Week of February 6, 2023: ESXiArgs Ransomware Spree and DPRK Ransomware Funding Advisory

Security leaders spent the week of February 6, 2023 responding to the fast-moving ESXiArgs ransomware campaign against VMware ESXi servers and a joint US-South Korean advisory tying North Korean ransomware proceeds to state cyber operations. CISA also pushed out a fresh OpenSSL vulnerability notice, added three actively exploited flaws to its Known Exploited Vulnerabilities Catalog, and issued multiple industrial control systems advisories.

ESXiArgs Ransomware Hits Thousands of VMware ESXi Servers

CISA and FBI issued a joint advisory on the ESXiArgs ransomware campaign, warning that attackers were exploiting known vulnerabilities in unpatched and out-of-date VMware ESXi servers to encrypt configuration files and render virtual machines unusable. The agencies said ESXiArgs actors had compromised thousands of servers globally and published a free recovery script on GitHub to help victims attempt to restore file access. CISA and FBI discouraged paying any ransom, noting payment does not guarantee recovery of encrypted files. (CISA)

Joint Advisory Warns DPRK Ransomware Funds State Cyber Operations

CISA, the NSA, FBI, HHS, and South Korea's National Intelligence Service and Defense Security Agency published a joint advisory on North Korean state-sponsored ransomware activity targeting Healthcare and Public Health Sector organizations and other critical infrastructure entities. The advisory detailed tactics and indicators of compromise used by DPRK actors, including exploitation of Log4Shell and unpatched SonicWall SMA 100 appliances, and said cryptocurrency obtained through these operations supports North Korea's national-level priorities, including cyber operations targeting United States and South Korean government networks. (CISA)

OpenSSL Advisory Addresses Multiple Vulnerabilities Across Major Versions

OpenSSL released a security advisory addressing multiple vulnerabilities affecting OpenSSL versions 3.0, 1.1.1, and 1.0.2, releases widely deployed across enterprise TLS and encryption implementations. CISA flagged the advisory to network defenders, noting an attacker could exploit some of the flaws to obtain sensitive information, and urged administrators to review OpenSSL's guidance and apply the necessary updates to reduce exposure across affected systems supporting secure communications. (CISA)

CISA Issues Six Industrial Control Systems Advisories

CISA released six Industrial Control Systems advisories covering products from Control By Web, LS Electric, Johnson Controls, Horner Automation, Omron, and ARC Informatique, detailing vulnerabilities and exploit information affecting operational technology environments. The batch, issued February 9, 2023, included updates to earlier bulletins for Omron SYSMAC and ARC Informatique PcVue, and CISA encouraged asset owners across critical infrastructure sectors to review the advisories and apply mitigations before the flaws could be used against production systems. (CISA)

CISA Flags Vulnerability in EnOcean SmartServer Building Controls

CISA published a single Industrial Control Systems advisory on February 7, 2023, covering the EnOcean SmartServer, a device used in building automation and energy management deployments. The bulletin provided technical details about the security issue and associated exploit information relevant to the product, and CISA encouraged users and administrators managing EnOcean SmartServer installations to review the advisory and apply recommended mitigations to reduce exposure within operational technology networks. (CISA)