Week of November 14, 2022: Hive Ransomware Advisory and Iranian APT Federal Breach

Security leaders tracking the week of November 14, 2022 saw CISA, the FBI, and HHS warn healthcare and critical infrastructure operators about Hive ransomware, while a separate joint advisory detailed how Iranian government-sponsored actors exploited Log4Shell to compromise a federal civilian network and deploy XMRig cryptomining software. The same week brought a new Known Exploited Vulnerabilities Catalog addition, fresh ICS advisories for Red Lion Crimson and Cradlepoint IBR600, final supply-chain security guidance for software customers from CISA, NSA, and ODNI, and vendor patches from Cisco and Samba addressing authorization-bypass and system-takeover flaws.

CISA, FBI, HHS Warned of Hive Ransomware Targeting Healthcare

On November 17, 2022, CISA, the FBI, and HHS released a joint Cybersecurity Advisory on Hive ransomware variants, detailing tactics, techniques, and procedures along with indicators of compromise identified through FBI investigations. The advisory noted that Hive had targeted Government Facilities, Communications, Critical Manufacturing, Information Technology, and especially the Healthcare and Public Health sector. CISA urged network defenders to review the advisory and apply the included mitigations, directing organizations to StopRansomware.gov for additional protection, detection, and response guidance. (CISA)

CISA and FBI Detailed Iranian APT Compromise of Federal Network

On November 16, 2022, CISA and the FBI published a joint Cybersecurity Advisory describing an incident at a Federal Civilian Executive Branch organization in which Iranian government-sponsored APT actors exploited a Log4Shell vulnerability in an unpatched VMware Horizon server. The advisory included a malware analysis report on the XMRig cryptocurrency mining software the actors deployed, along with indicators of compromise and recommended mitigations, including updating affected VMware Horizon and unified access gateway systems and minimizing internet-facing attack surface. (CISA)

CISA Added One Actively Exploited Vulnerability to KEV Catalog

On November 14, 2022, CISA added one new vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The addition fell under Binding Operational Directive 22-01, which requires Federal Civilian Executive Branch agencies to remediate catalog vulnerabilities by set deadlines to protect federal networks from active threats. CISA again urged all organizations, not just federal agencies, to prioritize timely remediation of catalog vulnerabilities as part of routine vulnerability management practice. (CISA)

CISA, NSA, ODNI Released Final Software Supply Chain Guidance for Customers

On November 18, 2022, CISA, the NSA, and the Office of the Director of National Intelligence published the third installment of their Securing Software Supply Chain Series, this one aimed at software customers. The guidance followed earlier releases for developers in August 2022 and for suppliers in October 2022, and provided recommended practices to help ensure the integrity and security of software during procurement and deployment. The series is an output of the Enduring Security Framework, a public-private working group led by NSA and CISA. (CISA)

CISA Released Two Industrial Control Systems Advisories

On November 17, 2022, CISA released two Industrial Control Systems advisories covering Red Lion Crimson and Cradlepoint IBR600 products, providing technical details on current vulnerabilities and exploits affecting ICS environments. CISA encouraged users and administrators overseeing industrial environments to review the advisories for mitigations, continuing a steady weekly cadence of ICS disclosures aimed at critical infrastructure operators managing operational technology alongside traditional IT networks. (CISA)

Cisco Patched Identity Services Engine Flaws Allowing Authorization Bypass

On November 16, 2022, Cisco released security updates addressing vulnerabilities in its Identity Services Engine, warning that a remote attacker could exploit some of the flaws to bypass authorization and access system files. CISA flagged the Cisco Identity Services Engine Insufficient Access Control Vulnerability and Cisco Identity Services Engine Cross-Site Scripting Vulnerability, urging administrators who rely on ISE for network access control to apply the vendor's patches promptly. (CISA)

Samba Team Patched Vulnerabilities Enabling System Takeover

On November 16, 2022, the Samba Team released security updates addressing vulnerabilities across multiple versions of the widely used open-source file and print server. CISA warned that an attacker could exploit some of the flaws to take control of an affected system and pointed administrators to Samba's security announcement for CVE-2022-42898 and the necessary updates. Organizations running Samba on Linux and Unix networks were encouraged to patch promptly. (CISA)