Cybersecurity

Threat Awareness – New USB Malware Variant Utilizes Novel Method of Obfuscation

Palo Alto Networks published a blog discussing research by its Unit 42 of a newly discovered variant of PlugX malware. This variant has a few unique capabilities, including the ability to hide itself within a USB using a novel technique that’s effective on the current Windows OS and that can only be detected using specialized forensic tools. It then copies all Adobe PDF and Microsoft Word files from the attached machine and spreads to any other removable drives (e.g., floppy, thumb, or flash) connected to the system.

Read more about Threat Awareness – New USB Malware Variant Utilizes Novel Method of Obfuscation

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins - January 26, 2023

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:

ICS Vulnerability Advisories:

Read more about CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins - January 26, 2023

Threat Awareness – Threat Actors Exploiting Microsoft OneNote Attachments to Spread Malware

Attackers are now exploiting Microsoft OneNote attachments in phishing emails to compromise users with remote access malware, which are likely to be used to deliver additional malware, steal credentials, and other financial information.

Read more about Threat Awareness – Threat Actors Exploiting Microsoft OneNote Attachments to Spread Malware

Threat Awareness – Emotet Employing New Tactics to Evade Detection and Infect more Victims

Once again, the infamous Emotet malware re-emerges with new evasion tactics to increase its chances of remaining undetected and propagate to more victims. As a reminder, successful Emotet attacks typically lead to the delivery of additional malware, including ransomware.

Read more about Threat Awareness – Emotet Employing New Tactics to Evade Detection and Infect more Victims

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins - January 24, 2023

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:

ICS Vulnerability Advisories:

XINJE XD - Product Used in the Energy Sector
SOCOMEC MODULYS GP - Product Used in the Energy Sector

Alerts, Updates, and Bulletins:

Read more about CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins - January 24, 2023

Threat Awareness – Actors Using DocuSign Theme with a Malicious Blank Image File

Avanan posted a blog covering its research into what they are calling the “Blank Image Attack,” a newly observed technique where attackers place an empty image file within an HTML file. In the wild, Avanan researchers observed the following steps to the attack. First, the victim is prompted to download an HTML file attached to a spoofed DocuSign lure. This file only consists of a blank SVG image that contains code which automatically redirects the victim to a malicious website – giving the victim the impression that nothing happened.

Read more about Threat Awareness – Actors Using DocuSign Theme with a Malicious Blank Image File

Threat Awareness – Microsoft’s Default Blocking of Macros Creates Threat Actor Shift to LNK Files

Cisco Talos posted a blog covering its research into threat actor activity in the aftermath of Microsoft’s July 2022 action of blocking all VBA macros by default in documents downloaded from the internet. This action mitigated a common technique frequently used by attackers to gain access to networks and devices.

Read more about Threat Awareness – Microsoft’s Default Blocking of Macros Creates Threat Actor Shift to LNK Files

Cyber Preparedness – CISA Updates Best Practices for Mapping to MITRE ATT&CK®

On Tuesday, the Cybersecurity and Infrastructure Security Agency (CISA) updated its Best Practices Guide for MITRE ATT&CK® Mapping. CISA uses ATT&CK as a lens through which to identify and analyze adversary behavior. ATT&CK provides details on 100-plus threat actor groups, including the techniques and software they are known to use.

Read more about Cyber Preparedness – CISA Updates Best Practices for Mapping to MITRE ATT&CK®

Threat Awareness – Threat Actors Infecting Victims Via Ads on Google Search

To improve the chances of infecting more victims, threat actors are increasingly exploiting the Google Ads platform to push malicious downloads and spread malware via search results.

Read more about Threat Awareness – Threat Actors Infecting Victims Via Ads on Google Search

NSA Publishes Internet Protocol Version 6 (IPv6) Security Guidance

The National Security Agency (NSA) published guidance today to help the Department of Defense (DoD) and other system administrators identify and mitigate security issues associated with a transition to Internet Protocol version 6 (IPv6). “IPv6 Security Guidance” highlights how several security issues can surface in networks that are new to IPv6, or in early phases of the IPv6 transition. Networks new to IPv6 lack maturity in IPv6 configurations and tools, and dual-stacked networks, which run on IPv4 and IPv6 simultaneously, have an increased attack surface.

Read more about NSA Publishes Internet Protocol Version 6 (IPv6) Security Guidance

You are here

Cybersecurity

Threat Awareness – New USB Malware Variant Utilizes Novel Method of Obfuscation

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins - January 26, 2023

Threat Awareness – Threat Actors Exploiting Microsoft OneNote Attachments to Spread Malware

Threat Awareness – Emotet Employing New Tactics to Evade Detection and Infect more Victims

CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins - January 24, 2023

Threat Awareness – Actors Using DocuSign Theme with a Malicious Blank Image File

Threat Awareness – Microsoft’s Default Blocking of Macros Creates Threat Actor Shift to LNK Files

Cyber Preparedness – CISA Updates Best Practices for Mapping to MITRE ATT&CK®

Threat Awareness – Threat Actors Infecting Victims Via Ads on Google Search

NSA Publishes Internet Protocol Version 6 (IPv6) Security Guidance

Pages

You are here

Cybersecurity

Pages

Footer Email Signup