Week of April 11, 2022: ICS/SCADA APT Tools Surface, Microsoft and VMware Rush Patches

The week of April 11, 2022 was dominated by a joint CISA-DOE-NSA-FBI warning that advanced persistent threat actors had built custom tools capable of seizing full control of ICS and SCADA devices, alongside urgent patches from Microsoft, VMware, and Google for actively exploited flaws. CISA also added 28 vulnerabilities to its Known Exploited Vulnerabilities Catalog across four separate postings between April 11 and April 15, 2022, keeping federal and private-sector patching teams busy through an already heavy Patch Tuesday cycle.

DOE, NSA, FBI, and CISA warn of APT tools built to hijack ICS/SCADA devices

The Department of Energy, the National Security Agency, the FBI, and CISA issued a joint advisory warning that advanced persistent threat actors had developed custom-made tools capable of gaining full system access to multiple industrial control system and SCADA devices, including Schneider Electric programmable logic controllers, OMRON Sysmac PLCs, and OPC UA servers. The tools could scan for, compromise, and control affected equipment, and a related capability could exploit a vulnerable ASRock motherboard driver to run malicious code on Windows-based engineering workstations. CISA urged critical infrastructure organizations, particularly in the energy sector, to apply the advisory's detection and mitigation recommendations. (CISA)

CISA adds exploited VMware Workspace ONE Access flaw to KEV Catalog

CISA added one new vulnerability to its Known Exploited Vulnerabilities Catalog on April 14, 2022, citing evidence of active exploitation of CVE-2022-22954, a flaw in VMware Workspace ONE Access and Identity Manager. Under Binding Operational Directive 22-01, federal civilian executive branch agencies were required to remediate the flaw by a set deadline, and CISA again urged all organizations to fold catalog entries into routine vulnerability management regardless of whether the directive applied to them. The addition came days before CISA flagged a separate remote code execution flaw in VMware Cloud Director on April 15, 2022. (CISA)

CISA adds 10 more vulnerabilities, including a Windows flaw, to KEV Catalog

CISA added 10 vulnerabilities to its Known Exploited Vulnerabilities Catalog on April 13, 2022, including CVE-2022-24521 affecting Microsoft Windows and CVE-2018-7602 affecting Drupal Core, alongside several older Adobe Flash Player and Internet Explorer flaws, based on evidence of active exploitation. Binding Operational Directive 22-01 required federal civilian executive branch agencies to remediate the listed flaws by set due dates, and CISA reiterated that such vulnerabilities remained a frequent attack vector for malicious cyber actors and posed significant risk to the federal enterprise, urging broader adoption of the remediation guidance beyond federal agencies. (CISA)

Microsoft ships April 2022 security updates across its software line

Microsoft released its April 2022 security updates addressing multiple vulnerabilities across its software portfolio. CISA warned that attackers could exploit some of the flaws to take control of an affected system and directed administrators to Microsoft's April 2022 Security Update Summary and Deployment Information for guidance on applying the necessary patches. The monthly release arrived alongside a standalone Microsoft advisory for a critical remote code execution flaw in the Windows Remote Procedure Call Runtime Library, published on April 13, 2022, adding to the patching workload facing enterprise IT and security teams. (CISA)

Microsoft flags critical unauthenticated RCE in RPC Runtime Library

Microsoft published a standalone advisory for CVE-2022-26809, a critical remote code execution vulnerability in the Remote Procedure Call Runtime Library. CISA said a remote, unauthenticated attacker could exploit the flaw to take control of an affected system, a severity profile that led the agency to call it out separately from the broader monthly update bundle released on April 12, 2022. CISA encouraged administrators to review Microsoft's advisory and apply the recommended mitigations promptly given the lack of any authentication requirement for exploitation. (CISA)

VMware patches remote code execution flaw in Cloud Director

VMware released security updates for Cloud Director to address a remote code execution vulnerability that an attacker could exploit to take control of an affected system. CISA pointed administrators to VMware Security Advisory VMSA-2022-0013 and urged them to apply the necessary updates. The fix landed days after CISA added a separate, actively exploited VMware Workspace ONE Access flaw to its Known Exploited Vulnerabilities Catalog on April 14, 2022, giving VMware customers two distinct product lines to patch within days of each other. (CISA)

Google rushes Chrome fix for bug already exploited in the wild

Google released Chrome version 100.0.4896.127 for Windows, Mac, and Linux to fix a vulnerability that had already been detected in exploits in the wild and could let an attacker take control of an affected system. CISA directed users and administrators to the Chrome release notes and urged immediate application of the update given the active exploitation. The patch followed an earlier Chrome 100 security update Google had issued on April 12, 2022, keeping browser patching a recurring task for security teams in mid-April 2022. (CISA)