Bulletins | CERT@VDE

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-059a

CISA Red Team Shares Key Findings to Improve Monitoring...

Title

<a href="/news-events/cybersecurity-advisories/aa23-059a" hreflang="en">CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks</a>

Published

Feb. 24, 2023, 8:04 p.m.

URL

Summary

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks

Title

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks

Published

Feb. 24, 2023, 8:04 p.m.

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-059a

Summary

SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this Cybersecurity Advisory (CSA) detailing activity and key findings from a recent CISA red team assessment—in coordination with the assessed organization—to provide network defenders recommendations for improving their organization's cyber posture. Actions to take today to harden your local environment: ...

#StopRansomware: Royal Ransomware

Title

#StopRansomware: Royal Ransomware

Published

Feb. 24, 2023, 6:30 p.m.

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

Summary

SUMMARY Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

#StopRansomware: Royal Ransomware

Title

<a href="/news-events/cybersecurity-advisories/aa23-061a" hreflang="en">#StopRansomware: Royal Ransomware</a>

Published

Feb. 24, 2023, 6:30 p.m.

URL

Summary

#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities

Title

#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities

Published

Feb. 16, 2023, 9:45 p.m.

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a

Summary

SUMMARY Note: This Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and various ransomware threat actors. These #StopRansomware advisories detail historically and recently observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a

#StopRansomware: Ransomware Attacks on Critical Infrast...

Title

<a href="/news-events/cybersecurity-advisories/aa23-040a" hreflang="en">#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities</a>

Published

Feb. 16, 2023, 9:45 p.m.

URL

Summary

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-039a

ESXiArgs Ransomware Virtual Machine Recovery Guidance

Title

<a href="/news-events/cybersecurity-advisories/aa23-039a" hreflang="en">ESXiArgs Ransomware Virtual Machine Recovery Guidance</a>

Published

Feb. 16, 2023, 7:50 p.m.

URL

Summary

ESXiArgs Ransomware Virtual Machine Recovery Guidance

Title

ESXiArgs Ransomware Virtual Machine Recovery Guidance

Published

Feb. 16, 2023, 7:50 p.m.

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-039a

Summary

Summary The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory (CSA) in response to the ongoing ransomware campaign, known as “ESXiArgs.” Malicious actors may be exploiting known vulnerabilities in VMware ESXi servers that are likely running unpatched and out-of-service ...

09.02.2023

AA23-040A: #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities

Title

AA23-040A: #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities

Published

Feb. 9, 2023, 7 p.m.

URL

https://us-cert.cisa.gov/ncas/alerts/aa23-040a

Summary

Original release date: February 9, 2023SummaryNote: This Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and various ransomware threat actors. These #StopRansomware advisories detail historically and recently observed tactics, techniques, and procedures (TTPs) and indicators of compromise ...

08.02.2023

AA23-039A: ESXiArgs Ransomware Virtual Machine Recovery Guidance

Title

AA23-039A: ESXiArgs Ransomware Virtual Machine Recovery Guidance

Published

Feb. 8, 2023, 5:14 p.m.

URL

https://us-cert.cisa.gov/ncas/alerts/aa23-039a

Summary

Original release date: February 8, 2023SummaryThe Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory (CSA) in response to the ongoing ransomware campaign, known as “ESXiArgs.” Malicious actors may be exploiting known vulnerabilities in VMware ESXi servers that are likely ...

January 2023

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-335a

#StopRansomware: Cuba Ransomware

Title

<a href="/news-events/cybersecurity-advisories/aa22-335a" hreflang="en">#StopRansomware: Cuba Ransomware</a>

Published

Jan. 31, 2023, 10:32 p.m.

URL

Summary

#StopRansomware: Hive Ransomware

Title

#StopRansomware: Hive Ransomware

Published

Jan. 31, 2023, 10:32 p.m.

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a

Summary

Summary Actions to Take Today to Mitigate Cyber Threats from Ransomware: • Prioritize remediating known exploited vulnerabilities. • Enable and enforce multifactor authentication with strong passwords • Close unused ports and remove any application not deemed necessary for day-to-day operations. Note: This joint Cybersecurity Advisory (CSA) is part of an ...

Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester

Title

Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester

Published

Jan. 31, 2023, 10:32 p.m.

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a

Summary

Summary From mid-June through mid-July 2022, CISA conducted an incident response engagement at a Federal Civilian Executive Branch (FCEB) organization where CISA observed suspected advanced persistent threat (APT) activity. In the course of incident response activities, CISA determined that cyber threat actors exploited the Log4Shell vulnerability in an unpatched VMware ...

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a

#StopRansomware: Hive Ransomware

Title

<a href="/news-events/cybersecurity-advisories/aa22-321a" hreflang="en">#StopRansomware: Hive Ransomware</a>

Published

Jan. 31, 2023, 10:32 p.m.

URL

Summary

#StopRansomware: Cuba Ransomware

Title

#StopRansomware: Cuba Ransomware

Published

Jan. 31, 2023, 10:32 p.m.

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-335a

Summary

Summary Actions to take today to mitigate cyber threats from ransomware: • Prioritize remediating known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Enable and enforce phishing-resistant multifactor authentication. Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for ...

Protecting Against Malicious Use of Remote Monitoring and Management Software

Title

Protecting Against Malicious Use of Remote Monitoring and Management Software

Published

Jan. 31, 2023, 10:32 p.m.

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a

Summary

Summary The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) (hereafter referred to as the “authoring organizations”) are releasing this joint Cybersecurity Advisory (CSA) to warn network defenders about malicious use of legitimate remote monitoring and management (RMM) software. In ...

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-277a

Impacket and Exfiltration Tool Used to Steal Sensitive ...

Title

<a href="/news-events/cybersecurity-advisories/aa22-277a" hreflang="en">Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization</a>

Published

Jan. 31, 2023, 10:32 p.m.

URL

Summary

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-279a

Top CVEs Actively Exploited By People’s Republic of Chi...

Title

<a href="/news-events/cybersecurity-advisories/aa22-279a" hreflang="en">Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors</a>

Published

Jan. 31, 2023, 10:32 p.m.

URL

Summary

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a

Protecting Against Malicious Use of Remote Monitoring a...

Title

<a href="/news-events/cybersecurity-advisories/aa23-025a" hreflang="en">Protecting Against Malicious Use of Remote Monitoring and Management Software</a>

Published

Jan. 31, 2023, 10:32 p.m.

URL

Summary

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a

Iranian Government-Sponsored APT Actors Compromise Fede...

Title

<a href="/news-events/cybersecurity-advisories/aa22-320a" hreflang="en">Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester</a>

Published

Jan. 31, 2023, 10:32 p.m.

URL

Summary

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-294a

#StopRansomware: Daixin Team

Title

<a href="/news-events/cybersecurity-advisories/aa22-294a" hreflang="en">#StopRansomware: Daixin Team</a>

Published

Jan. 31, 2023, 10:32 p.m.

URL

Summary

25.01.2023

AA23-025A: Protecting Against Malicious Use of Remote Monitoring and Management Software

Title

AA23-025A: Protecting Against Malicious Use of Remote Monitoring and Management Software

Published

Jan. 25, 2023, 6:55 p.m.

URL

https://us-cert.cisa.gov/ncas/alerts/aa23-025a

Summary

Original release date: January 25, 2023SummaryThe Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) (hereafter referred to as the “authoring organizations”) are releasing this joint Cybersecurity Advisory (CSA) to warn network defenders about malicious use of legitimate remote monitoring and ...

December 2022

01.12.2022

AA22-335A: #StopRansomware: Cuba Ransomware

Title

AA22-335A: #StopRansomware: Cuba Ransomware

Published

Dec. 1, 2022, 7:04 p.m.

URL

https://us-cert.cisa.gov/ncas/alerts/aa22-335a

Summary

Original release date: December 1, 2022SummaryActions to take today to mitigate cyber threats from ransomware: • Prioritize remediating known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Enable and enforce phishing-resistant multifactor authentication. Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort ...

November 2022

17.11.2022

AA22-321A: #StopRansomware: Hive Ransomware

Title

AA22-321A: #StopRansomware: Hive Ransomware

Published

Nov. 17, 2022, 6 p.m.

URL

https://us-cert.cisa.gov/ncas/alerts/aa22-321a

Summary

Original release date: November 17, 2022SummaryActions to Take Today to Mitigate Cyber Threats from Ransomware: • Prioritize remediating known exploited vulnerabilities. • Enable and enforce multifactor authentication with strong passwords • Close unused ports and remove any application not deemed necessary for day-to-day operations. Note: This joint Cybersecurity Advisory (CSA) ...

16.11.2022