Attacks

To protect against attacks such as this, organizations should:• Configure email clients to notify users when emails originate from outside the organization.• Focus on cyber security awareness and training.• Regularly provide users with training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.• Ensure Office applications are configured to disable all macros without notification.• Pay special attention to warning notifications in email clients and Office applications.• Implement monitoring of…

Individuals who were affected by this incident should consider following these steps: 1. Take advantage of the identity theft protection services offered by the university. This will help monitor any suspicious activity related to personal information.2. Monitor financial accounts and credit reports regularly. Look for any unauthorized activity or changes to credit reports that aren’t recognized.3. Change passwords for any accounts that use the same password as the Stanford University account. Use strong, unique passwords…

The hijacking of x64dbg to load PlugX was discovered last month by Palo Alto Networks Unit 42, which discovered a new variant of the malware that hides malicious files on removable USB devices to propagate the infection to other Windows hosts. Persistence is achieved by changing the Windows Registry and setting up scheduled processes to maintain access. Trend Micro’s analysis also revealed the use of x32dbg.exe to deploy a backdoor, a User Datagram Protocol (UDP)…

All macOS users are highly recommended to not download or use pirated apps that claim to be an authentic app at a highly discounted rate. When researching apps, users should only download the app from the legitimate Apple store and from the original author of the app. https://thehackernews.com/2023/02/hackers-using-trojanized-macos-apps-to.html

The threat of leaking data if a ransom is not paid is a common tactic amongst ransomware actors. In this case, the group would still leak data even if ransom was paid. By using this model, the group was setting themselves up to not get paid by anyone because there would be no benefit to paying. Although this is a risk taken by companies paying a ransom, most groups do not follow this model to…

This new recommendation from Microsoft demonstrates how adding over-encompassing AV exclusions can negatively impact and organization’s security. Especially in the current threat landscape, many actors make use of PowerShell and malicious IIS extensions to perform their attacks. Having these exclusions in place allows for a large gap in visibility where the threat actors can go unnoticed. On top of removing these exclusions and following the other recommendations from Microsoft, it is also recommended to frequently…

Although no one has claimed responsibility for the attack, if one actually took place, it is likely it was carried out by a pro-Ukrainian hacktivist group. Hacktivist groups have carried out multiple attacks on behalf of both Ukraine and Russia over the course of the conflict. Even though President Putin continues to erroneously blame the West and Ukraine for Russia’s invasion, multiple reports identified Russian backed cyber-attacks on Ukrainian organizations in the months leading up…

Social media sites like Facebook are common vectors for threat actors to spread malware. Due to this, it is highly recommended to avoid downloading files from social media sites, particularly in cases where the source is unknown or untrusted. Even from known sources, it is recommended to carefully vet any links or files that are shared, as the source could be compromised. It is also recommended to maintain good endpoint security controls on all devices…

This situation highlights the potential impact of cyber attacks on the food supply chain, which is a critical infrastructure that requires secure and resilient systems. The disruption of food supplies can have severe consequences for public health and safety, as well as economic and social stability. The continuance of ransomware attacks against businesses that are part of critical infrastructure emphasizes the need for organizations to continue to invest in cybersecurity and risk management processes, people,…