You're listening to the CyberWire Network, powered by N2K.

This is a CISA Cybersecurity Alert.

ID number Alpha Alpha 23-0-74 Alpha.

Original release date, March 15th, 2023.

CISA, FBI, and the Multistate Information Sharing and Analysis Center are releasing this joint

cybersecurity advisory to provide IT infrastructure defenders with TTPs, IOCs, and

methods to detect and protect against recent exploitation against Microsoft Internet information. and January 2023, CISA identified IOCs at a federal civilian executive branch agency.

Analysts determined that multiple cyber threat actors, including an APT actor and a known

cyber criminal group, were able to exploit a dot net deserrealization vulnerability

located in the agency's Microsoft Internet Information Services web server

successful exploitation of this vulnerability allows for remote code execution.

When exploiting the vulnerability, the threat actors uploaded malicious DLL files, some masqueraded as ping files, to the temp directory.

The malicious files were then executed from the directory via a legitimate process that runs

on IIS servers.

The review of antivirus logs identified that some DLL files were

created and detected as early as August 2021.

FBI and CISA encourage organizations to implement the recommendations in the mitigation section of this alert to reduce the likelihood and impact of similar exploitation.

The alert documentation linked in the show notes includes additional technical details

IOCs malicious actor TTPs recovery guidance mitigations and response

recommendations. Google's Threat Analysis Group contributed to this advisory.

To report incidents in a threat analysis group contributed to this advisory.

To report incidents in anomalous activity or to request incident response,

...