Cybersecurity

New evidence indicates the threat actor associated with the RomCom backdoor is not only motivated by financial gain but is increasingly targeting entities likely for geopolitical purposes. Security researchers at Trend Micro assess that the use of the RomCom backdoor in recent attacks, including on water and energy utilities, suggests the threat actor’s motives have changed since October 2022.

The following posts are useful for general awareness of current threats, vulnerabilities, guidance, and other security-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.

Infosecurity Magazine has written an article discussing threat actors increasing use of password-protected files as an attack vector, while also providing methods to mitigate against this threat activity. This technique has become an increasingly popular way of delivering malware, as it allows threat actors to utilize filesharing channels beyond email, such as SMS, workplace collaboration tools, or social media messaging, to drop payloads.

Threat actors have recently been observed utilizing encrypted attachments sent via compromised Microsoft 365 accounts to steal Microsoft credentials in targeted phishing attacks designed to evade detection by email security gateways, according to security researchers at Trustwave.