Supplemental Cyber Highlights – May 14, 2024

The following posts are useful for general awareness of current cyber threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.

Critical Infrastructure Vulnerabilities & Resilience

• Widely used Telit Cinterion modems open to SMS takeover attacks | BleepingComputer  
• Uninterrupted Power Supply (UPS): A Silent Threat to Critical Infrastructure Resilience | Cyble
• Global alarm intensifies as state-sponsored cyberattacks raise risks to critical infrastructure, national security | Industrial Cyber
• MITRE releases EMB3D cybersecurity threat model for embedded devices to boost critical infrastructure security | Industrial Cyber
• Untangling IT-OT Security Knots with a Zero Trust Platform Approach | Palo Alto Networks

IT Vulnerabilities & Security Updates

• 2 (or 5) Bugs in F5 Asset Manager Allow Full Takeover, Hidden Accounts | Dark Reading
• Citrix warns admins to manually mitigate PuTTY SSH client bug | BleepingComputer  
• Log4Shell shows no sign of fading, spotted in 30% of CVE exploits | HelpNetSecurity

IT Malware, Threats & Risks

• FCC Warns of ‘Royal Tiger’ Robocall Scammers | SecurityWeek
• Low-tech tactics still top the IT security risk chart | CSO

Ransomware

• INC ransomware source code selling on hacking forums for $300,000 | BleepingComputer  
• Security Brief: Millions of Messages Distribute LockBit Black Ransomware | Proofpoint

Cyber Resilience & General Awareness

• Cyber Resilience – Categorically Unsafe Software | CISA
• CISA and Partners Release Guidance for Civil Society Organizations on Mitigating Cyber Threats with Limited Resources | CISA
• Insider Threats Maintain a Rising Trend | Tripwire
• Critical vulnerabilities take 4.5 months on average to remediate | HelpNetSecurity