The NCCIC has provided a Malware Analysis Report (MAR) of KEYMARBLE, a Trojan malware variant used by HIDDEN COBRA. The U.S. government refers to all malicious cyber activity by the North Korean government as HIDDEN COBRA. This MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended mitigation techniques.
Social engineering is commonplace, convincing, and requires continuous consideration. Dr. Larry Ponemon, founder and chairman of Ponemon Institute, discusses the ever-present social engineering threats. He covers three key elements of every organization’s cybersecurity program – people, processes, and technology – and how they fit into combatting these threats.
In direct response to inquiries from stakeholders, DHS/NPPD launched a new website today focused on providing the critical infrastructure community with information on the principles of insider threat mitigation. The website is dedicated to assisting organizations in establishing internal capabilities to mitigate insider threats focused on a variety of topics, including ideology, workplace violence, and cybersecurity.
The NCCIC has released an advisory regarding multiple stack-based buffer overflows, and out-of-bounds read vulnerabilities affecting Delta Electronics CNCSoft and ScreenEditor products. CNCSoft Version 1.00.83 and prior, and the accompanying, ScreenEditor Version 1.00.54 are affected. Exploitation of both vulnerabilities cause the software to crash due to the failure to validate user input. Currently there are no known public exploits; however, this vulnerability is remotely exploitable, and could be successfully exploited by an attacker with a low skill level.
Mozilla has released a security update to address vulnerabilities in Thunderbird. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The NCCIC encourages users and administrators to review the Mozilla Security Advisory for Thunderbird 60 and apply the necessary update. NCCIC/US-CERT
The NCCIC is aware of a Linux kernel vulnerability affecting Linux versions 4.9 and greater. A remote attacker could exploit this vulnerability to cause a denial-of-service condition against a system with an available open port. The NCCIC encourages users and administrators to review the Vulnerability Note VU #962459 and apply the necessary updates. NCCIC/US-CERT
Drupal has released a security update addressing a vulnerability in Drupal 8.x. A remote attacker could exploit this vulnerability to take control of an affected system. The NCCIC encourages users and administrators to review Drupal's Security Advisory and apply the necessary update. NCCIC/US-CERT
The FBI has released an article on building a digital defense against a fraud that uses Facebook’s texting app—Facebook Messenger. Scammers send messages that appear to be from trusted sources or trick users into clicking on malicious links or sharing personal information. Before clicking on links, users should verify the validity of the message with the sender outside of the app.
The FBI has released a new Public Service Announcement (I-080218-PSA) on the risks associated with internet-connected devices, commonly referred to as the Internet of Things (IoT). The FBI warns that cyber threat actors can use unsecured IoT devices as proxies to anonymously pursue malicious cyber activities to further perpetuate fraud and other illegal activity.
While the value of asset inventory usually goes unchallenged, it is still surprising how few organizations are doing it effectively. World renowned Stuxnet and ICS cybersecurity expert, Ralph Langner discusses the importance of OT/ICS asset inventory, along with the differences between passive scanning and selective probing. Mr. Langner concisely describes what is technically meant by passive scanning, as well as its limitations, including devices and characteristics that will likely not be detected.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
