Week of February 7, 2022: CISA's Shields Up Debut and SAP ICM Critical Flaws

Security leaders faced a cluster of federal warnings the week of February 7, 2022: CISA opened its new Shields Up webpage, added vulnerabilities including an actively exploited Apple WebKit flaw to its Known Exploited Vulnerabilities Catalog, and flagged critical SAP Internet Communication Manager flaws alongside Microsoft's February Patch Tuesday. The FBI also published LockBit 2.0 indicators of compromise and a joint US-UK-Australia advisory detailed the maturing ransomware-as-a-service economy from 2021, while several security vendors announced leadership appointments.

CISA Launches Shields Up Webpage Amid Geopolitical Tensions

On February 11, 2022, the Cybersecurity and Infrastructure Security Agency launched a dedicated Shields Up webpage responding to heightened geopolitical tensions, consolidating guidance for organizations to increase vigilance, prepare for rapid incident response, and lower the threshold for threat and information sharing. The page centralized existing CISA products and recommendations rather than introducing new technical content, giving CISOs a single reference point amid rising concern over state-linked cyber activity. The agency encouraged organizations of all sizes to review and apply the posted recommendations. (CISA)

CISA Adds 15 Vulnerabilities to Known Exploited Vulnerabilities Catalog

On February 10, 2022, CISA added 15 vulnerabilities to its Known Exploited Vulnerabilities Catalog, spanning products from Microsoft, Apache, Oracle, Jenkins, D-Link, and Apple, some dating back to 2014. Entries such as the Windows SAM privilege escalation flaw carried a remediation deadline of February 24, 2022, while the remaining fourteen were due by August 10, 2022. Binding Operational Directive 22-01 required federal civilian agencies to remediate the listed flaws by those dates, and CISA urged all organizations to prioritize the same patches. (CISA)

Actively Exploited Apple WebKit Flaw Added to KEV Catalog

On February 11, 2022, CISA added CVE-2022-22620, an Apple WebKit remote code execution vulnerability, to its Known Exploited Vulnerabilities Catalog, setting a remediation due date of February 25, 2022. The addition followed Apple's release of updates for Safari 15.3, macOS Monterey 12.2.1, and iOS and iPadOS 15.3.1 to address flaws CISA said had been detected in exploits in the wild. Federal civilian agencies were required to patch under Binding Operational Directive 22-01, and CISA pressed all organizations to apply the fix quickly. (CISA)

US, Australia, UK Issue Joint Advisory on 2021 Ransomware Trends

On February 10, 2022, CISA, the FBI, NSA, Australia's Cyber Security Centre, and the UK's National Cyber Security Centre published a joint advisory describing a global rise in sophisticated, high-impact ransomware incidents against critical infrastructure during 2021, touching 14 of the 16 U.S. critical infrastructure sectors including the Defense Industrial Base, Emergency Services, and Food and Agriculture. The agencies described ransomware-as-a-service as an increasingly professionalized criminal business model, noting that the BlackMatter group transferred its victims to infrastructure owned by Lockbit 2.0 after announcing its shutdown. Recommended mitigations included multifactor authentication, offline backups, and RDP monitoring. (CISA)

Critical SAP ICM Vulnerabilities Disclosed

On February 8, 2022, SAP released security updates addressing critical vulnerabilities in applications using its Internet Communication Manager component, identified as CVE-2022-22536, CVE-2022-22532, and CVE-2022-22533. CISA warned that affected systems supporting enterprise resource planning, product lifecycle management, and supply chain management could face theft of sensitive data, financial fraud, disrupted business processes, ransomware, or a halt of operations. Security researchers from Onapsis, working with SAP, published a threat report on the vulnerabilities and released an open-source tool to help administrators identify systems requiring patches. (CISA)

February 2022 Patch Tuesday Fixes 51 Flaws

Microsoft's February 2022 Patch Tuesday, released February 8, 2022, fixed 51 CVE-numbered vulnerabilities, with 50 rated important and one moderate, and none listed as under active exploitation at release. Researchers highlighted CVE-2022-21984, a Windows DNS server remote code execution flaw active when dynamic updates are enabled, and CVE-2022-21995, a Hyper-V remote code execution bug, as priorities for enterprise administrators. Four elevation-of-privilege flaws in the Windows Print Spooler, including CVE-2022-21999, also drew attention given the component's history of exploitation by ransomware operators. (Help Net Security)

FBI Releases LockBit 2.0 Indicators of Compromise

On February 7, 2022, the FBI released a Flash report detailing indicators of compromise tied to intrusions using LockBit 2.0, a ransomware-as-a-service variant that employs a wide range of tactics, techniques, and procedures complicating detection and mitigation. CISA pointed administrators to the technical details in FBI Flash CU-000162-MW and urged them to apply the recommended mitigations, as LockBit 2.0 remained among the most active ransomware strains referenced in federal threat reporting that week. (CISA)

Security Vendors Announce Leadership Appointments

During the week of February 7, 2022, several cybersecurity vendors announced leadership additions: Nutanix named Gayle Sheppard to its board of directors, Aqua Security added Joe Sexton to its board, SecurID appointed Laura Marx as chief marketing officer, CyberSaint brought John A. Wheeler onto its growth advisory board, Noname Security named Filip Verloy technical evangelist for EMEA, and Spyderbat added Hal Pomeranz to its advisory board. (Help Net Security)