Week of April 25, 2022: CISA/FBI Update Ukraine Wiper Advisory, Add 7 KEVs

During the week of April 25, 2022, CISA and the FBI updated their joint advisory on destructive wiper malware targeting Ukrainian organizations and published detailed technical analyses of HermeticWiper and CaddyWiper for network defenders. CISA also added seven vulnerabilities to its Known Exploited Vulnerabilities Catalog, issued a joint international advisory on the top routinely exploited vulnerabilities of 2021, and flagged new security patches from Google and Cisco.

CISA and FBI Update Joint Advisory on Ukraine-Targeting Wiper Malware

CISA and the FBI updated their joint advisory AA22-057A on destructive malware aimed at organizations in Ukraine, first issued on February 26, 2022. The revision added indicators of compromise for WhisperGate and expanded technical detail on HermeticWiper, IsaacWiper, HermeticWizard, and CaddyWiper. The agencies pointed organizations to the Shields Up Technical Guidance webpage for help identifying, responding to, and mitigating disruptive cyber activity tied to the conflict. For CISOs tracking wiper malware spreading beyond Ukrainian networks, the update offered fresh technical detail to feed into detection rules. (CISA)

CISA Publishes Malware Analysis Report on HermeticWiper

CISA published a malware analysis report on HermeticWiper after receiving seven files tied to the destructive campaign against Ukrainian organizations, five of which were digitally signed by Hermetica Digital Ltd. The report described how the wiper exploits a legitimate EaseUS Partition Master driver to gain direct disk access, then overwrites the Master Boot Record, NTFS boot sector, and Windows Event Logs with random data before forcing a reboot that leaves the machine unusable. CISA included indicators of compromise and YARA rules so defenders could hunt for the malware on their own networks. (CISA)

CISA Details CaddyWiper's Disk-Wiping Technique

A separate CISA analysis report detailed CaddyWiper, a 9,216-byte Windows executable that overwrites victim files with null bytes during runtime. The malware enumerates files under C:\Users, recursively zeroes them out, then moves to attached drives starting with D:\ before using the DeviceIoControl API to access physical disks directly and wipe the first 1,920 bytes of each drive's Master Boot Record. CISA published indicators of compromise and recommendations alongside the report to help organizations identify and defend against the destructive tool. (CISA)

CISA Adds Seven Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA added seven new vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. The catalog operates under Binding Operational Directive 22-01, which requires federal civilian executive branch agencies to remediate listed vulnerabilities by set due dates to protect their networks from active threats. CISA reiterated that while the directive applies only to federal agencies, it strongly encourages all organizations to prioritize timely remediation of catalog vulnerabilities as part of routine vulnerability management practice. (CISA)

Five Nations Issue Joint Advisory on 2021's Most Exploited Vulnerabilities

CISA joined cybersecurity authorities from Australia, Canada, New Zealand, and the United Kingdom in publishing a joint advisory, AA22-117A, detailing the 15 vulnerabilities most routinely exploited by malicious cyber actors in 2021. The list included Log4Shell in Apache Log4j, the ProxyLogon and ProxyShell flaws in Microsoft Exchange, and a flaw in Atlassian Confluence, alongside older bugs still being exploited years after disclosure. The authorities urged organizations to apply timely patches and adopt centralized patch management to reduce exposure to known, weaponized vulnerabilities. (CISA)

Google Patches Chrome Vulnerabilities With Version 101.0.4951.41

Google shipped Chrome version 101.0.4951.41 for Windows, Mac, and Linux, prompting a CISA alert urging users and administrators to apply the update. The release addressed vulnerabilities that, left unpatched, could let an attacker take control of an affected system. CISA directed users to Google's Chrome Release Note for further detail and recommended applying the update promptly given Chrome's broad footprint across enterprise endpoints. (CISA)

Cisco Issues Security Updates Across Multiple Products

Cisco released security updates covering multiple products to fix vulnerabilities that could let an attacker take control of an affected system, prompting a CISA alert pointing administrators to Cisco's Security Advisories page. CISA encouraged organizations to review the full set of advisories and apply the necessary patches without delay, given the range of Cisco products affected by the disclosed issues. (CISA)