February 14, 2019
The NCCIC has updated this advisory with additional information on mitigation measures. This advisory was initially published on September 27, 2018. Read the advisory at NCCIC/ICS-CERT.
September 27, 2018
Software technology company Check Point reports its researchers detected a new campaign exploiting Linux servers to distribute a backdoor Trojan, dubbed SpeakUp. SpeakUp is capable of delivering any payload and executing it on compromised machines; it evades detection by all security vendors’ anti-virus software. According to Check Point, threats like SpeakUp are a stark warning of bigger threats to come since they can evade detection and then distribute further, potentially more dangerous malware to compromised machines.
The Emotet malware, which was responsible for deploying the Ryuk ransomware into a North Carolina water utility’s IT system in October, is back with new techniques and an upsurge in attacks.
An article from Recorded Future predicts some trends in ransomware for the coming year. One of the predicted trends is that successful ransomware campaigns will continue to rely on open remote desktop protocol (RDP) servers as the initial access point. These campaigns look for networks that have internet-facing servers running the RDP service, with attackers either taking advantage of well-known vulnerabilities in unpatched servers or using brute-force password attacks.
GPS Week Rollover occurs on April 6, 2019, which could cause a mini "millennium bug" for some GPS devices. While this is a known issue arising from the way the system works, critical infrastructure operators whose systems use GPS are encouraged to prepare for the event. Most modern GPS receivers shouldn't be affected by this (devices that conform to IS-GPS-200 and provides UTC will be fine), but testing carried out by the U.S.
February 12, 2019
The NCCIC has updated this advisory with additional details on the affected products and mitigation measures. Read the advisory at NCCIC/ICS-CERT.
January 23, 2018
A former cyber attacker writes about why city governments are appealing targets for malicious cyber operations. For one, the potential impact of targeting a city is huge. In addition to the normal “benefits” of getting access to private customer data, credit cards and so on, penetrating a city may give attackers access to sensitive information about residents. Depending on the local-government agency and its IT structure, attackers can access and impact a variety of systems, including those associated with critical infrastructure. Secondly, cities are vulnerable.
Hackers have breached the severs of email provider VFEmail and wiped the data from all its US servers, destroying customers' data in the process. "At this time, the attacker has formatted all the disks on every server," the company said yesterday. "Every VM is lost. Every file server is lost, every backup server is lost. This was more than a multi-password via SSH exploit, and there was no ransom. Just attack and destroy," VFEmail said. Founded in 2001 and based in Milwaukee, VFEmail provides email service to businesses and end users.
The NCCIC reports it is aware of a vulnerability affecting several open-source container management systems that leverage runc.
Microsoft has released its monthly update to address vulnerabilities in its software. For this month, Microsoft has released security updates for Adobe Flash Player, Internet Explorer, Microsoft Edge, Microsoft Windows, Microsoft Office and Microsoft Office Services and Web Apps, ChakraCore, .NET Framework, Microsoft Exchange Server, Microsoft Visual Studio, Azure IoT SDK, Microsoft Dynamics, Team Foundation Server, and Visual Studio Code.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
