Week of November 28, 2022: Cuba Ransomware Advisory and CISA ICS/KEV Alerts

Security leaders tracking the week of November 28, 2022 saw CISA and the FBI warn of a surge in Cuba ransomware compromises and ransom demands, while CISA separately added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog and published ten Industrial Control Systems advisories across two releases. The Cuba ransomware advisory detailed 101 compromised entities and ransom demands reaching 145 million U.S. Dollars, underscoring pressure on critical infrastructure sectors including healthcare, finance, and government facilities.

FBI and CISA Issue Joint Cuba Ransomware Advisory

On December 1, 2022, the FBI and CISA published a joint Cybersecurity Advisory titled #StopRansomware: Cuba Ransomware, updating a December 2021 FBI Flash with tactics, techniques, and indicators of compromise gathered from FBI investigations through August 2022. The advisory noted a sharp increase in compromised U.S. entities and ransom amounts demanded, and flagged a possible link between Cuba ransomware actors, RomCom Remote Access Trojan operators, and Industrial Spy ransomware actors. CISA urged network defenders to apply the advisory's mitigations. (CISA)

Cuba Ransomware Advisory Details Scale of Compromises

The more detailed CISA-FBI advisory, AA22-335A, disclosed that as of August 2022 Cuba ransomware actors had compromised 101 entities, 65 of them in the United States, and had demanded 145 million U.S. Dollars (USD) while receiving 60 million USD in ransom payments. The advisory described actors exploiting CVE-2022-24521 in the Windows Common Log File System driver and CVE-2020-1472, known as ZeroLogon, to escalate privileges, along with Kerberoasting and a tool called KerberCache used to extract cached Kerberos tickets. (CISA)

CISA Releases Seven ICS Advisories

On November 29, 2022, CISA published seven Industrial Control Systems advisories covering products from Mitsubishi Electric, Hitachi Energy, Moxa, and Omron, among others, providing technical details and mitigations for newly identified vulnerabilities. The batch included updates affecting GOT2000, IED Connectivity Packages and PCM600, MicroSCADA ProX SYS600, UC Series controllers, FA Engineering Software, MELSEC and MELIPC series, and CJ and CS series PLCs. CISA encouraged operators of industrial systems to review the advisories and apply recommended mitigations promptly. (CISA)

CISA Releases Three ICS Advisories

On December 1, 2022, CISA issued three additional Industrial Control Systems advisories addressing BD BodyGuard infusion pumps, Mitsubishi Electric's MELSEC iQ-R Series, and Horner Automation's Remote Compact Controller. The advisories provided technical details and mitigation guidance for the identified vulnerabilities. CISA encouraged administrators and users managing industrial control environments to review the advisories promptly and apply the recommended mitigations to reduce exposure to potential exploitation. (CISA)

CISA Adds Two Vulnerabilities to KEV Catalog

On November 28, 2022, CISA added two new entries to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, triggering remediation deadlines for federal civilian agencies under Binding Operational Directive 22-01. CISA reiterated that although the directive applies only to FCEB agencies, all organizations should prioritize timely patching of catalog vulnerabilities as part of routine vulnerability management to reduce exposure to active threats. (CISA)