• Skip to primary navigation
  • Skip to main content
nGuard

nGuard

Call us p. 704.583.4088
  • Solutions
    • Security Assessments
    • Compliance
    • Cyber Security Incidence Response
    • Penetration Testing
    • Managed Event Collection
    • Vulnerability Management
    • Red Teaming
    • Mobile Security
    • Cloud Security
  • Industries
    • Healthcare
    • Energy
    • Information Technology
    • Manufacturing
    • Defense
    • Banking
    • Insurance
    • Government
    • Transportation
    • Entertainment
    • Food & Beverage
  • About Us
    • Our Company
    • Careers
    • Blog
  • Contact
Client PortalSpeak to An Expert

critical infrastructure

TWiC: China Cyberattacks, ManageEngine Exploits, FBI Urges Barracuda Appliance Removal, Cyber Insurance

In this edition of This Week in Cybersecurity, we bring you a comprehensive overview of the latest developments and pressing concerns within cybersecurity. As threats continue to evolve, it is crucial to stay informed and prepared. Join us as we explore four pivotal topics that demand attention and action.

Hackers Exploit Barracuda Email Security Appliances: FBI Urges Immediate Removal

The FBI has issued a compelling alert urging the swift removal of compromised email security appliances manufactured by Barracuda Networks. This comes after Barracuda issued the same advice back in May, which was detailed in another nGuard Security Advisory. Despite patches designed to fix the exploited zero-day vulnerability (CVE-2023-2868), the FBI asserts that these patches have proven ineffective against suspected Chinese hackers. Organizations are strongly advised to remove all Barracuda Email Security Gateway (ESG) appliances promptly. This warning underscores the importance of vigilance and the evolving nature of cyber threats. To protect your organization from these attacks and stay informed of these new vulnerabilities as they are discovered, nGuard offers Vulnerability Scanning and Penetration Testing, along with Security Device Configuration Audit services that can help identify vulnerabilities, assess risks, and fortify your infrastructure against potential attacks.

Growing Concerns of Destructive Cyberattacks by China

Top U.S. cyber official, Jen Easterly, director of the U.S. Cybersecurity and Infrastructure Agency, has sounded an alarm about the potential for China to launch destructive cyberattacks on critical U.S. infrastructure in the event of escalated tensions. China’s hackers are reportedly positioning themselves for such actions, which represent a significant departure from their historical cyber espionage activities. nGuard has a wide range of experience helping organizations secure their critical infrastructure from Energy and Utilities, to Manufacturing, to Healthcare, to Government.

Cyber Insurance and the Nexus of Coverage and Protection

As cybersecurity evolves, the relationship between cybersecurity and insurance industries becomes increasingly intricate. Experts in the field gathered at the Def Con hacker conference to discuss the need for cyber insurance, its assessment, and its alignment with cybersecurity measures. Back in February, nGuard wrote about 5 new requirements that insurance companies need to issue policies. Security Awareness Training and Testing, Vulnerability Management, and 24/7/365 Monitoring were among the requirements listed. While cyber insurance offers financial protection, factors like calculating premiums and assessing risks are challenges that require attention. The role of cyber insurance as a motivator to enhance cybersecurity programs is emphasized, with a call to move quickly in preparing for potential cyberattacks.

Lazarus Hackers Exploit ManageEngine Vulnerability: New Threats Emerge

The North Korean state-backed Lazarus hacker group has capitalized on a critical ManageEngine ServiceDesk vulnerability (CVE-2022-47966) to compromise an internet backbone infrastructure provider and healthcare organizations. In early 2023, Lazarus exploited the flaw in multiple Zoho ManageEngine products to infiltrate a U.K. internet backbone provider, deploying the “QuiteRAT” malware and unveiling the newly discovered “CollectionRAT” remote access trojan (RAT). QuiteRAT, a potent malware discovered in February 2023, showcases enhanced capabilities compared to its predecessor, MagicRAT. CollectionRAT, linked to the “EarlyRAT” family and the Andariel subgroup, boasts sophisticated features, including on-the-fly code decryption using the Microsoft Foundation Class framework. Lazarus’ evolving tactics, employing open-source tools and frameworks, pose challenges for attribution and defense strategies. To safeguard against emerging threats, nGuard offers comprehensive Penetration Testing and Vulnerability Management services to assess vulnerabilities, enhance security, and mitigate risks.

The evolving nature of cyber threats demands taking proactive measures and forming strategic partnerships. As highlighted in the topics covered, cybersecurity is ever-changing where staying informed, prepared, and collaborating with experts is critical. At nGuard, we offer a suite of solutions designed to assist organizations in navigating this complex landscape. From incident response and vulnerability management to proactive security assessments, we are ready to enhance your security posture. The key to cybersecurity success lies in constant adaptation and continuous improvement.

Filed Under: Advisory, Breach, Compliance, Events, Financial, General, Products & Services, Vulnerabilities & Exploits Tagged With: Attribution Challenges, Barracuda Email Security, China Cyberattacks, Continuous Improvement, critical infrastructure, Cyber espionage, cyber insurance, Cyber Insurance Policies, Cyber Threats, cybersecurity, Cybersecurity Measures, Defense Strategies, Destructive Cyberattacks, Emerging Threats, FBI Alert, Hackers, Incident Response, Jen Easterly, Lazarus Hacker Group, Malware Analysis, ManageEngine Exploits, nGuard Security, Penetration Testing, Proactive Security, Risk assessment, Security Awareness, Threat intelligence, vulnerability management, Zero-day vulnerability

TWiC | Fortinet PoC, US Airport Sites Go Offline, CISA Warns of Industrial Appliance Flaws, & Windows 11 Phishing Protection

Over the past few weeks there have been several hot topics and time sensitive advisories released. In this edition of This Week in Cybersecurity, nGuard will highlight the Fortinet proof-of-concept (PoC) that was released; Russian-speaking hackers taking down US Airport websites; Windows 11 offering automatic phishing protection; and CISA warning of critical flaws in some industrial appliances.

Fortinet PoC Released
A proof-of-concept (PoC) exploit code has been made available for the recently disclosed critical security flaw affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager. A successful exploitation of the shortcoming is tantamount to granting complete access “to do just about anything” on the affected system. Fortinet issued an advisory urging customers to upgrade affected appliances to the latest version as soon as possible and CISA added this to their Known Exploited Vulnerabilities (KEV) Catalog. 12 unique IP addresses have accounted for most responsibility in weaponizing CVE-2022-40684 as of October 13, 2022. A majority of them are located in Germany, followed by the U.S., Brazil, China and France. nGuard covered this in more detail in a Security Advisory last week. Conducting ongoing penetration testing and vulnerability management can alert you to these types of vulnerabilities being present in your environment.

US Airport Sites Taken Down by Russian-Speaking Attackers
On Monday October 10th, more than a dozen public-facing airport websites, including those for some of the nation’s largest airports, appeared inaccessible, and Russian-speaking hackers claimed responsibility. The attack was carried out by a group known as Killnet, who support the Kremlin but are not thought to be government hackers. Killnet favors a type of attack known as a distributed denial of service (DDoS). Two of the sites that were affected by this attack were Atlanta’s Hartsfield-Jackson International Airport and the Los Angeles International Airport websites. Fortunately, there did not seem to be an impact to air travel itself but may have caused inconveniences for individuals traveling during the time access to those sites was attempted.

Windows 11 Offers Automatic Phishing Protection
Enhanced phishing protection now comes prebuilt into the Windows 11 operating system. This protection can automatically detect when users type their password into any app or site that is known to be dangerous. Admins can know exactly when a password has been stolen and can be equipped to better protect against such attacks. According to Microsoft, “When Windows 11 protects against one phishing attack, that threat intelligence cascades to protect other Windows users interacting with other apps and sites that are experiencing the same attack.” A blocking dialog warning is displayed prompting users to change their password if they type it into a phishing site in any Chromium browser or into an application connecting to a phishing site. If users try to store their password locally, like in Notepad or in any Microsoft 365 app, Windows 11 warns them that this is an unsafe practice and urges them to delete it from the file. To help train and test your employees on their security awareness, nGuard offers custom, tailored Security Awareness Training and social engineering.

CISA Publishes Two Advisories Regarding Industrial Appliances
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published two Industrial Control Systems advisories pertaining to severe flaws in Advantech R-SeeNet and Hitachi Energy APM Edge appliances. The list of issues, which affect R-SeeNet Versions 2.4.17 and prior are:

  • CVE-2022-3385 and CVE-2022-3386 (CVSS scores: 9.8) – Two stack-based buffer overflow flaws that could lead to remote code execution
  • CVE-2022-3387 (CVSS score: 6.5) – A path traversal flaw that could enable a remote attacker to delete arbitrary PDF files

Patches have been made available in version R-SeeNet version 2.4.21 released on September 30, 2022.

These alerts come less than a week after CISA published 25 ICS advisories on October 13, 2022, spanning several vulnerabilities across devices from Siemens, Hitachi Energy, and Mitsubishi Electric.

nGuard has a wide array of experience assessing critical infrastructure, SCADA, and Industrial Control Systems (ICS) and can help you secure yours. Conducting annual penetration testing, having a proper Incident Response Plan, and ensuring you have the proper logging, alerting, and correlation can help you stay ahead of the attackers.

Filed Under: Advisory, Breach, Compliance, Events, Financial, General, Products & Services, Vulnerabilities & Exploits Tagged With: auth, bypass, CISA, critical infrastructure, fort, fortigate, fortinet, Hacking, ICS, malware, Multi-Factor Authentication, Penetration Testing, russia, security awareness training, social engineering, urgent, US Airports, vuln, windows, windows 11, zeroday

TWiC | This Week in Cybersecurity

Over the past week there have been many hot topics in cybersecurity. This edition of This Week in Cybersecurity includes stories covering Microsoft rolling back their decision to not block Office macros by default, phishing campaigns successfully bypassing multi-factor authentication (MFA), a former CIA engineer responsible for the “Vault 7 Leaks” was convicted, hackers targeting industrial control systems, and much more. Check out the details below.

  • Microsoft Rolls Back Decision To Block Office Macros By Default

    While Microsoft announced earlier this year that it would block VBA macros on downloaded documents by default, Redmond said that it will roll back this change based on “Feedback” until further notice. Microsoft’s customers were the first to notice that Microsoft rolled back this change in the Current Channel, with the old ‘Enable Editing’ or ‘Enable Content’ buttons shown at the top of downloaded Office documents with embedded macros. While Microsoft has not shared the negative feedback that led to the rollback of this change, users have reported that they are unable to find the Unblock button to remove the Mark-of-the-Web from downloaded files, making it impossible to enable macros.

  • Large-Scale Phishing Campaign Bypasses MFA

    Attackers are getting wise to organizations’ increasing use of MFA to better secure user accounts and creating more sophisticated phishing attacks like these that can bypass it, noted a security professional. “While MFA is certainly valuable and should be used when possible, by capturing the password and session cookie – and because the session cookie shows that MFA was already used to login – the attackers can often circumvent the need for MFA when they login to the account again later using the stolen password,” observed Erich Kron from KnowB4. This attack is especially convenient for threat actors because it precludes the need for them to craft their own phishing sites such as the ones used in conventional phishing campaigns, researchers noted. In the phishing campaign observed by Microsoft researchers, attackers initiate contact with potential victims by sending emails with an HTML file attachment to multiple recipients in different organizations. One of nGuard’s most common assessments is Social Engineering. During these assessments our engineers come across applications that require MFA and attempt to bypass the requirement using these techniques and others like MFA Prompt Bombing.

  • Jury convicts ex-CIA engineer for leaking the agency’s “Vault7” hacking toolset

    Joshua Schulte, the former CIA engineer arrested for what’s being called the biggest theft of classified information in the agency’s history, has been convicted by a federal jury. Schulte was arrested in relation to the large cache of documents that Wikileaks had published throughout 2017. That string of CIA leaks known as “Vault 7” contained information on the tools and techniques the agency used to hack into iPhones and Android phones for overseas spying. It also had details on how the CIA broke into computers and how it turned smart TVs into listening devices. A federal jury has found Schulte guilty on nine counts, including illegally gathering national defense information and then transmitting it. As part of his closing arguments, he told the jurors that the CIA and the FBI made him a scapegoat for their embarrassing failure, repeating what his side had been saying from the time he was arrested.

  • State-backed hackers targeted US-based journalists in widespread spy campaigns

    State-sponsored hackers from China, North Korea, Iran and Turkey have been regularly spying on and impersonating journalists from various media outlets in an effort to infiltrate their networks and gain access to sensitive information, according to a report released by cybersecurity firm Proofpoint. In one of the operations, the report found that since early 2021, Chinese-backed hackers engaged in numerous phishing attacks mainly targeting U.S.-based journalists covering U.S. politics and national security. The researchers concluded their report with a warning to journalists to protect themselves and their sources because these types of attacks are likely to persist as state-sponsored hackers attempt to gather more sensitive information and manipulate public perception.

  • Hackers are targeting industrial systems with new strain of malware

    People hawking password-cracking software are targeting the hardware used in industrial-control facilities with malicious code that makes their systems part of a botnet, a researcher reported. Lost passwords happen in many organizations. A programmable logic controller — used to automate processes inside factories, electric plants, and other industrial settings, for example, may be set up and largely forgotten over the following years. When a replacement engineer later identifies a problem affecting the PLC, they may discover the now long-gone original engineer never left the passcode behind before departing the company. An entire ecosystem of malware attempts can capitalize on scenarios like this one inside industrial facilities. Online advertisements promote password crackers for PLCs and human-machine interfaces, which are the workhorses inside these environments. nGuard has a wide range of experience securing Critical Infrastructure, SCADA systems, and Industrial Controls Systems for the manufacturing industry. Our penetration testing and compliance assessments can give you the confidence in the security posture of these environments.

Filed Under: Advisory, Breach, Compliance, Events, Financial, General, Products & Services, Vulnerabilities & Exploits Tagged With: CIA, critical infrastructure, industrial control systems, macros, MFA, Microsoft, Multi-Factor Authentication, phishing, scada, social engineering, Vault7

Water Utilities Are Critical Infrastructure

Target: Water Utilities
    Water Utilities play a critical role in our society.  They provide fresh, potable water to residents, businesses and industry as well as manage the wastewater from them.   As with other utilities and critical infrastructure, they are increasingly a target for hackers, terrorists, and hostile nation states.  A successful hack can contaminate the fresh water supply, impair availability or cause an environmental disaster.  It’s a direct risk to the health of the local population and supply chains which depend on readily available fresh water and wastewater management.

Becoming a Hard Target
    Managing the risks isn’t trivial, but it’s not rocket science either –the science of cyber security has greatly matured over the past 20 years.  The following 5 steps are key to a water utility becoming a hard target that is resistant to cyberattacks. Assess your overall cyber security program. Test your organization’s current readiness to cyber attacks on an annual basis by assessing both your external perimeter and your internal networks.  Make sure you include both the IT and the OT (SCADA) sides of the house. Perform ongoing vulnerability management throughout the year. Make sure you have someone watching for suspicious security events. Lastly, make sure you have a Cyber Security Incident Response (CSIR) program in place.  Because a cyber security incident is a question of when, not if, you must have a plan in place before it happens.

Strength In Numbers
    Recognizing the critical importance of the water supply, leading water associations in the U.S., along with the U.S. federal government, have become increasingly organized in the defense of this essential infrastructure.  A key part of this organization has been the formation of the Water Information Sharing and Analysis Center (WaterISAC).  Authorized by the United States’ 2002 Bioterrorism Act, the WaterISAC is the key security information source for all threats impacting water and wastewater systems.  In support of their mission, they have developed the 15 Cybersecurity Fundamentals for Water & Wastewater Utilities.  As part of their ongoing education and outreach, WaterISAC recently invited nGuard to speak about some of these key cybersecurity concepts at an association meeting. You can watch this webinar below.

Filed Under: Advisory, Breach, Compliance, Events, Financial, General, Products & Services, Vulnerabilities & Exploits Tagged With: critical infrastructure, scada, water utilities, WaterISAC

nGuard

nGuard

3540 Toringdon Way
Suite 200
Charlotte, NC 28277-4650

info@nGuard.com

Client Portal

Solutions

  • Security Assessments
  • Compliance
  • Cyber Security Incident Response
  • Penetration Testing
  • Managed Event Collection
  • nGuard Vulnerability Management
  • Red Team Testing
  • Mobile Security
  • Cloud Security

Industries

  • Healthcare
  • Energy
  • Information Technology
  • Manufacturing
  • Defense
  • Banking
  • Insurance
  • Government
  • Transportation
  • Entertainment
  • Food & Beverage

About Us

  • Our Company
  • Careers
  • Blog

© 2023 nGuard. All rights reserved.

  • Privacy Policy