<p>This joint cybersecurity advisory—written by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA)—provides information on Russian state-sponsored advanced persistent threat (APT) actor activity targeting various U.S. state, local, territorial, and tribal (SLTT) government networks, as well as aviation networks. This advisory updates joint CISA-FBI cybersecurity advisory <a href=”https://us-cert.cisa.gov/ncas/alerts/aa20-283a”>AA20-283A: APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations</a>.</p>
<p>Since at least September 2020, a Russian state-sponsored APT actor—known variously as Berserk Bear, Energetic Bear, TeamSpy, Dragonfly, Havex, Crouching Yeti, and Koala in open-source reporting—has conducted a campaign against a wide variety of U.S. targets. The Russian state-sponsored APT actor has targeted dozens of SLTT government and aviation networks, attempted intrusions at several SLTT organizations, successfully compromised network infrastructure, and as of October 1, 2020, exfiltrated data from at least two victim servers.</p>
<p>The Russian-sponsored APT actor is obtaining user and administrator credentials to establish initial access, enable lateral movement once inside the network, and locate high value assets in order to exfiltrate data. In at least one compromise, the APT actor laterally traversed an SLTT victim network and accessed documents related to:</p>
<ul>
<li>Sensitive network configurations and passwords.</li>
<li>Standard operating procedures (SOP), such as enrolling in multi-factor authentication (MFA).</li>
<li>IT instructions, such as requesting password resets.</li>
<li>Vendors and purchasing information.</li>
<li>Printing access badges.</li>
</ul>
<p>To date, the FBI and CISA have no information to indicate this APT actor has intentionally disrupted any aviation, education, elections, or government operations. However, the actor may be seeking access to obtain future disruption options, to influence U.S. policies and actions, or to delegitimize SLTT government entities.</p>
<p>As this recent malicious activity has been directed at SLTT government networks, there may be some risk to elections information housed on SLTT government networks. However, the FBI and CISA have no evidence to date that integrity of elections data has been compromised. Due to the heightened awareness surrounding elections infrastructure and the targeting of SLTT government networks, the FBI and CISA will continue to monitor this activity and its proximity to elections infrastructure.</p>
<ul>
<li>Click here for a <a href=”https://us-cert.cisa.gov/sites/default/files/Joint_CISA_FBI_CSA-AA20-296A__Russian_State_Sponsored_APT_Actor_Compromise_US_Government_Targets.pdf”>PDF</a> version of this report.</li>
<li>Click here for a <a href=”https://us-cert.cisa.gov/sites/default/files/2020-10/AA20-296A.stix.xml”>STIX</a> package of IOCs.</li>
</ul>
<h4>U.S. Heat Map of Activity</h4>
<p><a href=”https://indd.adobe.com/view/64463245-3411-49f9-b203-1c7cb8f16769″>Click here</a> for an interactive heat map of this activity. Hovering the cursor over the map reveals the number and type of entities the Russian APT has targeted in each region. These totals include compromises, scanning, or other reconnaissance activity executed from the Russian APT actor infrastructure.</p>
<p><strong>Note</strong>: CISA is committed to providing access to our web pages and documents for individuals with disabilities, both members of the public and federal employees. If the format of any elements or content within this document interferes with your ability to access the information, as defined in the Rehabilitation Act, please email <a href=”https://us-cert.cisa.govmailto: info@us-cert.gov”>info@us-cert.gov</a>. To enable us to respond in a manner most helpful to you, please indicate the nature of your accessibility problem and the preferred format in which to receive the material.</p>
<p><strong>Note</strong>: the heat map has interactive features that may not work in your web browser. For best use, please download and save this catalog.</p>
<h3>Technical Details</h3><p>The FBI and CISA have observed Russian state-sponsored APT actor activity targeting U.S. SLTT government networks, as well as aviation networks. The APT actor is using Turkish IP addresses <code>213.74.101[.]65</code>, <code>213.74.139[.]196</code>, and <code>212.252.30[.]170</code> to connect to victim web servers (<em>Exploit Public Facing Application</em> [<a href=”https://attack.mitre.org/versions/v7/techniques/T1190/”>T1190</a>]).</p>
<p>The actor is using <code>213.74.101[.]65</code> and <code>213.74.139[.]196</code> to attempt brute force logins and, in several instances, attempted Structured Query Language (SQL) injections on victim websites (<em>Brute Force</em> [<a href=”https://attack.mitre.org/versions/v7/techniques/T1110″>T1110</a>]; <em>Exploit Public Facing Application</em> [<a href=”https://attack.mitre.org/versions/v7/techniques/T1190/”>T1190</a>]). The APT actor also hosted malicious domains, including possible aviation sector target <code>columbusairports.microsoftonline[.]host</code>, which resolved to <code>108.177.235[.]92</code> and <code>[cityname].westus2.cloudapp.azure.com</code>; these domains are U.S. registered and are likely SLTT government targets (<em>Drive-By Compromise </em>[<a href=”https://attack.mitre.org/versions/v7/techniques/T1189″>T1189</a>]).</p>
<p>The APT actor scanned for vulnerable Citrix and Microsoft Exchange services and identified vulnerable systems, likely for future exploitation. This actor continues to exploit a Citrix Directory Traversal Bug (<a href=”https://nvd.nist.gov/vuln/detail/CVE-2019-19781″>CVE-2019-19781</a>) and a Microsoft Exchange remote code execution flaw (<a href=”https://nvd.nist.gov/vuln/detail/CVE-2020-0688″>CVE-2020-0688</a>).</p>
<p>The APT actor has been observed using Cisco AnyConnect Secure Socket Layer (SSL) virtual private network (VPN) connections to enable remote logins on at least one victim network, possibly enabled by an Exim Simple Mail Transfer Protocol (SMTP) vulnerability (<a href=”https://nvd.nist.gov/vuln/detail/CVE-2019-10149″>CVE 2019-10149</a>) (<em>External Remote Services</em> [<a href=”https://attack.mitre.org/versions/v7/techniques/T1133″>T1133</a>]). More recently, the APT actor enumerated and exploited a Fortinet VPN vulnerability (<a href=”https://nvd.nist.gov/vuln/detail/CVE-2018-13379″>CVE-2018-13379</a>) for Initial Access [<a href=”https://attack.mitre.org/versions/v7/tactics/TA0001/”>TA0001</a>] and a Windows Netlogon vulnerability (<a href=”https://nvd.nist.gov/vuln/detail/CVE-2020-1472″>CVE-2020-1472</a>) to obtain access to Windows Active Directory (AD) servers for Privilege Escalation [<a href=”https://attack.mitre.org/versions/v7/tactics/TA0004/”>TA0004</a>] within the network (<em>Valid Accounts</em> [<a href=”https://attack.mitre.org/versions/v7/techniques/T1078″>T1078</a>]). These vulnerabilities can also be leveraged to compromise other devices on the network (<em>Lateral Movement</em> [<a href=”https://attack.mitre.org/versions/v7/tactics/TA0008/”>TA0008</a>]) and to maintain <em>Persistence</em> [<a href=”https://attack.mitre.org/versions/v7/tactics/TA0003/”>TA0003</a>]).</p>
<p>Between early February and mid-September, these APT actors used <code>213.74.101[.]65</code>, <code>212.252.30[.]170</code>, <code>5.196.167[.]184</code>, <code>37.139.7[.]16</code>, <code>149.56.20[.]55</code>, <code>91.227.68[.]97</code>, and <code>5.45.119[.]124</code> to target U.S. SLTT government networks. Successful authentications—including the compromise of Microsoft Office 365 (O365) accounts—have been observed on at least one victim network (<em>Valid Accounts</em> [<a href=”https://attack.mitre.org/versions/v7/techniques/T1078″>T1078</a>]).</p>
<h3>Mitigations</h3><h4>Indicators of Compromise</h4>
<p>The APT actor used the following IP addresses and domains to carry out its objectives:</p>
<ul>
<li><code>213.74.101[.]65</code></li>
<li><code>213.74.139[.]196</code></li>
<li><code>212.252.30[.]170</code></li>
<li><code>5.196.167[.]184</code></li>
<li><code>37.139.7[.]16</code></li>
<li><code>149.56.20[.]55</code></li>
<li><code>91.227.68[.]97</code></li>
<li><code>138.201.186[.]43</code></li>
<li><code>5.45.119[.]124</code></li>
<li><code>193.37.212[.]43</code></li>
<li><code>146.0.77[.]60</code></li>
<li><code>51.159.28[.]101</code></li>
<li><code>columbusairports.microsoftonline[.]host</code></li>
<li><code>microsoftonline[.]host</code></li>
<li><code>email.microsoftonline[.]services</code></li>
<li><code>microsoftonline[.]services</code></li>
<li><code>cityname[.]westus2.cloudapp.azure.com</code></li>
</ul>
<p>IP address <code>51.159.28[.]101</code> appears to have been configured to receive stolen Windows New Technology Local Area Network Manager (NTLM) credentials. FBI and CISA recommend organizations take defensive actions to mitigate the risk of leaking NTLM credentials; specifically, organizations should disable NTLM or restrict outgoing NTLM. Organizations should consider blocking IP address <code>51.159.28[.]101</code> (although this action alone may not mitigate the threat, as the APT actor has likely established, or will establish, additional infrastructure points).</p>
<p>Organizations should check available logs for traffic to/from IP address <code>51.159.28[.]101</code> for indications of credential-harvesting activity. As the APT actors likely have—or will—establish additional infrastructure points, organizations should also monitor for Server Message Block (SMB) or WebDAV activity leaving the network to other IP addresses.</p>
<p>Refer to <a href=”https://us-cert.cisa.gov/sites/default/files/publications/AA20-296A.stix.xml”>AA20-296A.stix</a> for a downloadable copy of IOCs.</p>
<h4>Network Defense-in-Depth</h4>
<p>Proper network defense-in-depth and adherence to information security best practices can assist in mitigating the threat and reducing the risk to critical infrastructure. The following guidance may assist organizations in developing network defense procedures.</p>
<ul>
<li>Keep all applications updated according to vendor recommendations, and especially prioritize updates for external facing applications and remote access services to address CVE-2019-19781, CVE-2020-0688, CVE 2019-10149, CVE-2018-13379, and CVE-2020-1472. Refer to table 1 for patch information on these CVEs.</li>
</ul>
<p class=”text-align-center”><em>Table 1: Patch information for CVEs</em></p>
<table border=”1″ cellpadding=”1″ cellspacing=”1″ class=”general-table” style=”width: 881.467px; height: 312px; margin-left: auto; margin-right: auto;”>
<thead>
<tr>
<th scope=”col” style=”width: 198px;”><strong>Vulnerability</strong></th>
<th scope=”col” style=”width: 311px;”><strong>Vulnerable Products</strong></th>
<th scope=”col” style=”width: 356px;”><strong>Patch Information</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td scope=”col” style=”text-align: left; width: 198px;”><a href=”https://nvd.nist.gov/vuln/detail/CVE-2019-19781″>CVE-2019-19781</a></td>
<td scope=”col” style=”text-align: left; width: 311px;”>
<ul>
<li>Citrix Application Delivery Controller</li>
<li>Citrix Gateway</li>
<li>Citrix SDWAN WANOP</li>
</ul>
<p> </p>
</td>
<td scope=”col” style=”text-align: left; width: 356px;”>
<p><a href=”https://www.citrix.com/blogs/2020/01/19/vulnerability-update-first-permanent-fixes-available-timeline-accelerated/”>Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 11.1 and 12.0</a></p>
<p><a href=”https://www.citrix.com/blogs/2020/01/22/update-on-cve-2019-19781-fixes-now-available-for-citrix-sd-wan-wanop/”>Citrix blog post: security updates for Citrix SD-WAN WANOP release 10.2.6 and 11.0.3</a></p>
<p><a href=”https://www.citrix.com/blogs/2020/01/23/fixes-now-available-for-citrix-adc-citrix-gateway-versions-12-1-and-13-0/”>Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 12.1 and 13.0</a></p>
<p><a href=”https://www.citrix.com/blogs/2020/01/24/citrix-releases-final-fixes-for-cve-2019-19781/”>Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway version 10.5</a></p>
</td>
</tr>
<tr>
<td scope=”col” style=”text-align: left; width: 198px;”><a href=”https://nvd.nist.gov/vuln/detail/CVE-2020-0688″>CVE-2020-0688</a></td>
<td scope=”col” style=”text-align: left; width: 311px;”>
<ul>
<li>Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30</li>
<li>Microsoft Exchange Server 2013 Cumulative Update 23</li>
<li>Microsoft Exchange Server 2016 Cumulative Update 14</li>
<li>Microsoft Exchange Server 2016 Cumulative Update 15</li>
<li>Microsoft Exchange Server 2019 Cumulative Update 3</li>
<li>Microsoft Exchange Server 2019 Cumulative Update 4</li>
</ul>
<p> </p>
</td>
<td scope=”col” style=”text-align: left; width: 356px;”><a href=”https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688″>Microsoft Security Advisory for CVE-2020-0688</a></td>
</tr>
<tr>
<td scope=”col” style=”text-align: left; width: 198px;”><a href=”https://nvd.nist.gov/vuln/detail/CVE-2019-10149″>CVE-2019-10149</a></td>
<td scope=”col” style=”text-align: left; width: 311px;”>
<ul>
<li>Exim versions 4.87–4.91</li>
</ul>
</td>
<td scope=”col” style=”text-align: left; width: 356px;”><a href=”https://www.exim.org/static/doc/security/CVE-2019-10149.txt”>Exim page for CVE-2019-10149</a></td>
</tr>
<tr>
<td scope=”col” style=”text-align: left; width: 198px;”><a href=”https://nvd.nist.gov/vuln/detail/CVE-2018-13379″>CVE-2018-13379</a></td>
<td scope=”col” style=”text-align: left; width: 311px;”>
<ul>
<li>FortiOS 6.0: 6.0.0 to 6.0.4</li>
<li>FortiOS 5.6: 5.6.3 to 5.6.7</li>
<li>FortiOS 5.4: 5.4.6 to 5.4.12</li>
</ul>
</td>
<td scope=”col” style=”text-align: left; width: 356px;”><a href=”https://www.fortiguard.com/psirt/FG-IR-18-384″>Fortinet Security Advisory: FG-IR-18-384</a></td>
</tr>
<tr>
<td scope=”col” style=”text-align: left; width: 198px;”><a href=”https://nvd.nist.gov/vuln/detail/CVE-2020-1472″>CVE-2020-1472</a></td>
<td scope=”col” style=”text-align: left; width: 311px;”>
<ul>
<li>Windows Server 2008 R2 for x64-based Systems Service Pack 1</li>
<li>Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)</li>
<li>Windows Server 2012</li>
<li>Windows Server 2012 (Server Core installation)</li>
<li>Windows Server 2012 R2</li>
<li>Windows Server 2016</li>
<li>Windows Server 2019</li>
<li>Windows Server 2019 (Server Core installation)</li>
<li>Windows Server, version 1903 (Server Core installation)</li>
<li>Windows Server, version 1909 (Server Core installation)</li>
<li>Windows Server, version 2004 (Server Core installation)</li>
</ul>
</td>
<td scope=”col” style=”text-align: left; width: 356px;”>
<p><a href=”https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472″>Microsoft Security Advisory for CVE-2020-1472</a></p>
<p> </p>
</td>
</tr>
</tbody>
</table>
<p> </p>
<ul>
<li>Follow Microsoft’s <a href=”https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc”>guidance</a> on monitoring logs for activity related to the Netlogon vulnerability, CVE-2020-1472.</li>
<li>If appropriate for your organization’s network, prevent external communication of all versions of SMB and related protocols at the network boundary by blocking Transmission Control Protocol (TCP) ports 139 and 445 and User Datagram Protocol (UDP) port 137. See the CISA publication on <a href=”https://us-cert.cisa.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices”>SMB Security Best Practices</a> for more information.</li>
<li>Implement the prevention, detection, and mitigation strategies outlined in:
<ul>
<li>CISA Alert <a href=”https://us-cert.cisa.gov/ncas/alerts/TA15-314A”>TA15-314A – Compromised Web Servers and Web Shells – Threat Awareness and Guidance</a>.</li>
<li>National Security Agency Cybersecurity Information Sheet <a href=”https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/2159419/detect-prevent-cyber-attackers-from-exploiting-web-servers-via-web-shell-malware/”>U/OO/134094-20 – Detect and Prevent Web Shells Malware</a>.</li>
</ul>
</li>
<li>Isolate external facing services in a network demilitarized zone (DMZ) since they are more exposed to malicious activity; enable robust logging, and monitor the logs for signs of compromise.</li>
<li>Establish a training mechanism to inform end users on proper email and web usage, highlighting current information and analysis and including common indicators of phishing. End users should have clear instructions on how to report unusual or suspicious emails.</li>
<li>Implement application controls to only allow execution from specified application directories. System administrators may implement this through Microsoft Software Restriction Policy, AppLocker, or similar software. Safe defaults allow applications to run from <code>PROGRAMFILES</code>, <code>PROGRAMFILES(X86)</code>, and <code>WINDOWS</code> folders. All other locations should be disallowed unless an exception is granted.</li>
<li>Block Remote Desktop Protocol (RDP) connections originating from untrusted external addresses unless an exception exists; routinely review exceptions on a regular basis for validity.</li>
</ul>
<h4>Comprehensive Account Resets</h4>
<p>For accounts where NTLM password hashes or Kerberos tickets may have been compromised (e.g., through CVE-2020-1472), a double-password-reset may be required in order to prevent continued exploitation of those accounts. For domain-admin-level credentials, a reset of KRB-TGT “Golden Tickets” may be required, and Microsoft has released specialized <a href=”https://docs.microsoft.com/en-us/azure-advanced-threat-protection/domain-dominance-alerts”>guidance</a> for this. Such a reset should be performed very carefully if needed.</p>
<p>If there is an observation of <a href=”https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472″>CVE-2020-1472</a> Netlogon activity or other indications of valid credential abuse, it should be assumed the APT actors have compromised AD administrative accounts. In such cases, the AD forest should not be fully trusted, and, therefore, a new forest should be deployed. Existing hosts from the old compromised forest cannot be migrated in without being rebuilt and rejoined to the new domain, but migration may be done through “creative destruction,” wherein, as endpoints in the legacy forest are decommissioned, new ones can be built in the new forest. This will need to be completed in on-premise—as well as in Azure-hosted—AD instances.</p>
<p>Note that fully resetting an AD forest is difficult and complex; it is best done with the assistance of personnel who have successfully completed the task previously.</p>
<p>It is critical to perform a full password reset on all user and computer accounts in the AD forest. Use the following steps as a guide.</p>
<ol>
<li>Create a temporary administrator account, and use this account only for all administrative actions</li>
<li>Reset the Kerberos Ticket Granting Ticket <code>(krbtgt</code>) password;[<a href=”https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-resetting-the-krbtgt-password”>1</a>] this must be completed before any additional actions (a second reset will take place in step 5)</li>
<li>Wait for the <code>krbtgt</code> reset to propagate to all domain controllers (time may vary)</li>
<li> Reset all account passwords (passwords should be 15 characters or more and randomly assigned):
<ol type=”a”>
<li>User accounts (forced reset with no legacy password reuse)</li>
<li>Local accounts on hosts (including local accounts not covered by Local Administrator Password Solution [LAPS])</li>
<li>Service accounts</li>
<li>Directory Services Restore Mode (DSRM) account</li>
<li>Domain Controller machine account</li>
<li>Application passwords</li>
</ol>
</li>
<li>Reset the<code> krbtgt</code> password again</li>
<li>Wait for the <code>krbtgt</code> reset to propagate to all domain controllers (time may vary)</li>
<li>Reboot domain controllers</li>
<li>Reboot all endpoints</li>
</ol>
<p>The following accounts should be reset:</p>
<ul>
<li>AD Kerberos Authentication Master (2x)</li>
<li>All Active Directory Accounts</li>
<li>All Active Directory Admin Accounts</li>
<li>All Active Directory Service Accounts</li>
<li>All Active Directory User Accounts</li>
<li>DSRM Account on Domain Controllers</li>
<li>Non-AD Privileged Application Accounts</li>
<li>Non-AD Unprivileged Application Accounts</li>
<li>Non-Windows Privileged Accounts</li>
<li>Non-Windows User Accounts</li>
<li>Windows Computer Accounts</li>
<li>Windows Local Admin</li>
</ul>
<h4>VPN Vulnerabilities</h4>
<p>Implement the following recommendations to secure your organization’s VPNs:</p>
<ul>
<li><strong>Update VPNs, network infrastructure devices, and devices</strong> being used to remote into work environments with the latest software patches and security configurations. See CISA Tips <a href=”https://us-cert.cisa.gov/ncas/tips/ST04-006″>Understanding Patches and Software Updates</a> and <a href=”https://us-cert.cisa.gov/ncas/tips/ST18-001″>Securing Network Infrastructure Devices</a>. Wherever possible, enable automatic updates.</li>
<li><strong>Implement MFA on all VPN connections to increase security</strong>. Physical security tokens are the most secure form of MFA, followed by authenticator app-based MFA. SMS and email-based MFA should only be used when no other forms are available. If MFA is not implemented, require teleworkers to use strong passwords. See CISA Tips <a href=”https://us-cert.cisa.gov/ncas/tips/ST04-002″>Choosing and Protecting Passwords</a> and <a href=”https://us-cert.cisa.gov/ncas/tips/ST05-012″>Supplementing Passwords</a> for more information.</li>
</ul>
<p>Discontinue unused VPN servers. Reduce your organization’s attack surface by discontinuing unused VPN servers, which may act as a point of entry for attackers. To protect your organization against VPN vulnerabilities:</p>
<ul>
<li><strong>Audit </strong>configuration and patch management programs.</li>
<li><strong>Monitor </strong>network traffic for unexpected and unapproved protocols, especially outbound to the Internet (e.g., Secure Shell [SSH], SMB, RDP).</li>
<li><strong>Implement</strong> MFA, especially for privileged accounts.</li>
<li><strong>Use</strong> separate administrative accounts on separate administration workstations.</li>
<li><strong>Keep </strong><a href=”https://us-cert.cisa.gov/ncas/tips/ST04-006″>software up to date</a>. Enable automatic updates, if available.</li>
</ul>
<h3>Contact Information</h3><p>To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at <a href=”http://www.fbi.gov/contact-us/field”>www.fbi.gov/contact-us/field</a>, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at <a href=”https://us-cert.cisa.govmailto:CyWatch@fbi.gov”>CyWatch@fbi.gov</a>. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at <a href=”https://us-cert.cisa.govmailto:Central@cisa.dhs.gov”>Central@cisa.dhs.gov</a>.</p>
<h3>Resources</h3>
<ul>
<li>APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations – <a href=”https://us-cert.cisa.gov/ncas/alerts/aa20-283a”>https://us-cert.cisa.gov/ncas/alerts/aa20-283a</a></li>
<li>CISA Activity Alert CVE-2019-19781 – <a href=”https://us-cert/cisa.gov/ncas/alerts/aa20-031a”>https://us-cert/cisa.gov/ncas/alerts/aa20-031a</a></li>
<li>CISA Vulnerability Bulletin – <a href=”https://us-cert/cisa.gov/ncas/bulletins/SB19-161″>https://us-cert/cisa.gov/ncas/bulletins/SB19-161</a></li>
<li>CISA Current Activity – <a href=”https://us-cert.cisa.gov/ncas/current-activity/2020/03/10/unpatched-microsoft-exchange-servers-vulnerable-cve-2020-0688″>https://us-cert.cisa.gov/ncas/current-activity/2020/03/10/unpatched-microsoft-exchange-servers-vulnerable-cve-2020-0688</a></li>
<li>Citrix Directory Traversal Bug (CVE-2019-19781) – <a href=”https://nvd.nist.gov/vuln/detail/CVE-2019-19781″>https://nvd.nist.gov/vuln/detail/CVE-2019-19781</a></li>
<li>Microsoft Exchange remote code execution flaw (CVE-2020-0688) – <a href=”https://nvd.nist.gov/vuln/detail/CVE-2020-0688″>https://nvd.nist.gov/vuln/detail/CVE-2020-0688</a></li>
<li>CVE-2018-13379 – <a href=”https://nvd.nist.gov/vuln/detail/CVE-2018-13379 “>https://nvd.nist.gov/vuln/detail/CVE-2018-13379</a></li>
<li>CVE-2020-1472 – <a href=”https://nvd.nist.gov/vuln/detail/CVE-2020-1472″>https://nvd.nist.gov/vuln/detail/CVE-2020-1472</a></li>
<li>CVE 2019-10149 – <a href=”https://nvd.nist.gov/vuln/detail/CVE-2019-10149”>https://nvd.nist.gov/vuln/detail/CVE-2019-10149</a></li>
<li>NCCIC/USCERT Alert TA15-314A – Compromised Web Servers and Web Shells – Threat Awareness and Guidance – <a href=”https://us-cert.cisa.gov/ncas/alerts/TA15-314A “>https://us-cert.cisa.gov/ncas/alerts/TA15-314A</a></li>
<li>NCCIC/US-CERT publication on SMB Security Best Practices – <a href=”https://us-cert.cisa.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices”>https://us-cert.cisa.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices</a><br />
</li>
</ul>
<div class=”special_container text-align-center”> </div>
<div class=”special_container text-align-center”><strong><em>DISCLAIMER</em></strong></div>
<div class=”special_container”> </div>
<div class=”special_container”>
<p><em>This information is provided “as is” for informational purposes only. The United States Government does not provide any warranties of any kind regarding this information. In no event shall the United States Government or its contractors or subcontractors be liable for any damages, including but not limited to, direct, indirect, special or consequential damages, arising out of, resulting from, or in any way connected with this information, whether or not based upon warranty, contract, tort, or otherwise, whether or not arising out of negligence, and whether or not injury was sustained from, or arose out of the results of, or reliance upon the information.</em></p>
<p><em>The United States Government does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or favoring by the United States Government.</em></p>
</div>
<p><o:p></o:p></p>
<h3>References</h3>
<ul> <li><a href=”https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-resetting-the-krbtgt-password”>[1] Microsoft: AD Forest Recovery – Resetting the krbtgt password</a></li> </ul> <h3>Revisions</h3>
<ul> <li>October 22, 2020: Initial Version</li> <li>November 17, 2020: Added U.S. Heat Map of Activity</li> </ul>
<hr />
<div class=”field field–name-body field–type-text-with-summary field–label-hidden field–item”><p class=”privacy-and-terms”>This product is provided subject to this <a href=”https://us-cert.cisa.gov/privacy/notification”>Notification</a> and this <a href=”https://www.dhs.gov/privacy-policy”>Privacy & Use</a> policy.</p>
</div>