Cybersecurity

The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Department of Defense have provided new information on malicious cyber activity by the North Korean government. In three new Malware Analysis Reports (MARs), these agencies discuss and provide technical information for three malware variants used by the North Korean government: COPPERHEDGE, TAINTEDSCRIBE, and PEBBLEDASH. In addition to providing malware descriptions, the MARs contain suggested response actions and recommended mitigation techniques.

In the Security & Resilience Update for March 31, 2020, WaterISAC reported on research related to the potential for more Stuxnet-style attacks against PLCs. Airbus Cybersecurity reported a similar Stuxnet-like vulnerability in Schneider Electric’s EcoStruxure Control Expert engineering software.

CISA has published an advisory on cross-site scripting and path traversal vulnerabilities in SAE IT-systems FW-50 Remote Telemetry Unit (RTU). FW-50 RTU, Series: 5 Series; CPU-type: CPU-5B; Hardware Revision: 2; CPLD Revision: 6 is affected. Successful exploitation of these vulnerabilities may allow an attacker to execute remote code, disclose sensitive information, or cause a denial-of-service condition. SAE IT-systems has provided options for addressing these vulnerabilities. CISA also recommends a series of measures to mitigate the vulnerabilities.

The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has published a joint Alert with its U.K. counterpart, the National Cyber Security Centre (NCSC), warning that they continue to see indications advanced persistent threat (APT) groups are exploiting the COVID-19 pandemic. Although the Alert highlights activity by these actors against the healthcare sector, it also notes that other sectors, especially those that provide essential services during the pandemic, are being targeted. Targeted sectors include those associated with local governments.