Week of September 18, 2023: Snatch Ransomware Advisory and CISA KEV Catalog Additions

Security leaders tracked a joint FBI-CISA advisory on Snatch ransomware, three additions to CISA's Known Exploited Vulnerabilities catalog covering Samsung, MinIO, and Trend Micro Apex One flaws, and a batch of Apple security updates addressing actively exploited iOS and macOS bugs. Vendor patch cycles continued alongside a Saudi Arabia leadership appointment at threat-intelligence firm Resecurity, underscoring both the operational and organizational dimensions of the week's cybersecurity activity.

FBI and CISA Detail Snatch Ransomware Tactics

On September 20, 2023, the FBI and CISA released a joint advisory on Snatch ransomware, which has operated since 2018 and targeted the Defense Industrial Base, Food and Agriculture, and Information Technology sectors. The advisory described Snatch actors exploiting Remote Desktop Protocol weaknesses to obtain administrator credentials, using a customized ransomware variant that reboots victim devices into Safe Mode to evade antivirus tools, and pursuing double extortion by threatening to post stolen data on an extortion blog. CISA urged organizations to secure RDP, maintain offline backups, and enforce phishing-resistant MFA. (CISA)

CISA Adds Eight Vulnerabilities to Known Exploited Catalog

On September 18, 2023, CISA added eight vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, spanning flaws in Samsung mobile devices, Realtek SDK, Zyxel EMG2926 routers, Laravel Ignition, and four issues in Owl Labs Meeting Owl devices. The catalog entries trigger remediation deadlines for federal civilian executive branch agencies under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize fixing these vulnerabilities as part of routine vulnerability management practices. (CISA)

MinIO Flaw Added to CISA's Known Exploited Vulnerabilities List

CISA added CVE-2023-28434, a security feature bypass vulnerability in MinIO, to its Known Exploited Vulnerabilities Catalog on September 19, 2023, citing evidence of active exploitation. The addition triggers Binding Operational Directive 22-01 remediation deadlines for federal civilian executive branch agencies, and CISA again urged all organizations to treat catalog entries as high-priority patching targets given their frequent use as attack vectors. (CISA)

Trend Micro Apex One RCE Flaw Joins KEV Catalog

On September 21, 2023, CISA added CVE-2023-41179, a remote code execution vulnerability affecting Trend Micro Apex One and Worry-Free Business Security, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. Federal civilian agencies were required to remediate the flaw under Binding Operational Directive 22-01, and CISA again urged organizations broadly to prioritize the vulnerability given its use as an attack vector by malicious cyber actors. (CISA)

Apple Patches Flaws Across iOS, macOS, watchOS

CISA advised on September 22, 2023 that Apple had issued a slate of security updates, including iOS 17.0.1, iPadOS 17.0.1, iOS 16.7, watchOS 10.0.1, watchOS 9.6.3, Safari 16.6.1, macOS Ventura 13.6, and macOS Monterey 12.7, addressing vulnerabilities that a threat actor could use to take control of an affected device. CISA encouraged users and administrators to apply the updates across the listed products. (CISA)

ISC Patches Two BIND 9 Denial-of-Service Flaws

The Internet Systems Consortium released advisories on September 21, 2023 addressing two vulnerabilities in BIND 9, CVE-2023-4236 and CVE-2023-3341, that a malicious actor could exploit to cause denial-of-service conditions in the widely used DNS software. CISA urged administrators running BIND 9 to review the ISC advisories and apply available updates or workarounds to prevent named processes from terminating unexpectedly under attack. (CISA)

Resecurity Names Mohammed Alghamdi Managing Director for Saudi Arabia

Resecurity announced on September 18, 2023 that it had appointed Mohammed Alghamdi as Managing Director for its operations in the Kingdom of Saudi Arabia, a role focused on government affairs and mission-critical operations tied to national security, aerospace, and defense. Alghamdi previously held roles at Booz Allen Hamilton, Oliver Wyman, and Bain & Company. Resecurity CEO Gene Yoo said the appointment would support the company's business development efforts and partnerships across the region. (Help Net Security)