Week of December 12, 2022: FortiOS Zero-Day, Citrix ADC State-Sponsored Exploit

Security leaders watched Fortinet confirm in-the-wild exploitation of a critical FortiOS heap overflow and the NSA attribute active abuse of a Citrix ADC zero-day to a Chinese state-sponsored group, while Microsoft's December Patch Tuesday closed an exploited SmartScreen bypass and revoked certificates tied to malicious drivers linked to Cuba ransomware activity. CISA also updated its Cuba ransomware advisory, added another vulnerability to its Known Exploited Vulnerabilities Catalog, and joined the FBI and USDA in warning about business email compromise schemes used to steal shipments of food products.

Fortinet Patches Actively Exploited FortiOS Zero-Day

Fortinet released security updates on December 12, 2022 to fix a critical heap-based buffer overflow vulnerability, CVE-2022-42475, in FortiOS. CISA said an attacker could exploit the flaw to take control of an affected system and noted it had already been exploited in the wild. The agency urged users and administrators to review Fortinet's advisory FG-IR-22-368, apply the necessary updates, and validate their systems against the indicators of compromise the vendor published, given the product's wide use in firewall and VPN deployments. (CISA)

Citrix ADC Zero-Day Exploited by Chinese State-Sponsored Group

Citrix issued security updates on December 13, 2022 for a critical unauthenticated remote code execution vulnerability, CVE-2022-27518, in Citrix ADC and Citrix Gateway. CISA confirmed the flaw had already been exploited in the wild and pointed organizations to NSA threat-hunting guidance addressing a group tracked as APT5. Affected appliances were those configured as a SAML service provider or identity provider. CISA urged administrators to apply Citrix's patch promptly and check their environments for signs of compromise using the NSA's published guidance. (CISA)

CISA Adds Another Actively Exploited Flaw to KEV Catalog

On December 14, 2022, CISA added one more vulnerability to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. The agency reiterated that Binding Operational Directive 22-01 requires federal civilian executive branch agencies to remediate catalog entries by their assigned due dates, and encouraged all organizations to treat timely patching of catalog vulnerabilities as a core part of vulnerability management, regardless of whether the directive formally applies to them. (CISA)

CISA and FBI Update Cuba Ransomware Advisory With New Indicators

On December 13, 2022, the FBI and CISA updated their joint advisory AA22-335A on Cuba ransomware, originally issued December 1, 2022, to add fresh indicators of compromise. The revision gave network defenders updated artifacts to hunt for Cuba ransomware activity inside their environments without altering the advisory's earlier recommended mitigations. CISA encouraged organizations to review the latest version of the advisory and apply the mitigation steps to reduce their exposure to the ransomware group. (CISA)

Microsoft Patches Exploited SmartScreen Zero-Day, Revokes Abused Driver Certificates

Microsoft's December 2022 Patch Tuesday, released December 13, 2022, fixed more than 50 vulnerabilities, including CVE-2022-44698, a Windows SmartScreen bypass flaw that attackers had already used to deliver malware through files crafted to evade Mark of the Web protections. The release followed Microsoft's revocation of certificates tied to drivers submitted through its developer program that had been used maliciously in post-exploitation activity connected to Cuba ransomware intrusions, after which Microsoft suspended the associated partner accounts and added blocking detections. (Help Net Security)

Agencies Warn of Business Email Compromise Schemes Targeting Food Shipments

On December 16, 2022, the FBI, the FDA's Office of Criminal Investigations, and USDA issued a joint cybersecurity advisory describing business email compromise schemes used to steal large shipments of food products and ingredients valued at hundreds of thousands of dollars. The advisory detailed how criminal actors spoofed emails and domains to impersonate legitimate employees, placed orders for goods that went unpaid, and in some cases resold the diverted products at devalued prices without standard labeling information. CISA directed organizations to the advisory for mitigation guidance. (CISA)

NSA, CISA, and ODNI Issue Guidance on 5G Network Slicing Threats

On December 13, 2022, the National Security Agency, CISA, and the Office of the Director of National Intelligence published joint guidance on potential threats to 5G network slicing, the practice of partitioning a single physical network into multiple virtual networks for different customers or uses. Produced through the public-private Enduring Security Framework, the guidance outlined both benefits and risks of network slicing and offered mitigation strategies, building on the group's 2021 paper on 5G infrastructure threats, and was aimed at 5G providers, integrators, and network operators. (CISA)