The CISA KEV Ransomware Alert: Vulnerability Data Analysis and Exploited Insights

CISA KEV has recently merged data with stop ransomware attacks, identifying the top vulnerabilities and attack methodologies exploited in ransomware. We will deep dive into the data identifying top vendors affected by ransomware in the last year.

The Cybersecurity and Infrastructure Security Agency (CISA) recently sent an alert about a particularly menacing ransomware known as KEV.

The new section of CISA KEV is a welcomed addition to the Stop the ransom website and initiative.

The Ransomware Landscape by Numbers from CISA KEV

Let’s first lay the groundwork with some statistics. Out of 154 vendors considered, 51 have a history of ransomware incidents, while 103 have remained unscathed, at least until now. KEV ransomware is not discriminating; whether a vendor has a past with ransomware or not, all are potential targets.

(note for simplicity of visualization a number of vendors with just 1 vulnerability has been removed)

Top 10 Vendors Exposed to Ransomware in CISA KEV in the Crosshairs.

Notably, the ransomware has zeroed in on some of the industry’s heavyweights. The top 10 most targeted vendors are:

1. Microsoft
2. VMware
3. QNAP
4. Oracle
5. Adobe
6. Apache
7. SonicWall
8. Accellion
9. Atlassian

Following an overview of the vulnerable data for the top 20 products

You can also explore more in-depth with our data visualization and threat intelligence explorer

Spotlight on Exploited Products and ransomware activity in CISA KEV

The products most frequently exploited give us a snapshot of the ransomware’s focus. We also compared the number of vulnerabilities reported in kev with the one affected by the ransomware activity in cisa kev, naming this ransomware density. Here are some insights:

Vulnerability in Microsoft’s Suite

• Windows: 96 entries in CISA KEV, 459 mentions across GIT, ExploitDB, and H1.
• Win32k: 22 CISA KEV entries, 100 mentions in exploit databases.
• Microsoft Exchange Server: 9 CISA KEV entries, 74 mentions, two in the top 25.

Other Vendors

• Accellion FTA: 4 CISA KEV entries, 8 mentions, 100% ransomware density.
• Adobe Flash Player: 29 CISA KEV entries, 87 mentions, 10.34% ransomware density.
• Oracle Java SE: 7 CISA KEV entries, 17 mentions, 42.86% ransomware density.

Ransomware Density and Vulnerability

• Microsoft’s Exchange Server has a staggering 66.67% ransomware density.
• Accellion’s FTA and QNAP’s Photo Station both have a 100% ransomware density, indicating all their vulnerabilities are exploited by ransomware.

(note for simplicity of visualization a number of vendors with just 1 vulnerability has been removed)

Defensive Measures for Organizations

1. Regular Software Updates: An outdated system is an open field for cyber predators.
2. Leverage CISA KEV to identify and prioritize vulnerabilities.
3. Implement a selection and prioritization method like risk based vulnerability prioritization and SSVC for selecting vulnerability based on indicator of compromise.
4. Multi-Factor Authentication (MFA): Implement MFA to add layer of security.
5. Segment network in line with Zero Trust principle to prevent a compromised host to extend the infection to other compromised hosts

Why You Should Refer to CISA’s StopRansomware Website

CISA’s StopRansomware website is a treasure trove of information on misconfigurations and weaknesses that are commonly exploited in ransomware campaigns. This platform serves as a one-stop resource for recognizing and rectifying vulnerabilities that KEV ransomware and its ilk are known to exploit.

Another interesting report to consider is the cisa top routinely exploited vulnerabilities

What are the top vendors mentioned in CISA Top Exploited Vulnerability 2022

• VMware,
• Atlassian,
• Microsoft,
• Fortinet,
• F5,
• Zoho,
• Apache,
• SonicWall,
• Zimbra,
• SAP,
• Oracle

What are the top exploits in the CISA Top exploited Vulnerabilities 2022

• 🛡️ CVE-2018-13379: Affects Fortinet SSL VPNs. The issue lies in failing to patch software, making organizations vulnerable.
• 📧 CVE-2021-34473, CVE-2021-31207, CVE-2021-34523 (ProxyShell): Targets Microsoft Exchange email servers. Enables remote actors to execute arbitrary code.
• 🔐 CVE-2021-40539: Impacts Zoho ManageEngine ADSelfService Plus. Enables unauthenticated remote code execution due to outdated third-party dependency.
• 🤝 CVE-2021-26084: Affects Atlassian Confluence Server and Data Center. Allows unauthenticated cyber actors to execute arbitrary code.
• 📚 CVE-2021-44228 (Log4Shell): Affects Apache’s Log4j library. Enables the execution of arbitrary code and system control.
• 💻 CVE-2022-22954, CVE-2022-22960: Affects VMware Workspace ONE Access and other VMware products. Allows remote code execution, privilege escalation, and authentication bypass.

What are the top Method of Attacks in the CISA Top exploited Vulnerabilities

• RCE (Remote Code Execution): 16 Mentions
• RCE/Authentication Bypass: 1 Mention
• Arbitrary Code Execution: 4 Mentions
• Security Feature Bypass: 1 Mention
• Elevation of Privilege: 2 Mentions
• Privilege Escalation: 2 Mentions
• Server Path Traversal: 2 Mentions
• SSL VPN Credential Exposure: 1 Mention

In the new report for 2022, CISA Top routinely exploited vulnerabilities  identifies the top routinely exploited vulnerabilities:

Note: The post has an embedded script and iframe to interact with the data directly. Make sure you have those enabled (on mobile, one of the visuals will ask to download a file, ignore this)

Conclusion

The CISA KEV ransomware alert as well as CISA KEV catalogues, are two great indicators of compromise and should be taken into consideration when prioritizing vulnerabilities. An alternative measure are EPSS, which helps organizations prioritise based on an observed vulnerability in the wild.
Phoenix security leverages CISA KEV, Ransomware indicators, and evidence of exploitability to alert immediately when a vulnerability and an asset can be compromised

How Phoenix Security Can Help

Phoenix Security helps organizations identify and trace which systems have vulnerabilities, understanding the relation between code and cloud. One of the significant challenges in securing applications is knowing where and how frameworks like Struts are used. ASPM tools can scan the application portfolio to identify instances of Struts, mapping out where it is deployed across the organization. This information is crucial for targeted security measures and efficient patch management. Phoenix Security’s robust Application Security Posture Management (ASPM) system is adept at not just managing, but preempting the exploitation of vulnerabilities through its automated identification system. This system prioritises critical vulnerabilities, ensuring that teams can address the most pressing threats first, optimising resource allocation and remediation efforts.

The Role of Application Security Posture Management (ASPM):

ASPM plays a vital role in managing and securing applications like those built with Apache Struts. It involves continuous assessment, monitoring, and improvement of the security posture of applications. ASPM tools can:

1. Identify and Track Struts Components: Locate where Struts is implemented within the application infrastructure.
2. Vulnerability Management: Detect known vulnerabilities in Struts and prioritize them for remediation.
3. Configuration Monitoring: Ensure Struts configurations adhere to best security practices.
4. Compliance: Check if the usage of Struts aligns with relevant cybersecurity regulations and standards.

By leveraging Phoenix Security, you not only unravel the potential threats but also take a significant stride in vulnerability management, ensuring your application security remains up to date and focuses on the key vulnerabilities.