• 1
  • 2
  • 3 (current)
  • 4
March 2021
Title
AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities
Published
March 3, 2021, 7:12 p.m.
Summary
Original release date: March 3, 2021 | Last revised: March 14, 2021SummaryNote: This Alert was updated March 13, 2021 to provide further guidance. Cybersecurity and Infrastructure Security (CISA) partners have observed active exploitation of vulnerabilities in Microsoft Exchange Server products. Successful exploitation of these vulnerabilities allows an unauthenticated attacker to ...
February 2021
Title
AA21-055A: Exploitation of Accellion File Transfer Appliance
Published
Feb. 24, 2021, 3 p.m.
Summary
Original release date: February 24, 2021 | Last revised: February 25, 2021SummaryThis joint advisory is the result of a collaborative effort by the cybersecurity authorities of Australia,[1] New Zealand,[2] Singapore,[3] the United Kingdom,[4] and the United States.[5][6] These authorities are aware of cyber actors exploiting vulnerabilities in Accellion File Transfer ...
Title
AA21-048A: AppleJeus: Analysis of North Korea’s Cryptocurrency Malware
Published
Feb. 17, 2021, 5 p.m.
Summary
Original release date: February 17, 2021 | Last revised: March 2, 2021SummaryThis Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. This joint advisory is the result of analytic efforts among the Federal Bureau ...
Title
AA21-042A: Compromise of U.S. Water Treatment Facility
Published
Feb. 11, 2021, 8:15 p.m.
Summary
Original release date: February 11, 2021 | Last revised: February 12, 2021SummaryOn February 5, 2021, unidentified cyber actors obtained unauthorized access to the supervisory control and data acquisition (SCADA) system at a U.S. drinking water treatment facility. The unidentified actors used the SCADA system’s software to increase the amount of ...
January 2021
Title
AA21-008A: Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments
Published
Jan. 8, 2021, 5:36 p.m.
Summary
Original release date: January 8, 2021SummaryThis Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. This Alert is a companion alert to AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private ...
December 2020
Title
AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations
Published
Dec. 17, 2020, 4 p.m.
Summary
Original release date: December 17, 2020 | Last revised: January 7, 2021SummaryThe Cybersecurity and Infrastructure Security Agency (CISA) is aware of compromises of U.S. government agencies, critical infrastructure entities, and private sector organizations by an advanced persistent threat (APT) actor beginning in at least March 2020. This APT actor has ...
Title
AA20-345A: Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data
Published
Dec. 10, 2020, 6 p.m.
Summary
Original release date: December 10, 2020SummaryThis Joint Cybersecurity Advisory was coauthored by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC). The FBI, CISA, and MS-ISAC assess malicious cyber actors are targeting kindergarten through twelfth grade (K-12) ...
Title
AA20-336A: Advanced Persistent Threat Actors Targeting U.S. Think Tanks
Published
Dec. 1, 2020, 7 p.m.
Summary
Original release date: December 1, 2020

Summary

This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques.

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have ...

October 2020
Title
AA20-304A: Iranian Advanced Persistent Threat Actor Identified Obtaining Voter Registration Data
Published
Oct. 30, 2020, 7:11 p.m.
Summary
Original release date: October 30, 2020 | Last revised: November 3, 2020SummaryThis advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 8 framework. See the ATT&CK for Enterprise version 8 for all referenced threat actor techniques. This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure ...
Title
AA20-302A: Ransomware Activity Targeting the Healthcare and Public Health Sector
Published
Oct. 29, 2020, 12:07 a.m.
Summary
Original release date: October 28, 2020 | Last revised: November 2, 2020SummaryThis advisory was updated to include information on Conti, TrickBot, and BazarLoader, including new IOCs and Yara Rules for detection. This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for ...
Title
AA20-301A: North Korean Advanced Persistent Threat Focus: Kimsuky
Published
Oct. 27, 2020, 6 p.m.
Summary
Original release date: October 27, 2020SummaryThis advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques. This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA), the ...
Title
AA20-296B: Iranian Advanced Persistent Threat Actors Threaten Election-Related Systems
Published
Oct. 22, 2020, 6 p.m.
Summary
Original release date: October 22, 2020SummaryThe Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are warning that Iranian advanced persistent threat (APT) actors are likely intent on influencing and interfering with the U.S. elections to sow discord among voters and undermine public confidence in the ...
Title
AA20-296A: Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets
Published
Oct. 22, 2020, 2:44 p.m.
Summary
Original release date: October 22, 2020SummaryThis joint cybersecurity advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor tactics and techniques This joint cybersecurity advisory—written by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure ...
Title
AA20-283A: APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations
Published
Oct. 9, 2020, 10:21 p.m.
Summary
Original release date: October 9, 2020 | Last revised: October 24, 2020SummaryThis joint cybersecurity advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. Note: the analysis in this joint cybersecurity advisory is ongoing, and the ...
Title
AA20-280A: Emotet Malware
Published
Oct. 6, 2020, 7 p.m.
Summary
Original release date: October 6, 2020SummaryThis Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. This product was written by the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing & Analysis Center ...
Title
AA20-275A: Potential for China Cyber Response to Heightened U.S.–China Tensions
Published
Oct. 1, 2020, 6 p.m.
Summary
Original release date: October 1, 2020SummaryThis Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. In light of heightened tensions between the United States and China, the Cybersecurity and Infrastructure Security Agency (CISA) is providing ...
September 2020
Title
AA20-266A: LokiBot Malware
Published
Sept. 22, 2020, 5 p.m.
Summary
Original release date: September 22, 2020 | Last revised: September 23, 2020SummaryThis Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise frameworks for all referenced threat actor techniques. This product was written by the Cybersecurity and Infrastructure Security Agency (CISA) with contributions ...
Title
AA20-259A: Iran-Based Threat Actor Exploits VPN Vulnerabilities
Published
Sept. 15, 2020, 6 p.m.
Summary
Original release date: September 15, 2020SummaryThis Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. This product was written by the Cybersecurity and Infrastructure Security Agency (CISA) with contributions from the Federal Bureau of Investigation ...
Title
AA20-258A: Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity
Published
Sept. 14, 2020, 3 p.m.
Summary
Original release date: September 14, 2020SummaryThe Cybersecurity and Infrastructure Security Agency (CISA) has consistently observed Chinese Ministry of State Security (MSS)-affiliated cyber threat actors using publicly available information sources and common, well-known tactics, techniques, and procedures (TTPs) to target U.S. Government agencies. CISA has observed these—and other threat actors with ...
Title
AA20-245A: Technical Approaches to Uncovering and Remediating Malicious Activity
Published
Sept. 1, 2020, 2:30 p.m.
Summary
Original release date: September 1, 2020 | Last revised: September 24, 2020SummaryThis joint advisory is the result of a collaborative research effort by the cybersecurity authorities of five nations: Australia,[1] Canada,[2] New Zealand,[3][4] the United Kingdom,[5] and the United States.[6] It highlights technical approaches to uncovering malicious activity and includes ...
August 2020
Title
AA20-239A: FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks
Published
Aug. 26, 2020, 4:17 p.m.
Summary
Original release date: August 26, 2020 | Last revised: October 1, 2020SummaryThis Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. This joint advisory is the result of analytic efforts among the Cybersecurity and Infrastructure ...
Title
AA20-227A: Phishing Emails Used to Deploy KONNI Malware
Published
Aug. 14, 2020, 2:59 p.m.
Summary
Original release date: August 14, 2020SummaryThis Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. The Cybersecurity and Infrastructure Security Agency (CISA) has observed cyber actors using emails containing a Microsoft Word document with a ...
Title
AA20-225A: Malicious Cyber Actor Spoofing COVID-19 Loan Relief Webpage via Phishing Emails
Published
Aug. 12, 2020, 3:49 p.m.
Summary
Original release date: August 12, 2020 | Last revised: August 14, 2020SummaryThe Cybersecurity and Infrastructure Security Agency (CISA) is currently tracking an unknown malicious cyber actor who is spoofing the Small Business Administration (SBA) COVID-19 loan relief webpage via phishing emails. These emails include a malicious link to the spoofed ...
July 2020
Title
AA20-209A: Potential Legacy Risk from Malware Targeting QNAP NAS Devices
Published
July 27, 2020, 2:20 p.m.
Summary
Original release date: July 27, 2020SummaryThis is a joint alert from the United States Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC). CISA and NCSC are investigating a strain of malware known as QSnatch, which attackers used in late 2019 to target Network ...
Title
AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902
Published
July 24, 2020, 12:59 p.m.
Summary
Original release date: July 24, 2020SummaryThe Cybersecurity and Infrastructure Security Agency (CISA) is issuing this alert in response to recently disclosed exploits that target F5 BIG-IP devices that are vulnerable to CVE-2020-5902. F5 Networks, Inc. (F5) released a patch for CVE-2020-5902 on June 30, 2020.[1] Unpatched F5 BIG-IP devices are ...
  • 1
  • 2
  • 3 (current)
  • 4

Last Updates

BOSCH PSIRT
21.09.2022
CODESYS
27.07.2022
SIEMENS CERT
13.09.2022
US CERT
22.09.2022
US CERT (ICS)
27.09.2022

By Source

Archive

2022
2021
2020
2019
2018
2017

Feeds