Week of January 23, 2023: CISA RMM Phishing Warning and K-12 Security Report

Security leaders tracking the week of January 23, 2023 saw CISA, the NSA, and MS-ISAC warn that criminal actors were abusing legitimate remote monitoring and management tools such as ScreenConnect and AnyDesk in a bank-fraud phishing scheme, while CISA separately added Zoho ManageEngine and Telerik UI flaws to its Known Exploited Vulnerabilities Catalog. The same week brought a new CISA K-12 cybersecurity report, the launch of JCDC's 2023 Planning Agenda, and vendor patch advisories covering Apple, VMware, and ISC's BIND 9.

CISA, NSA, MS-ISAC Warn of RMM Software Abuse in Bank-Fraud Phishing Campaign

CISA, the NSA, and the Multi-State Information Sharing and Analysis Center published a joint advisory describing a phishing campaign in which criminal actors used legitimate remote monitoring and management software, including ScreenConnect and AnyDesk, to access victim computers and manipulate online banking sessions to steal funds. The advisory said CISA identified the activity through retrospective analysis of its EINSTEIN intrusion detection system and found related traffic on multiple federal civilian networks. The agencies urged network defenders to review indicators of compromise and apply mitigations against RMM-enabled backdoor access. (CISA)

CISA Adds Zoho ManageEngine Flaw to Known Exploited Vulnerabilities Catalog

On January 23, 2023, CISA added one vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, a list of flaws federal civilian agencies must remediate under Binding Operational Directive 22-01. The entry addressed a Zoho ManageEngine vulnerability tracked as CVE-2022-47966, which CISA said posed a significant risk to the federal enterprise. CISA urged all organizations, not only federal agencies, to prioritize remediation of catalog vulnerabilities as part of routine vulnerability management. (CISA)

CISA Adds Telerik UI Vulnerability to Known Exploited Vulnerabilities Catalog

Three days later, on January 26, 2023, CISA added a second vulnerability to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The newly listed flaw was CVE-2017-11357, affecting Telerik User Interface for ASP.NET AJAX. Under Binding Operational Directive 22-01, federal civilian executive branch agencies must remediate catalog entries by their due dates, and CISA again encouraged all organizations to treat catalog vulnerabilities as a priority within their broader vulnerability management programs. (CISA)

CISA Releases K-12 Cybersecurity Report and Toolkit for Schools

CISA published "Partnering to Safeguard K-12 Organizations from Cybersecurity Threats," a report offering recommendations and an online toolkit to help school districts manage systemic cybersecurity risk. The report found that K-12 organizations need resources, simplicity, and prioritization to reduce risk, and it recommended investing in impactful security measures, addressing resource constraints, and focusing on collaboration and information-sharing. CISA Director Jen Easterly said schools needed to be "better prepared to confront a complex threat environment" as malicious actors targeted education technology. (CISA)

CISA's JCDC Unveils 2023 Planning Agenda for Collective Cyber Defense

CISA's Joint Cyber Defense Collaborative announced its 2023 Planning Agenda, bringing together government and private-sector partners to build cyber defense plans aimed at systemic risk, collective cyber response, and high-risk communities. The agenda included efforts to address open-source software risk in industrial control systems, reduce supply-chain risk for small and midsize critical infrastructure, and deepen coordination with the energy sector. CISA framed the initiative as a step toward more rapid, coordinated action across government and industry when major cyber risks emerge. (CISA)

Apple Patches Multiple Products Including Safari, iOS, and macOS

Apple released security updates addressing vulnerabilities across a wide range of products, including Safari 16.3, iOS 12.5.7, macOS Monterey 12.6.3, macOS Big Sur 11.7.3, watchOS 9.3, iOS and iPadOS 15.7.3, iOS and iPadOS 16.3, and macOS Ventura 13.2. CISA said an attacker could exploit some of the flaws to take control of an affected device, and it urged users and administrators to apply the updates as soon as possible across every impacted platform. (CISA)

VMware Patches vRealize Log Insight Against Remote Takeover Flaws

VMware released security updates addressing multiple vulnerabilities in vRealize Log Insight that a remote attacker could exploit to take control of an affected system. CISA pointed administrators to VMware Security Advisory VMSA-2023-0001 and encouraged organizations running the log-management platform to apply the necessary updates promptly to close off the identified attack paths. (CISA)

ISC Issues Security Advisories for Multiple BIND 9 Versions

The Internet Systems Consortium released security advisories covering four vulnerabilities, CVE-2022-3094, CVE-2022-3488, CVE-2022-3736, and CVE-2022-3924, affecting multiple versions of its widely used BIND 9 domain name system software. CISA said a remote attacker could exploit the flaws to cause denial-of-service conditions and system failures, and it encouraged administrators running DNS infrastructure on BIND 9 to review ISC's advisories and apply the necessary mitigations without delay. (CISA)