Cybersecurity

CISA has published an advisory on an uncontrolled search path element vulnerability in Fazecast jSerialComm. Versions 2.2.2 and prior of jSerialComm and versions 1.5.x, 1.6.x, and 1.7.x of EcoStruxure IT Gateway are affected. Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on a targeted system. Fazecast recommends users update jSerialComm to Version 2.3 or later. Schneider Electric recommends users upgrade EcoStruxure IT Gateway to Version 1.8.1 or later.

COVID-19 forced some organizations to exercise a business continuity plan that may not have formally existed prior to the pandemic. With the current pandemic running its course and activities still fresh in our minds, there is no better time than the present to formalize or refresh organizational business continuity and preparedness plans. OT security firm Applied Risk highlights some business continuity best practices and key activities for critical infrastructure entities.

The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has published a joint Alert with its U.K. counterpart, the National Cyber Security Centre (NCSC), warning that they continue to see indications advanced persistent threat (APT) groups are exploiting the COVID-19 pandemic. Although the Alert highlights activity by these actors against the healthcare sector, it also notes that other sectors, especially those that provide essential services during the pandemic, are being targeted. Targeted sectors include those associated with local governments.

The FBI has published a TLP:WHITE FLASH message providing indicators of COVID-19 phishing emails to assist in network defense. The FBI advises that cyber criminals, who include advanced persistent threat (APT) groups, have crafted COVID-19-themed health, informational, and warning notice emails in an attempt to obtain online service credentials, such as those for Microsoft Office 365 accounts. Additionally, cyber criminals have attached archive files that contain malicious portable executables (PE) or JAVA.jar files to their phishing emails.