Week of May 8, 2023: PaperCut Ransomware Alert and Russian Snake Malware Exposed

Security leaders tracked two major government advisories: a joint CISA-FBI warning on active exploitation of a PaperCut vulnerability by the Bl00dy Ransomware Gang against education-sector targets, and a joint disclosure attributing the long-running Snake malware implant to Russia's FSB. The period also brought Microsoft's May Patch Tuesday fixes for two actively exploited vulnerabilities, a dark web leak of MSI's firmware signing keys, and continued fallout from Western Digital's store outage tied to its March breach.

CISA and FBI Detail Active PaperCut Exploitation by Bl00dy Ransomware Gang

CISA and the FBI published a joint cybersecurity advisory on a PaperCut MF and NG vulnerability, CVE-2023-27350, that allowed unauthenticated remote code execution on vulnerable servers. The advisory, AA23-131A, said malicious actors exploited the flaw starting in mid-April 2023, with a group calling itself the Bl00dy Ransomware Gang attempting to compromise PaperCut servers inside the Education Facilities Subsector in early May 2023, in some cases leading to data exfiltration and encrypted systems. The agencies urged immediate patching and, for unpatched organizations, hunting for compromise using supplied detection signatures. (CISA)

CISA and Partners Attribute Snake Espionage Malware to Russia's FSB

CISA, the FBI, and international partners released a joint advisory attributing the Snake malware implant to Center 16 of Russia's Federal Security Service, describing it as the most sophisticated cyber espionage tool in the FSB's arsenal. The advisory said Snake infrastructure had been identified in more than 50 countries, with victims including government networks, research facilities, and journalists, and cited one case where FSB actors exfiltrated sensitive diplomatic communications from a NATO-member victim. The advisory included technical detection methods and mitigations for network defenders. (CISA)

CISA Adds Seven Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA added seven vulnerabilities to its Known Exploited Vulnerabilities Catalog on May 12, 2023, based on evidence of active exploitation, including flaws in Ruckus Wireless products, Red Hat Polkit, the Linux kernel, Jenkins, Oracle Java SE and JRockit, and Apache Tomcat. Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate the listed vulnerabilities by their assigned due dates. CISA said these vulnerability types are frequent attack vectors and urged all organizations, not just federal agencies, to prioritize remediation as part of routine vulnerability management. (CISA)

Microsoft's May Patch Tuesday Fixes Two Actively Exploited Flaws

Microsoft's May 2023 Patch Tuesday delivered fixes for 38 CVE-numbered vulnerabilities, including two flaws under active exploitation: CVE-2023-29336, a Win32k privilege-escalation bug that could grant SYSTEM access, and CVE-2023-24932, a Secure Boot bypass used by the BlackLotus bootkit to exploit a previously patched flaw. Microsoft said exploiting the Secure Boot bypass required physical access or local admin privileges, and the fix for it was not enabled by default because it could disrupt system startup. CISA separately added CVE-2023-29336 to its Known Exploited Vulnerabilities Catalog. (Help Net Security)

MSI's Private Firmware and Boot Guard Signing Keys Leaked

Attackers behind the April breach of Taiwanese hardware maker MSI leaked the company's private code-signing keys on a dark web site after MSI reportedly declined to pay a $4 million ransom demanded by a group called Money Message. Firmware security firm Binarly said the leaked data included private signing keys for firmware images used on 57 MSI products and Intel Boot Guard keys for 116 MSI products, raising concern that attackers could sign malicious firmware updates. Intel said it was investigating the reports. (Help Net Security)

Western Digital Online Store Remained Offline Amid Breach Investigation

Western Digital kept its online store offline through the period as it continued investigating a network security incident first identified on March 26, 2023. On May 5, 2023, the company told customers that an unauthorized party had obtained a store database containing names, billing and shipping addresses, email addresses, phone numbers, and encrypted, hashed and salted passwords and partial credit card numbers. Western Digital said the majority of other systems and services had been restored and that it anticipated bringing the online store back online on May 15, 2023. (Help Net Security)

CISA Welcomes First Cyber Innovation Fellows, Including a Sitting CISO

CISA Director Jen Easterly announced the agency's first two Cyber Innovation Fellows, private-sector experts joining CISA's Cybersecurity Division part-time under a program established the previous year. One of the two, Chris Hughes, Chief Information Security Officer at Aquia, was set to work on CISA's cross-sector Software Bill of Materials adoption efforts, advise on vulnerability management modernization, and make recommendations on software supply chain security. The second fellow, Michelle Hook, head of cyber threat intelligence at CLS International Bank, was to advise on CISA's cyber threat intelligence strategy. (CISA)

CISA Issues Fifteen Industrial Control Systems Advisories

CISA released fifteen Industrial Control Systems advisories on May 11, 2023, covering products from Siemens, Rockwell Automation, Sierra Wireless, Teltonika, BirdDog, SDG, and PTC. The advisories addressed vulnerabilities and exploits across equipment including Siemens Solid Edge, SCALANCE W1750D, and SINEC NMS, Rockwell's Kinetix 5500 servo drive and PanelView 800, and PTC Vuforia Studio, among others. CISA encouraged administrators managing affected industrial control systems to review each advisory for technical mitigation details. (CISA)