Malicious actors are leaving no technique unturned as they continue to predictably use every conceivable method to wage their coronavirus-themed attack campaigns. While the ploys are the same, the deluge of themed attacks is unprecedented. Therefore, it should come as no surprise that malware authors would eventually develop successful disk wiping malware designed around a coronavirus theme.
CISA has published an advisory on improper privilege management, missing required cryptographic step, and path traversal vulnerabilities in B&R Automation Studio. Numerous versions of this product are affected. Successful exploitation of these vulnerabilities could allow an attacker to delete arbitrary files from this system, fetch arbitrary files, or perform arbitrary write operations. B&R recommends applying product updates or applying a series of workarounds until updates can be applied. CISA also recommends a series of measures to mitigate the vulnerabilities.
The FBI has published a public service announcement (PSA) indicating that it anticipates cyber actors will exploit increased use of virtual environments by government agencies, the private sector, and individuals as a result of the COVID-19 pandemic. In the PSA, the FBI states it has received more than 1,200 complaints related to COVID-19 scams and that cyber actors have engaged in phishing campaigns against first responders, launched DDoS attacks against government agencies, deployed ransomware at medical facilities, and created fake COVID-19 websites that quietly download malware.
The FBI has published a Private Industry Notification (PIN) advising that Sodinokibi ransomware actors have adopted new tactics with the potential to increase the number of victims. According to the PIN, these new tactics include examining data in compromised accounts for information that could provide leverage for extortion and searching for unpatched vulnerabilities in VPN servers to facilitate deployment of malware. These tactics mimic those of several other ransomware groups, including the one behind Maze.
ZoomBombing – it’s photo-bombing for virtual meetings. As countless citizens work and learn from home through virtual conferences, miscreants are trolling social media for open/public links to Zoom and other virtual meetings. There have been numerous reports of conferences being bombed with unsavory images and hate speech. Anyone publicly sharing virtual conference links on social media, such as Instagram/Twitter/Facebook and other mediums where they could be discovered by scoundrels should change screensharing to “Host Only” before a call begins.
Originally designed to target Siemens SIMATIC PLCs, researchers recently demonstrated vulnerabilities from Stuxnet-style exploits could also affect similar products from other vendors. According to the report, researchers at Airbus CyberSecurity determined that a vulnerability in Schneider Electric’s Modicon M340 and M580 PLCs can be exploited to upload malicious code by replacing one of the DLL files associated with the engineering software. The attack targeted the controller via Schneider’s EcoStruxure Control Expert engineering software, formerly known as Unity Pro.
CISA has published an advisory on an uncontrolled resource consumption vulnerability in Mitsubishi Electric MELSEC. All versions of MELSEC’s iQ-R, iQ-F, Q, L, and F series are affected. Successful exploitation of this vulnerability may render the device unresponsive. Mitsubishi Electric recommends some measures to mitigate the vulnerability. CISA also recommends a series of measures to mitigate the vulnerability. Read the advisory at CISA.
CISA has published an advisory on a classic buffer overflow vulnerability in Hirschmann Automation and Control HiOS and HiSecOS Products. The following devices using HiOS Version 07.0.02 and lower are affected: RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED. The following devices using HiSecOS Version 03.2.00 and lower are affected: EAGLE20/30. Successful exploitation of this vulnerability could allow an unauthenticated, remote attacker to overflow a buffer and fully compromise the device.
March 31, 2020
CISA has updated the vulnerability overview section of this advisory. Read the advisory at CISA.
January 16, 2020
The FBI has published a Private Industry Notification (PIN) on Kwampirs, a remote access Trojan the FBI says has heavily targeted several industries, including energy and the software supply chain. As described in the PIN, a campaign with Kwampirs employs a two-phased approach. The first phase establishes a broad and persistent presence on the targeted network, to include delivery and execution of secondary malware payload(s). The second phase includes the delivery of additional Kwampirs components or malicious payload(s) to further exploit the infected victim host(s).
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
