You are here

Home » Cybersecurity

Cybersecurity

Australian Advisory: Mailto Ransomware Incidents

The Australian Cyber Security Centre (ACSC) has published an advisory noting that it is aware of recent ransomware incidents involving a ransomware tool known as “Mailto” or “Kazakavkovkiz.” The ACSC has limited information regarding the initial intrusion vector for Mailto, but evidence suggests that phishing and password spray attacks have been used to compromise user accounts. The ACSC advisory provides recommendations for users to detect and mitigate these types of attacks and assist with limiting their spread within networks.

Business Email Compromise – Don’t Forget About Your Vendors (VEC)

Email security firm Agari posted an article reminding us how the attack surface from the scourge known as business email compromise (BEC) is larger than we may think. Agari points out the need to protect against the compromised supply chain, in what is referred to as vendor email compromise (VEC). With the majority of phishing emails we receive impersonating trusted suppliers, it is imperative that organizations are intentional about securing their supply chain.

FBI Director Says HVEs, Domestic Extremists, and FTOs Are Most Persistent Terrorist Threat to U.S.

In testimony before the U.S. House Judiciary Committee yesterday, FBI Director Christopher Wray identified the most persistent terrorism threats to the U.S. as homegrown violent extremists (HVEs), domestic extremists, and foreign terrorist organizations (FTOs). Drawing a link between two of the groups, he explained how FTOs have made extensive use of the Internet and social media to disseminate propaganda and training materials to attract and influence individuals in the U.S., giving rise to HVEs.

OpenSMTPD Vulnerability

The CERT Coordination Center (CERT/CC) has released information on a vulnerability affecting OpenSMTPD. An attacker could exploit this vulnerability to take control of an affected system. OpenSMTPD is an open-source server-side implementation of the Simple Mail Transfer Protocol (SMTP) that is part of the OpenBSD Project. CISA encourages users and administrators to review CERT/CC’s Vulnerability Note VU#390745 and apply the necessary updates.

EKANS Ransomware Has Direct Implications for ICS Operations, and It May Not Be the First

Until mid-2019, previous ICS-impacting ransomware had been limited to only IT-based mechanisms that enabled the propagation into control system environments. ICS cybersecurity firm Dragos assesses the newly disclosed EKANS ransomware (also reported as SNAKE) is not the first sample with direct ICS-impacting implications.

AutomationDirect C-More Touch Panels (ICSA-20-035-01) – Product Used in the Water and Wastewater and Energy Sectors

The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has published an advisory on an insufficiently protected credentials vulnerability in AutomationDirect C-More Touch Panels. Firmware versions prior to 6.53 are affected. Successful exploitation of this vulnerability may allow an attacker to get account information such as usernames and passwords, obscure or manipulate process data, and lock out access to the device. AutomationDirect recommends users upgrade to version 6.53.

Pages

Subscribe to Cybersecurity