Week of January 17, 2022: Ukraine wiper malware, CISA's urgent guidance

The week of January 17, 2022 brought Microsoft's disclosure of WhisperGate wiper malware hitting Ukrainian government systems alongside CISA's emergency guidance urging organizations to harden defenses against related threats. CISA also expanded its Known Exploited Vulnerabilities Catalog twice, Oracle shipped a 497-vulnerability patch update, Zoho fixed an authentication bypass in ManageEngine Desktop Central, and the UK's NCSC outlined plans for a new incident response assurance scheme.

Wiper Malware Disguised as Ransomware Hit Ukrainian Government Systems

Microsoft researchers disclosed a malware operation targeting multiple Ukrainian organizations that deployed malware masquerading as ransomware but functioning as a Master Boot Record wiper. The malware, later named WhisperGate, first appeared on victim systems on January 13, 2022, days after government website defacements that hit Ukraine's Ministry of Foreign Affairs and Ministry of Education and Science. Microsoft said affected organizations included government agencies providing critical executive branch or emergency response functions and an IT firm managing websites for public and private sector clients. Microsoft notified compromised customers and urged use of multi-factor authentication and controlled folder access. (Help Net Security)

CISA Urged Organizations to Prepare for Potential Ukraine-Linked Cyber Threats

Citing a wave of malicious cyber activity in Ukraine, including government website defacements and destructive malware found on Ukrainian systems, CISA published a CISA Insights document urging organizations everywhere to raise their defensive posture. The guidance, revised January 21, 2022, provided a checklist covering reducing the likelihood of intrusion, detecting compromise, response readiness, and resilience to destructive incidents. CISA directed the advice at senior leaders and network defenders across every sector and organization size, regardless of direct ties to Ukraine, given concerns that the underlying campaign could spread beyond its original targets. (CISA)

CISA Added 13 Actively Exploited Vulnerabilities to Its KEV Catalog

CISA added 13 vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. The list spanned products including VMware vRealize Operations Manager, F5 BIG-IP, Nagios XI, Microsoft Exchange Server, Aviatrix Controller, Drupal core, and Apache Airflow. Under Binding Operational Directive 22-01, federal civilian agencies had to remediate nine of the flaws by February 1, 2022, with four older vulnerabilities given a July 18, 2022 deadline. CISA said these vulnerability types remain a frequent attack vector and urged all organizations, not just federal agencies, to prioritize remediation. (CISA)

Oracle Shipped January 2022 Critical Patch Update Addressing 497 Flaws

Oracle released its January 2022 Critical Patch Update on January 18, 2022, addressing 497 vulnerabilities spread across its product portfolio. CISA flagged the release the same day, warning that a remote attacker could exploit some of the flaws to take control of an affected system. The agency encouraged users and administrators to review Oracle's bulletin and apply the necessary updates promptly, given the scale of the patch set and the breadth of Oracle products it touched, from databases to middleware and applications. (CISA)

UK NCSC Set to Launch New IR and SimEx Assurance Scheme

Prism Infosec's Phil Robinson detailed plans by the UK's National Cyber Security Centre to launch a new assurance scheme covering incident response and simulated exercises in the second quarter of 2022. The scheme would expand the existing Cyber Incident Response service, soon renamed CIR Level 1, beyond central government and large businesses to also cover local businesses and SMEs, while a new Cyber Incident Exercising Service would target large, medium, and regional government organizations. NCSC planned to recruit Assured Scheme Partners to help vet and onboard providers under the new structure. (Help Net Security)

Zoho Patched Authentication Bypass Flaw in ManageEngine Desktop Central

Zoho issued a security advisory addressing an authentication bypass vulnerability, tracked as CVE-2021-44757, in ManageEngine Desktop Central and Desktop Central MSP. CISA relayed the advisory on January 19, 2022, warning that an attacker could exploit the flaw to take control of an affected system. CISA pointed administrators to Zoho's vulnerability notification and the corresponding Desktop Central and Desktop Central MSP advisories, urging recommended mitigations be applied immediately given the products' use for endpoint and patch management across enterprise networks. (CISA)

CISA Added Four More Exploited Vulnerabilities, Including Legacy Apache Struts Flaws

CISA added four more vulnerabilities to its Known Exploited Vulnerabilities Catalog on January 21, 2022, including two aging Apache Struts flaws dating to 2006 and 2012, a Microsoft Windows Win32k privilege escalation bug, and a SolarWinds Serv-U input validation vulnerability. Federal civilian agencies faced a July 21, 2022 remediation deadline for the Struts and Windows issues, while the SolarWinds flaw carried a February 4, 2022 deadline. CISA again urged all organizations, not just those bound by Binding Operational Directive 22-01, to prioritize remediation of catalog entries. (CISA)