Cybersecurity

A recent report from security researchers at Blackberry has discovered an initial access broker, identified as Zebra2104, with links to cyber criminal groups and advanced persistent threat (APT) actors involved in ransomware and phishing activities. The report notes that after Zebra2104 gained initial access to a victim’s device or network and established a reliable backdoor into the network. The actor then advertised their access to these compromised systems on the Dark Web. Zebra2104 provided access to ransomware groups such as MountLocker and Phobos as well as the StrongPity APT.

Security researchers at Palo Alto Unit 42 and Microsoft have uncovered an unknown threat actor, tracked as DEV-0322, compromising systems using the ZOHO ManageEngine ADSelfService Plus software versions vulnerable to CVE-2021-40539 in a targeted campaign. The threat actor has successfully compromised at least nine global organizations in the energy and defense sectors, among others.

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:

ICS Vulnerability Advisories:

• VISAM VBASE Editor
• AzeoTech DAQFactory - Product Used in the Water and Wastewater and Energy Sectors

Alerts, Updates, and Bulletins:

Researchers at the cybersecurity firm Lookout have observed a notable uptick in mobile phishing attacks over the past year, specifically in the energy sector. Since the second half of last year, “there’s been a 161 [percent] increase in mobile phishing attacks targeting the energy sector,” and the energy sector accounts for around 17 percent of all mobile phishing attacks globally. The possibility of energy providers being compromised, and services rendered non-operational represents a risk across the critical infrastructure community because of cross-sector reliance on power.