Week of April 18, 2022: Russian Critical-Infrastructure Advisory and BlackCat Ransomware IOCs

Security leaders watched a cluster of government advisories land in the same week: a joint US-Australia-Canada-New Zealand-UK warning on Russian state-sponsored and criminal cyber threats, a CISA/FBI/Treasury advisory on North Korea's TraderTraitor cryptocurrency campaign, and an FBI flash report on BlackCat/ALPHV ransomware. Vendor patching also demanded attention, with Cisco and Drupal issuing updates and CISA adding three actively exploited vulnerabilities to its catalog, while a new report examined the SEC's proposed cybersecurity disclosure rules for public companies.

CISA adds three actively exploited vulnerabilities to its catalog

CISA expanded its Known Exploited Vulnerabilities Catalog with three additional CVEs based on evidence of active exploitation. The catalog, established under Binding Operational Directive 22-01, requires federal civilian executive branch agencies to remediate listed flaws by set deadlines. CISA urged all organizations, not just federal agencies, to prioritize timely remediation of catalog entries as part of routine vulnerability management, reiterating that these vulnerability types remain a frequent attack vector posing significant risk to the federal enterprise. (CISA)

CISA and FBI warn on North Korea's TraderTraitor cryptocurrency campaign

CISA, the FBI, and the U.S. Treasury Department published a joint advisory detailing tactics used by a North Korean state-sponsored group known as Lazarus Group to steal cryptocurrency. The advisory described trojanized applications distributed through social engineering on blockchain, exchange, DeFi, and gaming companies, along with indicators of compromise. Security teams in blockchain and cryptocurrency sectors were urged to review the technical details and apply recommended mitigations against spearphishing and malware used to drain digital assets. (CISA)

Five-nation advisory flags Russian state and criminal cyber threats

Cybersecurity authorities from the United States, Australia, Canada, New Zealand, and the United Kingdom released a joint advisory warning that Russia's invasion of Ukraine could expose organizations worldwide to heightened malicious cyber activity. The advisory covered Russian state-sponsored advanced persistent threat groups along with Russian-aligned cybercrime groups and urged critical infrastructure defenders to harden networks, citing prior destructive malware deployments and distributed denial-of-service activity tied to the conflict. (CISA)

FBI releases BlackCat/ALPHV ransomware indicators of compromise

The FBI released a flash report with indicators of compromise tied to BlackCat/ALPHV, a ransomware-as-a-service operation that had compromised at least 60 entities worldwide. CISA pointed organizations to the flash report, labeled CU-000167-MW, and encouraged users and administrators to review the technical details and apply recommended mitigations. The advisory gave defenders fresh detection artifacts for an operation already linked to dozens of victim organizations across sectors. (CISA)

Cisco patches multiple products against takeover vulnerabilities

Cisco released security updates addressing vulnerabilities across several products, including a privilege escalation flaw in Virtualized Infrastructure Manager, a static SSH host key issue in the Umbrella Virtual Appliance, and a denial-of-service flaw in TelePresence Collaboration Endpoint and RoomOS software. CISA flagged the advisories and urged administrators to apply the necessary updates, noting that an attacker could exploit some of the flaws to take control of an affected system. (CISA)

Drupal issues updates for Drupal 9.2 and 9.3 core vulnerabilities

Drupal released security updates addressing vulnerabilities in Drupal 9.2 and 9.3, covered under advisories SA-CORE-008 and SA-CORE-009. CISA warned that an attacker could exploit the flaws to take control of an affected system and encouraged administrators running the content management platform to review the advisories and apply the necessary patches promptly, given Drupal's widespread use across public-facing websites. (CISA)

Report examines SEC's proposed cybersecurity disclosure rules

The National Association of Corporate Directors, SecurityScorecard, and the Cyber Threat Alliance released a report analyzing the SEC's proposed rules on cybersecurity reporting for public companies, advisors, and funds. The proposals included disclosure of material cybersecurity incidents within four days of discovery, board oversight of cyber risk, and written policies for advisors to report significant incidents to the SEC within 48 hours. The report concluded the rules, if enacted, would strengthen companies' ability to manage cyber threats. (Help Net Security)