Week of February 28, 2022: CISA's 95-Vulnerability KEV Update and Daxin Backdoor Disclosure

Security leaders tracked CISA's addition of 95 vulnerabilities to its Known Exploited Vulnerabilities catalog, Broadcom's disclosure of the Daxin espionage backdoor, and fresh Cisco, Google and NSA advisories requiring prompt patching and hardening. Dragos documented a doubling of ICS/OT vulnerabilities to 1,703 and APWG recorded a record monthly phishing total for December 2021, giving CISOs fresh benchmarks for industrial and phishing risk.

CISA Added 95 Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA added 95 entries to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog entries by specified deadlines, and CISA urged all organizations to prioritize patching accordingly. The agency credited Joint Cyber Defense Collaborative partners for contributing to the addition, which came as part of its Shields Up push for heightened vigilance amid rising cyber risk. (CISA)

Cisco Patched Flaws in Expressway, Ultra Cloud Core and ISE

Cisco released security updates addressing vulnerabilities across the Expressway Series, TelePresence Video Communication Server, Ultra Cloud Core Subscriber Microservices Infrastructure, and Identity Services Engine. CISA flagged the advisories, noting that an attacker could exploit some of the flaws to take control of an affected system. The bulletin pointed administrators to the Cisco Security Advisories page for lower-severity issues and urged prompt application of the vendor's patches across the named product lines. (CISA)

NSA Published Network Infrastructure Security Guidance

The National Security Agency released a Cybersecurity Technical Report titled Network Infrastructure Security Guidance, compiling best practices drawn from its experience defending customer networks and responding to threats. CISA highlighted the report alongside its own Layering Network Security Through Segmentation infographic, encouraging network architects, defenders and administrators to use the recommendations for perimeter and internal defenses, improved monitoring, and tighter access controls across enterprise networks. (CISA)

Google Patched Chrome Vulnerabilities With Version 99.0.4844.51

Google shipped Chrome version 99.0.4844.51 for Windows, Mac and Linux, addressing vulnerabilities that CISA said an attacker could exploit to take control of an affected system. CISA encouraged users and administrators to consult Google's Chrome Release Note and apply the update promptly, adding the browser fix to the list of vendor patches CISOs were tracking for enterprise endpoint deployment. (CISA)

Broadcom's Symantec Unit Disclosed Daxin Backdoor Used in Espionage Campaign

Broadcom Software's Symantec Threat Hunter team disclosed Daxin, a sophisticated rootkit backdoor used by an advanced persistent threat actor against select governments and critical infrastructure targets. Working with CISA, Symantec engaged multiple targeted governments to assist detection and remediation. CISA described Daxin as featuring stealthy command-and-control functionality that let remote actors communicate with secured devices not directly connected to the internet, and published indicators of compromise for defenders to review. (CISA)

Dragos Year-in-Review Found ICS Vulnerabilities Doubled, Ransomware Topped OT Threats

Dragos released its annual industrial threat report, identifying three new activity groups—KOSTOVITE, PETROVITE and ERYTHRITE—tracking targets across renewable energy, mining and North American manufacturing and utility sectors. The report found ICS/OT vulnerabilities more than doubled year over year to 1,703, with ransomware becoming the top attack vector; manufacturing accounted for 65%, or 211 cases, of industrial ransomware incidents detected. Dragos also reported 86% of surveyed organizations had limited to no OT network visibility. (Help Net Security)

APWG Recorded Record 316,747 Phishing Attacks in December 2021

The Anti-Phishing Working Group reported 316,747 phishing attacks in December 2021, the highest monthly total since it began tracking in 2004, with overall phishing volume tripling since early 2020. The financial sector became the most targeted cohort in the fourth quarter at 23.2% of attacks, while Abnormal Security separately logged 4,200 ransomware victims in Q4, up 36% from the prior quarter and the highest count in two years. (Help Net Security)