At Black Hat USA last week, industrial cybersecurity firm, Nozomi Networks revealed findings and a live demonstration of the malware attack known as TRITON/TRISIS/HatMan. For those new to this community, Nozomi includes a brief summary of the malware in their whitepaper.
The U.S. Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have identified a Trojan malware variant—referred to as KEYMARBLE—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.
The NCCIC has provided a Malware Analysis Report (MAR) of KEYMARBLE, a Trojan malware variant used by HIDDEN COBRA. The U.S. government refers to all malicious cyber activity by the North Korean government as HIDDEN COBRA. This MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended mitigation techniques.
Social engineering is commonplace, convincing, and requires continuous consideration. Dr. Larry Ponemon, founder and chairman of Ponemon Institute, discusses the ever-present social engineering threats. He covers three key elements of every organization’s cybersecurity program – people, processes, and technology – and how they fit into combatting these threats.
In direct response to inquiries from stakeholders, DHS/NPPD launched a new website today focused on providing the critical infrastructure community with information on the principles of insider threat mitigation. The website is dedicated to assisting organizations in establishing internal capabilities to mitigate insider threats focused on a variety of topics, including ideology, workplace violence, and cybersecurity.
The NCCIC has released an advisory regarding multiple stack-based buffer overflows, and out-of-bounds read vulnerabilities affecting Delta Electronics CNCSoft and ScreenEditor products. CNCSoft Version 1.00.83 and prior, and the accompanying, ScreenEditor Version 1.00.54 are affected. Exploitation of both vulnerabilities cause the software to crash due to the failure to validate user input. Currently there are no known public exploits; however, this vulnerability is remotely exploitable, and could be successfully exploited by an attacker with a low skill level.
Mozilla has released a security update to address vulnerabilities in Thunderbird. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The NCCIC encourages users and administrators to review the Mozilla Security Advisory for Thunderbird 60 and apply the necessary update. NCCIC/US-CERT
The NCCIC is aware of a Linux kernel vulnerability affecting Linux versions 4.9 and greater. A remote attacker could exploit this vulnerability to cause a denial-of-service condition against a system with an available open port. The NCCIC encourages users and administrators to review the Vulnerability Note VU #962459 and apply the necessary updates. NCCIC/US-CERT
Drupal has released a security update addressing a vulnerability in Drupal 8.x. A remote attacker could exploit this vulnerability to take control of an affected system. The NCCIC encourages users and administrators to review Drupal's Security Advisory and apply the necessary update. NCCIC/US-CERT
The FBI has released an article on building a digital defense against a fraud that uses Facebook’s texting app—Facebook Messenger. Scammers send messages that appear to be from trusted sources or trick users into clicking on malicious links or sharing personal information. Before clicking on links, users should verify the validity of the message with the sender outside of the app.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
