<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xxxxmsonospacing, li.xxxxmsonospacing, div.xxxxmsonospacing
{mso-style-name:x_x_x_x_msonospacing;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.xparagraph, li.xparagraph, div.xparagraph
{mso-style-name:x_paragraph;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.xmsonospacing, li.xmsonospacing, div.xmsonospacing
{mso-style-name:x_msonospacing;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.xcontentpasted0
{mso-style-name:x_contentpasted0;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">FYSA<o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="xxxxmsonospacing"><span style="color:black"><o:p> </o:p></span></p>
<p class="xparagraph" style="background:white"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released
a </span></span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:black"><a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-335a"><span style="font-size:11.0pt;font-family:"Franklin Gothic Book",sans-serif">joint Cybersecurity Advisory</span></a></span><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">
(CSA) with technical details associated with Cuba ransomware variants identified through FBI investigations as recently as August 2022. This CSA updates the December 2021
</span></span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:black"><a href="https://www.ic3.gov/Media/News/2021/211203-2.pdf"><span style="font-size:11.0pt;font-family:"Franklin Gothic Book",sans-serif">FBI Flash: Indicators of Compromise
Associated with Cuba Ransomware</span></a></span><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">.
</span></span><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p></o:p></span></p>
<p class="xparagraph" style="background:white"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p> </o:p></span></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">To gain initial access and compromise entities, Cuba actors historically leveraged known vulnerabilities in commercial software, use
phishing campaigns, leverage compromised credentials, and legitimate remote desktop protocol (RDP) tools. Cuba ransomware actors continue to target United States entities in the Financial Services, Government Facilities, Healthcare and Public Health, Critical
Manufacturing, and Information Technology sectors, as well as several entities outside of the U.S. </span></span><o:p></o:p></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">The impact on U.S. entities compromised by Cuba ransomware has doubled since the activity was reported in December 2021. In addition
to deploying ransomware, Cuba actors have used “double extortion” techniques, in which they exfiltrate victim data, demand ransomware, and release data if a ransom payment is not made. </span></span><o:p></o:p></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Additionally, since Spring 2022, third-party and open-source reporting have identified a possible link between Cuba ransomware actors,
Industrial Spy ransomware actors, and RomCom remote access Trojan (RAT) actors. RomCom actors using a custom RAT have targeted foreign military organizations, information technology companies, and food brokers and manufacturers. </span></span><o:p></o:p></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Actions organizations can take today to mitigate cyber threats from ransomware include prioritize remediating known exploited vulnerabilities
(KEVs), train users to recognize and report phishing attempts, and enable and enforce phishing-resistant multifactor authentication (MFA). </span></span><o:p></o:p></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">CISA and FBI do not encourage paying ransom as payment does not guarantee victim files will be recovered and may also embolden adversaries
to conduct more malicious activity. Organizations are urged to review the advisory and apply the recommended detections and mitigations. Regardless of whether payment is made or not, victims of ransomware should report the incident to their local FBI field
office or CISA. </span></span><o:p></o:p></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="xmsonospacing"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">This joint CSA is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware
variants and ransomware threat actors. </span></span><o:p></o:p></p>
<p class="xmsonospacing"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity State Coordinator/Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt;color:#0563C1">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_1" src="cid:image001.png@01D90570.17A5FB10"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>