Week of November 13, 2023: Scattered Spider Advisory, Rhysida Ransomware Guidance

Security leaders tracked joint federal advisories on the Scattered Spider extortion group and Rhysida ransomware, an updated advisory on Royal ransomware, and a string of new entries added to CISA's Known Exploited Vulnerabilities Catalog covering SysAid, Juniper, Sophos, Oracle, and Microsoft flaws. Microsoft's November Patch Tuesday release and a new CISA-ACSC business continuity toolkit gave network defenders additional guidance to act on between November 13 and November 19, 2023.

FBI and CISA Warn of Scattered Spider Extortion Group

On November 16, 2023, the FBI and CISA published a joint cybersecurity advisory describing tactics used by the Scattered Spider group, which engages in data theft for extortion against commercial facilities sectors. The advisory noted the group's use of social engineering and noted its use of BlackCat/ALPHV ransomware alongside its usual techniques, based on FBI investigations conducted through November 2023. CISA urged network defenders to review recommended mitigations. (CISA)

CISA Adds SysAid and Juniper Flaws to Exploited Vulnerabilities List

On November 13, 2023, CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, including a SysAid Server path traversal flaw and five Juniper Junos OS vulnerabilities affecting EX Series and SRX Series devices. Federal civilian agencies were required to remediate the flaws under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize remediation as part of their vulnerability management practice. (CISA)

CISA Flags Sophos, Oracle, and Windows Flaws as Actively Exploited

On November 16, 2023, CISA added three more vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing active exploitation of a Microsoft Windows Mark of the Web security bypass, a Sophos Web Appliance command injection flaw, and an Oracle Fusion Middleware vulnerability. The additions fall under Binding Operational Directive 22-01, which requires federal civilian agencies to remediate listed vulnerabilities by set deadlines, though CISA recommended all organizations do the same. (CISA)

Microsoft Ships November Patch Tuesday Fixes

On November 14, 2023, Microsoft released its November Patch Tuesday updates addressing multiple vulnerabilities across its software portfolio. CISA warned that threat actors could exploit some of the flaws to take control of affected systems and urged administrators to apply the updates promptly after reviewing Microsoft's Security Update Guide. (CISA)

CISA and Australian Partners Launch Business Continuity in a Box

On November 13, 2023, CISA and the Australian Signals Directorate's Australian Cyber Security Centre released Business Continuity in a Box, a toolkit to help organizations quickly and securely stand up critical business functions during or after a cyber incident. The resource comprises two components, Continuity of Communications and Continuity of Applications, designed for situations where data or system availability has been compromised. CISA tied the release to its Critical Infrastructure Security and Resilience Month activities. (CISA)