Week of March 3, 2025: BianLian Extortion Mailers and Dual Ransomware Disclosures

Security leaders tracked an FBI-CISA alert on extortion letters impersonating the BianLian ransomware brand, nine newly catalogued actively exploited vulnerabilities spanning Cisco routers to VMware ESXi, and multiple ICS advisories covering Hitachi Energy, Schneider Electric, Carrier, and other industrial vendors. Two public companies, Lee Enterprises and National Presto Industries, filed SEC disclosures detailing material cybersecurity incidents, while iVerify named a new chief information security officer.

FBI Warns Executives of BianLian-Branded Extortion Mailers

On March 6, 2025, CISA amplified an FBI Internet Crime Complaint Center alert describing extortion letters sent to corporate executives by criminals claiming affiliation with the BianLian ransomware group. The letters threatened to release sensitive company data unless a ransom was paid. CISA urged organizations to review the FBI advisory and report similar attempts to its 24/7 Operations Center. The alert illustrated how threat actors continue to invoke established ransomware brands to pressure executives directly through physical mail rather than network intrusion. (CISA)

CISA Flags Five Actively Exploited Vulnerabilities, Including Cisco Routers

On March 3, 2025, CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, including a command injection flaw in Cisco Small Business RV Series routers, two flaws in Hitachi Vantara Pentaho BA Server, a Windows Win32k resource-handling bug, and a path traversal vulnerability in Progress WhatsUp Gold. Federal civilian agencies were required to remediate the flaws under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching these vulnerabilities as part of routine vulnerability management practices. (CISA)

CISA Adds VMware ESXi Flaws to Exploited Vulnerabilities List

On March 4, 2025, CISA added four more vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing active exploitation. The additions included a Linux kernel use-of-uninitialized-resource flaw and three VMware vulnerabilities affecting ESXi, Workstation, and Fusion products: an arbitrary write bug, a time-of-check-time-of-use race condition, and an information disclosure issue. CISA again noted that these vulnerability types remain frequent attack vectors and reiterated that Federal Civilian Executive Branch agencies must remediate catalog entries by required deadlines, while encouraging all organizations to factor the additions into their own patching priorities. (CISA)

CISA Publishes Eight ICS Advisories Covering Carrier, Hitachi, Delta Systems

CISA released eight Industrial Control Systems advisories on March 4, 2025, covering products from Carrier, Keysight Technologies, Hitachi Energy, Delta Electronics, GMOD, and Edimax. The advisories addressed issues in Carrier Block Load, Keysight Ixia Vision Product Family, multiple Hitachi Energy platforms including MACH PS700, XMC20, and UNEM/ECST, Delta Electronics CNCSoft-G2, GMOD Apollo, and an Edimax IP camera. CISA encouraged administrators managing these industrial systems to review the technical details and apply recommended mitigations promptly to reduce exposure across operational technology environments. (CISA)

CISA Issues Three More ICS Advisories for Hitachi, Schneider Electric Gear

CISA released three additional Industrial Control Systems advisories on March 6, 2025, addressing vulnerabilities in Hitachi Energy's PCU400 and Relion 670/650/SAM600-IO product lines as well as an update to a previously issued advisory for Schneider Electric's EcoStruxure platform. The advisories provided technical detail on the affected systems and mitigation steps. CISA continued to encourage ICS operators and administrators to review the bulletins closely, reflecting ongoing agency attention to vulnerabilities in energy-sector control equipment during the first week of March. (CISA)

Lee Enterprises Discloses Material Impact, Lender Waiver After Ransomware Attack

In a Form 8-K/A filed March 6, 2025, Lee Enterprises provided updated detail on the cybersecurity attack that caused a February 3, 2025 system outage, confirming threat actors had encrypted critical applications and exfiltrated files. The company said the incident was likely to have a material impact on its financial condition and results of operations, while forensic work to determine whether personally identifiable information was taken remained ongoing. Lee's sole lender agreed to waive March 2025 interest and lease payments, providing $3.7M of additional capital to support remediation while back-office functions such as billing and vendor payments remained delayed. (SEC EDGAR)

National Presto Industries Discloses Cybersecurity Incident Disrupting Operations

National Presto Industries disclosed in a Form 8-K filed March 6, 2025 that it experienced a system outage caused by a cybersecurity incident on March 1, 2025. The company activated its incident response team, engaged external cybersecurity experts, and began a forensic investigation while notifying law enforcement and relevant regulators. The incident temporarily affected shipping and receiving, portions of manufacturing, and back-office functions, with the company stating the event could have a material impact on its financial condition and results of operations as the investigation continued. (SEC EDGAR)