Week of March 13, 2023: CISA Launches Ransomware Pilot, LockBit 3.0 Advisory Drops

Security leaders watching the week of March 13, 2023 saw CISA stand up a new ransomware vulnerability warning program, federal agencies warn of active LockBit 3.0 ransomware activity, and confirmation that a Progress Telerik flaw had already been exploited on a government web server. The same week brought three new entries to CISA's Known Exploited Vulnerabilities catalog, including a Microsoft Outlook flaw, alongside Microsoft's March Patch Tuesday and a batch of industrial control system advisories.

CISA Stands Up Ransomware Vulnerability Warning Pilot

CISA announced the creation of the Ransomware Vulnerability Warning Pilot, a program authorized under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 that proactively identifies internet-accessible systems at critical infrastructure entities carrying vulnerabilities commonly tied to ransomware intrusions. The agency said it had already notified 93 organizations running Microsoft Exchange instances with the ProxyNotShell vulnerability, which has been widely exploited by ransomware actors, and that the pilot would be coordinated with the Joint Ransomware Task Force co-led by CISA and the FBI. (CISA)

Microsoft Ships March 2023 Security Updates

Microsoft released its March 2023 security updates addressing multiple vulnerabilities across its software portfolio, including the Outlook elevation of privilege flaw that CISA separately added to its exploited vulnerabilities catalog the same day. CISA encouraged users and administrators to consult Microsoft's Security Update Guide and apply the necessary patches, noting that attackers could exploit some of the addressed vulnerabilities to take full control of an affected system. (CISA)

Telerik Flaw Confirmed Exploited on Federal Web Server

CISA, the FBI, and MS-ISAC released a joint advisory confirming that multiple cyber threat actors, including an advanced persistent threat actor, had exploited a .NET deserialization vulnerability in Progress Telerik's user interface for ASP.NET AJAX on a federal civilian executive branch agency's IIS web server. The exploitation allowed remote code execution and let attackers upload malicious DLL files, some disguised as PNG images, to the server. CISA pointed defenders to an accompanying malware analysis report for indicators of compromise. (CISA)

FBI, CISA, and MS-ISAC Detail LockBit 3.0 Ransomware Tactics

The FBI, CISA, and the Multi-State Information Sharing and Analysis Center published a joint #StopRansomware advisory on LockBit 3.0, sharing indicators of compromise and tactics drawn from FBI investigations as recent as March 2023. The advisory described LockBit 3.0, also called LockBit Black, as a more modular and evasive continuation of earlier LockBit versions operating as a ransomware-as-a-service model, with affiliates gaining initial access through RDP exploitation, phishing, valid account abuse, and exploitation of public-facing applications. (CISA)

CISA Publishes Eight Industrial Control Systems Advisories

CISA released eight Industrial Control Systems advisories covering products from Siemens, Honeywell, Rockwell Automation, and AVEVA, including SCALANCE and RUGGEDCOM devices, the Mendix SMAL module, a OneWireless Wireless Device Manager, and a Modbus TCP AOI server. The advisories provided technical details on current security issues and mitigations affecting operational technology environments, and CISA urged asset owners and administrators to review each bulletin and apply the recommended fixes to reduce exposure in industrial networks. (CISA)