Week of April 4, 2022: Spring4Shell Hits CISA's KEV List, FBI Disrupts Cyclops Blink Botnet

Security leaders tracked CISA's addition of Spring4Shell and six other actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, while the FBI disrupted the Sandworm-linked Cyclops Blink botnet built from compromised WatchGuard and ASUS devices. VMware shipped new security updates, Microsoft opened its bug bounty to on-premises Exchange and SharePoint servers, and CISA issued fresh guidance on reporting cyber incidents.

CISA Adds Four Vulnerabilities to Known Exploited Vulnerabilities Catalog

On April 4, 2022, CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, including a Spring Framework flaw (CVE-2022-22965) widely known as Spring4Shell, two Apple macOS vulnerabilities (CVE-2022-22675 and CVE-2022-22674), and a D-Link routers vulnerability (CVE-2021-45382). Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate catalog entries by set deadlines, and CISA urged all organizations to prioritize timely remediation of these flaws as part of standard vulnerability management practices. (CISA)

CISA Adds Three More Vulnerabilities to KEV Catalog

On April 6, 2022, CISA added three more vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a Sudo vulnerability (CVE-2021-3156), a Microsoft HTTP Protocol Stack flaw (CVE-2021-31166), and a Microsoft SMBv1 server vulnerability (CVE-2017-0148). CISA again pointed to Binding Operational Directive 22-01, which requires federal civilian executive branch agencies to remediate catalog vulnerabilities by specified deadlines, and encouraged all organizations to treat the additions as a priority within their own vulnerability management programs. (CISA)

Spring4Shell Exploitation Attempts Surged Days After Disclosure

Within days of the Spring4Shell vulnerability (CVE-2022-22965) being disclosed and fixed by the Spring development team, CISA added it to its Known Exploited Vulnerabilities Catalog on April 4, 2022. Researchers reported scanning activity, exploit attempts, and efforts to deploy web shells against vulnerable systems, though confirmed successful exploitation had yet to be documented. Check Point Research later said it detected roughly 37,000 attempts to exploit the flaw over the first weekend after disclosure, estimating that 16% of organizations worldwide faced exploitation attempts during the first four days. (Help Net Security)

VMware Issues Security Updates Across Multiple Products

VMware released security updates on April 7, 2022, to address vulnerabilities across multiple products, cautioning that attackers could exploit some of the flaws to take control of an affected system. CISA encouraged users and administrators to review VMware Security Advisories VMSA-2022-0011 and VMSA-2022-0012 and to apply the necessary updates promptly. The alert was one of several CISA issued that week directing enterprises toward vendor patches for actively monitored software vulnerabilities. (CISA)

FBI Disrupts Cyclops Blink Botnet Linked to Russia's Sandworm Group

The US Justice Department announced that the FBI had disrupted the Cyclops Blink botnet, which officials said operated under the control of the Sandworm group, a threat actor previously attributed to Russia's GRU military intelligence directorate. The operation copied and removed malware from compromised WatchGuard and ASUS networking devices used for command-and-control, severing the underlying bots from Sandworm's infrastructure without the FBI directly accessing victim devices worldwide. Device owners were advised to check for compromise and follow vendor remediation guidance, since a simple reboot would not clear the infection. (Help Net Security)

Microsoft Expands Bug Bounty to On-Premises Exchange and SharePoint Servers

Microsoft announced on April 6, 2022, that security researchers who discover and report high-impact vulnerabilities in on-premises Exchange, SharePoint, and Skype for Business could earn as much as $26,000 per eligible submission. The company said the highest rewards would go to researchers identifying flaws enabling scenarios such as authentication bypass leading to mass exploitation, insecure deserialization resulting in remote code execution, and server-side request forgery against Exchange or SharePoint servers, areas Microsoft flagged as carrying the greatest potential impact to customer security. (Help Net Security)

CISA Issues Guidance on Sharing Cyber Incident Information

CISA published guidance on April 7, 2022, describing what organizations should share, who should share it, and how to report unusual cyber incidents or activity to the agency. CISA said the information helps it build a common understanding of how adversaries target US networks and critical infrastructure sectors, fills information gaps, and allows the agency to deploy resources and render assistance to victims. The guidance directed organizations to CISA's Shields Up site for additional resources on reporting. (CISA)