CISA's New Ransomware Vulnerability Warning Pilot Helping Organizations Avoid Incidents

Agency Encourages Organizations to Enroll in Free Program

The federal Cybersecurity and Infrastructure Security Agency has launched a Ransomware Vulnerability Warning Pilot program that notifies critical infrastructure and public sector organizations anytime a new vulnerability being exploited by threat actors is identified.

The RVWP, authorized by the Cyber Incident Reporting for Critical Infrastructure Act of 2022, gives organizations a heads-up so they may mitigate the vulnerability before a ransomware incident occurs on their networks, according to CISA’s website. 

A warning from CISA-RVWP is “not indicative of a compromise” but “it does indicate you are at risk and the information system requires immediate remediation,” CISA said.

“The RVWP will identify organizations with internet-accessible vulnerabilities commonly associated with known ransomware actors by using existing services, data sources, technologies, and authorities, including our free Cyber Hygiene Vulnerability Scanning service,” CISA said. 

The agency emphasized that organizations should enroll so CISA has correct contact information in order to notify of vulnerabilities in a timely manner. Email [email protected] to enroll in the warning program. 

CISA said in a news release that the RVWP has already helped scores of public sector and critical infrastructure organizations avoid ransomware exploitation by notifying them of newly identified vulnerabilities being used by ransomware actors around the globe. RVWP is managed by the Joint Ransomware Task Force, a group established by CIRCIA last year and led by CISA and the FBI. 

The RVWP website cites an example of how the program is already helping organizations keep their networks secure: “CISA notified 93 organizations identified as running instances of Microsoft Exchange Service with a vulnerability called ‘ProxyNotShell,’ which has been widely exploited by ransomware actors,” the agency said. “This initial round of notifications demonstrated the effectiveness of this model in enabling timely risk reduction as we further scale the RVWP to additional vulnerabilities and organizations.”

Under the new program, CISA “leverages existing authorities and technology to proactively identify information systems that contain security vulnerabilities commonly associated with ransomware attacks,” the agency said. “Once CISA identifies these affected systems, our regional cybersecurity personnel notify system owners of their security vulnerabilities, thus enabling timely mitigation before damaging intrusions occur.”

CISA said notifications will come from its regional staff members, located throughout the country, who also may be able to help organizations mitigate the identified vulnerability. “Notifications will contain key information regarding the vulnerable system, such as the manufacturer and model of the device, the IP address in use, how CISA detected the vulnerability, and guidance on how the vulnerability should be mitigated,” the agency said.

Organizations receiving a notification may verify the identity of the sender by emailing [email protected] or by calling (888) 282-0870.

The vulnerability information comes from CISA’s existing personnel and services, data sources, technologies, and law enforcement, including its Cyber Hygiene Vulnerability Scanning service and the Administrative Subpoena Authority granted to CISA under Section 2209 of the Homeland Security Act of 2002.

The agency also encouraged organizations of all kinds to take advantage of its free Cyber Hygiene Vulnerability Scanning service and to establish a relationship with a regional CISA cybersecurity advisor to learn about additional no-cost cybersecurity resources. Organizations enrolled in the Vulnerability Scanning service receive recurring scans, regular reports, established relationships with CISA’s cybersecurity experts, and expedited notifications via documented points of contact. 

"Ransomware attacks continue to cause untenable levels of harm to organizations across the country, including target rich, resource poor entities like many school districts and hospitals” said Eric Goldstein, Executive Assistant Director for Cybersecurity, CISA. “The RVWP will allow CISA to provide timely and actionable information that will directly reduce the prevalence of damaging ransomware incidents affecting American organizations. We encourage every organization to urgently mitigate vulnerabilities identified by this program and adopt strong security measures consistent with the U.S. government’s guidance on StopRansomware.gov."

Learn more at StopRansomware.gov.

About the Author

Kristal Kuykendall is editor, 1105 Media Education Group. She can be reached at [email protected].


Featured

  • Training the Next Generation of Space Cybersecurity Experts

    CT asked Scott Shackelford, Indiana University professor of law and director of the Ostrom Workshop Program on Cybersecurity and Internet Governance, about the possible emergence of space cybersecurity as a separate field that would support changing practices and foster future space cybersecurity leaders.

  • modern college building with circuit and brain motifs

    Anthropic Launches Claude for Education

    Anthropic has announced a version of its Claude AI assistant tailored for higher education institutions. Claude for Education "gives academic institutions secure, reliable AI access for their entire community," the company said, to enable colleges and universities to develop and implement AI-enabled approaches across teaching, learning, and administration.

  • AI microchip, a cybersecurity shield with a lock, a dollar coin, and a laptop with financial graphs connected by dotted lines

    Survey: Generative AI Surpasses Cybersecurity in 2025 Tech Budgets

    Global IT leaders are placing bigger bets on generative artificial intelligence than cybersecurity in 2025, according to new research by Amazon Web Services (AWS).

  • university building surrounded by icons for AI, checklists, and data governance

    Improving AI Governance for Stronger University Compliance and Innovation

    AI can generate valuable insights for higher education institutions and it can be used to enhance the teaching process itself. The caveat is that this can only be achieved when universities adopt a strategic and proactive set of data and process management policies for their use of AI.