Cybersecurity

Security researchers have observed the Qbot/Qakbot botnet distributing malware payloads via a new delivery method. The technique involves sending a phishing email that includes a password-protected ZIP archive attachment containing malicious MSI Windows Installer packages. Qakbot, which WaterISAC has reported on numerous times, is a highly modular malware used for many malign activities such as credential harvesting and dropping ransomware.

Security Intelligence has posted a blog discussing the continued prevalence of remote work and detailing the various components of endpoint security that cybersecurity professionals should be aware of as they mature their endpoint protections to meet this new security landscape. The author reviews over a dozen concerns that network defenders should consider in order to have a truly robust defense, from VPNs to EDR solutions.

If your utility has been putting off participating in a tabletop exercise (TTX) because it seems too resource-consuming, CISA has an alternative. Similar to its CTEPs (CISA Tabletop Exercise Packages), CISA released a new toolkit called the “Secure Tomorrow Series” designed to be self-facilitated and completed with fewer staff in less time.

Security researchers have identified a new remote access trojan (RAT) malware, dubbed Borat, available on criminal marketplaces which allows threat actors to deploy ransomware, conduct DDoS attacks, user account control (UAC) bypass, and more. It is unknown if Borat is sold or shared for free among cyber criminals, but researchers note the malware is distributed as a highly modular comprehensive package allowing criminals to mix and match technical exploits that can be tailored for targeted attacks.