Supplemental Cyber Highlights – November 9, 2023

The following posts are useful for general awareness of current threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.

Critical Infrastructure Resilience

• SBOMs’ Role in Helping to Protect ICS (ISS Source)
• Machine Learning Aids Water Treatment Monitoring (ISS Source)
• Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology (Mandiant)

IT Vulnerabilities, Malware & Threats

• Atlassian Bug Escalated to 10, All Unpatched Instances Vulnerable (Dark Reading)
• New Malvertising Campaign Uses Fake Windows News Portal to Distribute Malicious Installers (The Hacker News)
• A Hole in the (fire) Wall: Check Point Research reveals technique allowing attackers to bypass Firewall rules designed to stop NTLM credential thefts, and provides protection methods (Check Point)
• October 2023’s Most Wanted Malware: NJRat Jumps to Second Place while AgentTesla Spreads through new File Sharing Mal-Spam Campaign (Check Point)
• Quishing Campaigns Spike 50% in September (Infosecurity Magazine)
• The Truth Crisis | The Rising Threat of Online Misinformation and Disinformation (Sentinel One)

Ransomware

• Dallas County reviewing data leaked by ransomware gang (The Record)

Cyber Resilience

• Zero Day Threat Protection for Your Network (Trend Micro)
• When Email Security Meets SaaS Security: Uncovering Risky Auto-Forwarding Rules (The Hacker News)
• Key questions to ask when evaluating an identity and access security vendor (SC Magazine)

General Awareness

• 3 Things to Know about Vishing (Cofense)
• Microsoft Authenticator now blocks suspicious MFA alerts by default (Bleeping Computer)
• Sumo Logic discloses security breach, advises API key resets (Bleeping Computer)

Technical Posts (for security analysts, sysadmins, and other nerds)

• Threat Actors Leverage File-Sharing Service and Reverse Proxies for Credential Harvesting (Trend Micro)