Security researchers at Trend Micro recently published a comprehensive report on the BlackCat ransomware group. BlackCat is one of the most active ransomware groups today, operating as a ransomware as a service (RaaS) model and targeting organizations in virtually every critical infrastructure sector.
Brand impersonation attacks, when adversaries attempt to mimic the website or domain of a well-known brand by using a similar domain name and webpage designed like the actual site, remain one of the most deceptive forms of phishing. A recent report from the IT company Check Point identifies the top brands criminals impersonated in brand phishing attacks in the third quarter of 2022.
Blackberry has published its findings from a survey of around 1,500 IT leaders in the U.S., the U.K., and Australia. A major observation is that four out of five organizations have been made aware that they’ve suffered from a supply chain vulnerability or attack in the past twelve months.
This week, the U.K.’s National Cyber Security Centre (NCSC) released its annual cybersecurity review, covering September 2021 to August 2022. The review states that over the past year, the cybersecurity threats to the U.K. have evolved significantly.
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
Alerts, Updates, and Bulletins:
Today, the OpenSSL Project released patches for two high-severity security flaws in its open-source cryptographic library used to encrypt communication channels and HTTPS connections. The vulnerabilities (tracked as CVE-2022-3602 and CVE-2022-3786) affect OpenSSL version 3.0.0 and later and have been addressed in the latest version OpenSSL 3.0.7.
Microsoft Security has published a blog post describing the Raspberry Robin worm and how it connects to the larger ecosystem of professional malware in order for criminals to execute attacks. Microsoft’s researchers have observed multiple families of payloads being deployed on machines with Raspberry Robin infections, suggesting the group behind the worm is offering paid access to compromised networks. Notably, in October, Microsoft observed Raspberry Robin being used in post-compromise activity, which resulted in the deployment of Clop ransomware.
Yesterday, the Cybersecurity and Infrastructure Security Agency (CISA) published two fact sheets to highlight threats against accounts and systems using certain forms of multifactor authentication (MFA). The first fact sheet covers phishing-resistant MFA, which CISA calls the most secure form of MFA, and provides information on how organizations can implement it.
Last week, the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) published an updated guide, Understanding and Responding to Distributed Denial-of-Service Attacks, which provides organizations proactive steps to reduce the likelihood and impact of distributed denial-of-service (DDoS) attacks. The guidance is aimed towards both network defenders and leaders to help them understand and respond to DDoS attacks, which can cost an organization time, money, and reputational damage.
Today, the Cybersecurity and Infrastructure Security Agency (CISA) released the Cross-Sector Cybersecurity Performance Goals (CPGs), which consist of voluntary, fundamental cybersecurity practices for critical infrastructure owners and operators to meaningfully reduce the likelihood of known risks and adversary techniques.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
