Reflecting on Recorded Future’s finding that there’s been a dramatic increase in the number of cyber attacks against local governments over the past several years, particularly in terms of ransomware in 2019, IBM’s Security Intelligence writes about why it is that municipal organizations are such attractive targets for threat actors.
The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has published an alert summarizing an incident to which it recently responded. The attack affected the control and communications assets on the operational technology (OT) network of a natural gas compression facility. The incident began with a spearphishing attack that provided access to the information technology (IT) network, from which the attacker pivoted to the OT network. The attacker then deployed ransomware on both networks.
CISA has published an advisory on an improper privilege management vulnerability in Honeywell INNCOM INNControl 3. Versions 3.21 and prior are affected. Successful exploitation of this vulnerability could allow an attacker to escalate user privileges within the INNControl application. Honeywell encourages users to contact an INNCOM sales representative or authorized systems integrator to obtain information on upgrading their system(s) to the latest version.
CISA has published an advisory on a heap-based buffer overflow vulnerability in Emerson OpenEnterprise SCADA Server. OpenEnterprise Server 2.83 is affected if Modbus or ROC Interfaces have been installed and are in use; all versions of OpenEnterprise 3.1 through 3.3.3 are also affected. Successful exploitation of this vulnerability could allow an attacker to execute code on an OpenEnterprise SCADA Server. Emerson recommends all users upgrade to OpenEnterprise 3.3, Service Pack 4 (3.3.4), to resolve this issue. CISA also recommends a series of measures to mitigate the vulnerability.
The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Department of Defense have provided new and updated information on malicious cyber activity by the North Korean government. In six new Malware Analysis Reports (MARs), these agencies discuss and provide technical information for Trojan malware variants used by the North Korean government. The new Trojan malware variants include BISTROMATH, SLICKSHOES, HOTCROISSANT, ARTFULPIE, BUFFETLINE, and CROWDEDFLOUNDER.
While there were not a lot of changes and expectations in ICS cybersecurity overall for 2019 and 2020, IBM observed, what it cites as, “explosive growth in OT infrastructure targeting” in 2019.
CISA has published an advisory on an improper check for unusual or exceptional conditions vulnerabilities in Schneider Electric Magelis HMI Panels. All firmware versions of multiple products are affected. Successful exploitation of this vulnerability could allow a denial-of-service condition. Schneider Electric recommends users set up network segmentation and implement a firewall to block all unauthorized access to Ports 44818/TCP, 502/TCP, 6000/TCP, 6002/TCP, 8080/TCP, 8014/TCP, and 6001/TCPP. CISA also recommends a series of measures to mitigate the vulnerability.
CISA has published an advisory on improper check for unusual or exceptional conditions and improper access control vulnerabilities in Schneider Electric Modicon BMXNOR0200H. All firmware versions are affected. Successful exploitation of these vulnerabilities could limit system availability. Schneider Electric recommends users set up network segmentation and implement a firewall to block all unauthorized access to Port 2404/TCP and SNMP Port 161/UDP. CISA also recommends a series of measures to mitigate the vulnerabilities.
The last calendar year saw both the highest number of complaints and the highest dollar losses reported to the FBI’s Internet Crime Complaint Center (IC3), according to an annual report just published by the group. In the 2019 Internet Crime Report, the IC3 notes it received 467,361 complaints in 2019 and recorded more than $3.5 billion in losses to individual and business victims. The report describes some of the new tactics and techniques criminals deployed to carry out existing scams.
CISA has published an advisory on unrestricted upload of file with dangerous type and cross-site scripting vulnerabilities in Digi International ConnectPort LTS 32 MEI. Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2 is affected. Successful exploitation of these vulnerabilities could limit system availability. Digi recommends users upgrade to the mandatory release of ConnectPort LTS Version 1.4.5, released on November 8, 2019. Additionally, it recommends a series of best practices. CISA also recommends a series of measures to mitigate the vulnerabilities.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
