Week of November 27, 2023: IRGC PLC Attacks on Water Utilities and Slovenian Power Ransomware

The week of November 27, 2023 was dominated by critical-infrastructure warnings, as CISA disclosed active exploitation of internet-exposed Unitronics PLCs at a U.S. water facility and then, with the FBI, NSA and international partners, attributed the campaign to IRGC-affiliated actors operating as CyberAv3ngers. Security leaders also tracked a ransomware intrusion at Slovenian power generator HSE, the UK NCSC's new internationally backed AI security guidelines, CISA's debut Secure by Design Alert, and fresh additions to the Known Exploited Vulnerabilities catalog.

CISA Warns of Active Exploitation of Unitronics PLCs at US Water Facility

CISA disclosed that cyber threat actors were actively exploiting Unitronics programmable logic controllers used across the Water and Wastewater Systems sector, including at a U.S. water facility where an identified Unitronics PLC was compromised. The affected municipality's water authority took the system offline and switched to manual operations, and CISA said there was no known risk to the municipality's drinking water or supply. CISA urged organizations to change default passwords, require multifactor authentication for remote OT access, and disconnect PLCs from the open internet. (CISA)

CISA, FBI, NSA and Partners Detail IRGC-Linked PLC Attacks

CISA joined the FBI, NSA, the Environmental Protection Agency, and Israel's National Cyber Directorate in issuing a joint advisory on IRGC-affiliated actors operating under the persona CyberAv3ngers. The advisory described ongoing compromise of Israeli-made Unitronics Vision Series PLCs exposed to the internet through default passwords, with victims spanning multiple U.S. states and other countries. The PLCs, used across water utilities and other sectors, may appear under rebranded manufacturer names. Agencies urged all organizations to review the advisory's mitigations regardless of sector. (CISA)

CISA Launches Secure by Design Alert Series

CISA published its first Secure by Design Alert, aimed at software manufacturers whose web management interface design choices leave customers exposed to malicious cyber activity. The alert urged vendors to take ownership of customer security outcomes and embrace transparency and accountability rather than relying on hardening guides. CISA executives Eric Goldstein and Bob Lord framed the series as a way to focus attention on vendor decisions that can reduce harm at a global scale, rather than placing the burden solely on victims. (CISA)

UK NCSC Publishes AI System Security Guidelines Backed by 18 Nations

The UK National Cyber Security Centre released new guidelines covering secure design, development, deployment, and operation of AI-powered systems, developed with input from the US Cybersecurity and Infrastructure Security Agency and other agencies and CERTs worldwide. The guidance addressed threat modeling, supply chain protection, responsible release, and ongoing monitoring of AI systems, and was aimed primarily at providers of AI systems built on hosted models or external APIs. NCSC described the guidelines as the first of their kind agreed globally. (Help Net Security)

CISA Adds Two Actively Exploited Vulnerabilities to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2023-6345, a Google Skia integer overflow vulnerability, and CVE-2023-49103, an ownCloud graphapi information disclosure vulnerability. Under Binding Operational Directive 22-01, federal civilian agencies must remediate catalog entries by their due dates, and CISA urged all organizations to prioritize timely remediation of these vulnerabilities as part of routine vulnerability management practice. (CISA)

CISA Coordinates Disclosure of Court Case Management System Flaws

CISA assisted a researcher in coordinating disclosure of multiple vulnerabilities affecting web-based case and document management systems used by state, county, and municipal courts, including products from Tyler Technologies and Catalis and custom software used by specific Florida counties. The nine disclosed flaws allowed an unauthenticated, remote attacker to access sensitive documents by manipulating identifiers and file names in URLs. CISA said some vulnerabilities may already have been mitigated and encouraged administrators to apply security updates as they become available. (CISA)