Week of June 12, 2023: CISA's Management-Interface Directive and LockBit Advisory

The week of June 12, 2023 brought a run of federal directives and high-profile vulnerability disclosures that kept security leaders occupied: CISA issued Binding Operational Directive 23-02 to curb internet-exposed management interfaces, published a joint advisory on LockBit ransomware with five allied nations, and added an actively exploited Fortinet FortiOS flaw to its Known Exploited Vulnerabilities Catalog. Progress Software and Barracuda Networks both updated guidance on previously disclosed flaws in MOVEit Transfer and Email Security Gateway appliances, while ISACA named a new chief executive to lead its global digital trust community.

CISA Orders Federal Agencies to Lock Down Management Interfaces

On June 13, 2023, CISA issued Binding Operational Directive 23-02, requiring federal civilian executive branch agencies to remove internet-exposed networked management interfaces from public access or protect them with Zero Trust Architecture controls within 14 days of discovery. The directive responded to recent threat campaigns exploiting improperly configured network devices to gain unrestricted network access. While mandatory only for federal civilian agencies, CISA urged all organizations across sectors to adopt the same guidance to reduce attack surface and limit full-scale compromise from exposed interfaces. (CISA)

CISA and Global Partners Detail LockBit Ransomware Tactics

On June 14, 2023, CISA, the FBI, MS-ISAC, and cybersecurity authorities from Australia, Canada, the UK, Germany, France, and New Zealand published a joint advisory, Understanding Ransomware Threat Actors: LockBit, detailing the group's tools, tactics, and exploited vulnerabilities. The advisory described LockBit as the most deployed ransomware variant worldwide in 2022, still active in 2023, with affiliates attacking financial services, healthcare, education, energy, manufacturing, and government sectors. The authoring agencies recommended mitigations to help organizations reduce the likelihood and impact of future ransomware incidents. (CISA)

Progress Discloses Additional MOVEit Transfer SQL Injection Flaws

On June 12, 2023, Progress Software disclosed additional SQL injection vulnerabilities in its MOVEit Transfer managed file transfer solution, found with help from researchers at Huntress, and urged customers to apply newly issued patches to on-premises installations. The new flaws had not yet received CVE numbers at disclosure. The discovery followed weeks of active exploitation of an earlier MOVEit zero-day, CVE-2023-34362, by the Cl0p extortion gang, which hit organizations across technology, manufacturing, healthcare, and financial services sectors during the Memorial Day weekend. (Help Net Security)

Barracuda Updates Advisory on Exploited Email Security Gateway Flaw

On June 15, 2023, CISA highlighted an updated Barracuda Networks advisory addressing CVE-2023-2868, a vulnerability in Email Security Gateway appliances that had been exploited by an aggressive threat actor. Barracuda advised affected customers to replace impacted appliances immediately rather than rely on a software patch alone. CISA urged organizations that used privileged credentials, such as Active Directory Domain Admin accounts, for appliance management to take immediate incident investigation steps, warning that threat actors could have used the appliance as an entry point into broader enterprise networks. (CISA)

CISA Updates Joint Advisory on Exploited Telerik Flaws in Government Servers

On June 15, 2023, CISA, the FBI, and MS-ISAC updated a joint advisory on exploitation of Progress Telerik UI for ASP.NET AJAX vulnerabilities, renaming it to reflect identified activity at an additional federal civilian executive branch agency. The update detailed forensic analysis of CVE-2017-9248 exploitation separate from the CVE-2019-18935 activity described in the original publication, and provided a timeline of unattributed advanced persistent threat activity, including malicious files recovered from compromised IIS servers. CISA pointed defenders to an accompanying malware analysis report for further technical detail. (CISA)

ISACA Names Erik Prusch as New Chief Executive Officer

On June 12, 2023, ISACA announced that Erik Prusch would join the organization as its new CEO, bringing prior chief executive experience at companies including Outerwall, Lumension, NetMotion Wireless, Clearwire, and Borland Software Corporation. ISACA Board Chair Pam Nigro said his leadership experience would help the association, known for the CISA and CISM certifications and the COBIT framework, continue serving its membership base spanning 170,000 professionals in 188 countries during a period of global expansion for the organization. (Help Net Security)