Bulletins | CERT@VDE

Threat Actors Exploiting Ivanti EPMM Vulnerabilities

Titel

Threat Actors Exploiting Ivanti EPMM Vulnerabilities

Veröffentlicht

1. August 2023 16:42

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a

Text

SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) are releasing this joint Cybersecurity Advisory (CSA) in response to active exploitation of CVE-2023-35078 and CVE-2023-35081. Advanced persistent threat (APT) actors exploited CVE-2023-35078 as a zero day from at least April 2023 through July ...

Juli 2023

26.07.2023

Preventing Web Application Access Control Abuse

Titel

Preventing Web Application Access Control Abuse

Veröffentlicht

26. Juli 2023 23:10

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-208a

Text

SUMMARY The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), U.S. Cybersecurity and Infrastructure Security Agency (CISA), and U.S. National Security Agency (NSA) are releasing this joint Cybersecurity Advisory to warn vendors, designers, and developers of web applications and organizations using web applications about insecure direct object reference (IDOR) vulnerabilities. ...

20.07.2023

Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells

Titel

Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells

Veröffentlicht

20. Juli 2023 21:28

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a

Text

SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this Cybersecurity Advisory to warn network defenders about exploitation of CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway. In June 2023, threat actors exploited this vulnerability as a zero-day ...

11.07.2023

Enhanced Monitoring to Detect APT Activity Targeting Outlook Online

Titel

Enhanced Monitoring to Detect APT Activity Targeting Outlook Online

Veröffentlicht

11. Juli 2023 23:55

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a

Text

SUMMARY In June 2023, a Federal Civilian Executive Branch (FCEB) agency identified suspicious activity in their Microsoft 365 (M365) cloud environment. The agency reported the activity to Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA), and Microsoft determined that advanced persistent threat (APT) actors accessed and exfiltrated unclassified Exchange ...

05.07.2023

Increased Truebot Activity Infects U.S. and Canada Based Networks

Titel

Increased Truebot Activity Infects U.S. and Canada Based Networks

Veröffentlicht

5. Juli 2023 23:30

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-187a

Text

SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Canadian Centre for Cyber Security (CCCS) are releasing this joint Cybersecurity Advisory (CSA) in response to cyber threat actors leveraging newly identified Truebot malware variants against ...

Juni 2023

12.06.2023

Understanding Ransomware Threat Actors: LockBit

Titel

Understanding Ransomware Threat Actors: LockBit

Veröffentlicht

12. Juni 2023 18:22

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a

Text

SUMMARY In 2022, LockBit was the most deployed ransomware variant across the world and continues to be prolific in 2023. Since January 2020, affiliates using LockBit have attacked organizations of varying sizes across an array of critical infrastructure sectors, including financial services, food and agriculture, education, energy, government and emergency ...

06.06.2023

#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability

Titel

#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability

Veröffentlicht

6. Juni 2023 22:58

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a

Text

SUMMARY Note: this joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...

Mai 2023

23.05.2023

People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection

Titel

People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection

Veröffentlicht

23. Mai 2023 20:06

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a

Text

Summary The United States and international cybersecurity authorities are issuing this joint Cybersecurity Advisory (CSA) to highlight a recently discovered cluster of activity of interest associated with a People’s Republic of China (PRC) state-sponsored cyber actor, also known as Volt Typhoon. Private sector partners have identified that this activity affects ...

15.05.2023

#StopRansomware: BianLian Ransomware Group

Titel

#StopRansomware: BianLian Ransomware Group

Veröffentlicht

15. Mai 2023 18:29

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a

Text

Summary Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...

10.05.2023

Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG

Titel

Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG

Veröffentlicht

10. Mai 2023 23:35

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a

Text

SUMMARY The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory (CSA) in response to the active exploitation of CVE-2023-27350. This vulnerability occurs in certain versions of PaperCut NG and PaperCut MF and enables an unauthenticated actor to execute malicious code ...

08.05.2023

Hunting Russian Intelligence “Snake” Malware

Titel

Hunting Russian Intelligence “Snake” Malware

Veröffentlicht

8. Mai 2023 23:02

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a

Text

SUMMARY The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia’s Federal Security Service (FSB) for long-term intelligence collection on sensitive targets. To conduct operations using this tool, the FSB created a covert peer-to-peer (P2P) network of numerous Snake-infected computers worldwide. ...

April 2023

17.04.2023

APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers

Titel

APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers

Veröffentlicht

17. April 2023 22:32

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-108

Text

APT28 accesses poorly maintained Cisco routers and deploys malware on unpatched devices using CVE-2017-6742. Overview and Context The UK National Cyber Security Centre (NCSC), the US National Security Agency (NSA), US Cybersecurity and Infrastructure Security Agency (CISA) and US Federal Bureau of Investigation (FBI) are releasing this joint advisory to ...

März 2023

15.03.2023

#StopRansomware: LockBit 3.0

Titel

#StopRansomware: LockBit 3.0

Veröffentlicht

15. März 2023 20:20

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a

Text

SUMMARY Note: this joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect ...

13.03.2023

Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server

Titel

Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server

Veröffentlicht

13. März 2023 18:57

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a

Text

SUMMARY From November 2022 through early January 2023, the Cybersecurity and Infrastructure Security Agency (CISA) and authoring organizations identified the presence of indicators of compromise (IOCs) at a federal civilian executive branch (FCEB) agency. Analysts determined that multiple cyber threat actors, including an APT actor, were able to exploit a ...

13.03.2023

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a

Threat Actors Exploit Progress Telerik Vulnerability in...

Titel

<a href="/news-events/cybersecurity-advisories/aa23-074a" hreflang="en">Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server</a>

Veröffentlicht

13. März 2023 18:57

URL

Text

13.03.2023

Threat Actors Exploit Progress Telerik Vulnerabilities in Multiple U.S. Government IIS Servers

Titel

Threat Actors Exploit Progress Telerik Vulnerabilities in Multiple U.S. Government IIS Servers

Veröffentlicht

13. März 2023 18:57

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a

Text

Februar 2023

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-059a

CISA Red Team Shares Key Findings to Improve Monitoring...

Titel

<a href="/news-events/cybersecurity-advisories/aa23-059a" hreflang="en">CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks</a>

Veröffentlicht

24. Februar 2023 20:04

URL

Text

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks

Titel

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks

Veröffentlicht

24. Februar 2023 20:04

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-059a

Text

SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this Cybersecurity Advisory (CSA) detailing activity and key findings from a recent CISA red team assessment—in coordination with the assessed organization—to provide network defenders recommendations for improving their organization's cyber posture. Actions to take today to harden your local environment: ...

#StopRansomware: Royal Ransomware

Titel

#StopRansomware: Royal Ransomware

Veröffentlicht

24. Februar 2023 18:30

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

Text

SUMMARY Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a

#StopRansomware: Royal Ransomware

Titel

<a href="/news-events/cybersecurity-advisories/aa23-061a" hreflang="en">#StopRansomware: Royal Ransomware</a>

Veröffentlicht

24. Februar 2023 18:30

URL

Text

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a

#StopRansomware: Ransomware Attacks on Critical Infrast...

Titel

<a href="/news-events/cybersecurity-advisories/aa23-040a" hreflang="en">#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities</a>

Veröffentlicht

16. Februar 2023 21:45

URL

Text

#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities

Titel

#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities

Veröffentlicht

16. Februar 2023 21:45

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-040a

Text

SUMMARY Note: This Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and various ransomware threat actors. These #StopRansomware advisories detail historically and recently observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations ...

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-039a

ESXiArgs Ransomware Virtual Machine Recovery Guidance

Titel

<a href="/news-events/cybersecurity-advisories/aa23-039a" hreflang="en">ESXiArgs Ransomware Virtual Machine Recovery Guidance</a>

Veröffentlicht

16. Februar 2023 19:50

URL

Text

ESXiArgs Ransomware Virtual Machine Recovery Guidance

Titel

ESXiArgs Ransomware Virtual Machine Recovery Guidance

Veröffentlicht

16. Februar 2023 19:50

URL

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-039a

Text

Summary The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory (CSA) in response to the ongoing ransomware campaign, known as “ESXiArgs.” Malicious actors may be exploiting known vulnerabilities in VMware ESXi servers that are likely running unpatched and out-of-service ...

09.02.2023