Week of July 4, 2022: Maui Ransomware Advisory and NIST's Post-Quantum Algorithms

The week of July 4, 2022 brought a joint CISA-FBI-Treasury warning about North Korean state-sponsored Maui ransomware striking healthcare providers, alongside NIST's selection of four post-quantum cryptography algorithms that CISOs must begin planning for. Additional advisories covered critical patches for Cisco Expressway, OpenSSL, and Chrome, a new ransomware strain hitting QNAP NAS devices, and reports of attackers using the Brute Ratel C4 tool to evade endpoint defenses.

CISA, FBI, Treasury Warn of Maui Ransomware Targeting Healthcare

On July 6, 2022, CISA released a joint advisory with the FBI and Treasury Department warning that North Korean state-sponsored actors have used Maui ransomware against Healthcare and Public Health Sector organizations since at least May 2021. The advisory detailed how the malware encrypts servers running electronic health records, diagnostics, and imaging systems, disrupting patient care for prolonged periods. Investigators noted the initial access vector remained unknown. The agencies urged healthcare organizations to apply listed mitigations, report incidents to FBI or CISA, and avoid paying ransoms due to sanctions risk. (CISA)

NIST Selects Four Post-Quantum Cryptography Algorithms

The National Institute of Standards and Technology named the first four algorithms — CRYSTALS-Kyber for general encryption and CRYSTALS-Dilithium, FALCON, and SPHINCS+ for digital signatures — that will form its forthcoming post-quantum cryptographic standard. CISA, which highlighted the announcement in an alert dated July 5, 2022, urged organizations to inventory systems using public-key cryptography and begin planning migrations even though the standard will not be finalized for commercial use until 2024. Security leaders were advised to test the algorithms in lab environments only, not production, ahead of the official release. (Help Net Security)

OpenSSL Patches Critical Vulnerability in Version 3.0.4

CISA alerted administrators on July 6, 2022, that OpenSSL had issued a security update fixing a vulnerability in OpenSSL 3.0.4 that could let an attacker take control of an affected system. The agency directed users and administrators to review OpenSSL's advisory and upgrade to the corrected version without delay, given the widespread use of the library in securing web and network communications across enterprise infrastructure. (CISA)

Cisco Issues Updates for Expressway, TelePresence VCS, and Smart Software Manager

On July 7, 2022, CISA highlighted Cisco security updates addressing vulnerabilities in the Expressway Series, TelePresence Video Communication Server, and Smart Software Manager On-Prem products. Some flaws could let an attacker take control of an affected system, while another could trigger a denial-of-service condition. CISA pointed administrators to Cisco's advisories, cisco-sa-expressway-overwrite-3buqW8LH and cisco-sa-onprem-privesc-tP6uNZOS, and recommended applying the necessary patches to reduce exposure across collaboration and licensing infrastructure. (CISA)

Google Patches Chrome Vulnerabilities in Version 103.0.5060.114

CISA advised on July 5, 2022, that Google had shipped Chrome version 103.0.5060.114 for Windows to fix vulnerabilities an attacker could exploit to seize control of an affected system. The agency encouraged users and administrators to consult Google's Chrome Release Notes and apply the update promptly, given Chrome's broad enterprise deployment and its frequent targeting by threat actors seeking browser-based footholds into corporate networks. (CISA)

Threat Actors Adopt Brute Ratel C4 to Evade Endpoint Detection

Palo Alto Networks researchers reported on July 7, 2022, that unidentified threat actors were using Brute Ratel C4, a red-team adversary simulation tool comparable to Cobalt Strike, to slip past endpoint detection and response tools. Malicious ISO and LNK files delivering the tool's "badger" payload went largely unflagged on VirusTotal, and researchers traced command-and-control infrastructure to suspected victims in North and South America, urging security vendors to build detections for the tool's activity. (Help Net Security)

OneSpan Names Michael Lillie as Chief Information Officer

OneSpan announced on July 6, 2022, that Michael Lillie had joined the company as Chief Information Officer, reporting to President and CEO Matthew Moynahan. Lillie brought nearly 30 years of IT and information security leadership experience, having previously served as CIO at Qlik and at Endurance International Group, where he oversaw infrastructure, technical operations, and information security. He said he would focus on infrastructure and security operations as OneSpan scaled its digital-agreement business. (Help Net Security)