide information about the Karakurt data extortion group, also known as the Karakurt Team and Karakurt Lair. Karakurt actors have employed a variety of TTPs, creating significant challenges for defense and mitigation. Karakurt victims have not reported encryption of compromised machines or files; rather, Karakurt actors claim to steal data and threaten to auction it or release it to the public unless they receive payment.

AA22-152A Alert, Technical Details, and Mitigations

CISA-Multi-State Information Sharing and Analysis Center (MS-ISAC) Joint Ransomware Guide

Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events. Stopransomware.gov 

CISA's Ransomware Readiness Assessment

CISA's cyber hygiene services

FinCEN Advisory to Financial Institutions on Cyber-Events and Cyber-Enabled Crime

FinCEN Advisory on Ransomware and the Use of the Financial System to Facilitate Ransom Payments

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Learn more about your ad choices. Visit megaphone.fm/adchoices

CISA is releasing this cybersecurity advisory to warn organizations that malicious cyber actors are exploiting CVE-2022-22954 and CVE-2022-22960. These vulnerabilities affect versions of VMware products. Successful exploitation permits malicious actors to trigger a server-side template injection that may result in remote code execution or escalation of privileges to root level access. Based on this activity, CISA expects malicious cyber actors to quickly develop a capability to exploit newly released VMware vulnerabilities CVE-2022-22972 and CVE-2022-22973 in the same impacted VMware products.

AA22-138B Alert, Technical Details, and Mitigations

AA22-138B.stix

Emergency Directive 22-03 Mitigate VMware Vulnerabilities

VMware Security Advisory VMSA-2022-0011

VMware Security Advisory VMSA-2022-0014

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Learn more about your ad choices. Visit megaphone.fm/adchoices

CISA and the Multi-State Information Sharing & Analysis Center (MS-ISAC), are releasing this joint Cybersecurity Advisory in response to active exploitation of CVE-2022-1388. This vulnerability is a critical iControl REST authentication bypass vulnerability affecting multiple versions of F5 Networks BIG-IP. 

AA22-138A Alert, Technical Details, and Mitigations

F5 Security Advisory K23605346 and indicators of compromise

F5 guidance K11438344 for remediating a compromise

Emerging Threats suricata signatures

Palo Alto Networks Unit 42 Threat Brief: CVE-2022-1388. This brief includes indicators of compromise. 

Cisco Talos Intelligence Group - Comprehensive Threat Intelligence: Threat Advisory: Critical F5 BIG-IP Vulnerability. This blog includes indicators of compromise. Note: due to the urgency to share this information, CISA and MS-ISAC have not yet validated this content.

Randori’s bash script. This script can be used to identify vulnerable instances of BIG-IP. Note: MS-ISAC has verified this bash script identifies vulnerable instances of BIG-IP. 

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Learn more about your ad choices. Visit megaphone.fm/adchoices

This joint cybersecurity advisory was coauthored by the cybersecurity authorities of the US, Canada, New Zealand, the Netherlands, and the UK. Cyber actors routinely exploit poor security configurations, weak controls, and other poor cyber hygiene practices to gain initial access or as part of other tactics to compromise a victim’s system. This joint Cybersecurity Advisory identifies commonly exploited controls and practices, and includes best practices to mitigate these risks.

AA22-137A Alert, Technical Details, and Mitigations

White House Executive Order on Improving the Nation’s Cybersecurity

NCSC-NL Factsheet: Prepare for Zero Trust

NCSC-NL Guide to Cyber Security Measures

N-able Blog: Intrusion Detection System (IDS): Signature vs. Anomaly-Based

NCSC-NL Guide to Cyber Security Measures

National Institute of Standards and Technology SP 800-123 – Keeping Servers Secured

NCSC-UK Guidance – Phishing Attacks: Defending Your Organisation 

Open Web Application Security Project (OWASP) Proactive Controls: Enforce Access Controls

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Learn more about your ad choices. Visit megaphone.fm/adchoices

The cybersecurity authorities of the UK, Australia, Canada, New Zealand, and the US have observed a recent increase in malicious cyber activity against managed service providers (MSPs). Allied cybersecurity authorities expect state-sponsored cyber actors to increase their targeting of MSPs in an attempt to exploit provider-customer trust relationships. This advisory includes security guidance tailored for both MSPs and their customers. 

AA22-131A Alert, Technical Details, and Mitigations

Technical Approaches to Uncovering and Remediating Malicious Activity

Mitigations and Hardening Guidance for MSPs and Small- and Mid-sized Businesses

APTs Targeting IT Service Provider Customers

ACSC's Managed Service Providers: How to manage risk to customer networks 

Global Targeting of Enterprise Managed Service Providers

Cyber Security Considerations for Consumers of Managed Services 

How to Manage Your Security When Engaging a Managed Service Provider

Kaseya Ransomware Attack: Guidance for Affected MSPs and their Customers

Baseline Cyber Security Controls for Small and Medium Organizations

Actions to take when the cyber threat is heightened

Top 10 IT Security Action Items to Protect Internet Connected Networks and Information

CCCS's Alert: Malicious Cyber Activity Targeting Managed Service Providers 

CISA Cybersecurity Alert: APT Activity Exploiting MSPs (2018)

CISA Cyber Essentials and CISA Cyber Resource Hub 

Improving Cybersecurity of Managed Service Providers 

Shields Up Technical Guidance

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Learn more about your ad choices. Visit megaphone.fm/adchoices

The US government attributes cyberattacks on satellite communication (SATCOM) networks to Russian state-sponsored malicious cyber actors. The FBI and CISA are aware of possible threats to US and international SATCOM networks. Intrusions into SATCOM networks could create risk in customer environments.

AA22-076A Alert, Technical Details, and Mitigations

Attribution of Russia’s Malicious Cyber Activity Against Ukraine

CISA Shields Up Technical Guidance

NSA Cybersecurity Advisory: Protecting VSAT Communications 

NSA Cybersecurity Tech-Rep: Network Infrastructure Security Guidance

Annual Threat Assessment of the U.S. Intelligence Community, February 2022

CISA Tip: Choosing and Protecting Passwords 

CISA Capacity Enhancement Guide: Implementing Strong Authentication

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Learn more about your ad choices. Visit megaphone.fm/adchoices

This joint Cybersecurity Advisory was coauthored by cybersecurity authorities of the US, Australia, Canada, New Zealand, and the UK. This advisory provides details on the top 15 Common Vulnerabilities and Exposures (CVEs) routinely exploited by malicious cyber actors in 2021, as well as other CVEs frequently exploited.

AA22-117A Alert, Technical Details, and Mitigations

Top 15 CVEs Routinely Exploited in 2020

Risk Considerations for Managed Service Provider Customers

Mitigations and Hardening Guidance for MSPs and Small- and Mid-sized Businesses

How to Manage Your Security When Engaging a Managed Service Provider

CISA Capacity Enhancement Guide – Implementing Strong Authentication

Implementing Multi-Factor Authentication

CISA’s Apache Log4j Vulnerability Guidance

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Learn more about your ad choices. Visit megaphone.fm/adchoices