CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – February 29, 2024
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
CISA released a joint Cybersecurity Advisory (CSA) today in coordination with the FBI, MS-ISAC, and multiple international partners to emphasize that cyber threat actors continue exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. The advisory was developed with the cooperation of Volexity, Ivanti, Mandiant, and other industry partners.
Today, CISA, the FBI, and MS-ISAC released a joint Cybersecurity Advisory (CSA), #StopRansomware: Phobos Ransomware, to disseminate known tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs), which are from incident response investigations tied to Phobos ransomware activity from as recently as February, 2024.
Two recently resolved vulnerabilities in ConnectWise ScreenConnect, tracked as CVE-2024-1709 and CVE-2024-1708 (CVSS scores of 10 and 8.4, respectively) are being exploited by more and more threat actors. This greater interest among varied threat actors is broadening the threat and escalating urgency of remediation. Affected versions include ScreenConnect 23.9.7 and earlier versions.
The President’s Council of Advisors on Science and Technology (PCAST) released a report on fortifying the nation’s cyber-physical systems (attached). These systems are the integrated digital and infrastructural resources that are crucial to Americans’ daily lives, including the electrical grid, public water systems, internet and telecommunications, banking systems, air traffic control, and much more.
FBI Cyber put together new info graphics on FBI Cyber Threat Response and Fact vs Fiction. They include helpful information to help organizations and users understand the proper supportive role that the FBI employs when assisting during an intrusion and helps to discard common misconceptions surrounding what FBI Cyber actually does. They also provide useful pre-intrusion and post-intrusion tips for properly reporting and responding to cyber intrusions including how to contact FBI Cyber.
CISA, the FBI, and the Department of Health and Human Services (HHS) released an update to the joint advisory #StopRansomware: ALPHV Blackcat to provide new indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with the ALPHV Blackcat ransomware as a service (RaaS). ALPHV Blackcat affiliates have been observed primarily targeting the healthcare sector.
The FBI, NSA, U.S. Cyber Command, and international partners are releasing this joint Cybersecurity Advisory (CSA) to warn of Russian state-sponsored cyber actors’ use of compromised Ubiquiti EdgeRouters (EdgeRouters) to facilitate malicious cyber operations worldwide.
The following posts are useful for general awareness of current cyber threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.
Critical Infrastructure
Following the international takedown operation of the LockBit ransomware group last week – which disrupted LockBit’s criminal network infrastructure and arrested two of its members – the ransomware group’s leader, known as LockBitSupp, has issued a lengthy message on a new dark web site with additional threats and promises of return.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
