Another vulnerability associated with Microsoft Exchange Server has been disclosed. The flaw, dubbed “ProxyToken,” allows remote attackers to bypass authentication and alter an Exchange email server’s backend configuration. This vulnerability could be exploited by a threat actor to copy all emails sent to a specified target account and then forward those emails to a separate account controlled by the attacker.
Users are not the only ones to suffer from password re-use across multiple sites, services, or devices. Unfortunately, many system administrators use the same passwords for local administrator access across all workstations for ease of technical support. But what’s good for the sysadmin, is also good for the threat actor who gains access to password hashes. Pen Test Partners (PTP) briefly discusses the issues with admin password re-use and suggests a more secure solution than using the same local admin password across all workstations.
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
The FBI has published another TLP:WHITE FLASH providing indicators of compromise associated with “Hive” ransomware. The Flash indicates that Hive ransomware, which was first discovered in June 2021 and likely operates as an affiliate-based ransomware campaign, primarily employs phishing tactics and remote desktop protocol (RDP) attacks to infiltrate a company’s network. After compromising a network, attackers exfiltrate data and encrypt files on the network before leaving a ransom note with further instructions.
WaterISAC convened its monthly Water Sector Cyber Threat Briefing on August 25. WaterISAC Infrastructure Cyber Defense Director Jennifer Lyn Walker presented.
Utilities using the following SSL VPN products within their environment are strongly encouraged to apply all available patches: Pulse Connect Secure SSL VPN, Fortinet Fortigate SSL VPN, and Citrix Application Delivery Controller (ADC), Gateway and SD-WAN WANOP.
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
Today, virtually everyone shops online and expects electronic notifications from package couriers regarding order status. That’s why a recently discovered phishing campaign, purporting to be an email from UPS, could have potentially traversed inboxes. The email states that the person’s package had an “exception” and directs them to download an invoice for pickup. Additionally, the email is filled with multiple legitimate links that mask its malicious intent.
The FBI has published a TLP:WHITE FLASH providing indicators of compromise associated with the “OnePercent Group” ransomware. According to the FBI, the OnePercent group has used Cobalt Strike to perpetrate ransomware attacks against U.S. companies since November 2020. The group compromises victims through a phishing email containing an attachment that infects the system with the IcedID banking trojan. IcedID downloads additional software, to include Cobalt Strike. Cobalt Strike then moves laterally in the network, primarily with PowerShell remoting.
Organizations that have still not addressed the Microsoft Exchange vulnerabilities from May 2021 and the PetitPotam vulnerability from July 2021 could find themselves victim to recent exploitation activity, including the deployment of ransomware. This past weekend, the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert warning Microsoft Exchange users to patch servers against actively exploited ProxyShell vulnerabilities.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
