You are here

Home » Cybersecurity

Cybersecurity

Threat Awareness – AnyDesk-Themed Campaign Infecting Victims with Information-Stealing Malware

Bleeping Computer has written an article covering research from a SEKOIA analyst regarding a Vidar malware campaign involving 1,300 domains impersonating the AnyDesk brand. Victims are likely directed to these domains through a phishing campaign or search engine results and are then  redirected to a DropBox folder to download the Vidar malware disguised as an AnyDesk installer. Vidar malware capabilities include copying browser histories, account credentials, passwords, cryptocurrency wallets, and banking data to send to its controller for further malicious use.

Threat Awareness – Ransomware Group Returns to Leverage Backdoor Implanted Prior to Patch

Bleeping Computer has written an article discussing recently discovered activity by the Lorenz ransomware gang in relation to a Mitel MiVoice vulnerability (CVE-2022-29499) publicized in 2022 and included on CISA’s Known Exploited Vulnerabilities Catalog in June. While Mitel released a patch for the vulnerability in a timely manner, researchers from S-RM determined that the Lorenz group was already exploring and exploiting vulnerable networks at least a week ahead of the patch release.

Cyber Resilience – Tips for Improving your Incident Response Plan

Creating incident response plans that define how utilities plan to respond during cyber incidents is crucial for allowing organizations to better recover from potential cyber attacks.

An effective cyber incident response plan (IRP) will limit damage to an organization’s operations and reduce recovery time and costs. Most importantly, IRPs need to be in place and tested before a cyber incident. In other words, regularly exercising the IRP is crucial.

Besides creating an IRP there are a few tips organizations can implement to strengthen response and recovery efforts:

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins - January 10, 2023

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:

ICS Vulnerability Advisories:

Alerts, Updates, and Bulletins:

  • None

Threat Advisory – Phishing Campaign Mimicking Primacy Agency Data Validation Request Resurfaces

In August, WaterISAC reported on a phishing campaign pretending to be from the Massachusetts Department of Environmental Protection (EPA Region 1). The campaign was specifically targeting utilities in Massachusetts with a request to verify the PWS information that the threat actor included in the email.

Vendor Risk Management – Using MSPs to Administer Your Cloud Services

The UK’s National Cyber Security Centre (NCSC) posted a blog covering the topic of Managed Service Providers (MSPs) and the risk they pose to an organization. While MSPs can reduce the organizational responsibilities for operating cloud capabilities, the article argues that security responsibilities still remain relevant, albeit shifted. It discusses how security teams need to assess their expanded third party risk before and after procuring a contract.

Threat Awareness – IcedID Banking Trojan Changes Strategy to Zoom Phishing Sites

Cyble has posted a blog discussing its analysis of a recently discovered phishing campaign targeting Zoom in order to deliver IcedID malware, also known as BokBot. This malware is a banking trojan whose purpose is to steal banking credentials from victims. IcedID also functions as a loader capable of downloading further malware (including ransomware) and is commonly associated with the Emotet botnet. IcedID has been observed traditionally targeting businesses to steal payment information using compromised Office attachments.

Threat Awareness – Over 60,000 Exchange Servers Still Vulnerable to ProxyNotShell Flaws

Bleeping Computer posted an article reporting that more than 60,000 Microsoft Exchange servers have still not been patched against CVE-2022-41082. CVE-2022-41082 is one of the two CVEs that make up the exploit known as ProxyNotShell. For more information, access WaterISAC’s coverage included in the Security & Resilience Update on December 22, 2022 here.

Breach Awareness – Cyber Attack on Third-Party Digital Records Vendor Impacts Local Governments Across Nation

StateScoop has written an article discussing the impacts of a cyberattack against Cott Systems, a nationwide digital records management vendor reportedly utilized by approximately 400 local governments across 21 states. On December 26th, the company alerted customers that they had detected “unusual activity” on internal servers and were taking their network offline. Cott Systems has not yet provided a recovery timeline for its customers, but states that no customer data appears to be affected.

Pages

Subscribe to Cybersecurity