-
AA21-336A: APT Actors Exploiting CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus
Original release date: December 2, 2021 Summary This joint Cybersecurity Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework, Version 9. See the ATT&CK for Enterprise framework for referenced threat actor techniques and for mitigations. This joint...- News
- Thread
- active directory apt attack techniques cisa critical infrastructure cve-2021-44077 cybersecurity exploitation fbi indicators of compromise it consulting mitigation rce remote code execution service desk threat actors update vulnerability web shells zoho
- Replies: 0
- Forum: Security Alerts
-
AA21-321A: Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activi
Original release date: November 17, 2021 Summary Actions to Take Today to Protect Against Iranian State-Sponsored Malicious Cyber Activity • Immediately patch software affected by the following vulnerabilities: CVE-2021-34473, 2018-13379, 2020-12812, and 2019-5591. • Implement Link Removed. •...- News
- Thread
- apt authentication cisa compromise cybersecurity data exfiltration exchange server exploitation fbi fortinet indicator infrastructure iran malware mitigation patch management protection ransomware threat actors vulnerability
- Replies: 0
- Forum: Security Alerts
-
AA21-291A: BlackMatter Ransomware
Original release date: October 18, 2021 Summary Actions You Can Take Now to Protect Against BlackMatter Ransomware • Implement and enforce backup and restoration policies and procedures. • Use Link Removed. • Use Link Removed. • Implement network segmentation and traversal monitoring. Note...- News
- Thread
- active directory backup blackmatter cisa credential access critical infrastructure cybersecurity data security encryption fbi incident response mitigation monitoring network security nsa ransomware security tactics techniques threat detection
- Replies: 0
- Forum: Security Alerts
-
VIDEO AA21-287A: Ongoing Cyber Threats to U.S. Water and Wastewater Systems
Original release date: October 14, 2021 Summary Immediate Actions WWS Facilities Can Take Now to Protect Against Malicious Cyber Activity • Do not click on Link Removed. • If you use RDP, secure and monitor it. • Use Link Removed. • Use Link Removed. Note: This advisory uses the MITRE...- News
- Thread
- cisa cyber hygiene cybersecurity epa exploitation fbi infrastructure insider threats mitigation monitoring nist nsa ransomware remote access scada tactics technical details threats wastewater water systems
- Replies: 0
- Forum: Security Alerts
-
VIDEO AA21-265A: Conti Ransomware
Original release date: September 22, 2021 Summary Immediate Actions You Can Take Now to Protect Against Conti Ransomware • Use Link Removed. • Segment and segregate networks and functions. • Update your operating system and software. Note: This Alert uses the MITRE Adversarial Tactics...- News
- Thread
- attack techniques cisa conti credential access cybersecurity data security exploit fbi incident response malware mitigation multi-factor authentication network security phishing privilege escalation ransomware security updates threat intelligence vulnerability windows
- Replies: 0
- Forum: Security Alerts
-
AA21-259A: APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus
Original release date: September 16, 2021 Summary This Joint Cybersecurity Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework, Version 8. See the ATT&CK for Enterprise for referenced threat actor tactics and for techniques. This joint advisory is...- News
- Thread
- adselfservice apt actors cisa critical infrastructure cve-2021-40539 cyber command cybersecurity data exfiltration exploit fbi incident response manageengine mitigation remote code execution security advisory security bypass technical details threat actors vulnerability web shells
- Replies: 0
- Forum: Security Alerts
-
AA21-243A: Ransomware Awareness for Holidays and Weekends
Original release date: August 31, 2021 Summary Immediate Actions You Can Take Now to Protect Against Ransomware • Make an offline backup of your data. • Do not click on Link Removed. • If you use RDP, secure and monitor it. • Link Removed your OS and software. • Use Link Removed. • Use Link...- News
- Thread
- backup best practices cisa cyber hygiene cyber trends cybercriminals cybersecurity fbi incident incident response malware multi-factor authentication network defense phishing ransomware remote desktop security threat awareness threat hunting vulnerability
- Replies: 0
- Forum: Security Alerts
-
AA21-229A: BadAlloc Vulnerability Affecting BlackBerry QNX RTOS
Original release date: August 17, 2021 Summary On August 17, 2021, BlackBerry publicly disclosed that its QNX Real Time Operating System (RTOS) is affected by a Link Removed vulnerability—CVE-2021-22156. BadAlloc is a collection of vulnerabilities affecting multiple RTOSs and supporting...- News
- Thread
- arbitrary code automation badalloc blackberry c runtime critical infrastructure cve-2021-22156 denial of service firmware ics integer overflow iot memory management mitigation patch management qnx rto security vulnerability
- Replies: 0
- Forum: Security Alerts
-
AA21-209A: Top Routinely Exploited Vulnerabilities
Original release date: July 28, 2021 Summary This Joint Cybersecurity Advisory was coauthored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre (ACSC), the United Kingdom’s National Cyber Security Centre (NCSC), and the U.S. Federal Bureau...- News
- Thread
- advisory cisa cloud security cve cybersecurity exploitation fbi incident response malware microsoft network security patch patch management ransomware remote code execution security updates threat actors vpn vulnerability
- Replies: 0
- Forum: Security Alerts
-
AA21-201A: Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013
Original release date: July 20, 2021 Summary This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework, Version 9. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. Note: CISA released technical information...- News
- Thread
- chinese actors cisa cyber threats cybersecurity data security exfiltration fbi ics indicator infrastructure intrusion malware mitigation natural gas phishing pipeline security scada spear phishing threat actors ttps
- Replies: 0
- Forum: Security Alerts
-
AA21-200B: Chinese State-Sponsored Cyber Operations: Observed TTPs
Original release date: July 19, 2021 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework, Version 9, and MITRE D3FEND™ framework, version 0.9.2-BETA-3. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques...- News
- Thread
- advisory chinese cyber operations cisa credential access cyber intelligence cybersecurity data exfiltration exploitation fbi incident response information security lateral movement malware mitre att&ck national security network security tactics techniques threat actors vulnerability
- Replies: 0
- Forum: Security Alerts
-
AA21-200A: Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department
Original release date: July 19, 2021 Summary This Joint Cybersecurity Advisory was written by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) to provide information on a Chinese Advanced Persistent Threat (APT) group known in open-source...- News
- Thread
- apt40 china compromise compromised credentials credential access cyber threats cybersecurity exfiltration hainan indicator information security intellectual property lateral movement malware mitre network defense state security tactics threat actors vulnerability
- Replies: 0
- Forum: Security Alerts
-
AA21-148A: Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs
Original release date: May 28, 2021 Summary The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are responding to a spearphishing campaign targeting government organizations, intergovernmental organizations (IGOs), and non-governmental...- News
- Thread
- apt29 cisa cobalt strike compromise cybersecurity detection email security emerging threats fbi government incident response indicator iso malware mitigation phishing risk management spear phishing threat actors user training
- Replies: 0
- Forum: Security Alerts
-
VIDEO AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks
Original release date: May 11, 2021 Summary This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework, Version 9. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. The Cybersecurity and Infrastructure Security...- News
- Thread
- access control backup business resilience cisa critical infrastructure cybersecurity dark side encryption fbi incident response malware mitigation network segmentation phishing prevention ransomware security technical details threat actors user training
- Replies: 0
- Forum: Security Alerts
-
AA21-116A: Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders
Original release date: April 26, 2021 Summary The Federal Bureau of Investigation (FBI), Department of Homeland Security (DHS), and Cybersecurity and Infrastructure Security Agency (CISA) assess Russian Foreign Intelligence Service (SVR) cyber actors—also known as Advanced Persistent Threat 29...- News
- Thread
- active directory apt29 cloud exploitation credential abuse cyber defense cyber exploitation cyber operations intrusion detection malware multi-factor authentication network security security security best practices solarwinds svr threat intelligence vps hosting wellmess zero-day
- Replies: 0
- Forum: Security Alerts