Category: Homeland Security

Source: US Department of Homeland Security

To strengthen cooperation between France and the United States in customs matters and improve the facilitation of travelers and goods, the Minister Delegate for Public Accounts, Mr. Thomas Cazanave, and the Senior Official Performing the Duties of Deputy Secretary of the Department of Homeland Security, Ms. Kristie Canegallo, signed today a Joint Declaration of Intent.   

Improved collaboration as outlined in the Joint Declaration is expected to include intelligence, inspections, investigations, targeting and operational cooperation, and exchange of best practices in the customs field. Additionally, this customs cooperation is expected to focus on securing container traffic, major port and airport facilities, express freight, e-commerce, and the financial flows of criminal organizations. 

Enhanced collaboration is also expected to cover combatting arms and drug trafficking, transnational organized crime, and threats to national security.  The collaboration is expected to occur between entities in their Ministries such as the French Customs Coast Guard and U.S. Customs and Border Protection’s (CBP) Air and Marine Operations, as well as the French National Directorate of Customs Intelligence and Investigations and U.S. Immigration and Customs Enforcement Homeland Security Investigations, including in French communities in the Pacific, Polynesia, New Caledonia, and Wallis and Futuna. 

Cooperation is expected to intensify between CBP’s National Targeting Center and the French Customs Risk Analysis and Targeting Service for risk analysis and targeting of controls on passengers and cargo.  

The Joint Declaration of Intent additionally places emphasis on working together to secure the 2024 Paris Summer Olympics and 2028 Los Angeles Summer Olympics through the sharing of best practices.   

On this occasion, the Minister and Senior Official Performing the Duties of Deputy Secretary reaffirmed their common commitment to further strengthen operational cross-border cooperation between their Ministries to better combat the most current and sensitive threats to the flow of goods, national security breaches, narcotics, fentanyl, forced labor, arms trafficking, economic and fiscal fraud, and money laundering. 

Source: US Department of Homeland Security

WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA) and Office of the National Cyber Director (ONCD) awarded the winners of the fifth annual President’s Cup Cybersecurity Competition in a private ceremony at the Eisenhower Executive Office Building.   

The 2024 first place team winner was “Artificially Intelligent,” a team with participants from the U.S. Army and U.S. Air Force. The winner of the 2024 Individuals Track A was U.S. Army Major Nolan Miles, and the winner of the 2024 Individuals Track B was Sergeant Michael Torres from the U.S. Marine Corps.  

“The President’s Cup provides a unique opportunity to create a network of cyber professionals across government organizations, allowing these groups to compete for the best outcomes while simultaneously learning from and working alongside leaders across the government,” said CISA Director Jen Easterly. “The government must rise to the occasion and lead by example by rigorously training, competing, and innovating so that we are prepared to address the cyber-enabled threats that stand in front of us. This is why this program is so important.”

“The President’s Cup Cybersecurity Competition brings out the best in our Nation’s cyber workforce and today’s ceremony at the White House provided a fitting tribute to the talent, dedication and service of the men and women who work everyday to protect us in our increasingly digital world,” said White House National Cyber Director Harry Coker, Jr. “I’m proud to recognize, reward, and celebrate the accomplishments of our winners in this competition but I’m even prouder to acknowledge their service to the Nation. Their work is vital, their service is appreciated, and we – as a Nation – are all better, safer, and stronger because of their efforts.”

The President’s Cup is led and hosted by CISA and presents competitors with a series of challenges designed around the National Initiative for Cybersecurity Education (NICE) Framework Work Roles to identify, recognize, and reward the best cybersecurity talent across the federal workforce.

CISA developed this interactive competition to invest in the professional development of federal employees and bring awareness to having skilled talent in cybersecurity careers.

This year’s competition provided a unique training opportunity that included an interactive story-based video game featuring a series of challenges aligned to the NICE Framework Work roles to enhance and embrace participants’ skills as they outwit and outthink their competitors. 

Another new element to the competition was the ICScape Room, an immersive, hands-on experience that provided challengers with a realistic and relatable scenario, compelling them to apply their expertise, teamwork, and collaboration skills to achieve optimal solutions.

The President’s Cup Cybersecurity Competition is open to the federal civilian workforce and members of the military. Watch videos from the 2024 and previous competitions and learn more information about the annual event at President’s Cup Cybersecurity Competition.  

Source: US Department of Homeland Security

WASHINGTON – Today, Secretary of Homeland Security Alejandro N. Mayorkas issued the following statement regarding the Partnership for Public Service’s recognition of the Department of Homeland Security (DHS) as the most improved large agency in its 2023 Best Places to Work in the Federal Government:

“The workforce of the Department of Homeland Security is the best in the world.  Our people execute an extraordinarily expansive, diverse, and challenging set of missions.  We have a solemn responsibility to recognize them, champion them, and take care of them. Ensuring these 268,000 public servants have the tools, resources, and support they need and deserve is not just the right thing to do, it is fundamental to our homeland security. 

“For three years, our Department has executed one of our highest organizational priorities: we engage with, listen to, and learn from our workforce and we take meaningful, tangible action in response to what we learn. The impact of this line of effort is real. I am very proud that, for the second consecutive year, our Department has shown significant improvement in its employee well-being and satisfaction, and that this year the Partnership for Public Service has recognized us as the Most Improved Large Agency in the federal government. 

“There is a lot more to do, and we are committed to doing it.  Our devotion to the incredible public servants who work in the Department of Homeland Security is enduring. I look forward to continuing to work with Congress to prioritize, support, and champion the DHS workforce, as together we address the threats and challenges America faces.”

Efforts by Secretary Mayorkas to support and champion the workforce include:

• TSA Pay Equity and Collective Bargaining: Ensured the TSA’s workforce is paid comparably with their colleagues by implementing a new compensation plan in July 2023, which, for the first time ever puts all TSA employees on the same pay level as their federal counterparts on the General Schedule (GS) pay scale. The agency’s attrition numbers have noticeably dropped, and numbers of applicants continue to increase. TSA reached a new Collective Bargaining Agreement (CBA) with the American Federation of Government Employees (AFGE), which will take effect on May 24. The new agreement will provide benefits for all TSA bargaining unit employees comprised of non-supervisory screening officers. 
   
• Recognizing Employees Across the Nation: In an effort to connect directly with DHS employees and recognize the incredible work they do each day, the Secretary directed that the Annual Secretary’s Awards be conducted through multiple regional ceremonies across the country rather than one ceremony at DHS Headquarters. During these regional ceremonies, leadership recognizes exemplary employees closer to where their work is happening, enabling more employees to participate and be recognized. Traveling to these locations also provides leadership with an opportunity to see first-hand any issues or concerns that can be addressed, and receive feedback directly from DHS employees that serve the public outside the National Capital Region.
   
• More Staffing at the Border: Secretary Mayorkas helped to secure the first increase in Border Patrol staffing in over a decade with 300 additional Agents added in Fiscal Year 2023, and another 1,400 added in Fiscal Year 2024. 
   
• Prioritizing Safe and Effective Facilities: DHS has stressed the importance of ensuring personnel have access to facilities that support our mission and provide a safe and effective working environment. This includes utilizing the Non-recurring Expenses Fund, which allows DHS to use expiring funds to improve DHS facilities across the country in need of repair. 
   
• Jump Teams: Jump Teams provide a mechanism to build the connections between mission support and the front-line. Jump Team members are responsible for helping to solve immediate issues, guide how funding is allocated, and to assist in developing solutions to deliver support most effectively to our front-line. Secretary Mayorkas directed the creation of DHS Jump Teams to leverage DHS and Component leadership resources to solve problems for our front-line personnel. 

To read the full DHS results of the 2023 Best Places to Work in the Federal Government rankings, visit here: Home • Best Places to Work in the Federal Government.

To learn more about ways in which DHS is championing the workforce, visit: Champion the DHS Workforce and Strengthen the Department | Homeland Security.

###

Source: US Department of Homeland Security

Justice Department Finalizes Rule to Allow for More Efficient Immigration Judge Dockets

WASHINGTON – Today, Secretary of Homeland Security Alejandro N. Mayorkas and Attorney General Merrick B. Garland announced a new Recent Arrivals (RA) Docket process to more expeditiously resolve immigration cases of certain noncitizen single adults who attempt to cross irregularly between ports of entry at the Southwest border.

This effort will allow DHS and DOJ to more swiftly impose consequences, including removal, on those without a legal basis to remain in the United States and to more swiftly grant immigration relief or protections to noncitizens with valid claims. The Justice Department also submitted to the Federal Register a final rule to promote efficient case and docket management in immigration proceedings.

“Today, we are instituting with the Department of Justice a process to accelerate asylum proceedings so that individuals who do not qualify for relief can be removed more quickly and those who do qualify can achieve protection sooner,” said Secretary of Homeland Security Alejandro N. Mayorkas. “This administrative step is no substitute for the sweeping and much-needed changes that the bipartisan Senate bill would deliver, but in the absence of Congressional action we will do what we can to most effectively enforce the law and discourage irregular migration.”

“The Justice Department’s immigration courts are committed to the just and efficient enforcement of the immigration laws,” said Attorney General Merrick B. Garland. “These measures will advance that mission by helping to ensure that immigration cases are adjudicated promptly and fairly.”

In our current, overwhelmed immigration system, noncitizens arriving at the U.S. Southwest border often wait years before receiving a final decision in an immigration court proceeding. Insufficient resources, including insufficient immigration judges and attorneys, has impeded the swift resolution of claims, and extended the length of the immigration court process.

Under the RA Docket process, DHS will place certain noncitizen single adults on the RA Docket, and EOIR adjudicators will prioritize the adjudication of these cases. The RA Docket will operate in five cities: Atlanta, Boston, Chicago, Los Angeles, and New York City. Immigration judges will aim to render final decisions within 180 days, though the time to decision in any particular case will remain subject to case-specific circumstances and procedural protections, including allowing time for noncitizens to seek representation where needed.

In order to support these efforts, today the Justice Department also submitted to the Federal Register a final rule titled Efficient Case and Docket Management in Immigration Proceedings. The rule codifies procedures and standards for immigration adjudicators across the country to manage their dockets and resolve cases efficiently. The rule allows adjudicators to prioritize cases that are ready to be resolved promptly, enabling them to address their caseloads more efficiently and quickly. This rule is an important step the Justice Department is taking to promote the efficient, expeditious, and fair adjudication of immigration cases, allocate limited resources more efficiently, and ensure procedural protections for parties in immigration court.

Lastly, the Departments continue to call on Congress to take up and pass the Senate’s bipartisan border security legislation, which if passed would provide DHS and DOJ with additional authorities and resources that are critically needed. These resources include more immigration judges, additional asylum officers and support staff, and needed authorities to more quickly adjudicate asylum cases of those arriving at our border, including by granting protection to those with valid claims, and removing those without a lawful basis to remain. Congress should take up and pass this legislation to fix our broken immigration system.

###

Source: US Department of Homeland Security

Provides actionable guidance that conforms to federal zero trust strategy 

WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) published Encrypted Domain Name System (DNS) Implementation Guidance today for federal civilian agencies to meet requirements related to encryption of DNS traffic and enhance the cybersecurity posture of their IT networks to align to the Office of Management and Budget (OMB) Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles and the National Cybersecurity Strategy. 

Traditionally, DNS protocol has not supported methods for ensuring the confidentiality, integrity, or authenticity of requests for information or the responses. M-22-09 specifically calls for agencies to encrypt DNS traffic where technically feasible while statutory mandates require agencies to use CISA’s Protective DNS capability for egress DNS resolution. This guide will assist agencies with implementation of currently feasible technical capabilities for agency networks, DNS infrastructure, on-premises endpoints, cloud deployments, and roaming, nomadic, and mobile endpoints.

“As the operational lead for federal cybersecurity, CISA developed this guide to assist federal agencies with understanding and implementing key actions and protocols to begin encrypting DNS traffic,” said Eric Goldstein, Executive Assistant Director for Cybersecurity, CISA. “This guide will help agencies progress further in their zero trust security journey. CISA continues our efforts and collaboration with agencies to modernize federal agency cybersecurity successfully and securely.”

To help agency personnel understand the requirements and engage in the transition work, this document provides an array of resources such as a high-level implementation checklist of required changes, recommendations to help agencies prioritize phased implementation, and technical guidance and references. Implementing encrypted DNS will align and base civilian agencies enterprise security architecture with zero trust principles.

While this guide is intended for federal agencies, all organizations are encouraged to review it as a benchmark for appropriate, applicable steps they can apply to advance their own zero trust efforts.

For more information, please visit: Zero Trust Maturity Model

Source: US Department of Homeland Security

Largest Ever One-Time Expansion Will Help Responsible Companies Keep Forced Labor out of their Supply Chain

WASHINGTON – Today, the U.S. Department of Homeland Security (DHS) announced the addition of 26 textile companies based in the People’s Republic of China (PRC) to the Uyghur Forced Labor Prevention Act (UFLPA) Entity List. Effective May 17, 2024, goods produced by the named 26 entities will be restricted from entering the United States. By focusing on cotton manufacturers based outside of the Xinjiang Uyghur Autonomous Region (XUAR) that source cotton from the XUAR, their designation will increase transparency and ensure responsible companies can conduct due diligence on their supply chains to ensure they do not include goods made with forced labor.

The Forced Labor Enforcement Task Force (FLETF), chaired by DHS, is taking these steps as part of the United States’ commitment to eliminating the use of forced labor in the U.S. supply chain and promoting accountability for the ongoing genocide and crimes against humanity against Uyghurs and other religious and ethnic minority groups in the XUAR.

“The Department of Homeland Security will not tolerate forced labor in our nation’s supply chains,” said Secretary of Homeland Security Alejandro N. Mayorkas. “Today’s announcement strengthens our enforcement of the UFLPA and helps responsible companies conduct due diligence so that, together, we can keep the products of forced labor out of our country. We will continue to execute on our textile enforcement strategy and hold the PRC accountable for their exploitation and abuse of the Uyghur people.”

Since the UFLPA was signed into law in December 2021, the FLETF has added 65 entities to the UFLPA Entity List. These entities reach into the apparel, agriculture, polysilicon, plastics, chemicals, batteries, household appliances, electronics, and food additives sectors, among others. The interagency FLETF – which also includes the Office of the U.S. Trade Representative and the U.S. Departments of Commerce, Justice, Labor, State, and the Treasury – voted to add the 26 companies to the UFLPA Entity List. Today’s announcement represents the largest ever one-time expansion to the UFLPA Entity List. 

“Today we add 26 additional companies to the UFLPA Entity List,” said DHS Under Secretary for Policy Robert Silvers, who serves as Chair of the FLETF. “We have shown again through today’s enforcement actions that the United States is taking action to prevent forced labor in U.S. supply chains. Companies must conduct due diligence and know where their products are coming from. The Forced Labor Enforcement Task Force will continue to designate entities known to violate our laws, and U.S. Customs and Border Protection will continue its vigilant enforcement at our ports.”

Adding these entities to the UFLPA Entity List advances DHS’ Textile Enforcement Plan, which prioritizes examination and review of entities in the textile sector for possible inclusion on the UFLPA Entity List. The FLETF will continue to consider future designations to the UFLPA Entity List as part of DHS’ broader forced labor enforcement efforts.

The 26 entities added to the UFLPA Entity List include cotton traders and warehouse facilities within China, the majority of which operate outside of the XUAR. Adding these entities to the UFLPA Entity List will make it easier for responsible companies to ensure that they are not purchasing cotton from entities who are sourcing cotton from the XUAR. By identifying these additional entities in the textile sector, U.S. importers have more information to conduct due diligence and examine their supply chains for risks of forced labor to ensure compliance with the UFLPA. The FLETF determined that 21 of the entities source and sell cotton from the XUAR on the wholesale market. The FLETF also determined that five additional entities also source cotton from the XUAR.

Since January 2021, prior to the implementation of the UFLPA, cotton from the XUAR was subject to a U.S. Customs and Border Protection Withhold Release Order.  In addition, cotton and cotton products were also designated as a high priority sector under the Strategy to Prevent Importation of Goods Mined, Produced or Manufactured with Forced Labor in the People’s Republic of China, issued in June 2022. Before these new additions, the UFLPA Entity List   included 10 textile entities.

The bipartisan UFLPA, signed into law by President Joseph R. Biden, Jr., in December 2021, mandates that CBP apply a rebuttable presumption that goods that are mined, produced or manufactured in the XUAR, or produced by entities identified on the UFLPA Entity List, are prohibited from importation into the United States unless the Commissioner of CBP determines, by clear and convincing evidence, that the goods were not produced with forced labor.  CBP began enforcing the UFLPA in June 2022.  Since then, CBP has reviewed more than 8,000 shipments valued at more than $3 billion under the UFLPA.  Additionally, Homeland Security Investigations, through the DHS Center for Countering Human Trafficking, supports investigations and outreach to secure international cooperation in investigating human rights abuses and forced labor in XUAR.

Today’s announcement supports President Biden’s memorandum on advancing worker empowerment, rights, and high labor standards globally. The memorandum represents the first whole-of-government approach to advance workers’ rights by directing federal agencies engaged abroad to advance international recognized labor rights, which includes DHS’s work implementing the UFLPA.

This expansion of the UFLPA Entity List reflects DHS’ prioritization of combating the introduction of forced labor into U.S. supply chains.  This commitment is outlined in the Department’s recent Quadrennial Homeland Security Review, which added combating crimes of exploitation, including labor exploitation, as the newest and sixth DHS mission.

You can read more about the FLETF by visiting: www.dhs.gov/uflpa. 

Source: US Department of Homeland Security

The Departments of State, Homeland Security, and the Treasury are jointly issuing this alert to notify airlines, air charter operators, travel agents, and service providers of the ways in which migrant smuggling and human trafficking networks are exploiting legitimate transportation services to facilitate irregular migration to the United States.  This statement conveys the U.S. government’s efforts to promote responsible practices in the industry, prevent and disrupt illicit activity, and enhance compliance with lawful immigration and migration pathways.  It follows an important announcement by the International Air Transport Association (IATA) and several member airlines of their commitment to strengthen collaboration with governments and international organizations to address irregular migration and to consider commercial measures to minimize illicit travel. 

Recent developments in the aviation sector, described below, expose migrants, airlines, air charter operators, travel agents, and service providers to increased safety, economic, reputational, financial, logistical, and legal risks.  This statement identifies a number of recommendations that could help industry stakeholders and governments reduce their exposure to risks associated with facilitating irregular migration.

Migrants are increasingly traversing the region using Managua as a disembarkation point to continue the journey northward by overland means. The United States has shared releasable intelligence with the aviation sector highlighting this trend and underscoring the need for greater enforcement of airline policies with respect to flights in and out of Managua.  In particular, actions by the Nicaraguan government are of grave concern.  President Daniel Ortega and Vice President Rosario Murillo have put in place permissive-by-design migration policies that have introduced opportunities for migrant smuggling and trafficking networks to exploit migrants for economic gain and fuel dangerous, irregular travel towards the U.S. southwest border. 

There are numerous examples of how ruthless smuggling networks have taken advantage of these routes:

In September 2023, Ofelia Hernandez-Salas was extradited to the United States by Mexico for allegedly conspiring with other smugglers to facilitate the travel of large numbers of migrants into the United States from and through Bangladesh, Yemen, Pakistan, Eritrea, India, the United Arab Emirates, Uzbekistan, Russia, Egypt, Brazil, Peru, Ecuador, Colombia, Costa Rica, Nicaragua, Honduras, El Salvador, Guatemala, and Mexico.  Hernandez-Salas took advantage of commercial routes and charter flights to facilitate the movement of individuals to the U.S. southwest border.

In December 2023, French authorities thwarted an attempt by an organization to move individuals from India, through France, into Nicaragua for further transportation and smuggling arrangements to the U.S. southwest border.  More recently, in May 2024, authorities in Jamaica refused entry to a charter flight of irregular migrants that were seeking to travel to the U.S. southwest border. 

In May 2024, an Egyptian court initiated the trial of 16 individuals accused of smuggling migrants to the United States.  The individuals face criminal charges related to organized crime and human smuggling.  According to the charges, the group arranged air transportation of migrants and placed the migrants in dangerous, degrading, and inhuman circumstances throughout the smuggling process.

Recommended Industry Actions

The following are recommended best practices, subject to applicable laws and regulations and, as appropriate according to their risk, based on: (i) their role; (ii) the information available to them; and (iii) the types of transactions in which they engage:

Recommendation 1:  Monitor high-risk routes. Proactive measures to identify flight segments/routes known to be used by migrants and migrant smuggling or human trafficking networks can prevent the exploitation of those routes.  The United States is closely tracking this issue and can provide relevant information to support airline efforts.  IATA and several airlines already have announced voluntary steps industry can take in support of this effort.

Recommendation 2:  Report companies that trigger concerns.  Industry participants can report concerning activity, including information about travel agencies known or suspected to be engaging in activities supporting irregular migration and migrant smuggling or human trafficking networks to their U.S. Customs and Border Protection (CBP) liaisons, relevant law enforcement and civil aviation authorities, and IATA.  As appropriate, carriers may take proactive administrative actions, such as by restricting the ability of agencies known or suspected to be supporting irregular migration to conduct financial transactions with airlines for the purpose of making reservations and ticketing.

Recommendation 3:  Undertake appropriate due diligence.  Airlines can reduce risk by carrying out appropriate due diligence to protect against the exploitation of services.  Conducting increased diligence when dealing with intermediary companies (e.g., travel agents or brokers) that conceal their ownership or otherwise engage in unusually opaque practices.  Doing so can help mitigate deceptive practices that create risk.

Recommendation 4:  Transmit Advance Passenger Information (API).  All airlines should comply with government regulations requiring the transmission of accurate and timely Advance Passenger Information (API) prior to departure, beginning at 24 hours prior to scheduled takeoff to enable proper record checks and offload recommendations.

Actions the United States will Continue to Take to Halt Irregular Migration and the Exploitation of Migrant Populations:

Action 1:  Government-to-Government Training and Information Sharing:  The U.S. Government will work with governments to identify travel patterns and routes of concern and share indicators and best practices for addressing irregular migration.

Action 2:  Industry Training:  The U.S. Government will share information with and train airlines to help them detect migrant smuggling and human trafficking cases, signs of irregular migration, fraudulent documents, and imposters.  Enhancing foreign partner passenger analysis units and helping them fully leverage Advance Passenger Information System (APIS) transmission will aid in illuminating emerging trends, targeting malafide passengers, and identifying migration facilitators.

Action 3:  Visa Restrictions:  Under Immigration and Nationality Act (INA) Section 212(a)(3)(C), the Secretary of State has recently announced a visa restriction policy that targets owners, executives, and senior officials of companies providing transportation by land, sea, or charter air designed for use primarily by persons intending to migrate irregularly to the United States.  

The State Department has taken steps to impose visa restrictions on several individuals and their family members for knowingly facilitating the travel of irregular migrants to the U.S. southwest border.

Action 4:  Sanctioning transnational criminal organizations:  The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) will continue to impose sanctions on transnational criminal organizations, including migrant smuggling organizations, their facilitators, and their support networks, pursuant to Executive Order (E.O.) 13581, as amended by E. O. 13863.  OFAC is also prepared to use, as appropriate, other sanctions authorities to target human smuggling activity, including its Global Magnitsky authorities under E.O. 13818 that target persons involved in corruption or serious human rights abuses related to human smuggling and other irregular migration. 

Sanctions actions apply broadly and carry serious consequences.  OFAC’s regulations generally prohibit all transactions by U.S. persons with or within the United States involving the property or interests in property of any individual or entity that is sanctioned.  All U.S. persons must comply with OFAC’s prohibitions—including all U.S. citizens and permanent resident aliens whether in the United States or abroad, all persons within the United States, and all U.S.-incorporated entities and their foreign branches.  Violations of OFAC regulations could trigger civil or criminal penalties.  Moreover, OFAC may impose civil penalties for sanctions violations based on strict liability, meaning that a person subject to U.S. jurisdiction may be held civilly liable even if that person did not know or have reason to know that it was engaging in a transaction that was prohibited under sanctions laws and regulations administered by OFAC.

Action 5:  Investigate and prosecute migrant smuggling and human trafficking:  The U.S. government will continue to investigate and prosecute migrant smuggling and human trafficking cases through collaboration with foreign governments and the aviation industry and pursue criminal charges against migrant smugglers and human traffickers, and their co-conspirators.

Source: US Department of Homeland Security

Informs civil society organizations and individuals of cyber adversary behaviors and actions to mitigate this threat

WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA), Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI), in collaboration with cyber partners from Canada, Estonia, Japan and United Kingdom, published “Mitigating Cyber Threats with Limited Resources: Guidance for Civil Society” today which provides civil society organizations with recommended actions and mitigations to reduce their risk of cyber intrusions, particularly from state-sponsored cyber actors. It also strongly encourages software manufactures to actively implement and publicly commit to Secure by Design practices that are necessary to help protect vulnerable and high-risk communities.

The guide provides recommended mitigations for civil society organizations, which include implementing phishing-resistant multifactor authentication (MFA), using caution when sharing information on social media, prioritizing vendors that align their practices to Secure by Design principles, and ensuring awareness of social engineering tactics.

“State-sponsored actors seek to undermine fundamental democratic and humanitarian values and interests supported by civil society organizations and individuals. However, these high-risk community organizations often lack cyber threat information and security resources,” said Jen Easterly Director CISA. “With our federal and international partners, we are providing this resource to help these organizations better understand the cyber threats they face and help them improve their cyber safety.”

“The FBI and its partners are putting out this guidance so that civil society organizations have the capacity to mitigate the threats that they face in the cyber realm,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division. “We’d like to help these entities, whether they are nonprofits, think tanks, or groups working to defend human rights and advance democracy, defend themselves against malicious state-sponsored actors looking to exploit them.”

“We thank CISA and partners for close cooperation on releasing this guidance. It was confirmed in Japan that organizations and individuals such as academia, think tanks and journalists have been targeted by cyberattacks.,” said Mr. Atsuo Suzuki, Director General, Japan National Center of Incident Readiness and Strategy for Cybersecurity (NISC). “We would like to partner with co-sealing countries and organizations of this guidance to make contribution to enhancing cybersecurity.”

“Last couple of years have shown that every organisation can be targeted with malicious cyber activities. The root of this problem lies typically in lack of knowledge about cyber threats, or cyber threaths not taken as seriously as they should be. It is important to raise awareness and provide guidelines, such as the freshly published guidance for civil society organisations and individuals. I invite all organisations to make good use of the guide and to learn how to take the necessary steps to protect yourself from cyber threats,“ said Gert Auväärt, Director of Cyber Security of the Estonian State Information Authority (RIA).

“The Canadian Centre for Cyber Security, a part of CSE, welcomes this report. The best way to protect Canada and our global partners from the growing threat of foreign interference, and digital transnational repression is to raise awareness about the threat,” said Sami Khoury, Head, Canadian Centre for Cyber Security. “We all have a role to play in defending our democratic institutions, including our civil society organizations and individuals.”

“Civil society groups play a crucial role in upholding our democratic values in the UK and around the world and so it is vital they have the information they need to protect themselves online,” said Felicity Oswald, Chief Executive of the United Kingdom National Cyber Security Centre. “This new guidance, developed with international partners, will help those with limited resources ensure they have strong security measures in place to manage the greater risk of targeting that they face. We are committed to our ongoing collaboration with likeminded countries to raise the collective resilience of global democracy and safeguard civil society from cyber threats.”

“Preparing for global cyber threats requires national and international cooperation. This report is an excellent example of confidential cooperation with our international partners. This guide also supports our work to improve cyber security awareness in Finland,” says Anssi Kärkkäinen, deputy director general of National Cyber Security Centre Finland (NCSC-FI)

Malicious state-sponsored actors use various tactics to gain initial access and then often install spyware on the compromised devices to conduct more extensive surveillance, such as location tracking and access to files. The guide provides a list of state-sponsored actors known to target civil society organizations primarily from Russia, China, Iran and North Korea, along with an overview of their known tactics and techniques. The overview helps organizations better understand the adversarial behavior so their leadership can make informed resourcing decisions on basic cybersecurity controls.

In addition to CISA, partnering agencies include:

Department of Homeland Security Office of Intelligence and Analysis (DHS I&A), 
Federal Bureau of Investigation (FBI), Canadian Centre for Cyber Security (CCCS), Estonian National Cyber Security Centre (NCSC-EE), National Center of Incident Readiness and Strategy for Cybersecurity (NISC) Japan, National Police Agency (NPA) Japan, Japan Computer Emergency Response Team Coordination Center (JPCERT/CC), National Cyber Security Centre – Finland (NCSC-FI), and United Kingdom National Cyber Security Centre (NCSC-UK).

For more information, see CISA’s Cybersecurity Resources for High-Risk Communities webpage.

Source: US Department of Homeland Security

SUMMARY

Note: This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC) (hereafter referred to as the authoring organizations) are releasing this joint CSA to provide information on Black Basta, a ransomware variant whose actors have encrypted and stolen data from at least 12 out of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector.

This joint CSA provides TTPs and IOCs obtained from FBI investigations and third-party reporting. Black Basta is considered a ransomware-as-a-service (RaaS) variant and was first identified in April 2022. Black Basta affiliates have impacted a wide range of businesses and critical infrastructure in North America, Europe, and Australia. As of May 2024, Black Basta affiliates have impacted over 500 organizations globally.

Black Basta affiliates use common initial access techniques—such as phishing and exploiting known vulnerabilities—and then employ a double-extortion model, both encrypting systems and exfiltrating data. Ransom notes do not generally include an initial ransom demand or payment instructions. Instead, the notes provide victims with a unique code and instructs them to contact the ransomware group via a .onion URL (reachable through the Tor browser). Typically, the ransom notes give victims between 10 and 12 days to pay the ransom before the ransomware group publishes their data on the Black Basta TOR site, Basta News.

Healthcare organizations are attractive targets for cybercrime actors due to their size, technological dependence, access to personal health information, and unique impacts from patient care disruptions. The authoring organizations urge HPH Sector and all critical infrastructure organizations to apply the recommendations in the Mitigations section of this CSA to reduce the likelihood of compromise from Black Basta and other ransomware attacks. Victims of ransomware should report the incident to their local FBI field office or CISA (see the Reporting section for contact information).

Download the PDF version of this report:

TECHNICAL DETAILS

Note: This advisory uses the MITRE ATT&CK for Enterprise framework, version 15. See the MITRE ATT&CK Tactics and Techniques section for a table of the threat actors’ activity mapped to MITRE ATT&CK® tactics and techniques. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Initial Access

Black Basta affiliates primarily use spearphishing [T1566] to obtain initial access. According to cybersecurity researchers, affiliates have also used Qakbot during initial access.[1]

Starting in February 2024, Black Basta affiliates began exploiting ConnectWise vulnerability CVE-2024-1709 [CWE-288] [T1190]. In some instances, affiliates have been observed abusing valid credentials [T1078].

Discovery and Execution

Black Basta affiliates use tools such as SoftPerfect network scanner (netscan.exe) to conduct network scanning. Cybersecurity researchers have observed affiliates conducting reconnaissance using utilities with innocuous file names such as Intel or Dell, left in the root drive C: [T1036].[1]

Lateral Movement

Black Basta affiliates use tools such as BITSAdmin and PsExec, along with Remote Desktop Protocol (RDP), for lateral movement. Some affiliates also use tools like Splashtop, Screen Connect, and Cobalt Strike beacons to assist with remote access and lateral movement.

Privilege Escalation and Lateral Movement

Black Basta affiliates use credential scraping tools like Mimikatz for privilege escalation. According to cybersecurity researchers, Black Basta affiliates have also exploited ZeroLogon (CVE-2020-1472, [CWE-330]), NoPac (CVE-2021-42278 [CWE-20] and CVE-2021-42287 [CWE-269]), and PrintNightmare (CVE-2021-34527, [CWE-269]) vulnerabilities for local and Windows Active Domain privilege escalation [T1068].[1],[2]

Exfiltration and Encryption

Black Basta affiliates use RClone to facilitate data exfiltration prior to encryption. Prior to exfiltration, cybersecurity researchers have observed Black Basta affiliates using PowerShell [T1059.001] to disable antivirus products, and in some instances, deploying a tool called Backstab, designed to disable endpoint detection and response (EDR) tooling [T1562.001].[3] Once antivirus programs are terminated, a ChaCha20 algorithm with an RSA-4096 public key fully encrypts files [T1486]. A .basta or otherwise random file extension is added to file names and a ransom note titled readme.txt is left on the compromised system.[4] To further inhibit system recovery, affiliates use the vssadmin.exe program to delete volume shadow copies [T1490].[5]

Leveraged Tools

See Table 1 for publicly available tools and applications used by Black Basta affiliates. This includes legitimate tools repurposed for their operations.

Disclaimer: Use of these tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control.

Table 1: Tools Used by Black Basta Affiliates

Tool Name	Description
BITSAdmin	A command-line utility that manages downloads/uploads between a client and server by using the Background Intelligent Transfer Service (BITS) to perform asynchronous file transfers.
Cobalt Strike	A penetration testing tool used by security professions to test the security of networks and systems. Black Basta affiliates have used it to assist with lateral movement and file execution.
Mimikatz	A tool that allows users to view and save authentication credentials such as Kerberos tickets. Black Basta affiliates have used it to aid in privilege escalation.
PSExec	A tool designed to run programs and execute commands on remote systems.
PowerShell	A cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework, which runs on Windows, Linux, and macOS.
RClone	A command line program used to sync files with cloud storage services such as Mega.
SoftPerfect	A network scanner (netscan.exe) used to ping computers, scan ports, discover shared folders, and retrieve information about network devices via Windows Management Instrumentation (WMI), Simple Network Management Protocol (SNMP), HTTP, Secure Shell (SSH) and PowerShell. It also scans for remote services, registry, files, and performance counters.
ScreenConnect	Remote support, access, and meeting software that allows users to control devices remotely over the internet.
Splashtop	Remote desktop software that allows remote access to devices for support, access, and collaboration.
WinSCP	Windows Secure Copy is a free and open source SSH File Transfer Protocol, File Transfer Protocol, WebDAV, Amazon S3, and secure copy protocol client. Black Basta affiliates have used it to transfer data from a compromised network to actor-controlled accounts.

MITRE ATT&CK TACTICS AND TECHNIQUES

See Tables 2–6 for all referenced threat actor tactics and techniques in this advisory.

Source: US Department of Homeland Security

WASHINGTON – As part of the Biden-Harris Administration’s continued efforts to enhance the security of our border and deliver more timely consequences for those encountered who do not have a legal basis to remain in the United States, today the Department of Homeland Security (DHS), through U.S. Citizenship and Immigration Services (USCIS), published a Notice of Proposed Rulemaking (NPRM) that would allow statutory bars to asylum to be applied much earlier in the process. Even though the number of migrants who are subject to these bars is small, this rule would enable DHS to more quickly remove those who are subject to the bars and pose a risk to our national security or public safety.

Federal law bars individuals who pose a national security or public safety risk from asylum and withholding of removal, specifically those who have been convicted of a particularly serious crime, participated in the persecution of others, are inadmissible on national security or terrorism-related grounds, or for whom there are reasonable grounds to deem them a danger to the security of the United States. While anyone who is deemed to pose a public safety threat is taken into custody, the asylum eligibility determination is not currently made until later in the process – at the merits adjudication stage of the asylum and withholding of removal claims. Today’s proposed rule would permit Asylum Officers to consider these bars to asylum and withholding of removal during initial credible fear screening, which happens just days after an individual is encountered. This will allow DHS to expeditiously remove individuals who pose a threat to the United States much sooner than is currently the case, better safeguarding the security of our border and our country.

“The proposed rule we have published today is yet another step in our ongoing efforts to ensure the safety of the American public by more quickly identifying and removing those individuals who present a security risk and have no legal basis to remain here,” said Secretary of Homeland Security Alejandro Mayorkas. “We will continue to take action, but fundamentally it is only Congress that can fix what everyone agrees is a broken immigration system.”

Noncitizens who present a national security or public safety risk remain in DHS custody while their cases are referred for full immigration hearings before an immigration judge, a process that can take years and is resource intensive. The proposed rule would allow Asylum Officers to issue denial of claims within days after an individual is encountered when there is evidence that the individual is barred from asylum because of a terrorism, national security, or criminal bar, thereby significantly shortening the overall time between encounter and removal from the United States.

In addition to this proposed rule and in close coordination with vetting and law enforcement partners, DHS is updating its policy and procedures regarding the use of classified information in immigration proceedings. This updated guidance clarifies the circumstances in which classified information should be used in immigration proceedings. Consistent with longstanding practice, DHS will continue to screen and vet individuals prior to their entry to the United States to identify national security or public safety threats and take appropriate action.

The Department also continues enforcing the Circumvention of Lawful Pathways (CLP) rule. This rule incentivizes the use of orderly processes and imposes swifter consequences for those without a legal basis to remain in the United States. Today, USCIS issued revised guidance to Asylum Officers to consider whether an asylum seeker could reasonably relocate to another part of the country of feared persecution when assessing claims of future persecution in all credible fear cases. Internal relocation has always been a part of an analysis of future claims of harm, and this new guidance, consistent with the CLP rule, will ensure early identification and removal of individuals who would ultimately be found ineligible for protection because of their ability to remain safe by relocating elsewhere in the country from which they fled.

The Biden-Harris Administration has already taken numerous actions to address migration challenges in the region and at our border, while overseeing a historic expansion of lawful pathways. These efforts, with partner countries in the region and across the world, have made a significant impact. From May 12, 2023 through May 1, 2024, DHS has removed or returned more than 720,000 individuals, the vast majority of whom crossed the Southwest Border, including more than 109,000 individual family members. That includes removals to 170 countries around the world. Total removals and returns since mid-May 2023 exceed removals and returns in every full fiscal year since 2011. DHS has also significantly expanded the capacity to conduct the credible fear interviews needed to ultimately remove those without a legal basis to stay in the United States.

The Administration again calls on Congress to pass needed reforms and provide DHS the resources and tools it needs to fully implement expedited processing of all individuals encountered at the border. The public is invited to submit comments on the NPRM during the 30-day public comment period from May 13, 2024 to June 12, 2024.