Week of February 17, 2025: Ghost Ransomware Alert and DoD CISO Return

Security leaders faced a cluster of federal alerts between February 17 and February 23, 2025, headlined by a joint CISA-FBI-MS-ISAC advisory on Ghost (Cring) ransomware and five new Known Exploited Vulnerabilities Catalog entries spanning Palo Alto Networks, SonicWall, Craft CMS, and Microsoft Power Pages. The same stretch also brought nine CISA industrial control systems advisories and the return of Katie Arrington as the Department of Defense's Chief Information Security Officer.

CISA, FBI, MS-ISAC Issue Ghost (Cring) Ransomware Advisory

On February 19, 2025, CISA, the FBI, and the Multi-State Information Sharing and Analysis Center published a joint #StopRansomware advisory on Ghost (Cring) ransomware, detailing indicators of compromise and tactics identified through FBI investigations as recent as January 2025. The advisory described Ghost actors exploiting outdated, internet-facing software and firmware, including Fortinet FortiOS, Adobe ColdFusion, and Microsoft Exchange vulnerabilities tied to the ProxyShell attack chain, to deploy ransomware payloads often within the same day as initial compromise. It urged defenders to patch known CVEs, segment networks, and require phishing-resistant multi-factor authentication for privileged accounts. (CISA)

CISA Adds Palo Alto and SonicWall Flaws to Known Exploited Vulnerabilities Catalog

On February 18, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2025-0108, a Palo Alto Networks PAN-OS authentication bypass vulnerability, and CVE-2024-53704, a SonicWall SonicOS SSLVPN improper authentication vulnerability. The addition triggered Binding Operational Directive 22-01 remediation deadlines for federal civilian executive branch agencies, and CISA again urged all organizations, not just federal agencies, to prioritize patching catalog vulnerabilities as part of routine vulnerability management practice. (CISA)

CISA Flags Craft CMS and a Second PAN-OS Bug as Actively Exploited

On February 20, 2025, CISA added two more vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2025-23209, a Craft CMS code injection vulnerability, and CVE-2025-0111, a Palo Alto Networks PAN-OS file read vulnerability, both flagged for evidence of active exploitation. Under Binding Operational Directive 22-01, federal civilian executive branch agencies faced a remediation due date for the two entries, and CISA encouraged all organizations to fold catalog vulnerabilities into their patching priorities to reduce exposure to ongoing attacks. (CISA)

Microsoft Power Pages Flaw Added to CISA Exploited Vulnerabilities List

On February 21, 2025, CISA added CVE-2025-24989, an improper access control vulnerability in Microsoft Power Pages, to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. The listing set a remediation deadline for federal civilian executive branch agencies under Binding Operational Directive 22-01 and renewed CISA's broader call for organizations of all sizes to treat catalog entries as high-priority items in vulnerability management programs, given their frequent use as attack vectors by malicious cyber actors. (CISA)

CISA Publishes Seven ICS Advisories Covering ABB, Siemens, Mitsubishi Electric

CISA released seven Industrial Control Systems advisories on February 20, 2025, spanning ABB's ASPECT-Enterprise, NEXUS, MATRIX, and FLXEON product lines, Siemens SiPass Integrated, Rapid Response Monitoring's My Security Account App, Elseta's Vinci Protocol Analyzer, an update to a Mitsubishi Electric CNC Series advisory, and a medical device advisory for Medixant's RadiAnt DICOM Viewer. The advisories laid out technical details and mitigations for current vulnerabilities and exploits affecting the listed industrial and healthcare-adjacent control products, and CISA encouraged administrators to review and apply the guidance. (CISA)

CISA Issues Two ICS Advisories for Delta Electronics and Rockwell Automation

CISA released two Industrial Control Systems advisories on February 18, 2025, updating prior guidance on Delta Electronics' CNCSoft-G2 software and on Rockwell Automation's GuardLogix 5380 and 5580 controllers. Each advisory provided technical details on the underlying vulnerabilities along with recommended mitigations for asset owners running the affected products. CISA encouraged users and administrators across critical infrastructure sectors to review the advisories and apply the fixes to reduce exposure to known exploits and security issues surrounding the control systems. (CISA)

Katie Arrington Returns as Chief Information Security Officer at the Department of Defense

During the week of February 17, 2025, SecurityWeek's Industry Moves column reported that Katie Arrington had been appointed CISO at the Department of Defense, returning to a post she previously held between 2019 and 2022. In the interim she took on leadership roles at supply chain and risk management company Exiger. The same roundup also noted that Australia's .au domain administrator, auDA, named Robert Turney as its first CISO, after he held cybersecurity roles at iSelect and Australia Post. (SecurityWeek)