Blog Viewer

The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has released updated information concerning cyberthreats to critical infrastructure. CISA urges continued vigilance, with emphasis on domestic threats connected to tensions surrounding Russia’s invasion of Ukraine. CISA has distributed a White House fact sheet, released in response to “…evolving intelligence that Russia may be exploring options for potential cyberattacks....” The White House fact sheet contains prudent steps that may be taken to strengthen cybersecurity preparedness, and can be viewed here.

CISA, the Federal Bureau of Investigation (FBI), and the U.S. Department of Energy (DOE), have released joint Cybersecurity Advisory (CSA), covering intrusion campaigns conducted by state-sponsored Russian cyber actors from 2011 to 2018 and targeting U.S. and international Energy Sector organizations. The CSA’s purpose is to highlight historical tactics used to target the U.S. and international energy sector. The CSA can be viewed here.

CISA has also released a list of IP addresses believed to be owned by victim organizations that potentially have rogue installations of remote management software thought to be imminently used to propagate Conti ransomware. If your special district or organization owns one of the following IPs, CISA encourages you to take action to investigate immediately and provide feedback to CISA as appropriate:

68.43.143.59

50.232.118.194

177.242.128.218

75.31.19.6

208.95.92.131

131.228.48.122

73.218.152.171

87.166.48.18

74.204.54.99

2.118.252.150

156.146.57.64

212.102.40.8

52.250.42.144

156.146.38.131

154.61.71.51

154.61.71.51

154.61.71.51

2.118.252.150

154.61.71.51

174.209.228.1

178.214.9.199

190.2.130.168

50.210.165.115

52.250.42.144

52.250.42.144

108.62.52.151

Those special districts utilizing satellite communications networks may also wish to view CISA’s recent advisory concerning threats to those networks, which can be viewed here.

Special districts may report incidents and anomalous activity to the agency, to a local Federal Bureau of Investigation field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or CyWatch@fbi.gov. 

For more information, visit CISA’s Shields Up resources page and CISA’s  Russia Cyber Threat Overview and Advisories webpage for more information on Russian state-sponsored malicious cyber activity. 

CSDA members may wish to sign up for CISA free cyber hygiene services (Cyber Hygiene Services | CISA), or CISA’s mailing lists and feeds (Mailing Lists and Feeds | CISA).