Cyber Resilience – Get to Know the Enemy Before They Get to Know You
by Jennifer Lyn Walker
Cybersecurity
Organizational Resilience – Insider Threats
The risk posed by insider threats is increasing. Organizations routinely fall victim to cyber attacks due to both intentional and unintentional insider threats. There are two broad categories of insider threats: the malicious insider and the unwitting asset. Malicious insiders can be motivated by financial or political factors or be driven by personal grievances against an employer. They also may be a disgruntled former employee. While malicious insiders have negative intentions, unwitting assets are also a concern.
Threat Awareness – Compromised Microsoft SQL Servers Being Used to Deliver Ransomware
Threat actors have been observed compromising vulnerable Microsoft SQL servers and infecting them with FARGO ransomware. Disrupting database servers can lead to significant disruption of business operations. They are often compromised via brute force, dictionary attacks, or by exploiting unpatched vulnerabilities. According to security researchers at AhnLab, this attack chain involves downloading a .Net file and PowerShell, followed by the execution of a BAT file, which eventually leads to the deployment of the FARGO ransomware and a ransom note on a victim’s device.
CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins - September 27, 2022
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
Threat Awareness – Ransomware Groups Attempting to Destroy Data Rather than Encrypt to Ensure Payouts
Last week, researchers began noticing at least one ransomware group attempting to “up” the data extortion game. Researchers at Cyderes and Stairwell observed a BlackCat/ALPHV sample attempting to corrupt files within the victim’s environment rather than encrypting them and then staging the files for destruction. The data destruction functionality is being linked to Exmatter, a tool that has previously been associated with BlackMatter.
OT/ICS Cyber Resilience – Joint Cybersecurity Advisory on Control System Defense
CISA and the National Security Agency (NSA) published a joint cybersecurity advisory about control system defense for operational technology (OT) and industrial control systems (ICSs). According to the advisory, Control System Defense: Know the Opponent (AA22-265A) is intended to provide critical infrastructure owners and operators with an understanding of the tactics, techniques, and procedures (TTPs) used by malicious cyber actors.
Cyber Resilience – U.K. Cyber Center Publishes Guidance on Authentication Methods “Beyond Passwords”
The U.K.’s National Cyber Security Center (NCSC) recently published guidance highlighting how organizations can strengthen access and identity management security by implementing additional authentication methods beyond just using passwords.
Security Awareness – Credential Reuse Contributes to Increase in Credential Stuffing Attacks
Credential stuffing attacks became so pervasive in the first quarter of 2022, that the malicious traffic surpassed that of legitimate login attempts from normal users in some countries, according to security researchers at Okta.
Joint Cybersecurity Advisory – Iranian State Actors Conduct Cyber Operations Against the Government of Albania
Yesterday, the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI published a joint Cybersecurity Advisory (CSA) with technical details on cyber activity by Iranian state-sponsored threat actors that launched a destructive cyberattack against the government of Albania. Members are encouraged to review this advisory for greater understanding of adversary capabilities and behaviors and for recommended mitigations to protect systems from similar threats – irrespective of threat group or victimology.
CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins - September 22, 2022
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
Pages
