<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:0in;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoNoSpacing, li.MsoNoSpacing, div.MsoNoSpacing
{mso-style-priority:1;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">FYSA<o:p></o:p></p>
<p class="MsoNoSpacing"><o:p> </o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">The Cybersecurity and Infrastructure Security Agency (CISA),
</span><span style="font-family:"Franklin Gothic Book",sans-serif">the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), U.S. Cyber Command - Cyber National Mission Force (CNMF), the Department of the Treasury (Treasury), the Australian
Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), and the United Kingdom’s National Cyber Security Centre (NCSC)
<span style="color:black">released a </span></span><a href="https://www.cisa.gov/uscert/ncas/current-activity/2022/09/14/iranian-islamic-revolutionary-guard-corps-affiliated-cyber-actors"><span style="font-family:"Franklin Gothic Book",sans-serif">joint Cybersecurity
Advisory</span></a><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> (CSA) with technical details on cyber activity by advanced persistent threat (APT) actors assessed to be affiliated with the Iranian Government’s Islamic Revolutionary
Guard Corps (IRGC). This advisory is an update to our 2021 joint CSA on </span><a href="https://www.cisa.gov/uscert/ncas/alerts/aa21-321a"><span style="font-family:"Franklin Gothic Book",sans-serif">Iranian government-sponsored APT actors exploiting Microsoft
Exchange and Fortinet vulnerabilities</span></a><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">.
</span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">As recently as February 2022, these APT actors has been observed exploiting VMware Horizon® Log4j vulnerabilities for initial access. This is in addition to their
exploit of known Fortinet® and Microsoft Exchange® vulnerabilities that were reported in our 2021 CSA and
</span><span style="font-family:"Franklin Gothic Book",sans-serif">in the FBI Liaison Alert System (FLASH) report
</span><a href="https://www.ic3.gov/Media/News/2021/210527.pdf"><span style="font-family:"Franklin Gothic Book",sans-serif">APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity</span></a><span style="font-family:"Franklin Gothic Book",sans-serif">
from May 2021<span style="color:black">. Also, this CSA provides additional malicious and legitimate tools being used by these actors as well as additional indicators of compromise (IOCs) observed as recently as March 2022 that can help organizations detect
this activity. </span></span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">The agencies assess that multiple critical infrastructure sectors and organizations in the U.S., as well as in the United Kingdom, Australia, and Canada, are being
actively targeted. The IRGC-affiliated APT actors have been observed scanning for and/or exploiting the known vulnerabilities on unprotected networks rather than specific entities or sectors. After gaining access to a network, the APT actors likely determine
a course of action based on their perceived value of the data, which could lead them to encrypting data for ransom and/or exfiltrating data.</span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">In addition to enforcing multifactor authentication, making offline backups of your data, securing remote desktop protocol (RDP), and other recommended mitigations,
the agencies encourage organizations to immediately patch software affected by vulnerabilities identified in the latest advisory. Those specific common vulnerabilities and exposures (CVE) to patch are:
</span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr style="height:27.85pt">
<td width="168" valign="top" style="width:125.75pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:27.85pt">
<p class="MsoNoSpacing" align="center" style="text-align:center"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Microsoft Exchange ProxyShell</span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;height:27.85pt">
<p class="MsoNoSpacing" align="center" style="text-align:center"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">VMware Horizon / Log4j</span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;height:27.85pt">
<p class="MsoNoSpacing" align="center" style="text-align:center;text-indent:.4pt">
<span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Fortinet FortiOS</span><o:p></o:p></p>
</td>
<td width="168" valign="top" style="width:125.75pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;height:27.85pt">
<p class="MsoNoSpacing" align="center" style="text-align:center"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Microsoft Exchange</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="168" valign="top" style="width:125.75pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2021-34473</span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:.05pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2021-44228</span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:3.05pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2018-13379</span><o:p></o:p></p>
</td>
<td width="168" valign="top" style="width:125.75pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:2.3pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2021-31196</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="168" valign="top" style="width:125.75pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2021-34523</span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:.05pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2021-45046</span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:3.05pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2020-12812</span><o:p></o:p></p>
</td>
<td width="168" valign="top" style="width:125.75pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:2.3pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE, 2021-31206</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="168" valign="top" style="width:125.75pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2021-31207</span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:.05pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2021-45105</span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:3.05pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2019-5591</span><o:p></o:p></p>
</td>
<td width="168" valign="top" style="width:125.75pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:2.3pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2021-33768</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="168" valign="top" style="width:125.75pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:.05pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:3.05pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
</td>
<td width="168" valign="top" style="width:125.75pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:2.3pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2021-33766</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="168" valign="top" style="width:125.75pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:.05pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
</td>
<td width="144" valign="top" style="width:1.5in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:3.05pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
</td>
<td width="168" valign="top" style="width:125.75pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNoSpacing" style="margin-left:2.3pt"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CVE-2021-34470</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Also, organizations are recommended to validate or test their existing security controls to assess how they perform against the adversarial behavior (i.e., MITRE
ATT&CK techniques) described in this advisory. </span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">In this new
</span><a href="https://www.cisa.gov/uscert/ncas/alerts/a22-257a"><span style="font-family:"Franklin Gothic Book",sans-serif">CSA</span></a><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">, the Iranian APT exploit activity reported in
our </span><a href="https://www.cisa.gov/uscert/ncas/alerts/aa21-321a"><span style="font-family:"Franklin Gothic Book",sans-serif">2021 CSA</span></a><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> is now assessed to be by APT actors
affiliated with the IRGC, an Iranian Government agency tasked with defending the Iranian Regime from perceived internal and external threats.</span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNoSpacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">All organizations are encouraged to review the CSA for complete details on this ongoing threat and recommended mitigations. Organizations are reminded that in September
2021 Treasury </span><a href="https://home.treasury.gov/system/files/126/ofac_ransomware_advisory.pdf"><span style="font-family:"Franklin Gothic Book",sans-serif">issued an advisory</span></a><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">
highlighting the sanctions risk associated with ransomware payments and providing steps that can be taken by companies to mitigate risk being a victim of ransomware.</span><o:p></o:p></p>
<p class="MsoNoSpacing"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;line-height:normal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal" style="margin-bottom:0in;line-height:normal"><span style="font-size:10.0pt;color:#1F497D">Cyber Security Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;line-height:normal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;line-height:normal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;line-height:normal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;line-height:normal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal" style="margin-bottom:0in;line-height:normal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;line-height:normal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_1" src="cid:image002.png@01D8C817.5D27EBD0"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>