Cybersecurity

The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Department of Defense have published a malware analysis report (MAR) about a malware variant used by Chinese government cyber actors, which is known as TAIDOOR. The FBI has high confidence that Chinese government actors are using malware variants in conjunction with proxy servers to maintain a presence on victim networks and to further network exploitation.

The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has announced it will convene the third annual National Cybersecurity Summit this year as a series of events in September and October. More specifically, the series will consist of a two-hour webinars every Wednesday for four weeks, beginning September 16 and ending October 7. The summit will focus on providing cybersecurity strategies, policies and/or initiatives that facilitate collaboration between the full range of government, defense, civilian, intelligence, and law enforcement entities.

As reported in the Security & Resilience Update on July 21, Emotet has arisen after its nearly six month snooze. At first it did not seem to be exhibiting any discernable new behavior as is typical for an Emotet awakening. But after more in-depth analysis researchers have since identified a new module designed to steal attachments.

CISA has published an advisory on heap-based buffer overflow and uncontrolled resource consumption vulnerabilities in Softing Industrial Automation OPC. All versions prior to the latest build of 4.47.0 are affected. Successful exploitation of these vulnerabilities could crash the device being accessed. A buffer-overflow condition may also allow remote code execution. Softing Industrial Automation has released an update to mitigate the reported vulnerabilities. CISA also recommends a series of measures to mitigate the vulnerabilities.