Week of April 17, 2023: CISA Chief of Staff Transition and APT28 Cisco Router Advisory

Security leaders watched CISA announce a chief of staff transition, a joint advisory detailing APT28's exploitation of Cisco routers, and new CISA malware analysis tying an infostealer to the 3CX supply chain compromise. The week also brought fresh entries to CISA's Known Exploited Vulnerabilities Catalog, a VMware logging-product patch, multinational guidance on smart city cybersecurity, and research on sensitive data left on resold corporate routers.

CISA Chief of Staff Kiersten Todt to Depart, Kathryn Coulter Mitchell Named Successor

CISA announced that Kiersten Todt would leave her post as Chief of Staff to return to the private sector, while remaining available to the agency in a senior advisory capacity. She was to be succeeded by Kathryn Coulter Mitchell, who had been serving as Deputy Under Secretary for the DHS Science and Technology Directorate. Coulter Mitchell was set to support planning, resource allocation, and implementation of CISA's Strategic Plan, continuing leadership continuity at the agency during an active threat period for federal networks. (CISA)

Joint Advisory Details APT28 Exploitation of Cisco Routers via CVE-2017-6742

The UK's NCSC, the US NSA, CISA, and the FBI released a joint advisory describing how the Russian state-linked actor APT28 exploited CVE-2017-6742 to access poorly maintained Cisco routers and deploy malware on unpatched devices. The advisory covered 2021 activity that used weak or default SNMP community strings to reach routers in Europe, US government institutions, and approximately 250 Ukrainian victims, with further technical detail provided in NCSC's accompanying Jaguar Tooth malware analysis report. (CISA)

CISA Adds MinIO, PaperCut, and Chrome Flaws to KEV Catalog

CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a MinIO information disclosure flaw (CVE-2023-28432), a PaperCut MF/NG improper access control vulnerability (CVE-2023-27350), and a Google Chrome Skia integer overflow (CVE-2023-2136). Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate these by CISA's specified due dates, while the agency urged all organizations to prioritize the fixes as part of standard vulnerability management. (CISA)

Five Eyes Agencies Release Smart Cities Cybersecurity Guidance

CISA joined the NSA, FBI, NCSC-UK, the Australian Cyber Security Centre, the Canadian Centre for Cyber Security, and NCSC-NZ to publish a joint guide, Cybersecurity Best Practices for Smart Cities. The guidance addressed expanded attack surfaces, ICT supply chain risk, and automation of infrastructure operations, recommending secure planning and design, proactive supply chain risk management, and operational resilience measures such as multifactor authentication, zero trust architecture, and incident response planning for communities integrating connected technologies. (CISA)

VMware Patches Aria Operations for Logs Vulnerabilities

VMware released a security update addressing multiple vulnerabilities in Aria Operations for Logs, formerly known as vRealize Log Insight, that could let a cyber threat actor take control of an affected system. CISA pointed administrators to VMware Security Advisory VMSA-2023-0007 and urged prompt patching of the logging product, which organizations commonly rely on for centralized log management across on-premises and cloud environments. (CISA)

ESET Finds Sensitive Corporate Data Left on Resold Routers

ESET researchers reported that 56% of decommissioned routers disposed of and sold on the secondary market contained sensitive corporate data, including authentication credentials, VPN details, and customer information. Among devices with complete configuration data, 100% held IPsec or VPN credentials or hashed root passwords, and 100% contained enough data to identify the former owner, raising concerns about third-party decommissioning and disposal practices at organizations ranging from medium-sized businesses to global enterprises. (Help Net Security)