<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xmsonospacing, li.xmsonospacing, div.xmsonospacing
{mso-style-name:x_msonospacing;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<div>
<div>
<p class="xmsonospacing">FYSA<o:p></o:p></p>
<p class="xmsonospacing"><o:p> </o:p></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">The Cybersecurity and Infrastructure Security Agency (CISA) and United States Coast Guard Cyber Command (CGCYBER) are releasing this
</span><span style="color:black"><a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-174a"><span style="font-family:"Franklin Gothic Book",sans-serif">joint Cybersecurity Advisory</span></a></span><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">
(CSA) to warn network defenders that cyber threat actors, including state-sponsored advanced persistent threat (APT) actors, have continued to exploit CVE-2021-44228 (Log4Shell) in VMware Horizon® and Unified Access Gateway (UAG) servers to obtain initial
access to networks. </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Since December 2021, multiple threat actor groups have exploited Log4Shell on unpatched, public-facing VMware Horizon and UAG servers. The advisory includes tactics
used by actors, technical details on their tools and malware, and indicators of compromise (IOCs) to help organizations detect possible exploitation on their networks. </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Log4Shell is a remote code execution vulnerability (CVE-2021-44228) affecting the Apache® Log4j library and a variety of products using Log4j, including certain
versions of VMware Horizon and UAG. The vulnerability enables malicious cyber actors to submit a specially crafted request to a vulnerable system that causes the system to execute arbitrary code. The request allows the malicious actor to take full control
of the affected system. </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CISA and CGCYBER recommend all organizations with affected systems that did not immediately apply updates or workarounds should assume compromise and initiate threat
hunting activities using the IOCs and malware analysis provided in this CSA, Malware Analysis Report (MAR) [<a href="https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-174b" title="https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-174b">10382580-1</a>],
and [<a href="https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-174a" title="https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-174a">MAR-10382254-1</a>]. If potential compromise is detected, administrators should apply the incident response recommendations
included in the CSA and report key findings to CISA. </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cyber Security Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt;color:#0563C1">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_1" src="cid:image001.png@01D88701.D6D1CB60"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal" align="center" style="text-align:center"><o:p> </o:p></p>
</div>
</body>
</html>