Week of February 21, 2022: Cyber attacks accompany Russia's invasion of Ukraine, and Cyclops Blink is exposed

What mattered to security leaders in the week of February 21, 2022? Russia's invasion of Ukraine on Thursday, February 24 came with DDoS attacks and newly discovered data-wiping malware, and US and UK agencies spent the week publishing advisories on Russian and Iranian state actors, starting with Sandworm's Cyclops Blink botnet.

DDoS and a new wiper arrive alongside the invasion

Help Net Security reported that the physical invasion was preceded and accompanied by cyber attacks: renewed DDoS against the websites of Ukrainian government agencies and banks, including the Ministry of Defence and the parliament, beginning on the afternoon of Wednesday, February 23; new data-wiper malware found on computers in Ukraine and on machines in Latvia and Lithuania; and cloned copies of Ukrainian government websites booby-trapped with malware. Organizations with staff, suppliers or networks in the region had reason to plan for spillover. (Help Net Security)

CISA and the FBI warn about WhisperGate and HermeticWiper

On February 26 CISA and the FBI issued advisory AA22-057A on destructive malware used against organizations in Ukraine. It recounted Microsoft's January 15 disclosure of WhisperGate, which is designed to render devices inoperable, and researchers' February 23 disclosure of HermeticWiper, which manipulates a Windows machine's master boot record so that it fails to boot. The advisory's first actions were familiar hygiene: regular scans, spam filtering, traffic filtering, patching and multifactor authentication. The page was later revised on April 28, 2022 to add more wipers. (CISA and FBI)

Sandworm's Cyclops Blink replaces VPNFilter on WatchGuard firewalls

A joint advisory from the UK's NCSC, CISA, the NSA and the FBI, published February 23, said the Sandworm actor, previously attributed to Russia's GRU, had replaced its exposed VPNFilter malware with a more advanced modular framework called Cyclops Blink, deployed since at least June 2019. It had mainly been placed on WatchGuard devices, and only those reconfigured to expose remote management to outside access could be infected. That detail made it a clean audit item: find any perimeter device with management open to the internet. (NCSC, CISA, NSA and FBI)

Joint advisory details Iran's MuddyWater operations

On February 24 the FBI, CISA, US Cyber Command's Cyber National Mission Force and the UK's NCSC described MuddyWater, an Iranian government-sponsored group they placed within Iran's Ministry of Intelligence and Security, conducting espionage against government and private organizations in telecommunications, defense, local government, and oil and gas across Asia, Africa, Europe and North America. The agencies said the group exploits publicly reported vulnerabilities, uses open-source tools and can deploy ransomware. (FBI, CISA, CNMF and NCSC)

Zabbix, Zimbra and old Microsoft bugs added to the exploited list

CISA's Known Exploited Vulnerabilities catalog grew by six entries across the week. On February 22 it added two Zabbix Frontend flaws, including an authentication bypass (CVE-2022-23131). On February 25 it added a Zimbra webmail cross-site scripting bug (CVE-2022-24682), with a March 11, 2022 due date for federal agencies, plus three older Microsoft Office, Internet Explorer and Windows remote code execution flaws with CVE identifiers from 2014 and 2017. (CISA, CISA)

Appgate names Leo Taddeo as its CISO

Help Net Security's roundup of security leadership appointments on February 21 led with Appgate, a zero trust security vendor, appointing Leo Taddeo as chief information security officer. Appgate's chief executive, Barry Field, pointed to Taddeo's hands-on experience and understanding of the federal market as the company expanded its zero trust portfolio. The same roundup covered appointments at Comodo, HYPR, Nucleus Security, the PCI Security Standards Council and TrueFort. (Help Net Security)