You are here

Home » Cybersecurity

Cybersecurity

Pot Calling the Kettle Black – Ransomware Groups Blame Negotiators for Only Being there to Make Money

Under the guise of ‘negotiators don’t care about the victim, they’re only in it for the money,’ at least two ransomware groups have recently upped the ante on their quest for a quick buck – or hundreds of thousands of bucks. Amid the flurry of ransomware attacks, the Grief ransomware group is now threatening to destroy the decryption keys of any victim who hires a professional negotiator. Similarly, the Ragnar Locker ransomware group threatened to release stolen data if the victim contacted law enforcement or a negotiator.

Another Reason to Patch – Potential Nexus Between Microsoft’s MSHTML Zero-Day Attacks and Ransomware Activity

Microsoft recently disclosed that its Windows MSHTML zero-day vulnerability may have possibly been exploited by ransomware gangs. The exploit, tracked as CVE-2021-40444, was revealed on September 7 when Microsoft acknowledged that it had observed the exploit used in limited targeted attacks. Microsoft released a patch for this vulnerability with its September 14th updates.

Australian Annual Cyber Threat Report

The Australian Cyber Security Centre (ACSC) has released its second annual report on key cyber threats and statistics from 2020–2021. The report underlines that threat actors have greatly exploited the pandemic environment, ransomware attacks saw a 15 percent increase over the past year, and around 25 percent of all reported cyber incidents were associated with critical infrastructure. WaterISAC encourages members to review the ACSC report more insights and observations.

Security isn’t Always About the Technology – Rethinking Your Organizations Cybersecurity Practices

As cybersecurity threats continue to proliferate in today’s increasingly interconnected world, it is imperative to generate new strategies for confronting this dynamic threat. For example, before crafting new cyber policies, it is important to understand the bottlenecks impacting your current cybersecurity practices. Likewise, cyber defense isn’t always about technology controls and strategies. Sometimes it may be necessary to address our cultural mindsets from being reactive to proactive through cooperation, communication, and initiative.

Apple Releases Security Updates to Fix Multiple Zero-Days, but be Wary of Overhyping

Prior to this publishing, you may already be aware of the recent Apple security updates released to patch against exploits being attributed to the NSO Group’s Pegasus spyware. According to CitizenLab, the exploit, dubbed FORCEDENTRY has been leveraged since at least February 2021 and is tracked as CVE-2021-30860. CitizenLab describes FORCEDENTRY as a zero-day, zero-click exploit against iMessage that could lead to arbitrary code execution by processing a maliciously crafted PDF. Reuters states it more plainly as, the vulnerability lies in how iMessage automatically renders images.

Who Needs New Exploits when you have 500,000 Fortinet VPN Account Credentials Leaked on the Dark Web

Attention: If your utility uses Fortinet FortiOS SSL VPNs, you are encouraged to review this activity and address accordingly, especially if you haven’t applied security updates since 2018. WaterISAC has previously advised members of active exploitation of the vulnerability referenced in this post (CVE-2018-13379) and urged members to address older patches for Fortinet devices – see (Fortinet

Ransomware Reprise? – REvil Ransomware Group Reemerges

The ransomware group REvil has just reappeared after going offline shortly after its attack on Kaseya over the July 4th weekend. REvil is responsible for some of the most disruptive ransomware attacks. For example, in June, REvil targeted Brazil’s JBS SA, one of the world’s largest meat suppliers. In July, REvil exploited a zero-day vulnerability in the Kaseya VSA remote management software to encrypt approximately 60 managed service providers (MSPs) and more than 1,500 of its clients. Shortly after these high-profile attacks, REvil’s online infrastructure went dark for no apparent reason.

Pages

Subscribe to Cybersecurity