www.bleepingcomputer.com
Open in
urlscan Pro
104.20.60.209
Public Scan
URL:
https://www.bleepingcomputer.com/news/security/cisa-warns-orgs-of-watchguard-bug-exploited-by-russian-state-hackers/
Submission: On April 12 via api from US — Scanned from DE
Submission: On April 12 via api from US — Scanned from DE
Form analysis 6 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/cisa-warns-orgs-of-watchguard-bug-exploited-by-russian-state-hackers/
<form
action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/cisa-warns-orgs-of-watchguard-bug-exploited-by-russian-state-hackers/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/cisa-warns-orgs-of-watchguard-bug-exploited-by-russian-state-hackers/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
* News
* Featured
* Latest
* Qbot malware switches to new Windows Installer infection vector
* Microsoft: Moving Windows 11 taskbar may never be an option again
* Third npm protestware: 'event-source-polyfill' calls Russia out
* Microsoft: Windows Autopatch steals the 'fun' from Patch Tuesdays
* Sandworm hackers fail to take down Ukrainian energy provider
* CISA warns orgs of WatchGuard bug exploited by Russian state hackers
* Third npm protestware: 'event-source-polyfill' calls Russia out
* Qbot malware switches to new Windows Installer infection vector
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to Translate a Web Page in Google Chrome
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* CISA warns orgs of WatchGuard bug exploited by Russian state hackers
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditReddit101Share to Hacker NewsHacker NewsShare
to EmailEmail
*
CISA WARNS ORGS OF WATCHGUARD BUG EXPLOITED BY RUSSIAN STATE HACKERS
By
SERGIU GATLAN
* April 11, 2022
* 06:24 PM
* 0
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal
civilian agencies and urged all US organizations on Monday to patch an actively
exploited bug impacting WatchGuard Firebox and XTM firewall appliances.
Sandworm, a Russian-sponsored hacking group, believed to be part of the GRU
Russian military intelligence agency, also exploited this high severity
privilege escalation flaw (CVE-2022-23176) to build a new botnet dubbed Cyclops
Blink out of compromised WatchGuard Small Office/Home Office (SOHO) network
devices.
"WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged
credentials to access the system with a privileged management session via
exposed management access," the company explains in a security advisory rating
the bug with a critical threat level.
PLAY Top Articles Video Settings Full Screen About Connatix V158503 Read More
Read More Read More Read More Read More Third npm protestware:
'event‑source‑polyfill'calls Russia out 1/1 Skip Ad Continue watching after the
ad Visit Advertiser websiteGO TO PAGE
The flaw can only be exploited if they are configured to allow unrestricted
management access from the Internet. By default, all WatchGuard appliances are
configured for restricted management access.
Federal Civilian Executive Branch Agencies (FCEB) agencies must secure their
systems against these security flaws according to November's binding operational
directive (BOD 22-01).
CISA has given them three weeks, until May 2nd, to patch the CVE-2022-23176 flaw
added today to its catalog of Known Exploited Vulnerabilities.
Even though this directive only applies to federal agencies, CISA also strongly
urged all US organizations to prioritize fixing this actively abused security
bug to avoid having their WatchGuard appliances compromised.
MALWARE HIT 1% OF WATCHGUARD FIREWALL APPLIANCES
Cyclops Blink, the malware used by the Sandworm state hackers to create their
botnet, has been used to target WatchGuard Firebox firewall appliances with
CVE-2022-23176 exploits, as well as multiple ASUS router models, since at least
June 2019.
It establishes persistence on the device through firmware updates, and it
provides its operators with remote access to compromised networks.
It uses the infected devices' legitimate firmware update channels to maintain
access to the compromised devices by injecting malicious code and deploying
repacked firmware images.
This malware is also modular, making it simple to upgrade and target new devices
and security vulnerabilities, tapping into new pools of exploitable hardware.
WatchGuard issued its own advisory after US and UK cybersecurity and law
enforcement agencies linked the malware to the GRU hackers, saying that Cyclops
Blink may have hit roughly 1% of all active WatchGuard firewall appliances.
The UK NCSC, FBI, CISA, and NSA joint advisory says organizations should assume
all accounts on infected devices as being compromised. Admins should also
immediately remove Internet access to the management interface.
BOTNET DISRUPTED, MALWARE REMOVED FROM C2 SERVERS
On Wednesday, US government officials announced the disruption of the Cyclops
Blink botnet before being weaponized and used in attacks.
The FBI also removed the malware from Watchguard devices identified as being
used as command and control servers, notifying owners of compromised devices in
the United States and abroad before cleaning the Cyclops Blink infection.
"I should caution that as we move forward, any Firebox devices that acted as
bots, may still remain vulnerable in the future until mitigated by their
owners," FBI Director Chris Wray warned.
"So those owners should still go ahead and adopt Watchguard's detection and
remediation steps as soon as possible."
WatchGuard has shared instructions on restoring infected Firebox appliances to a
clean state and updating them to the latest Fireware OS version to prevent
future infections.
RELATED ARTICLES:
US, UK link new Cyclops Blink malware to Russian state hackers
CISA orders agencies to patch actively exploited Sophos firewall bug
CISA warns orgs to patch actively exploited Chrome, Redis bugs
CISA adds 66 vulnerabilities to list of bugs exploited in attacks
CISA adds 15 vulnerabilities to list of flaws exploited in attacks
* Actively Exploited
* CISA
* GRU
* Russia
* WatchGuard
* Facebook
* Twitter
* LinkedIn
* Email
*
SERGIU GATLAN
Sergiu Gatlan is a reporter who covered cybersecurity, technology, Apple,
Google, and a few other topics at Softpedia for more than a decade. Email or
Twitter DMs for tips.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* Here are the new features coming to Windows 11
* Atlassian says ongoing outage might last two more weeks
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2022 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT