Week of March 10, 2025: Medusa Ransomware Advisory and CISA's KEV Catalog Additions

Security leaders tracked CISA's joint advisory on Medusa ransomware alongside three rounds of Known Exploited Vulnerabilities additions covering Windows, Ivanti, Juniper, and Apple products during the week of March 10, 2025. CISA also published thirteen industrial control systems advisories and addressed reporting about its Red Team, while Absolute Security named a new CISO and NIST selected a backup post-quantum encryption algorithm.

CISA, FBI, and MS-ISAC Detail Medusa Ransomware Activity

CISA, the FBI, and MS-ISAC published a joint cybersecurity advisory on Medusa ransomware on March 12, 2025, detailing tactics, techniques, and indicators of compromise tied to the ransomware-as-a-service variant. The advisory stated that, as of December 2024, Medusa had impacted over 300 victims across critical infrastructure sectors through phishing campaigns and exploitation of unpatched software vulnerabilities. CISA recommended organizations patch systems, segment networks, and filter traffic from untrusted sources to reduce the likelihood and impact of Medusa intrusions. (CISA)

CISA Adds Six Windows Flaws to Known Exploited Vulnerabilities Catalog

On March 11, 2025, CISA added six vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, all affecting Microsoft Windows components including Win32k, NTFS, the Fast FAT File System Driver, and the Windows Management Console. The agency noted that such vulnerability types are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise, directing Federal Civilian Executive Branch agencies to remediate the flaws by set deadlines under Binding Operational Directive 22-01. (CISA)

CISA Issues Thirteen ICS Advisories Covering Siemens and Other Products

CISA released thirteen Industrial Control Systems advisories on March 13, 2025, covering products from Siemens and other vendors, including Teamcenter Visualization, SINEMA Remote Connect Server, SIMATIC S7-1500 TM MFP, SiPass access control systems, SCALANCE network equipment, and OPC UA, along with a Sungrow iSolarCloud advisory and a Philips Intellispace Cardiovascular medical-device advisory. CISA encouraged users and administrators to review the advisories for technical details and mitigations to secure operational technology deployed across manufacturing, energy, and healthcare environments. (CISA)

CISA Responds to Reports on Its Red Team

CISA issued a public statement on March 12, 2025, pushing back on reports describing a layoff of its Red Team, calling the characterization inaccurate. The agency said it had taken action to terminate certain contracts to eliminate duplication of effort, an action that did not affect the employment status of CISA personnel, and that Red Team operations continued without interruption, working directly with critical infrastructure network defenders and system administrators on detection, response, and hunt capabilities. (CISA)

Absolute Security Names Harold Rivas Chief Information Security Officer

Absolute Security named Harold Rivas as its new Chief Information Security Officer during the week of March 10, 2025, according to SecurityWeek's Industry Moves roundup. Rivas previously held CISO roles at Trellix, loanDepot, Santander Consumer USA, and Mr. Cooper. The same roundup noted additional security-sector leadership changes that week, including Amir Preminger's appointment as Chief Technology Officer at ICS/OT security firm Claroty after seven years leading its Team82 research group. (SecurityWeek)

NIST Selects HQC as Backup Post-Quantum Encryption Algorithm

NIST announced on March 12, 2025, that it had selected HQC as a backup algorithm for post-quantum general encryption, intended to serve as a second line of defense should ML-KEM, the primary standard finalized in 2024, ever prove vulnerable. NIST mathematician Dustin Moody said HQC was chosen because it relies on a different mathematical approach, built around error-correcting codes rather than structured lattices. NIST plans to release a draft HQC standard for public comment within about a year. (Help Net Security)