The Cybersecurity and Infrastructure Security Agency (CISA) has released Best Practices for MITRE ATT&CK Mapping, which shows analysts how to map adversary behavior using this framework through instructions and examples. The MITRE ATT&CK framework helps facilitate understandings of adversary behavior to help identify defensive gaps, assess security tool capabilities, hunt for threats, and more.
The Domain Name System (DNS) is the backbone of the internet and is what makes navigating to websites and sending emails seamless to humans. Unfortunately, like many internet protocols, DNS is also abused by threat actors – from exploiting user domain name typos to transmitting malicious data over what appears to be legitimate and expected DNS network traffic. The U.S. National Security Agency (NSA) Central Security Service has released an InfoSheet on adopting encrypted (protective) DNS in enterprise environments.
While cyber insurance has matured during the past few years, there are still many lesser understood facets, especially OT needs and requirements. In a recent post, Verve Industrial poignantly states, even as threats to critical controls systems grow exponentially, cyber insurance underwriters have been slow to update rating tables to incorporate growing cyber-physical risks. Organizations, likewise, often fail to adequately account for OT/ICS risks and basic controls in their overall assessment strategies.
Another exploitation opportunity is taking advantage of still unpatched on-premise Microsoft Exchange servers. Last week, Sophos discovered a new ransomware strain, calling itself Epsilon Red that was observed targeting a U.S.-based company in the hospitality sector. According to Sophos, it isn’t clear whether the attack was enabled by the ProxyLogon exploit or another vulnerability, but it seems likely that the root cause was an unpatched server.
A recent threat research post by Mandiant Threat Intelligence highlights the increasing frequency of OT compromises by low sophistication threat actors. The majority of these compromises occur due to insecure OT systems exposed to the internet. According to Mandiant’s report, the compromises appear to be driven by threat actors who are motivated to achieve ideological, egotistical, or financial objectives by taking advantage of an ample supply of internet-connected OT systems.
Given how ransomware has evolved, regular system backups no longer protect against these attacks like they once did, as an article in Tech Radar points out. Backups may still help organizations restore their systems quickly, but they don’t address ransomware threat actors’ latest tactic of exfiltrating data that they then threaten to sell or publicly release if the victim doesn’t pay the ransom. Referred to as the “double extortion” of “encrypt and exfiltrate,” a recent Coveware study found that 77 percent of ransomware attacks involve these tactics.
The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have issued an alert regarding a sophisticated spearphishing campaign targeting government organizations, intergovernmental organizations (IGOs), and non-governmental organizations (NGOs). They note a sophisticated cyber threat actor leveraged a compromised end-user account from Constant Contact, a legitimate email marketing software company, to spoof a U.S.-based government organization and distribute links to malicious URLs.
Microsoft has released an alert describing a sophisticated email-based campaign that NOBELIUM has been operating to help users and administrators understand and protect from this latest activity (Microsoft identifies NOBELIUM as the threat actor responsible for the SolarWinds Orion platform compromise).
According to countless reports of risk assessments, vulnerability assessments, penetration tests, and disclosed incidents, organizations of all sizes and sectors are not doing well with basic cybersecurity. The reasons why (excuses) vary from entity to entity, but what shouldn’t be an excuse is cost. Cybersecurity doesn’t have to cost a lot of money. Granted, at some point you’ll want/need or have the budget for the next shiny thing, but that currently elusive shiny thing should not stop anyone from embracing a lot of the best practice guidance already out there – for no cost.
Cyber insurance has been in the news a lot lately, especially insurers – some being attacked and subsequently paying millions, to others declaring they will no longer cover ransomware claims and subsequently being attacked.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
