A story in Bleeping Computer reveals that a large-scale cyber-espionage campaign is targeting primarily renewable energy and industrial technology organizations. It has been discovered to be active since at least 2019, targeting over fifteen entities worldwide.

https://www.bleepingcomputer.com/news/security/cyber-espionage-campaign-targets-renewable-energy-companies/

News Insights:

According to Bryson Bort, CEO & Founder, SCYTHE (www.scythe.io), “This is similar to the targeted credential theft attack as seen in the breach of the Florida water plant in 2020. The underlying goal depends on the nation-state actor involved. If it’s Russia, then it a further example of iterative intelligence against our critical infrastructure and possibly putting “levers” in place in anticipation of conflict (Ukraine weighs heavy on the mind). On the other hand, if it’s North Korea, then it could be the reconnaissance phase for future ransomware attacks. Renewables are the fastest growing energy segment which means they’re a target for financially motivated attacks.”

Saryu Nayyar, CEO and Founder, Gurucul (she/her) said, “While the attack itself is deemed “unsophisticated”, this is a perfect example of an elaborate industrial espionage campaign targeting multiple sectors to disrupt or steal data from a specific industry. While simple, this phishing attack is difficult to defend, however, with a next generation SIEM that supports behavioral analytics supported by adaptable machine learning models, the abnormal communications to suspicious domains can immediately be prioritized for security teams to investigate and determine if a real threat exists. If the campaign is indeed purported by proponents of the fossil-fuel industry, it is indeed unfortunate. Renewable energy companies need to invest more in cloud-native analytical security solutions to protect themselves against this type of threat, but also nation state threat actors looking to steal intellectual property for their own energy programs.”

Is The War On? Malware Hits Ukrainian Organizations

The UK’s National Cyber Security Centre (NCSC) has joined key international partners in warning operators of critical national infrastructure (CNI) – such as telecoms networks, energy suppliers and utilities, transport operators, and logistics and distribution specialists, to be on their guard against intrusions into their systems originating from malicious actors linked to the Russian state.

https://www.computerweekly.com/news/252511934/NCSC-sounds-alarm-over-Russia-backed-hacks

The Infrastructure Investment and Jobs Act has passed, allocating a billion dollars for cybersecurity for state, local, tribal and territorial governments (SLTTs). In this video from our sister organization, the Cyber Policy Institute, Jill Shapiro, Senior Director of Government Affairs at Tenable Security discusses the best use of the cyber funding for SLTTs. She explores the federal government’s role in helping SLTTs secure infrastructure and mitigate unique threats to their governments as well.

To watch the video, visit https://youtu.be/dtG1TnEkflw

Jill has been with Tenable since 2018, where she advocates for safe cybersecurity policies to close the cybersecurity gap. Jill is a longstanding advocate of cyber investments in state, local, tribal and territorial governments. She offers a unique perspective on the implementation of funding for cybersecurity now that the Infrastructure Investment and Jobs Act has passed.

Facebook groups swelled with at least 650,000 posts attacking the legitimacy of Joe Biden’s victory between Election Day and the Jan. 6 siege of the U.S. Capitol, with many calling for executions or other political violence, an investigation by ProPublica and The Washington Post has found.

The barrage — averaging at least 10,000 posts a day, a scale not reported previously — turned the groups into incubators for the baseless claims supporters of then-President Donald Trump voiced as they stormed the Capitol, demanding he get a second term. Many posts portrayed Biden’s election as the result of widespread fraud that required extraordinary action — including the use of force — to prevent the nation from falling into the hands of traitors.

https://www.propublica.org/article/facebook-hosted-surge-of-misinformation-and-insurrection-threats-in-months-leading-up-to-jan-6-attack-records-show?utm_source=sailthru&utm_medium=email&utm_campaign=majorinvestigations&utm_content=river&fbclid=IwAR21NPf7lE1RZWRBVDeRLjuWJeJ_x3oq-xJtClcNomzmjbsfqA3hLOk4KSk

Preventing BlackMatter Ransomware from Encryption of Available Remote Share

Last week, a ransomware attack on Finalsite compromised the websites of 5,000 schools nationwide.

This attack is just the latest on schools nationwide, responsible for interrupting remote learning, and compromising the data of educational institutions.

News Insights:

According to Ric Longenecker, CISO at Open Systems:

“Schools continue to be ransomware attack targets, as illustrated by the recent Finalsite attack. With so many educational institutions continuing to rely on remote learning, these organizations – which have a wealth of data, including addresses, banking and credit card details, medical information and Social Security numbers – are particularly attractive to bad actors.

Although it seems that Finalsite and the thousands of schools that use its software escaped the attack without their data being compromised, this event highlights the need for schools to increase their cybersecurity efforts and decrease their attack surfaces. Schools can take these important steps by working with a managed detection and response (MDR) solution provider.

An experienced MDR provider combines AI technology and human know-how to assess threats and speed up effective mitigation of attacks before they spread and impact students, faculty and parents. A better MDR provider goes beyond detection and response to actual reduction of the attack surface and increase of the school’s security maturity, to prevent future breaches.”

Photo by Produtora Midtrack from Pexels

https://www.darkreading.com/threat-intelligence/fbi-nsa-cisa

News Insights:

According to Tim Helming, Security Evangelist at DomainTools:

“There is good guidance here from the agencies (CISA, NSA, FBI) though it’s tempting to look at it as motherhood-and-apple-pie: the vast majority of owners and operators of critical infrastructure are well aware of the threats, and are also cognizant of many of the fundamental steps toward hardening their assets against these threats. Many in the critical infrastructure community take an ‘assume breach’ posture already, based on what we know about the capabilities of these actors. Procedures and tools to improve asset visibility and vulnerability management, identity and access management, log management, ingress and egress filtering, anomaly detection, and behavioral analytics are all recognized as fundamental necessities, and it’s safe to say are being actively improved, to a greater or lesser extent, in the majority of installations.

So why did CISA et al issue the advisory? In part, because if they weren’t on record doing so and a compromise were confirmed, it would have been a glaring gap. It also gives owners and operators facing resource constraints more support in their requests, and it’s important not to underestimate how important that can be.”

Bleeping Computers recently reported that the The Federal Bureau of Investigation (FBI) warned US companies in a recently updated flash alert that the financially motivated FIN7 cybercriminal group targeted the US defense industry with packages containing malicious USB devices to deploy ransomware.

https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/

News Insights:

Purandar Das, Co-founder and CEO of Sotero, an encryption-based security solutions company, said, “This seems like a step back in terms of attack sophistication. In a time when attacks are being executed leveraging third part and open-source software components this seems like a step back in to a bygone era where the attack depended on a human failure or event to start. It may have been an attempt to capitalize on lowered guards when everyone is focused on talking about the more sophisticated attacks. Regardless, this demonstrated that the attackers will leave no avenue unexploited. It also demonstrates the potential for pay off’s that the attackers are willing to invest in USB drives and physical mailing costs.”