CISA pilot program seeks to bolster ransomware preparedness

The Cybersecurity and Infrastructure Security Agency (CISA) announced Monday a pilot program designed to help critical infrastructure entities vulnerable to cyberattacks mitigate a ransomware incident before it occurs.

The Ransomware Vulnerability Warning Pilot will allow CISA to “determine vulnerabilities commonly associated with known ransomware exploitation and warn critical infrastructure entities,” the agency said in a press release announcing the program.

CISA said it will use its cyber hygiene scanning service to identify to organizations internet-accessible vulnerabilities commonly exploited by ransomware actors. The agency said it already alerted 93 organizations running an outdated Microsoft Exchange Service vulnerability called “ProxyNoShell.” Threat actors have exploited the vulnerability to access “emails on an organization’s server and … plant malware on an Exchange server,” according to Kroll’s “Q4 2022 Threat Landscape Report.”