AdvisoriesCISAAA23-319ANovember 15, 2023
November 15, 2023
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have jointly issued a Cybersecurity Advisory to alert about the emerging Rhysida ransomware. This ransomware, active since May 2023, primarily targets sectors like education, healthcare, manufacturing, IT, and government. The advisory, part of the #StopRansomware initiative, provides detailed information on the tactics, techniques, and procedures (TTPs) of Rhysida, as well as indicators of compromise (IOCs) based on recent investigations. It also encourages organizations to follow recommended mitigation strategies to reduce the risk and impact of Rhysida and other ransomware threats.
November 15, 2023
Rhysida ransomware actors have been known to exploit the Zerologon vulnerability (CVE-2020-1472) in Microsoft’s Netlogon Remote Protocol and use phishing attacks to infiltrate and persist within a network. The ease of exploitation involved with this vulnerability - a simple request to a specific vulnerable protocol - underscores the importance of automatic patching. At many organizations, especially larger ones, upgrading software is a manual and time-consuming process. Each upgrade carries a certain amount of risk, as the change set may be incompatible with other critical applications on the system. However, it is possible to establish a process of safe automated patching - and setting one up should be a top priority.
Be immediately notified of new advisories and associated security tests
AdvisoryCISAAA24-207AJuly 25, 2024
