Cybersecurity

Securonix has written a blog post describing an observed brute-force attack against Microsoft SQL servers to deploy Cobalt Strike and FreeWorld ransomware. The organization’s researchers found this attack interesting due to the relative sophistication of its tooling, infrastructure, and payloads.

As people become more aware of phishing attacks, threat actors are constantly evolving their social engineering tactics to continue to compromise victims. To help organizations stay ahead of the latest phishing tactics, Cofense has written a report highlighting threat actors’ use of misleading dates in subject lines to influence the emotions of recipients and create a false sense of urgency. 

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:

ICS Vulnerability Advisories:

CISA Releases Four Industrial Control Systems Advisories

Products are used across multiple sectors, please check these latest advisories for specific equipment used across your ICS environments and address accordingly.

CISA and the FBI have released a joint Cybersecurity Advisory (CSA), Identification and Disruption of QakBot Infrastructure, to help organizations detect and protect against newly identified QakBot-related activity and malware. Originally used as a banking trojan to steal banking credentials for account compromise, QakBot has since grown to deploy multiple types of malware, trojans, and highly-destructive ransomware variants targeting the U.S.