CISA's New Ransomware Vulnerability Warning Pilot Helping Organizations Avoid Incidents

Agency Encourages Organizations to Enroll in Free Program

The federal Cybersecurity and Infrastructure Security Agency has launched a Ransomware Vulnerability Warning Pilot program that notifies critical infrastructure and public sector organizations anytime a new vulnerability being exploited by threat actors is identified.

The RVWP, authorized by the Cyber Incident Reporting for Critical Infrastructure Act of 2022, gives organizations a heads-up so they may mitigate the vulnerability before a ransomware incident occurs on their networks, according to CISA’s website. 

A warning from CISA-RVWP is “not indicative of a compromise” but “it does indicate you are at risk and the information system requires immediate remediation,” CISA said.

“The RVWP will identify organizations with internet-accessible vulnerabilities commonly associated with known ransomware actors by using existing services, data sources, technologies, and authorities, including our free Cyber Hygiene Vulnerability Scanning service,” CISA said. 

The agency emphasized that organizations should enroll so CISA has correct contact information in order to notify of vulnerabilities in a timely manner. Email [email protected] to enroll in the warning program. 

CISA said in a news release that the RVWP has already helped scores of public sector and critical infrastructure organizations avoid ransomware exploitation by notifying them of newly identified vulnerabilities being used by ransomware actors around the globe. RVWP is managed by the Joint Ransomware Task Force, a group established by CIRCIA last year and led by CISA and the FBI. 

The RVWP website cites an example of how the program is already helping organizations keep their networks secure: “CISA notified 93 organizations identified as running instances of Microsoft Exchange Service with a vulnerability called ‘ProxyNotShell,’ which has been widely exploited by ransomware actors,” the agency said. “This initial round of notifications demonstrated the effectiveness of this model in enabling timely risk reduction as we further scale the RVWP to additional vulnerabilities and organizations.”

Under the new program, CISA “leverages existing authorities and technology to proactively identify information systems that contain security vulnerabilities commonly associated with ransomware attacks,” the agency said. “Once CISA identifies these affected systems, our regional cybersecurity personnel notify system owners of their security vulnerabilities, thus enabling timely mitigation before damaging intrusions occur.”

CISA said notifications will come from its regional staff members, located throughout the country, who also may be able to help organizations mitigate the identified vulnerability. “Notifications will contain key information regarding the vulnerable system, such as the manufacturer and model of the device, the IP address in use, how CISA detected the vulnerability, and guidance on how the vulnerability should be mitigated,” the agency said.

Organizations receiving a notification may verify the identity of the sender by emailing [email protected] or by calling (888) 282-0870.

The vulnerability information comes from CISA’s existing personnel and services, data sources, technologies, and law enforcement, including its Cyber Hygiene Vulnerability Scanning service and the Administrative Subpoena Authority granted to CISA under Section 2209 of the Homeland Security Act of 2002.

The agency also encouraged organizations of all kinds to take advantage of its free Cyber Hygiene Vulnerability Scanning service and to establish a relationship with a regional CISA cybersecurity advisor to learn about additional no-cost cybersecurity resources. Organizations enrolled in the Vulnerability Scanning service receive recurring scans, regular reports, established relationships with CISA’s cybersecurity experts, and expedited notifications via documented points of contact. 

"Ransomware attacks continue to cause untenable levels of harm to organizations across the country, including target rich, resource poor entities like many school districts and hospitals” said Eric Goldstein, Executive Assistant Director for Cybersecurity, CISA. “The RVWP will allow CISA to provide timely and actionable information that will directly reduce the prevalence of damaging ransomware incidents affecting American organizations. We encourage every organization to urgently mitigate vulnerabilities identified by this program and adopt strong security measures consistent with the U.S. government’s guidance on StopRansomware.gov."

Learn more at StopRansomware.gov.

About the Author

Kristal Kuykendall is editor, 1105 Media Education Group. She can be reached at [email protected].


Featured

  • futuristic brain made of glowing circuits with a human hand reaching toward it

    Cloud Security Alliance Calls for Rethinking AI Development in the Face of DeepSeek Debut

    The Cloud Security Alliance (CSA) has weighed in on DeepSeek AI’s disruptive debut, warning that the revolutionary AI model is “rewriting the rules” of AI development. The remarks come as cloud security firm Wiz disclosed a major data leak in DeepSeek’s platform, raising concerns about security vulnerabilities in the cutting-edge system.

  • two abstract humanoid figures made of interconnected lines and polygons, glowing slightly against a dark gradient background

    Microsoft Introduces Copilot Chat Agents for Education

    Microsoft recently announced Microsoft 365 Copilot Chat, a new pay-as-you-go offering that adds AI agents to its existing free chat tool for Microsoft 365 education customers.

  • Stock market graphs and candlesticks breaking apart with glass-like cracks

    Chinese Startup DeepSeek Disrupts AI Market

    A new low-cost Chinese artificial intelligence model is wreaking havoc in the technology sector, with tech stocks plummeting globally as concerns grow over the potential disruption it could cause.

  • robot waving

    Copilot Updates Aim to Make AI More Personal

    Microsoft has unveiled a range of updates to its Copilot platform, marking a new phase in its effort to deliver what it calls a "true AI companion" that adapts to individual users' needs, preferences and routines.