<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xmsobodytext, li.xmsobodytext, div.xmsobodytext
{mso-style-name:x_msobodytext;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.xcontentpasted1
{mso-style-name:x_contentpasted1;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">FYSA<o:p></o:p></p>
<p class="xmsobodytext" style="mso-margin-top-alt:12.55pt;margin-right:31.7pt;margin-bottom:12.0pt;margin-left:0in">
<span class="xcontentpasted1"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) published a joint Cybersecurity Advisory (CSA) about
suspected Iranian government-sponsored actors that compromised a federal civilian executive branch (FCEB) agency. The advisory, “</span></span><span style="color:black"><a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-320a"><span style="font-family:"Franklin Gothic Book",sans-serif">Iranian
Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester</span></a></span><span class="xcontentpasted1"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">” provides information on their tactics,
techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help network defenders detect and protect against related compromises. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsobodytext" style="mso-margin-top-alt:12.55pt;margin-right:31.7pt;margin-bottom:12.0pt;margin-left:0in">
<span class="xcontentpasted1"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">During an incident response at a federal agency, CISA determined the advanced persistent threat (APT) actors had exploited the Log4Shell vulnerability in unpatched
VMware Horizon server on federal agency’s network for initial access. With access, the Iranian APT actors installed software and proxies that enabled them to move laterally, compromise credentials, and maintain persistence. This activity was first detected
during routine, retrospective analysis using EINSTEIN, an FCEB-wide intrusion detection system (IDS) operated and monitored by CISA. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsobodytext" style="mso-margin-top-alt:12.55pt;margin-right:31.7pt;margin-bottom:12.0pt;margin-left:0in">
<span class="xcontentpasted1"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Organizations that suspect initial access or compromise is detected based on IOCs or TTPs are advised to assume lateral movement by threat actors and investigate
connected systems and the domain controller (DC). </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsobodytext" style="mso-margin-top-alt:12.55pt;margin-right:31.7pt;margin-bottom:12.0pt;margin-left:0in">
<span class="xcontentpasted1"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Some of the recommended mitigations include install updated builds to ensure affected VMware Horizon and Unified Access Gateway systems are updated to the
latest version; keep all software up to date and prioritize patching known exploited vulnerabilities; and use best practices for identity and access management (IAM) by implementing multifactor authentication (MFA) and enforcing use of strong passwords. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="xmsobodytext" style="mso-margin-top-alt:12.55pt;margin-right:31.7pt;margin-bottom:12.0pt;margin-left:0in">
<span class="xcontentpasted1"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">In addition to applying mitigations, CISA and FBI recommend exercising, testing, and validating your organization's security program against the threat behaviors
mapped to the MITRE ATT&CK for Enterprise framework in this advisory. Network defenders are recommended to test existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory. </span></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity State Coordinator/Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt;color:#0563C1">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_1" src="cid:image001.png@01D8F98B.9A340360"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>