Key Points

References

Key Concepts

NIST cybersecurity framework

https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf

NIST.Cybersecurity-framework-2-SWP.29.pdf.     GD

NIST.Cybersecurity-framework-2-SWP.29.pdf.  file

NIST now provides Implementation Examples and Informative References

• CSF Core, the nucleus of the CSF, which is a taxonomy of high-level cybersecurity outcomes that can help any organization manage its cybersecurity risks. The CSF Core components are a hierarchy of Functions, Categories, and Subcategories that detail each outcome. The outcomes are sector-, country-, and technology-neutral, they provide an organization with the flexibility needed to address its unique risks, technologies, and mission considerations.

• CSF Organizational Profiles, which are a mechanism for describing an organization’s current and/or target cybersecurity posture in terms of the CSF Core’s outcomes.

• CSF Tiers, which can be applied to CSF Organizational Profiles to characterize the rigor of an organization’s cybersecurity risk governance and management practices. Tiers can also provide context for how an organization views cybersecurity risks and the processes in place to manage those risks

NIST resources that describe the mutual relationship between cybersecurity risk management and ERM include: • NIST Cybersecurity Framework 2.0 – Enterprise Risk Management Quick-Start Guide • NIST Interagency Report (IR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM) • IR 8286A, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management • IR 8286B, Prioritizing Cybersecurity Risk for Enterprise Risk Management • IR 8286C, Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight • IR 8286D, Using Business Impact Analysis to Inform Risk Prioritization and Response • SP 800-221, Enterprise Impact of Information and Communications Technology Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio • SP 800-221A, Information and Communications Technology (ICT) Risk Outcomes: Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio

Supply chain risks: An organization can use the CSF to foster cybersecurity risk oversight and communications with stakeholders across supply chains. All types of technology rely on a complex, globally distributed, extensive, and interconnected supply chain ecosystem with geographically diverse routes and multiple levels of outsourcing. This ecosystem is composed of public- and private-sector entities (e.g., acquirers, suppliers, developers, system integrators, external system service providers, and other technology-related service providers) that interact to research, develop, design, manufacture, acquire, deliver, integrate, operate, maintain, dispose of, and otherwise utilize or manage technology products and services. These interactions are shaped and influenced by technologies, laws, policies, procedures, and practices.

NIST 2.0 CSF review 

NIST CSF 2.0 Updates Summary
Introduction to NIST CSF 2.0 (00:00 - 00:35)

The NIST Cybersecurity Framework (CSF) is a voluntary security guide developed by NIST in collaboration with public and private sectors.
It was originally designed for critical infrastructure but has now been expanded for all organizations.
Major Name and Scope Change (00:35 - 01:56)

CSF 2.0 removes the emphasis on "critical infrastructure" to make it applicable across all industries.
New additions include community profiles, organizational profile templates, and Quick Start guides to streamline implementation.
New Sixth Function: "Govern" (02:14 - 02:41)

CSF functions expanded from five to six, adding "Govern" to improve cybersecurity strategy and policy oversight.
The functions now include: Govern, Identify, Protect, Detect, Respond, and Recover.
Updated Implementation Approach (03:08 - 04:47)

The framework is not prescriptive, but defines desirable security outcomes across 21 categories and 112 subcategories.
New implementation examples provide clearer guidance on achieving security objectives, making it easier to follow.
Enhanced Clarity and Usability (06:05 - 06:54)

The language in CSF 2.0 is simplified to improve communication across technical and non-technical stakeholders.
Some outdated terms and categories have been restructured and consolidated for better alignment.
Major Overhaul of Respond and Recover Functions (08:52 - 09:49)

These functions now better align with industry-accepted incident response and recovery processes.
The updates provide more structure for security operations, making them actionable rather than abstract.
Community and Organizational Profiles (10:17 - 10:43)

Community profiles offer ready-made cybersecurity blueprints tailored to specific sectors or threats (e.g., ransomware).
Organizational profiles help define current vs. target security states, streamlining the transition to CSF 2.0.
No Official 1.1 to 2.0 Mapping (11:27 - 11:44)

Due to significant changes in structure and terminology, there’s no direct mapping from CSF 1.1 to 2.0.
Organizations are encouraged to start fresh with CSF 2.0 rather than attempting a direct migration.
Recommended Implementation Approach (12:03 - 12:33)

Organizations should create a new CSF 2.0 profile and use their existing CSF 1.1 data only as a baseline reference.
A migration plan should be at least a 3-month project, depending on the organization's size and complexity.
Final Thoughts and Community Support (12:33 - 13:01)

CSF 2.0 is more comprehensive, easier to implement, and better for communication across an organization.
The cybersecurity community (e.g., Simply Cyber's Discord) can be a valuable resource for practitioners adopting CSF 2.0.
Key Takeaway:
NIST CSF 2.0 is a major upgrade with a new Govern function, improved clarity, better incident response, and implementation examples, making it easier to adopt and apply across all organizations.

800-37  Risk Management Framework for Information Systems

800-30.  Guide for Conducting Risk Assessments

800-53.  Security and Privacy Controlsfor Information Systems 

AI Risk Management Framework

NIST AI 600-1.  Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence 

NIST-CSF-GUIDE_v2-implementation.pdf.     GD

NIST-CSF-GUIDE_v2-implementation.pdf.  file

NIST Cybersecurity Advisories

Advisory - 250317 - Medusa Ransomware

1. Mitigate known vulnerabilities by ensuring operating systems, software, and firmware are patched and up to date within a risk-informed span of time.
2. Segment networks to restrict lateral movement from initial infected devices and other devices in the same organization.
3. Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems.

Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 16. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

Background

The RaaS Medusa variant has been used to conduct ransomware attacks from 2021 to present. Medusa originally operated as a closed ransomware variant, meaning all development and associated operations were controlled by the same group of cyber threat actors. While Medusa has since progressed to using an affiliate model, important operations such as ransom negotiation are still centrally controlled by the developers. Both Medusa developers and affiliates—referred to as “Medusa actors” in this advisory—employ a double extortion model, where they encrypt victim data and threaten to publicly release exfiltrated data if a ransom is not paid.

Medusa IABs (affiliates) are known to make use of common techniques, such as:

• Phishing campaigns as a primary method for stealing victim credentials [T1566].
• Exploitation of unpatched software vulnerabilities [T1190] through Common Vulnerabilities and Exposures (CVEs) such as the ScreenConnect vulnerability CVE-2024-1709 [CWE-288: Authentication Bypass Using an Alternate Path or Channel] and Fortinet EMS SQL injection vulnerability [CVE-2023-48788 [CWE 89: SQL Injection].

FBI has observed Medusa actors using the following tools to support command and control (C2) and evade detection:

• Ligolo.
  • A reverse tunneling tool often used to create secure connections between a compromised host and threat actor’s machine.
• Cloudflared.
  • Formerly known as ArgoTunnel.
  • Used to securely expose applications, services, or servers to the internet via Cloudflare Tunnel without exposing them directly.

Lateral Movement and Execution

Medusa actors use a variety of legitimate remote access software [T1219]; they may tailor their choice based on any remote access tools already present in the victim environment as a means of evading detection. Investigations identified Medusa actors using remote access software AnyDesk, Atera, ConnectWise, eHorus, N-able, PDQ Deploy, PDQ Inventory, SimpleHelp, and Splashtop. Medusa uses these tools—in combination with Remote Desktop Protocol (RDP) [T1021.001] and PsExec [T1569.002]—to move laterally [TA0008] through the network and identify files for exfiltration [TA0010] and encryption [T1486]. When provided with valid username and password credentials, Medusa actors use PsExec to:

• Copy (-c) one script from various batch scripts on the current machine to the remote machine and execute it with SYSTEM level privileges (-s).
• Execute an already existing local file on a remote machine with SYSTEM level privileges.
• Execute remote shell commands using cmd /c.

One of the batch scripts executed by PsExec is openrdp.bat, which first creates a new firewall rule to allow inbound TCP traffic on port 3389:

• netsh advfirewall firewall add rule name="rdp" dir=in protocol=tcp localport=3389 action=allow

Then, a rule to allow remote WMI connections is created:

• netsh advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes

Finally, the registry is modified to allow Remote Desktop connections:

• reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Mimikatz has also been observed in use for Local Security Authority Subsystem Service (LSASS) dumping [T1003.001] to harvest credentials [TA0006] and aid lateral movement.

Exfiltration and Encryption

Medusa actors install and use Rclone to facilitate exfiltration of data to the Medusa C2 servers [T1567.002] used by actors and affiliates. The actors use Sysinternals PsExec, PDQ Deploy, or BigFix [T1072] to deploy the encryptor, gaze.exe, on files across the network—with the actors disabling Windows Defender and other antivirus services on specific targets. Encrypted files have a .medusa file extension. The process gaze.exe terminates all services [T1489] related to backups, security, databases, communication, file sharing and websites, then deletes shadow copies [T1490] and encrypts files with AES-256 before dropping the ransom note. The actors then manually turn off [T1529] and encrypt virtual machines and delete their previously installed tools [T1070].

Indicators of Compromise

Table 1 lists the hashes of malicious files obtained during investigations.

Potential Value Opportunities

Norton AVI protection for ransomware

Ransomware protection includes a proactive action plan that covers what to do before, during, and after an attack. It’s a multi-layered approach that includes installing antivirus software, securing accounts, and having a recovery plan to mitigate risks associated with ransomware attacks.

Here is more detail on how the three-stage ransomware protection process works:

1. Prevention:

2. Management:

3. Recovery:

Potential Challenges

Candidate Solutions

Step-by-step guide for Example

sample code block

Recommended Next Steps

Related articles