2021 Week 28 security roundup
Summary
Almost all the news this week was dominated by the Kaseya breach which allowed REvil to gain access to and encrypt the systems of 1500+ organizations. This might end up being even bigger than the Solarwinds attack. I did not include articles about the PrintNightmare due to it being a more generalized OS Zero-day. If, you use Microsoft products, however, I strongly encourage you to get up to speed on this issue.
Outside of the Kaseya issue, there was also news of new and old attacks against infrastructure components, most notably a couple of water plants that were breached.
News
Kaseya breach
The technology services company Kaseya had a backdoor in one of their popular remote access applications that allowed bad actors to gain access to thousands of entities over the long weekend, including governments of all sizes. The backdoor was a Zero-Day bug that was quickly exploited and timed for the U.S. long holiday weekend. While not as popular as the Solarwinds software, Kaseya's VSA is still a widely used application platform. More to the point for this event, Managed Service Providers can perform actions on client systems which is why so many organizations were affected. The Russian hacking group REvil (or at least one of their affiliates) has taken responsibility for the attack and initially demanded $70 to unlock all files worldwide. It should be noted that in a departure from REvil's normal process, it appears this attack did not allow for data exfiltration nor were their deletion of backups, so early reporting is indicating few victims are paying.
Company Statement:
Attackers ramping up attacks on Industrial Control Systems (ICS)
Yet another organization that is saying that the bad guys are focusing efforts on the systems that make water, power, and factories work. If you defend such systems, your work is cut out for you. Another report indicated that while attacks are up, the vast majority of the public throughout the industrialized world does not even know of the risks to our world.
Wiregrass Electric Cooperative hacked
Wiregrass Electric Coop was breached over the 4th of July weekend, but they say no data was compromised.
WSSC Water had a Ransomware attack
WSSC Water was attacked by ransomware back in May. They are now reporting that the attack was repelled and remediated within hours. What they are now reporting is that several internal files were compromised. The company credits true air-gapped networks and effective backups that allowed them to quickly restore affected systems.
Legislative actions
The Federal Cybersecurity Workforce Expansion Act is getting strong by-partisan support. The bill seeks to strengthen the U.S. Cyber workforce by allowing the Cybersecurity and Infrastructure Security Agency (CISA) and Department of Veterans Affairs to create apprenticeship programs. The law sets a 2-year timeline to create the program at CISA. The VA would be granted one year to create a program that would transition military personnel into cybersecurity jobs.
Comments
Post a Comment