BruCERT - Alerts & Advisories

Standards need to reflect that most endpoints will be remote and/or wireless.

Original release date: November 24, 2021

CISA has released actionable Capacity Enhancement Guides (CEGs) to help users and organizations improve mobile device cybersecurity.

• The CEG: Mobile Device Cybersecurity Checklist for Consumers provides steps for consumers, including using strong authentication and enabling automatic operating system updates.
• The CEG: Mobile Device Cybersecurity Checklist for Organizations provides steps to help organizations secure mobile access to enterprise resources.

CISA encourages users and administrators to review the guidance and apply the recommendations.

This product is provided subject to this Notification and this Privacy & Use policy.

We are going to analyze the forecasts we made at the end of 2020, go through the key events of 2021 relating to financial attacks and make some forecasts about them in 2022.

Opportunistic attackers instantly exploited insecurely exposed services deployed in honeypots by Unit 42 researchers, demonstrating the immediate danger of these typical mistakes.

The ancient Chinese military strategist Sun Tzu would agree: The best defense is to avoid an attack in the first place.

Each security step, no matter how small, can have great impact in detecting and deterring cyber theft.

There is currently no specific time frame during which banks must report to federal regulators that a security incident had occurred. A new notification rules changes that to 36 hours.

Original release date: November 19, 2021 | Last revised: November 24, 2021

The Federal Bureau of Investigation (FBI), CISA, and Coast Guard Cyber Command (CGCYBER) have updated the Joint Cybersecurity Advisory (CSA) published on September 16, 2021, which details the active exploitation of an authentication bypass vulnerability (CVE-2021-40539) in Zoho ManageEngine ADSelfService Plus—a self-service password management and single sign-on solution.

The update provides details on a suite of tools APT actors are using to enable this campaign: 

• Dropper: a dropper trojan that drops Godzilla webshell on a system 
• Godzilla: a Chinese language web shell 
• NGLite: a backdoor trojan written in Go 
• KdcSponge: a tool that targets undocumented APIs in Microsoft’s implementation of Kerberos for credential exfiltration  

Note: FBI, CISA, and CGCYBER cannot confirm the CVE-2021-40539 is the only vulnerability APT actors are leveraging as part of this activity, so it is key that network defenders focus on detecting the tools listed above in addition to initial access vector.

CISA encourages organizations to review the November 19 update and apply the recommended mitigations. CISA also recommends reviewing the relevant blog posts from Palo Alto Networks, Microsoft, and IBM Security Intelligence. 

This product is provided subject to this Notification and this Privacy & Use policy.