| 2025-03-12 |
CISA and Partners Release Cybersecurity Advisory on Medusa Ransomware
This advisory provides tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and detection methods associated with known Medusa ransomware activity. Medusa is a ransomware-as-a-service variant used to conduct ransomware attacks; as of December 2024, over 300 victims from critical infrastructure sectors have been impacted.
|
CISA
MS-ISAC
|
| 2025-03-12 |
#StopRansomware: Medusa Ransomware
CISA, FBI, and MS-ISAC warn that Medusa ransomware has targeted over 300 victims across critical infrastructure sectors since 2021 using a double-extortion model. Operators gain initial access via phishing and unpatched vulnerabilities, then encrypt systems and threaten to leak stolen data unless ransom is paid.
|
CISA
MS-ISAC
|
| 2025-03-12 |
#StopRansomware: Medusa Ransomware
Finally, the registry is modified to allow Remote Desktop connections: fDenyTSConnections /t REG_DWORD /d 0 /f Mimikatz has also been observed in use for Local Security Authority Subsystem Service (LSASS) dumping [T1003.001] to harvest credentials [TA0006] and aid lateral movement. Medusa actors install and use Rclone to facilitate exfiltration of data to the Medusa C2 servers [T1567.002] used by actors and affiliates.
|
CISA
MS-ISAC
|
| 2025-03-06 |
FBI Warns of Data Extortion Scam Targeting Corporate Executives
The Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3) has released an alert warning of a scam involving criminal actors masquerading as the “BianLian Group.” The cyber criminals target corporate executives by sending extortion letters threatening to release victims’ sensitive information unless payment is received.
|
CISA
|
| 2025-02-19 |
CISA and Partners Release Advisory on Ghost (Cring) Ransomware
Today, CISA—in partnership with the Federal Bureau of Investigation (FBI) and Multi-State Information Sharing and Analysis Center (MS-ISAC)—released a joint Cybersecurity Advisory, #StopRansomware: Ghost (Cring) Ransomware . This advisory provides network defenders with indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and detection methods associated with Ghost ransomware activity identified through FBI investigations.
|
CISA
MS-ISAC
|
| 2025-02-19 |
#StopRansomware: Ghost (Cring) Ransomware
Actions for Organizations to Take Today to Mitigate Cyber Threats Related to Ghost
|
CISA
MS-ISAC
|
| 2025-02-19 |
#StopRansomware: Ghost (Cring) Ransomware
Actions for Organizations to Take Today to Mitigate Cyber Threats Related to Ghost
|
CISA
MS-ISAC
|
| 2025-02-12 |
CISA and FBI Warn of Malicious Cyber Actors Using Buffer Overflow Vulnerabilities to Compromise Software
CISA and the Federal Bureau of Investigation (FBI) have released a Secure by Design Alert, Eliminating Buffer Overflow Vulnerabilities , as part of their cooperative Secure by Design Alert series —an ongoing series aimed at advancing industry-wide best practices to eliminate entire classes of vulnerabilities during the design and development phases of the product lifecycle.
|
CISA
|
| 2025-02-12 |
Secure by Design Alert: Eliminating Buffer Overflow Vulnerabilities
The Secure by Design initiative seeks to foster a cultural shift across the technology industry, normalizing the development of the Secure by Design Pledge, and stay informed on the latest Secure by Design Alerts. Buffer overflow vulnerabilities are a prevalent type of memory The software development community has safety software design defect that regularly lead to system compromise.
|
CISA
NSA
|
| 2025-02-04 |
Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances
This guidance has been developed with contributions from partnering agencies and is included in a series of publications aiming to draw attention to the importance of edge device cyber security measures. It is produced by the UK National Cyber Security Centre (NCSC) in partnership with the Australian Signals Directorate (ASD), US Cybersecurity and Infrastructure Security Agency (CISA), the Canadian Centre for Cyber Security – part of the Communic…
|
ASD/ACSC
CCCS
CISA
NCSC-NZ
NCSC-UK
|
| 2025-02-03 |
CSI: Security Considerations for Edge Devices: Executive Guidance
Mitigation strategies for edge Malicious actors are increasingly targeting internet-facing edge devices to gain unauthorised access to networks; therefore, it is vital that organisations prioritise securing edge devices in their environments. Edge devices are critical network components that serve as security boundaries between internal enterprise networks and the internet.
|
ASD/ACSC
CCCS
CISA
NCSC-NZ
NCSC-UK
NSA
|
| 2025-01-22 |
CISA and FBI Release Advisory on How Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications
This advisory was crafted in response to exploitation of vulnerabilities— CVE-2024-8963 , an administrative bypass vulnerability; CVE-2024-9379 , a SQL injection vulnerability; and CVE-2024-8190 and CVE-2024-9380 , remote code execution vulnerabilities—in Ivanti Cloud Service Appliances (CSA) in September 2024.
|
CISA
CSA
|
| 2025-01-22 |
Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications
For more information on mitigating CVE -2025-0282 and CVE-2025-0283, see Ivanti Releases Security Updates for Connect Secure, Policy Secure, and ZTA Gateways . Summary The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory in response to exploitation in September 2024 of vulnerabilities in Ivanti Cloud Service Appliances (CSA): CVE-2024-8963 , an admini…
|
CISA
|
| 2025-01-22 |
Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications
For more information on mitigating CVE-20250282 and CVE-2025-0283, see Ivanti Releases Security Updates for Connect Secure, Policy Secure, and The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory in response to exploitation in September 2024 of vulnerabilities in Ivanti Cloud Service Appliances (CSA): CVE-2024-8963, an administrative bypass vulnerabil…
|
CISA
|
| 2025-01-17 |
CISA and FBI Release Updated Guidance on Product Security Bad Practices
This updated guidance incorporates public comments CISA received in response to a Request for Information, adding additional bad practices, context regarding memory-safe languages, clarifying timelines for patching Known Exploited Vulnerabilities (KEVs) , and other recommendations.
|
CISA
|
| 2025-01-17 |
Product Security Bad Practices
Feedback incorporated from the 78 public comments CISA received in response to our Request for insecure or outdated cryptographic functions, hardcoded credentials, and product support actions to prevent SQL injection vulnerabilities. Updates actions to prevent command injection (MFA) specific to operational technology support phishing-resistant MFA.
|
CISA
|
| 2025-01-16 |
CSI: Closing the Software Understanding Gap
Software is embedded in countless systems responsible for providing U.S. critical infrastructure services that Americans rely on as well as systems providing national security capabilities. To maintain confidence in national security and critical infrastructure systems, mission owners and operators should be able to trust the system is functional, safe, and secure.
|
CISA
DOE
NSA
|
| 2025-01-13 |
CISA and US and International Partners Publish Guidance on Priority Considerations in Product Selection for OT Owners and Operators
As part of CISA’s Secure by Demand series, this guidance focuses on helping customers identify manufacturers dedicated to continuous improvement and achieving a better cost balance, as well as how Operational Technology (OT) owners and operators should integrate secure by design elements into their procurement process. Critical infrastructure and industrial control systems are prime targets for cyberattacks.
|
CISA
NSA
|
| 2025-01-13 |
Secure by Demand: Priority Considerations for Operational Technology Owners and Operators When Selecting Digital Products
Many OT products are not designed and developed with Secure by Design principles1 and commonly have weaknesses, such as weak authentication, known software vulnerabilities, limited logging, insecure default settings and passwords, and insecure legacy protocols. Cyber threat actors can easily exploit these weaknesses across multiple victims to gain access to control systems.
|
ASD/ACSC
BSI
CCCS
CISA
EPA
NCSC-NL
NCSC-NZ
NCSC-UK
NSA
TSA
|
| 2025-01-13 |
Threat of Copycat Attacks after ISIS-Inspired Vehicle Attack in New Orleans
The Federal Bureau of Investigation (FBI) and Department of Homeland Security (DHS) are issuing this Public Service Announcement to highlight a potential public safety threat from violent extremists in response to the New Year’s Day attack in New Orleans, Louisiana.
|
DHS
|