cisa

  1. AA21-048A: AppleJeus: Analysis of North Korea’s Cryptocurrency Malware

    Original release date: February 17, 2021 Summary This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. This joint advisory is the result of analytic efforts...
    • News
    • Thread
    • applejeus apt actors cisa cryptocurrency cryptocurrency theft cybersecurity exfiltration fbi finance sectors hidden cobra korean cyber actors malicious software malware malware analysis mitigation mitre att&ck north korea phishing spearphishing threat assessment
    • Replies: 0
    • Forum: Security Alerts

  2. AA21-042A: Compromise of U.S. Water Treatment Facility

    Original release date: February 11, 2021 Summary On February 5, 2021, unidentified cyber actors obtained unauthorized access to the supervisory control and data acquisition (SCADA) system at a U.S. drinking water treatment plant. The unidentified actors used the SCADA system’s software to...
    • News
    • Thread
    • cisa cyber attacks cyber hygiene cybersecurity epa exploitation fbi hygiene measures infrastructure security legacy systems mitigations password security physical security rdp vulnerability scada social engineering teamviewer unauthorized access water treatment windows 7
    • Replies: 0
    • Forum: Security Alerts

  3. AA20-336A: Advanced Persistent Threat Actors Targeting U.S. Think Tanks

    Original release date: December 1, 2020<br/><h3>Summary</h3><p class="tip-intro" style="font-size: 15px;"><em>This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&amp;CK®) framework. See the <a href="Techniques - Enterprise | MITRE ATT&CK®">ATT&amp;CK for...
    • News
    • Thread
    • apt cisa cybersecurity data exfiltration fbi incident response malicious activity mitigation multi-factor authentication network security phishing remote access security awareness security policy social engineering tactics techniques think tanks threat actors vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  4. AA20-304A: Iranian Advanced Persistent Threat Actor Identified Obtaining Voter Registration Data

    Original release date: October 30, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques. This joint cybersecurity advisory...
    • News
    • Thread
    • acunetix api security cisa cyber attacks cyber threats cybersecurity data exfiltration disinformation election security fbi incident response iranian apt malicious activity mitigations reconnaissance sql injection user agents voter registration voting processes vulnerability scanning
    • Replies: 0
    • Forum: Security Alerts

  5. AA20-302A: Ransomware Activity Targeting the Healthcare and Public Health Sector

    Original release date: October 28, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques. This joint cybersecurity advisory...
    • News
    • Thread
    • cisa continuity plans cyber threats cybersecurity data protection data theft encryption fbi healthcare incident response malware mitigation network security phishing public health ransomware ryuk threat detection trickbot user awareness
    • Replies: 0
    • Forum: Security Alerts

  6. AA20-296A: Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets

    Original release date: October 22, 2020 Summary This joint cybersecurity advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor tactics and techniques This joint cybersecurity...
    • News
    • Thread
    • brute force cisa citrix bug credentials cybersecurity data exfiltration fbi government targets incident response krb-tgt mfa microsoft exchange mitigation network compromise password reset russian apt sql injection threat actor vpn security vulnerability
    • Replies: 0
    • Forum: Security Alerts

  7. AA20-283A: APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations

    Original release date: October 9, 2020 Summary This joint cybersecurity advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. Note: the analysis in this joint...
    • News
    • Thread
    • active directory apt cisa cve-2020-1472 cybersecurity elections exploitation fortinet incident response legacy systems malware mitigation monitoring netlogon network security privilege escalation remote access vpn vulnerabilities windows
    • Replies: 0
    • Forum: Security Alerts

  8. AA20-280A: Emotet Malware

    Original release date: October 6, 2020 Summary This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. This product was written by the Cybersecurity and...
    • News
    • Thread
    • antivirus brute force cisa cybersecurity data exfiltration detection email security emotet lateral movement malicious software malware mitigation mitre network security payload phishing phishing email ransomware threat trojan
    • Replies: 1
    • Forum: Security Alerts

  9. AA20-275A: Potential for China Cyber Response to Heightened U.S.–China Tensions

    Original release date: October 1, 2020 Summary This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. In light of heightened tensions between the United States and...
    • News
    • Thread
    • apt china cisa critical infrastructure cyber threats cybersecurity data breach economic espionage espionage incident response intellectual property malware mitigations mitre att&ck phishing software vulnerability threat intelligence ttps us relations vulnerability
    • Replies: 0
    • Forum: Security Alerts

  10. AA20-266A: LokiBot Malware

    Original release date: September 22, 2020 Summary This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise frameworks for all referenced threat actor techniques. This product was written by the Cybersecurity and...
    • News
    • Thread
    • android trojan att&ck backdoor cisa credential theft cybersecurity exfiltration incident response information theft keylogger lokibot malicious attachments malspam malware mitigation password theft phishing spearphishing threat detection windows security
    • Replies: 0
    • Forum: Security Alerts

  11. AA20-259A: Iran-Based Threat Actor Exploits VPN Vulnerabilities

    Original release date: September 15, 2020 Summary This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. This product was written by the Cybersecurity and...
    • News
    • Thread
    • cisa cve cybersecurity data exfiltration exploits fbi initial access iran mitigations network defense persistence rdp remote access security tactics techniques threat actor vpn vulnerabilities web shells
    • Replies: 0
    • Forum: Security Alerts

  12. AA20-258A: Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity

    Original release date: September 14, 2020 Summary The Cybersecurity and Infrastructure Security Agency (CISA) has consistently observed Chinese Ministry of State Security (MSS)-affiliated cyber threat actors using publicly available information sources and common, well-known tactics...
    • News
    • Thread
    • apt chinese threats cisa cobalt strike command and control cybersecurity data breaches exploits incident response mimikatz mitre att&ck mss network security open source patch management ransomware spearphishing technical information threat actors vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  13. AA20-227A: Phishing Emails Used to Deploy KONNI Malware

    Original release date: August 14, 2020 Summary This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. The Cybersecurity and Infrastructure Security Agency (CISA)...
    • News
    • Thread
    • antivirus cisa command execution command shell cybersecurity data exfiltration email security keylogging konni malware mitigation mitre att&ck phishing remote access security best practices social engineering threat detection user awareness vba windows
    • Replies: 0
    • Forum: Security Alerts

  14. AA20-225A: Malicious Cyber Actor Spoofing COVID-19 Loan Relief Webpage via Phishing Emails

    Original release date: August 12, 2020 Summary The Cybersecurity and Infrastructure Security Agency (CISA) is currently tracking an unknown malicious cyber actor who is spoofing the Small Business Administration (SBA) COVID-19 loan relief webpage via phishing emails. These emails include a...
    • News
    • Thread
    • antivirus best practices cisa covid-19 credential theft cybersecurity email security federal security indicators links low trust malicious actor malware mitigations phishing remote attacks sba threats unauthorized access vulnerability
    • Replies: 0
    • Forum: Security Alerts

  15. AA20-209A: Potential Legacy Risk from Malware Targeting QNAP NAS Devices

    Original release date: July 27, 2020 Summary This is a joint alert from the United States Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC). CISA and NCSC are investigating a strain of malware known as QSnatch, which...
    • News
    • Thread
    • analysis backdoor campaigns cisa credential scraper cybersecurity exfiltration firmware infections malware mitigation nas devices ncsc network storage persistence qnap qsnatch risk security threat
    • Replies: 0
    • Forum: Security Alerts

  16. AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902

    Original release date: July 24, 2020 Summary The Cybersecurity and Infrastructure Security Agency (CISA) is issuing this alert in response to recently disclosed exploits that target F5 BIG-IP devices that are vulnerable to CVE-2020-5902. F5 Networks, Inc. (F5) released a patch for CVE-2020-5902...
    • News
    • Thread
    • cisa credential theft cve-2020-5902 cybersecurity data exfiltration detection digital security exploitation f5 big-ip incident response it security malware mitigation network segmentation patch management remote code execution security advisory system compromise threat actor vulnerability
    • Replies: 0
    • Forum: Security Alerts

  17. AA20-205A: NSA and CISA Recommend Immediate Actions to Reduce Exposure Across Operational Technologies and Control Systems

    Original release date: July 23, 2020 Summary Note: This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise and Link Removed frameworks for all referenced threat actor techniques and mitigations. Over recent...
    • News
    • Thread
    • access control attack techniques cisa control systems critical infrastructure cybersecurity data security incident response mitigation monitoring network security nsa operational technology ransomware resilience plan risk management software patching system mapping threat analysis vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  18. AA20-195A: Critical Vulnerability in SAP NetWeaver AS Java

    Original release date: July 13, 2020 Summary On July 13, 2020 EST, SAP released a Link Removed to address a critical vulnerability, Link Removed, affecting the SAP NetWeaver Application Server (AS) Java component LM Configuration Wizard. An unauthenticated attacker can exploit this...
    • News
    • Thread
    • access application attacker cisa configuration cve-2020-6287 cybersecurity data exploitation integrity java mitigation monitoring netweaver patch recommendations sap security system vulnerability
    • Replies: 0
    • Forum: Security Alerts

  19. AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor

    Original release date: July 1, 2020 | Last revised: July 2, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) and Pre-ATT&CK framework. See the ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques. This...
    • News
    • Thread
    • anonymity att&ck framework cisa command and control cyber threats cybersecurity data breaches exfiltration fbi identity cloaking incident response malicious activity malicious actors network defense network monitoring privacy risk mitigation threat assessment tor traffic analysis
    • Replies: 0
    • Forum: Security Alerts

  20. AA20-182A: EINSTEIN Data Trends – 30-day Lookback

    Original release date: June 30, 2020 Summary Cybersecurity and Infrastructure Security Agency (CISA) analysts have compiled the top detection signatures that have been the most active over the month of May in our national Intrusion Detection System (IDS), known as EINSTEIN. This information is...
    • News
    • Thread
    • antivirus cisa cryptocurrency miner cybersecurity einstein ids kovter malware mitigation strategies netsupport network security phishing rat remote access tool security updates situational awareness snort signatures threat detection xmrig
    • Replies: 0
    • Forum: Security Alerts