CISA Cybersecurity Alerts

This CISA cybersecurity alert warns of increased state-sponsored cyber threats targeting managed service providers (MSPs) and provides security guidance for MSPs and their customers.

This CISA cybersecurity alert details how Russian state-sponsored cyber actors have been targeting U.S.

This CISA cybersecurity alert details how malicious actors exploit weak security controls and practices for initial access, providing 18 best practices across 7 categories to strengthen defenses.

CISA and FBI issue an alert about the ESXiArgs ransomware targeting VMware ESXI servers, providing recovery guidance and a script for affected organizations.

CISA and FBI update a cybersecurity advisory attributing Russian state-sponsored cyber attacks on SATCOM networks during the Ukraine invasion and urge organizations to implement protective measures.

This CISA cybersecurity alert warns network defenders about a widespread cyber campaign where malicious actors use legitimate remote monitoring and management software in phishing attacks to steal money and potentially enable further cybercrime.

This CISA cybersecurity alert warns that Russia's invasion of Ukraine may lead to increased malicious cyber activity against global organizations, particularly critical infrastructure, with details on recent state-sponsored operations and threats from Russian-aligned cybercriminals.

This CISA cybersecurity alert details the LockBit ransomware threat, its widespread impact across critical infrastructure sectors, and provides recommended mitigations for network defenders.

This CISA cybersecurity alert details the Hive ransomware group's tactics, targets, and indicators of compromise, highlighting its impact on over 1,300 companies worldwide.

This CISA and FBI joint advisory details the CL0P ransomware gang's exploitation of the CVE-2023-34362 vulnerability in MOVEit Transfer software, including their tactics and recommended mitigations.

This CISA alert details the Medusa Locker ransomware, its attack methods via remote desktop protocol and phishing, and provides mitigation resources.

This episode discusses a CISA cybersecurity alert about Volt Typhoon, a Chinese state-sponsored cyber actor using living off the land techniques to evade detection in U.S.

This CISA cybersecurity alert details the Daixin Team ransomware group's attacks on U.S.

This CISA cybersecurity alert warns that malicious actors continue to exploit the Log4Shell vulnerability in unpatched VMware Horizon systems to gain initial access and control over networks.

This CISA cybersecurity alert details how Chinese state-sponsored cyber actors exploit known vulnerabilities in network devices to target telecommunications companies and establish global infrastructure for intrusions.

This CISA and FBI joint advisory details the Royal ransomware variant, its tactics, ransom demands, and mitigation recommendations for organizations.

This CISA cybersecurity alert details a 2022 red team assessment that successfully penetrated a critical infrastructure organization's network undetected, highlighting key findings and recommendations for improving network monitoring and hardening.

This CISA cybersecurity alert details the top malware strains from 2021, including remote access trojans, banking trojans, information stealers, and ransomware, with technical information and mitigation strategies.

This CISA cybersecurity alert details tactics used by malicious actors to compromise industrial control systems and provides mitigation recommendations for operators to defend critical infrastructure.

CISA warns that threat actors are exploiting unpatched VMware vulnerabilities to gain full system control and recommends immediate action.

This CISA cybersecurity alert warns about active exploitation of the critical CVE-2022-1388 vulnerability in F5 BIG-IP systems, urging organizations to apply patches immediately.

This CISA cybersecurity alert details active exploitation of critical VMware vulnerabilities, providing updates on detection methods, incident response procedures, and emergency directives for organizations.

This CISA cybersecurity alert details how Russian state-sponsored cyber actors exploited default MFA settings and the PrintNightmare vulnerability to gain unauthorized access to an NGO's network and cloud environment.

This CISA cybersecurity alert details the BianLian ransomware group's tactics, targets, and provides mitigation recommendations for organizations.

This CISA and FBI cybersecurity alert warns about active exploitation of a critical vulnerability in PaperCut software that allows remote code execution and has been targeted by ransomware groups.

This CISA cybersecurity alert details the sophisticated Snake malware used by Russia's FSB for long-term cyber espionage against sensitive targets worldwide.

This episode presents a joint CISA and FBI advisory detailing the LockBit 3.0 ransomware's indicators of compromise, tactics, and mitigation strategies to protect organizations.

This CISA cybersecurity alert details how threat actors exploited a .NET deserialization vulnerability in U.S.

This CISA cybersecurity alert details ongoing ransomware attacks by DPRK cyber actors targeting healthcare and critical infrastructure sectors, with technical indicators and mitigation guidance.

This CISA and FBI joint advisory updates information on Cuba ransomware, detailing its increased impact, new tactics, and providing mitigation recommendations.

CISA and FBI release an alert detailing how Iranian government-sponsored APT actors exploited the log4shell vulnerability in a federal network to deploy crypto miners and credential harvesters.

This CISA cybersecurity alert details the top 20 common vulnerabilities exploited by Chinese state-sponsored cyber actors targeting U.S.

This CISA alert details how Iranian state cyber actors conducted destructive cyber operations against the Albanian government in 2022, using ransomware and disk-wiping malware after maintaining network access for over a year.

This CISA cybersecurity alert details how APT groups used Impacket and Covalent Stealer tools to compromise a defense industrial base organization's network and steal sensitive data from November 2021 to January 2022.

CISA and MS-ISAC issue a joint cybersecurity advisory warning about active exploitation of multiple high-severity vulnerabilities in Zimbra Collaboration Suite, urging organizations to patch systems and monitor for malicious activity.

This CISA and FBI joint advisory details the Zeppelin ransomware's indicators of compromise, tactics, techniques, and procedures, targeting various sectors including defense, healthcare, and education.

CISA updates its cybersecurity alert about malicious actors exploiting the Log4Shell vulnerability in unpatched VMware Horizon systems, detailing ongoing attacks and providing new indicators of compromise.

This CISA cybersecurity alert details how North Korean state-sponsored actors have used Maui ransomware to target healthcare organizations since May 2021, providing mitigation recommendations and warning against ransom payments.

This CISA cybersecurity alert details how APT28 exploited a known vulnerability in Cisco routers using SNMP to conduct reconnaissance and deploy malware in 2021, targeting victims worldwide including in Europe, the U.S., and Ukraine.

This CISA cybersecurity alert details the new modular malware framework called Cyclops Blink, used by the Russian GRU-linked Sandworm APT actor as a replacement for VPNFilter, targeting network devices like SOHO routers.

This CISA cybersecurity alert details the top 15 vulnerabilities exploited by malicious actors in 2021, emphasizing the risks of unpatched software and highlighting critical threats like log4shell.

This CISA cybersecurity alert details how North Korean state-sponsored APT groups like Lazarus Group target blockchain and cryptocurrency organizations through social engineering and malicious applications to steal digital assets.

This CISA alert warns about APT actors using custom tools to compromise ICS/SCADA devices and provides initial protection steps.

This CISA cybersecurity alert details Russian state-sponsored cyber operations targeting energy sector organizations from 2011 to 2018, including indictments of FSB officers and their tactics, techniques, and procedures.

CISA and the FBI issue a cybersecurity alert warning of threats to satellite communication networks and provide mitigation recommendations for providers and customers.

This CISA alert details the Karakurt data extortion group, which steals data and demands ransoms of $25,000 to $13 million in Bitcoin.

This CISA alert details destructive malware campaigns targeting Ukrainian organizations amid Russia's 2022 invasion.

CISA, the FBI, and MSISAC released advisory AA22-249A on September 6, 2022, warning about Vice Society ransomware campaigns.

The FBI, CISA, U.S.

This CISA alert details ongoing cyber operations by Iranian Islamic Revolutionary Guard Corps-affiliated threat actors.