Google’s Threat Analysis Group (TAG) and Mandiant produced a first-ever joint report that digs into the zero-day vulnerabilities that were exploited in 2023 to better understand threat actor behavior and key trends. The report shows 97 zero-day vulnerabilities were exploited in 2023, 50 percent more than the 62 in 2022, but slightly less than the 106 peak in 2021.
Yesterday, the Federal Register posted for public comment CISA’s Notice of Proposed Rulemaking (NPRM), which the agency was required to develop by the “Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)”. The proposal describes when critical infrastructure organizations will be required to report cybersecurity incidents.
Today, WaterISAC is unveiling the first three of its newly updated 12 Cybersecurity Fundamentals for Water and Wastewater Utilities as part of a concerted effort to provide the sector with the most up-to-date guidance (see attached). At the WaterISAC Cyber Resilience Briefing yesterday, Gus Serino, President at I&C Secure, walked attendees through the first three of the Fundamentals and gave a high-level overview of their importance and practical application.
WaterISAC is sharing this for your situational awareness. Last week, Anne Neuberger, Deputy National Security Advisor for Cyber and Emerging Technologies and Janet McCabe, EPA Deputy Administrator, met with state and local officials from across the country to discuss cybersecurity in the water sector. This meeting was initiated by EPA Administrator Michael Regan and National Security Advisor Jake Sullivan after they sent a letter to U.S. Governors.
The following posts are useful for general awareness of current cyber threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.
Critical Infrastructure
Throughout the decade, ransomware has become a prime method for attackers and one of the most impactful on victims. Threat actors don’t seem to discriminate, with attacks spanning all kinds of industries, both large and small. Regardless of the size or type of organization, when incidents occur there are always practical lessons that everyone can learn from to bolster your own resilience against similar attacks.
CISA ICS Vulnerability Advisories and Alerts, Updates, and Bulletins – March 26, 2024
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:
ICS Vulnerability Advisories:
CISA and the FBI released a joint Secure by Design Alert, Eliminating SQL Injection Vulnerabilities in Software. The alert came in response to a recent exploitation of SQL injection in a managed file transfer application (MOVEit) that affected thousands of organizations.
As Phishing-as-a-Service (PhaaS) offerings continue lowering the barrier to entry for low-skilled threat actors, “Adversary-in-the-Middle” (AitM) attacks have become much less technical to execute. Open-source toolkits make phishing campaigns accessible to the most novice threat actors. With such frameworks, actors can easily create custom Microsoft365 login pages and mimic other popular websites such as Amazon, Google, LinkedIn, Facebook, and X (formerly Twitter) to conduct opportunistic or highly targeted phishing campaigns.
As data breaches continue to impact organizations at an ever-increasing rate, the importance of effective cyber incident response is more important than ever. WaterISAC is sharing resources and tools to help utilities prepare for and implement this crucial aspect of organizational security.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
