<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xmsobodytext, li.xmsobodytext, div.xmsobodytext
{mso-style-name:x_msobodytext;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">FYSA<o:p></o:p></p>
<div>
<div>
<p class="xmsobodytext" style="mso-margin-top-alt:12.55pt;margin-right:31.7pt;margin-bottom:12.0pt;margin-left:0in">
<span style="font-family:"Franklin Gothic Book",sans-serif">As the Nation’s cyber defense agency, the Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the Federal Bureau of Investigation (FBI), published a joint Cybersecurity Advisory
(CSA) with recommended actions and mitigations to protect against <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a">
Royal ransomware</a> used by threat actors. Attacks have spread across numerous critical infrastructure sectors including, but not limited to, manufacturing, communications, healthcare and public healthcare (HPH), and education. <o:p></o:p></span></p>
<p class="xmsobodytext" style="mso-margin-top-alt:12.55pt;margin-right:31.7pt;margin-bottom:12.0pt;margin-left:0in">
<span style="font-family:"Franklin Gothic Book",sans-serif;color:black">The advisory includes known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) that were identified through FBI investigations as recently as January 2023.
</span><span style="font-family:"Franklin Gothic Book",sans-serif"> According to third-party reporting, Royal actors most commonly gain initial access through phishing emails and secondly by Remote Desktop Protocol (RDP) compromise; FBI observed the exploitation
of public-facing applications. Other trusted third-party reports indicate a tendency to leverage brokers to gain initial access, and source traffic by mining virtual private network (VPN) credentials from stealer logs. <o:p></o:p></span></p>
<p class="xmsobodytext" style="mso-margin-top-alt:12.55pt;margin-right:31.7pt;margin-bottom:12.0pt;margin-left:0in">
<span style="font-family:"Franklin Gothic Book",sans-serif">Actions that organizations can take today to mitigate the ransomware cyber threat include, prioritize remediating known exploited vulnerabilities, train users to recognize and report phishing attempts,
and enable and enforce multifactor authentication with strong passwords. With contributions from Coveware, Q6, RedSense, Digital Asset Redemption, and Recorded Future, CISA and the FBI encourage network defenders to review the advisory, implement the recommended
mitigations in the advisory to limit potential adversarial techniques and reduce the risk of compromise by Royal ransomware. <o:p></o:p></span></p>
<p class="xmsobodytext" style="mso-margin-top-alt:12.55pt;margin-right:31.7pt;margin-bottom:12.0pt;margin-left:0in">
<span style="font-family:"Franklin Gothic Book",sans-serif">This joint CSA is part of an ongoing <a href="https://www.cisa.gov/stopransomware">#StopRansomware</a> effort to publish advisories for network defenders that detail various ransomware variants and
ransomware threat actors. It is available on stopransomware.gov, along with other advisories on the ransomware threat and no-cost resources. With our partner agencies, CISA is committed to helping organizations protect against all cyber threats through information
sharing, services, and resources. <o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><b><o:p> </o:p></b></p>
<p class="MsoNormal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity State Coordinator/Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt;color:#0563C1">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_1" src="cid:image001.png@01D94CF0.10F1E2D0"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>