Bulletins | CERT@VDE

APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers

Titel

APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers

Veröffentlicht

17. April 2023 22:32

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-108

Text

APT28 accesses poorly maintained Cisco routers and deploys malware on unpatched devices using CVE-2017-6742. Overview and Context The UK National Cyber Security Centre (NCSC), the US National Security Agency (NSA), US Cybersecurity and Infrastructure Security Agency (CISA) and US Federal Bureau of Investigation (FBI) are releasing this joint advisory to ...

März 2023

15.03.2023

#StopRansomware: LockBit 3.0

Titel

#StopRansomware: LockBit 3.0

Veröffentlicht

15. März 2023 20:20

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a

Text

SUMMARY Note: this joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect ...

13.03.2023

Threat Actors Exploit Progress Telerik Vulnerabilities in Multiple U.S. Government IIS Servers

Titel

Threat Actors Exploit Progress Telerik Vulnerabilities in Multiple U.S. Government IIS Servers

Veröffentlicht

13. März 2023 18:57

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a

Text

SUMMARY From November 2022 through early January 2023, the Cybersecurity and Infrastructure Security Agency (CISA) and authoring organizations identified the presence of indicators of compromise (IOCs) at a federal civilian executive branch (FCEB) agency. Analysts determined that multiple cyber threat actors, including an advanced persistent threat (APT) actor, were able ...

13.03.2023

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a

Threat Actors Exploit Progress Telerik Vulnerability in...

Titel

<a href="/news-events/cybersecurity-advisories/aa23-074a" hreflang="en">Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server</a>

Veröffentlicht

13. März 2023 18:57

URL

Text

13.03.2023

Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server

Titel

Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server

Veröffentlicht

13. März 2023 18:57

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a

Text

Februar 2023

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-059a

CISA Red Team Shares Key Findings to Improve Monitoring...

Titel

<a href="/news-events/cybersecurity-advisories/aa23-059a" hreflang="en">CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks</a>

Veröffentlicht

24. Februar 2023 20:04

URL

Text

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks

Titel

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks

Veröffentlicht

24. Februar 2023 20:04

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-059a

Text

SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this Cybersecurity Advisory (CSA) detailing activity and key findings from a recent CISA red team assessment—in coordination with the assessed organization—to provide network defenders recommendations for improving their organization's cyber posture. Actions to take today to harden your local environment: ...

#StopRansomware: Royal Ransomware

Titel

#StopRansomware: Royal Ransomware

Veröffentlicht

24. Februar 2023 18:30

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

Text

SUMMARY Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

#StopRansomware: Royal Ransomware

Titel

<a href="/news-events/cybersecurity-advisories/aa23-061a" hreflang="en">#StopRansomware: Royal Ransomware</a>

Veröffentlicht

24. Februar 2023 18:30

URL

Text

#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities

Titel

#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities

Veröffentlicht

16. Februar 2023 21:45

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a

Text

SUMMARY Note: This Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and various ransomware threat actors. These #StopRansomware advisories detail historically and recently observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a

#StopRansomware: Ransomware Attacks on Critical Infrast...

Titel

<a href="/news-events/cybersecurity-advisories/aa23-040a" hreflang="en">#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities</a>

Veröffentlicht

16. Februar 2023 21:45

URL

Text

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-039a

ESXiArgs Ransomware Virtual Machine Recovery Guidance

Titel

<a href="/news-events/cybersecurity-advisories/aa23-039a" hreflang="en">ESXiArgs Ransomware Virtual Machine Recovery Guidance</a>

Veröffentlicht

16. Februar 2023 19:50

URL

Text

ESXiArgs Ransomware Virtual Machine Recovery Guidance

Titel

ESXiArgs Ransomware Virtual Machine Recovery Guidance

Veröffentlicht

16. Februar 2023 19:50

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-039a

Text

Summary The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory (CSA) in response to the ongoing ransomware campaign, known as “ESXiArgs.” Malicious actors may be exploiting known vulnerabilities in VMware ESXi servers that are likely running unpatched and out-of-service ...

09.02.2023

AA23-040A: #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities

Titel

AA23-040A: #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities

Veröffentlicht

9. Februar 2023 19:00

URL

https://us-cert.cisa.gov/ncas/alerts/aa23-040a

Text

Original release date: February 9, 2023SummaryNote: This Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and various ransomware threat actors. These #StopRansomware advisories detail historically and recently observed tactics, techniques, and procedures (TTPs) and indicators of compromise ...

08.02.2023

AA23-039A: ESXiArgs Ransomware Virtual Machine Recovery Guidance

Titel

AA23-039A: ESXiArgs Ransomware Virtual Machine Recovery Guidance

Veröffentlicht

8. Februar 2023 17:14

URL

https://us-cert.cisa.gov/ncas/alerts/aa23-039a

Text

Original release date: February 8, 2023SummaryThe Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory (CSA) in response to the ongoing ransomware campaign, known as “ESXiArgs.” Malicious actors may be exploiting known vulnerabilities in VMware ESXi servers that are likely ...

Januar 2023

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-335a

#StopRansomware: Cuba Ransomware

Titel

<a href="/news-events/cybersecurity-advisories/aa22-335a" hreflang="en">#StopRansomware: Cuba Ransomware</a>

Veröffentlicht

31. Januar 2023 22:32

URL

Text

#StopRansomware: Hive Ransomware

Titel

#StopRansomware: Hive Ransomware

Veröffentlicht

31. Januar 2023 22:32

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a

Text

Summary Actions to Take Today to Mitigate Cyber Threats from Ransomware: • Prioritize remediating known exploited vulnerabilities. • Enable and enforce multifactor authentication with strong passwords • Close unused ports and remove any application not deemed necessary for day-to-day operations. Note: This joint Cybersecurity Advisory (CSA) is part of an ...

Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester

Titel

Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester

Veröffentlicht

31. Januar 2023 22:32

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a

Text

Summary From mid-June through mid-July 2022, CISA conducted an incident response engagement at a Federal Civilian Executive Branch (FCEB) organization where CISA observed suspected advanced persistent threat (APT) activity. In the course of incident response activities, CISA determined that cyber threat actors exploited the Log4Shell vulnerability in an unpatched VMware ...

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a

#StopRansomware: Hive Ransomware

Titel

<a href="/news-events/cybersecurity-advisories/aa22-321a" hreflang="en">#StopRansomware: Hive Ransomware</a>

Veröffentlicht

31. Januar 2023 22:32

URL

Text

#StopRansomware: Cuba Ransomware

Titel

#StopRansomware: Cuba Ransomware

Veröffentlicht

31. Januar 2023 22:32

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-335a

Text

Summary Actions to take today to mitigate cyber threats from ransomware: • Prioritize remediating known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Enable and enforce phishing-resistant multifactor authentication. Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for ...

Protecting Against Malicious Use of Remote Monitoring and Management Software

Titel

Protecting Against Malicious Use of Remote Monitoring and Management Software

Veröffentlicht

31. Januar 2023 22:32

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a

Text

Summary The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) (hereafter referred to as the “authoring organizations”) are releasing this joint Cybersecurity Advisory (CSA) to warn network defenders about malicious use of legitimate remote monitoring and management (RMM) software. In ...

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-277a

Impacket and Exfiltration Tool Used to Steal Sensitive ...

Titel

<a href="/news-events/cybersecurity-advisories/aa22-277a" hreflang="en">Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization</a>

Veröffentlicht

31. Januar 2023 22:32

URL

Text

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-279a

Top CVEs Actively Exploited By People’s Republic of Chi...

Titel

<a href="/news-events/cybersecurity-advisories/aa22-279a" hreflang="en">Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors</a>

Veröffentlicht

31. Januar 2023 22:32

URL

Text

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a

Protecting Against Malicious Use of Remote Monitoring a...

Titel

<a href="/news-events/cybersecurity-advisories/aa23-025a" hreflang="en">Protecting Against Malicious Use of Remote Monitoring and Management Software</a>

Veröffentlicht

31. Januar 2023 22:32

URL

Text