Continuous Monitoring and Protection
This list has always been kept away from the public eye. Now that it has been posted publicly and released, the U.S. government and TSA have all began investigation into the leak and into the threat actor behind the leak. The threat actor took their attack one step further by claiming to have pivoted from the AWS server into gaining access to more critical systems that would allow them to delay or cancel flights. Air…
Read MoreTo protect against ransomware attacks, organizations should:• Regularly back up data, air gap, and password protect backup copies offline.• Ensure copies of critical data are not accessible for modification or deletion• Implement network segmentation.• Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location.• Install updates/patch operating systems, software, and firmware as soon as possible.• Implement monitoring of security events on…
Read MoreThe VMware patch for vRealize is available now, and system administrators should update the software as soon as possible. Ensuring that vRealize is not exposed to the internet is also an important factor to consider. Below are the version details for the software patch: • VMware vRealize Log Insight◦ Fixed version: 8.10.2• VMware Cloud Foundation (VMware vRealize Log Insight)◦ Fixed Version: KB90668IOCs for potential exploitation of this vulnerability can be found here: https://www.horizon3.ai/vmware-vrealize-cve-2022-31706-iocs/ https://www.bleepingcomputer.com/news/security/researchers-to-release-vmware-vrealize-log-rce-exploit-patch-now/
Read MoreCyber Security Hub explores why and how hackers are targeting cryptocurrency investors. With more than 420 million cryptocurrency users, more than 12,000 cryptocurrencies worldwide and an estimated value of US$2.2bn by 2026, the digital currency marketplace is growing rapidly. This rapid growth, however, has made it a target for cyber attackers looking to defraud victims. Here, Cyber Security Hub explores the threat vectors used and vulnerabilities exploited by hackers specific to cryptocurrency-based cyber crime. Why…
Read MoreWiper malware can be a very destructive tool for threat actors when targeting a specific group or business. Although difficult to defend against, there are ways to make organizations less susceptible to these types of attacks. Some of these methods include: • Making sure malware protection and AV is up to date• Regularly creating secure offline backups• Train employees on how to spot phishing attempts and other forms of attacks• Install updates/patch operating systems, software,…
Read More“One of the primary reasons [threat actors] may be using Golang for their information stealer malware is because it allows them to easily create cross-platform malware that can run on multiple operating systems, such as Windows, Linux, and macOS. Additionally, the Go compiled binary files are small in size, making them more difficult to detect by security software,” reads Cyble’s technical analysis. The finding comes a little more than two months after SEKOIA announced Aurora…
Read MoreDDoS attacks can have devastating consequences if performed successfully. The use of the internet will not go away, and with the world increasingly going more digital, the likelihood of DDoS attempts will continue to grow. It is important to dedicate resources towards protecting against these types of attacks with a vigilant DDoS mitigation approach. Cyberattacks Target Websites of German Airports, Admin
Read MoreIt is highly recommended to install security patches on all Windows systems in an environment, particularly any that are exposed to the Internet. As vulnerabilities are discovered, maintaining a consistent patching cycle for devices can help reduce attack surface and prevent an environment from being breached. Threat actors have been known to still use fixed vulnerabilities that are months old, due to inconsistent patching among many systems around the world. It is also recommended to…
Read MoreThe authoring organizations encourage network defenders to:• Implement best practices to block phishing emails.• Audit remote access tools on your network to identify currently used and/or authorized RMM software.• Review logs for execution of RMM software to detect abnormal use of programs running as a portable executable.• Use security software to detect instances of RMM software only being loaded in memory.• Implement application controls to manage and control execution of software, including allow listing RMM…
Read MoreOriginal release date: January 27, 2023 The Internet Systems Consortium (ISC) has released security advisories that address vulnerabilities affecting multiple versions of the ISC’s Berkeley Internet Name Domain (BIND) 9. A remote attacker could exploit these vulnerabilities to potentially cause denial-of-service conditions and system failures. CISA encourages users and administrators to review the following ISC advisories CVE-2022-3094, CVE-2022-3488, CVE-2022-3736, and CVE-2022-3924 and apply the necessary mitigations. This product is provided subject to this Notification and…
Read More