cisa

  1. AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

    Original release date: April 16, 2020 | Last revised: June 30, 2020 Summary Note: This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques and mitigations...
    • News
    • Thread
    • active directory cisa credential dumping cve-2019-11510 cybersecurity detection exploitation incident response indicators of compromise iocs lateral movement mitigation network security pulse secure ransomware remote access remote services threat actor vpn vulnerability
    • Replies: 0
    • Forum: Security Alerts

  2. AA20-099A: COVID-19 Exploited by Malicious Cyber Actors

    Original release date: April 8, 2020 Summary This is a joint alert from the United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC). This alert provides information on...
    • News
    • Thread
    • apt cisa compromise covid-19 credential theft cybersecurity email security indicators malicious actors malware mitigation ncsc phishing ransomware remote access scams social engineering teleconferencing teleworking vpn
    • Replies: 0
    • Forum: Security Alerts

  3. VIDEO AA20-049A: Ransomware Impacting Pipeline Operations

    Original release date: February 18, 2020 | Last revised: June 30, 2020 Summary Note: This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) framework. See the MITRE ATT&CK for Enterprise and Link Removed frameworks for all referenced threat actor...
    • News
    • Thread
    • access control cisa control systems cybersecurity data backup data security emergency planning incident response it networks mitigation strategies multipoint authentication network segmentation operational technology ot networks pipeline operations productivity loss ransomware spearphishing threat actor techniques user training
    • Replies: 0
    • Forum: Security Alerts

  4. AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor

    Original release date: July 1, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) and Pre-ATT&CK framework. See the ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques. This advisory—written by the...
    • News
    • Thread
    • anonymity apt cisa command and control cybersecurity data exfiltration data manipulation denial of service exploitation fbi incident response indicators of compromise malicious activity network monitoring network security reconnaissance risk mitigation security tools threat actors tor
    • Replies: 0
    • Forum: Security Alerts

  5. AA20-182A: EINSTEIN Data Trends – 30-day Lookback

    Original release date: June 30, 2020 Summary Cybersecurity and Infrastructure Security Agency (CISA) analysts have compiled the top detection signatures that have been the most active over the month of May in our national Intrusion Detection System (IDS), known as EINSTEIN. This information is...
    • News
    • Thread
    • analysis cisa compartments cybersecurity detection einstein ids kovter malware mitigations netsupport network rat security snort tcpsecurity threats updates vulnerability xmrig
    • Replies: 0
    • Forum: Security Alerts

  6. AA20-133A: Top 10 Routinely Exploited Vulnerabilities

    Original release date: May 12, 2020 Summary The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the broader U.S. Government are providing this technical guidance to advise IT security professionals at public and private sector...
    • News
    • Thread
    • apachestruts cisa cloudservices cve cve-2019 cybersecurity education exploitation malware microsoft mitigations networksecurity ole patching ransomware remotework securitybestpractices threats vpn vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  7. AA20-126A: APT Groups Target Healthcare and Essential Services

    Original release date: May 5, 2020 Summary This is a joint alert from the United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC). CISA and NCSC continue to see indications that...
    • News
    • Thread
    • apt groups cisa covid-19 cybersecurity data breach healthcare incident management intellectual property malware mitigation strategies ncsc password spraying pharmaceuticals remote work research organizations security policies sensitive data supply chain threat actors vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  8. AA20-099A: COVID-19 Exploited by Malicious Cyber Actors

    Original release date: April 8, 2020 Summary This is a joint alert from the United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC). This alert provides information on...
    • News
    • Thread
    • apt groups cisa covid-19 credential theft cyber attacks cybersecurity exploitation indicators of compromise malicious software malware mitigation ncsc phishing ransomware remote access scams social engineering teleconferencing teleworking vpn
    • Replies: 0
    • Forum: Security Alerts

  9. AA20-073A: Enterprise VPN Security

    Original release date: March 13, 2020 Summary As organizations prepare for possible impacts of Coronavirus Disease 2019 (COVID-19), many may consider alternate workplace options for their employees. Remote work options—or telework—require an enterprise virtual private network (VPN) solution to...
    • News
    • Thread
    • access authentication cisa connections cybersecurity incident response infrastructure it security malware mfa mitigation nist patching phishing remote work security telework updates vpn vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  10. VIDEO AA20-049A: Ransomware Impacting Pipeline Operations

    Original release date: February 18, 2020 Summary Note: This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) framework. See the MITRE ATT&CK for Enterprise and Link Removed frameworks for all referenced threat actor techniques and mitigations. CISA...
    • News
    • Thread
    • cisa control systems cybersecurity data backup data integrity emergency response hmi incident response infrastructure it network loss of productivity mitigation network segmentation operational technology ot network phishing pipeline security ransomware spearphishing threat actor
    • Replies: 0
    • Forum: Security Alerts

  11. AA20-020A: Critical Vulnerability in Citrix Application Delivery Controller, Gateway, and SD-WAN WANOP

    Original release date: January 20, 2020<br/><h3>Summary</h3><p>On January 19, 2020, Citrix released firmware updates for Citrix Application Delivery Controller (ADC) and Citrix Gateway versions 11.1 and 12.0 to address CVE-2019-19781. Citrix expects to release updates for other vulnerable...
    • News
    • Thread
    • adc appliances cisa citrix code execution critical cve-2019-19781 cybersecurity detection exploitation firmware gateway impact mitigation nsa remote sd-wan security update vulnerability
    • Replies: 0
    • Forum: Security Alerts

  12. AA20-010A: Continued Exploitation of Pulse Secure VPN Vulnerability

    Original release date: January 10, 2020 Summary Unpatched Pulse Secure VPN servers continue to be an attractive target for malicious actors. Affected organizations that have not applied the software patch to fix a remote code execution (RCE) vulnerability, known as CVE-2019-11510, can become...
    • News
    • Thread
    • cisa cve-2019-11510 cyber attacks cybersecurity exploitation incident response malware mitigation network security patch management pulse secure rce remote access security advisory software update threat actors unauthorized access unpatched servers vpn vulnerability
    • Replies: 0
    • Forum: Security Alerts

  13. AA20-006A: Potential for Iranian Cyber Response to U.S. Military Strike in Baghdad

    Original release date: January 6, 2020 Summary The Cybersecurity and Infrastructure Security Agency (CISA) is sharing the following information with the cybersecurity community as a primer for assisting in the protection of our Nation’s critical infrastructure in light of the current tensions...
    • News
    • Thread
    • apt techniques cisa cisa recommendations critical infrastructure cyber defense cyber threats cybersecurity data theft ddos attacks incident response iranian cyber irgc malware mitigation strategies network monitoring phishing security best practices threat intelligence user training vulnerability management
    • Replies: 0
    • Forum: Security Alerts

  14. AA19-339A: Dridex Malware

    Original release date: December 5, 2019 Summary This Alert is the result of recent collaboration between the Department of the Treasury Financial Sector Cyber Information Group (CIG) and the Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) to identify and share...
    • News
    • Thread
    • bots cisa cybersecurity data breach dridex exploits financial fincen indicators of compromise intrusion detection intrusion prevention malspam malware mitigation phishing privacy ransomware security best practices trojan vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  15. AA19-168A: Microsoft Operating Systems BlueKeep Vulnerability

    Original release date: June 17, 2019 Summary The Cybersecurity and Infrastructure Security Agency (CISA) is issuing this Activity Alert to provide information on a vulnerability, known as “BlueKeep,” that exists in the following Microsoft Windows Operating Systems (OSs), including both 32- and...
    • News
    • Thread
    • bluekeep cisa cve-2019-0708 cybersecurity end-of-life exploitation malware microsoft mitigation network authentication operating systems patch management patches rdp remote access security tcp port user rights vulnerability windows
    • Replies: 0
    • Forum: Security Alerts

  16. AA19-122A: New Exploits for Unsecure SAP Systems

    Original release date: May 02, 2019 Summary The Cybersecurity and Infrastructure Security Agency (CISA) is issuing this activity alert in response to recently disclosed exploits that target unsecure configurations of SAP components. [1] Technical Details A presentation at the April 2019...
    • News
    • Thread
    • access control acls cisa configuration cybersecurity exploits internet exposure message server mitigation network security os commands presentation remote code execution research routing sap security recommendations security tools snc vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  17. AA19-024A: DNS Infrastructure Hijacking Campaign

    Original release date: January 24, 2019 Summary The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), is aware of a global Domain Name System (DNS) infrastructure hijacking campaign. Using compromised...
    • News
    • Thread
    • attack best practices campaign cisa credentials cybersecurity dns encryption hijacking infrastructure inspection malware manipulation mitigation network phishing security threat traffic validation
    • Replies: 0
    • Forum: Security Alerts