You are here

Home » Cybersecurity

Cybersecurity

Mitel MiCollab and MiVoice Business Express Applications Exploited for DDoS Amplification Attacks

In a recent Cloudflare blogpost, security researchers from multiple companies warn of a new DDoS attack method they have named TP240PhoneHome. This method utilizes vulnerable versions of the Mitel MiCollab and MiVoice Business Express communications systems, which are largely employed by government and private sector organizations. The TP240PhoneHome method was first observed utilized for DDoS attacks on February 18.

China’s APT41 Successfully Compromises Applications Used By At Least Six U.S. State Governments

In a recent blog post by Mandiant, security researchers detail techniques used by the Chinese state-sponsored threat actor APT41 against the government networks of multiple U.S. states between the months of May 2021 and February 2022. During this period, the company observed the use of various zero day vulnerabilities, including the notorious Log4j vulnerability, to successfully compromise applications used by at least six states.

U.S. EPA-WaterISAC Joint Notification on Protecting VSAT Networks and Communications

WaterISAC and the U.S. Environmental Protection Agency (EPA) are notifying water and wastewater systems about the recent cybersecurity advisory from the National Security Agency (NSA) regarding very small aperture terminal (VSAT) networks. A very small aperture terminal (VSAT) is a two-way ground station that transmits and receives data from satellites. VSAT is largely used to monitor and operate remote infrastructure, particularly when other options are not feasible.

Security Awareness – Beware of Russia-Ukraine Themed Phishing

Amidst Russia’s ongoing invasion of Ukraine, threat actors are using phishing emails related to the conflict to deliver malware and infect victim computers with remote access trojans (RAT). After installing RATs on a target system to gain remote access, adversaries can then steal sensitive information, conduct network reconnaissance, disable security software, and other malicious activities. Security researchers at Bitdefender Labs are tracking two distinct phishing campaigns with themes leveraging the conflict. One campaign purports to be a survey about supply chain disruptions.

FBI PSA: FBI Warns of the Impersonation of Law Enforcement and Government Officials

The FBI has published a Public Service Announcement (PSA) detailing ongoing pervasive fraud schemes in which scammers impersonate law enforcement or government officials in order to extort money or steal personally identifiable information. These threat actors commonly spoof genuine phone numbers and names and use fake credentials of well-known government and law enforcement agencies. Scammers will use an urgent and aggressive tone and refuse to speak to or leave a message with anyone other than their targeted victim, according to the FBI.

FBI FLASH: RagnarLocker Ransomware Indicators of Compromise

The FBI has published a TLP:WHITE FLASH providing indicators of compromise associated with RagnarLocker ransomware. The FLASH indicates that since January 2022, RagnarLocker ransomware has targeted at least 52 organizations across 10 critical infrastructure sectors. According to the FBI, members of the RagnarLocker group work as part of a ransomware family and frequently alter obfuscation techniques to avoid detection and prevention. The FLASH includes further technical details regarding this activity and lists recommended mitigations.

Blended (Cyber-Physical) Threat Awareness – APC Smart-UPS Devices Vulnerable to Remote Exploitation Could have Physical Impacts

UPS (uninterruptible power supply) devices are widely relied on to keep our computer networks operational during a short-term power outage and to allow for graceful shutdowns in the event of longer-term power failures. But UPS devices can be a set it and forget it part of our network. A recent trio of vulnerabilities dubbed TLStorm highlight why UPS devices shouldn’t be neglected.

Threat Awareness – Anchor Malware

Cybersecurity researchers have uncovered a new version of the Anchor malware that has been observed targeting Windows systems. Anchor is a backdoor malware that was first spotted in 2018 and helped threat actors communicate with C2 servers to ultimately deploy Conti ransomware. Anchor has been used to target multiple critical infrastructure sectors. This new variant, dubbed AnchorMail, employs an email-based C2 server and communicates via the SMTP and IMAP protocols over TLS. This helps threat actors avoid detection from common email-based security protocols.

Pages

Subscribe to Cybersecurity