Cybersecurity

Bleeping Computer has written an article covering research from a SEKOIA analyst regarding a Vidar malware campaign involving 1,300 domains impersonating the AnyDesk brand. Victims are likely directed to these domains through a phishing campaign or search engine results and are then  redirected to a DropBox folder to download the Vidar malware disguised as an AnyDesk installer. Vidar malware capabilities include copying browser histories, account credentials, passwords, cryptocurrency wallets, and banking data to send to its controller for further malicious use.

Creating incident response plans that define how utilities plan to respond during cyber incidents is crucial for allowing organizations to better recover from potential cyber attacks.

An effective cyber incident response plan (IRP) will limit damage to an organization’s operations and reduce recovery time and costs. Most importantly, IRPs need to be in place and tested before a cyber incident. In other words, regularly exercising the IRP is crucial.

Besides creating an IRP there are a few tips organizations can implement to strengthen response and recovery efforts:

In August, WaterISAC reported on a phishing campaign pretending to be from the Massachusetts Department of Environmental Protection (EPA Region 1). The campaign was specifically targeting utilities in Massachusetts with a request to verify the PWS information that the threat actor included in the email.

Cyble has posted a blog discussing its analysis of a recently discovered phishing campaign targeting Zoom in order to deliver IcedID malware, also known as BokBot. This malware is a banking trojan whose purpose is to steal banking credentials from victims. IcedID also functions as a loader capable of downloading further malware (including ransomware) and is commonly associated with the Emotet botnet. IcedID has been observed traditionally targeting businesses to steal payment information using compromised Office attachments.