WaterISAC regularly provides awareness of recent CISA reporting. While direct relevance to your utility/organization on the details of each report may vary, activity alerts like this are practical for general awareness of active threats and adversary capabilities.
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
Weaponized Microsoft documents were a highly favored technique until Microsoft put the kibosh on macros in files received from the internet last year. As such, WaterISAC been tracking the various tactics threat actors have migrated to. According to Proofpoint, Microsoft’s action has resulted in a monumental shift in activity and threat behavior over the last year in a way not previously observed by threat researchers.
-by Jennifer Lyn Walker
Yesterday, CISA shared the release of a new white paper on Research, Development, and Innovation for Enhancing Resilience of Cyber-Physical Critical Infrastructure: Needs and Strategic Actions.
May 11, 2023
Previously Patched Microsoft Outlook Zero-Day Can be Bypassed if New Update is not Applied
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
Sophos has released its The State of Ransomware 2023 report, which concludes that “independent of revenue, geography, or industry, ransomware continues to be major threat to organizations.” Sophos supports this conclusion with that fact that the number of ransomware victims whose data was encrypted by their victimizer has grown to 76 percent, the highest the report has seen since it began in 2020.
Recent analysis by Malwarebytes highlights how threat actors continue leveraging malvertising in various ways to proliferate malware. Malwarebytes posted a blog discussing a recently observed advertising campaign directing victims to download a new loader labeled Invalid Printer, which later delivers Aurora malware as a payload. The attack begins as users click on a potentially risky ad, which redirects them to a full-screen browser window mimicking a Windows security update.
It’s been two years since the ransomware attack on the Colonial Pipeline, which many observers view as a watershed moment in cybersecurity. While many positive strides have been made since the attack, which CISA details in a recent blog post, other analysts argue the threat from ransomware is still growing and impacting critical infrastructure organizations.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
