Week of January 10, 2022: Russian Threat Advisory and Ukraine Wiper Malware Surface

Security leaders tracked a joint CISA-FBI-NSA advisory on Russian state-sponsored threats to critical infrastructure, Microsoft's January Patch Tuesday fixing a wormable Windows Server flaw, and a newly disclosed wiper campaign targeting Ukrainian government networks. CISA also expanded its Known Exploited Vulnerabilities catalog while Cisco and Ivanti pushed out fixes for actively tracked flaws.

CISA Adds 15 Vulnerabilities to Known Exploited Vulnerabilities Catalog

On January 10, 2022, CISA expanded its Known Exploited Vulnerabilities Catalog with 15 additional entries, citing evidence that threat actors were actively exploiting the listed flaws. The newly added vulnerabilities spanned products including VMware vCenter Server, Oracle WebLogic Server, Fortinet FortiOS and FortiProxy, Palo Alto Networks PAN-OS, and the Exim Mail Transfer Agent. Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate the vulnerabilities by set due dates, while CISA urged all organizations to prioritize the same fixes as part of routine vulnerability management. (CISA)

CISA, FBI, and NSA Warn of Russian State-Sponsored Threats to Critical Infrastructure

On January 11, 2022, CISA, the FBI, and the NSA issued a joint Cybersecurity Advisory outlining Russian state-sponsored cyber operations against U.S. critical infrastructure. The advisory detailed commonly observed tactics, techniques, and procedures, along with detection actions, incident response guidance, and mitigations such as patching known exploited vulnerabilities, enabling multi-factor authentication, and using antivirus software. The agencies urged critical infrastructure network defenders to adopt a heightened state of awareness and conduct proactive threat hunting in light of the ongoing risk. (CISA)

Microsoft's January Patch Tuesday Fixes Wormable Windows Server Flaw

Microsoft's first Patch Tuesday of 2022, issued January 11, addressed 96 CVE-numbered vulnerabilities, among them a wormable remote code execution flaw in the HTTP Protocol Stack affecting Windows Server, tracked as CVE-2022-21907. Researchers flagged the bug as a top priority because it required no user interaction or privileges to exploit. The release also patched three Exchange Server remote code execution vulnerabilities, an Active Directory Domain Services elevation of privilege flaw, and fixes for curl and libarchive libraries bundled with Windows. (Help Net Security)

U.S. Cyber Command Discloses Malware Used by Iranian APT MuddyWater

On January 12, 2022, U.S. Cyber Command's Cyber National Mission Force disclosed multiple open-source tools used by the Iranian advanced persistent threat group known as MuddyWater. CNMF released malware samples attributed to the group on VirusTotal and described techniques including side-loading DLLs to trick legitimate programs into running malicious code and obfuscating PowerShell scripts to conceal command-and-control traffic. CISA encouraged network defenders to review the disclosure and the associated indicators for detection purposes. (CISA)

Microsoft Warns of Destructive Wiper Targeting Ukrainian Organizations

CISA highlighted a Microsoft disclosure describing destructive Master Boot Record wiper activity aimed at Ukrainian organizations, including government agencies. According to Microsoft, powering down an infected device triggered the malware, which overwrote the MBR with a ransom note that served only as a decoy, since the code actually destroyed the MBR and targeted files rather than enabling recovery. CISA directed network defenders to review Microsoft's indicators of compromise and associated tactics, techniques, and procedures. (CISA)

Ivanti Updates Log4j Advisory for Multiple Products

On January 14, 2022, Ivanti updated its Log4j advisory to include security updates for multiple products addressing CVE-2021-44228, the critical Log4Shell flaw. CISA noted that an unauthenticated attacker could exploit the vulnerability to take control of an affected system and pointed administrators to Ivanti's advisory pages covering Avalanche, File Director, and the MobileIron Core, Sentry, and Core Connector product lines for the necessary patches and workarounds. (CISA)

Cisco Patches Privilege Escalation Flaw in Contact Center Management Tools

On January 13, 2022, Cisco released security updates addressing a vulnerability in Cisco Unified Contact Center Management Portal and Cisco Unified Contact Center Domain Manager. CISA warned that a remote attacker could exploit the flaw to take control of an affected system and advised administrators to apply the fixes detailed in Cisco's advisory cisco-sa-ccmp-priv-esc-JzhTFLm4 without delay given the potential for full system compromise in contact center environments. (CISA)