Cybersecurity

The FBI has published a TLP:WHITE FLASH providing indicators of compromise associated with LockBit 2.0 ransomware. The FLASH indicates LockBit 2.0 threat actors operate as an affiliate run Ransomware-as-a-Service (RaaS) and employ a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Some techniques these threat actors include, but are not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.

Many organizations are not utilizing the cybersecurity features offered by Microsoft 365, according to research from the IT company Ensono. For its research Ensono surveyed IT staff whose companies use Microsoft 365. Some key findings from the survey reveal that 38 percent of respondents are not using multi-factor authentication, only 43 percent have Conditional Access setup, and 46 percent do have data loss prevention or data classification configured.

Data leaks, for whatever reason, are costly. However, financial recovery costs and costs due to damaged trust and reputation are not the only ramifications. Lost data often finds its way into the hands of advanced adversaries who use it for reconnaissance efforts to learn about potential targets, including critical infrastructure organizations.

A current phishing scam is purporting to be a message from the U.S. Postal Service (USPS) claiming recipients have missed an important delivery, but instead contains a malicious link. In recent phishing awareness posts, WaterISAC has highlighted threat actors using trusted brands in phishing campaigns to fool users more easily into downloading various malware.