Week of October 3, 2022: CISA's Asset Directive and a DIB Espionage Breach Disclosed

The week of October 3, 2022 brought a new binding federal directive on asset visibility, a detailed advisory on a nation-state breach of a Defense Industrial Base organization, and a fresh warning on the top vulnerabilities exploited by Chinese state-sponsored actors. CISA also flagged two actively exploited Microsoft Exchange zero-days for its Known Exploited Vulnerabilities catalog while issuing advisories covering Cisco networking gear and five industrial control systems products.

CISA Issues Binding Operational Directive 23-01 on Asset Visibility

CISA issued Binding Operational Directive 23-01 on October 3, 2022, directing federal civilian executive branch agencies to improve asset visibility and vulnerability detection across their networks. The directive requires agencies to build capabilities for automated asset discovery and vulnerability enumeration, with CISA recommending that all organizations review and adopt the same standards to strengthen cyber resilience, even though the directive itself applies only to federal agencies. (CISA)

Joint Advisory Details APT Breach of Defense Industrial Base Organization

CISA, the FBI, and the NSA published a joint advisory describing an advanced persistent threat campaign against a Defense Industrial Base sector organization's enterprise network. Investigators found that multiple APT groups had used the open-source Impacket toolkit to move laterally and a custom tool called CovalentStealer to exfiltrate sensitive data, with some actors maintaining long-term access to the compromised environment. CISA had responded to the intrusion between November 2021 and January 2022, and the advisory detailing it was released the week of October 3, 2022. (CISA)

NSA, CISA, FBI Publish Top CVEs Exploited by PRC State-Sponsored Actors

NSA, CISA, and the FBI released a joint cybersecurity advisory listing the top Common Vulnerabilities and Exposures that People's Republic of China state-sponsored cyber actors have exploited since 2020 against U.S. and allied networks. The list included widely known flaws such as Apache Log4j's CVE-2021-44228, Microsoft Exchange's CVE-2021-26855, and Citrix ADC's CVE-2019-19781, and the agencies urged organizations to prioritize patching, adopt phishing-resistant multi-factor authentication, and move toward a Zero Trust security model. (CISA)

Exchange Zero-Days CVE-2022-41040 and CVE-2022-41082 Added to CISA's KEV Catalog

CVE-2022-41040 and CVE-2022-41082, two Microsoft Exchange zero-day vulnerabilities that still had no official patch, were added to CISA's Known Exploited Vulnerabilities Catalog on October 3, 2022. Microsoft continued revising its mitigation guidance after researchers found earlier advice ineffective, and the company said the flaws had been used to compromise fewer than 10 organizations globally in a small number of targeted attacks observed since August 2022. (Help Net Security)

FBI and CISA Assess Election Infrastructure Cyber Activity Ahead of Midterms

The FBI and CISA published a joint public service announcement assessing that malicious cyber activity targeting election infrastructure was unlikely to cause large-scale disruption or prevent voting ahead of the 2022 midterms. The agencies said they had no reporting indicating that cyber activity had ever prevented a registered voter from casting a ballot, compromised the integrity of ballots cast, or altered voter registration accuracy, and the PSA outlined safeguards protecting election systems. (CISA)

Cisco Patches Multiple Products After CISA Alert

Cisco released security updates addressing vulnerabilities across multiple products, including its Enterprise NFV Infrastructure Software and its Expressway Series and TelePresence Video Communication Server. CISA highlighted the updates in an October 6, 2022 alert, noting that a remote attacker could exploit some of the flaws to take control of an affected system, and urged administrators to apply the necessary patches. (CISA)

CISA Releases Five Industrial Control Systems Advisories

CISA released five Industrial Control Systems advisories on October 4, 2022, covering products from Johnson Controls, Hitachi Energy, Horner Automation, Omron, and Becton Dickinson. The advisories addressed security issues and vulnerabilities affecting systems including the Johnson Controls Metasys ADX Server, Hitachi Energy's Modular Switchgear Monitoring, and BD's Totalys MultiProcessor, giving administrators technical details and mitigations to reduce exposure to exploitation of ICS environments. (CISA)