Cybersecurity

The NCCIC has released a Threat Alert on the Emotet malware, an advanced, modular banking Trojan that primarily functions as a downloader or dropper of other banking Trojans. Emotet continues to be among the most costly and destructive malware affecting state, local, tribal, and territorial (SLTT) governments, and the private and public sectors. Emotet is disseminated through malspam (emails containing malicious attachments or links) that uses branding familiar to the recipient and imitates PayPal receipts, shipping notifications, or “past-due” invoices.

Yesterday, the U.S. Department of Homeland Security (DHS) hosted an unclassified, virtual awareness briefing in its NCCIC Awareness Briefing series, titled, Russian Activity Against Critical Infrastructure.

The NCCIC has released an advisory on a stack-based buffer overflow vulnerability in AVEVA InTouch. Numerous versions of this product are affected. Successful exploitation of this vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as those of the InTouch View process which could lead to a compromise of the InTouch HMI. Systems are only vulnerable if the operating system locales do not use a dot floating point separator. AVEVA recommends a series of mitigation measures for each version of the software affected.

Utilities with more mature monitoring capabilities may be interested in a new tool by Nozomi Networks, a Wireshark plug-in developed to detect TriStation protocol traffic on the network, the TriStation Protocol Plug-in for Wireshark. Wireshark, a widely used open source network packet analyzer commonly used for network troubleshooting and analysis, is extremely useful for advanced malware analysis, including detecting TRITON/TRISIS/HatMan activity.