Cybersecurity

Throughout 2020, multiple attacks occurred against Israeli water infrastructure including what was believed to be large-scale cyber intrusion attempts at wastewater treatment plants, water pumping stations, sewers, and agricultural water pumps.

CSO Online has written an article discussing the importance of cyber incident reporting and how it helps build a more resilient security community. While many governments are beginning to implement legislation that mandates incident reporting, the article points to existing mechanisms the private sector has used to share information through Information Sharing and Analysis Centers (ISACs). These channels have helped organizations mitigate attacks and coordinate a response to widespread campaigns.

Threat actors are utilizing a new attack vector that hijacks legitimate proxyware services, which allows users to sell portions of Internet bandwidth to third parties. In large-scale attacks that exploit cloud-based systems, threat actors can use this vector, termed proxyjacking, to earn possibly hundreds of thousands of dollars per month in passive income, according to security researchers from Sysdig Threat Research Team.

Menlo Labs has observed a threat actor conducting PureCrypter-enabled attacks against government agencies. Utilizing a compromised non-profit’s website, researchers tracked multiple attempts to infect government agencies through ZIP files containing PureCrypter distributed through Discord who were primed to upload a secondary payload from a compromised non-profit organization’s network. After analyzing the potential chain of infection, they found 106 other attacks that utilized similar behaviors.