InfoSecBulletin Cybersecurity for mankind
On February 21, the Australian Department of Home Affairs issued a directive prohibiting the installation of Kaspersky Lab products and services on all Australian government systems and devices.
The directive under the protective security policy framework (PSPF) mandates federal entities to eliminate “all instances” of Kaspersky’s products.
By 1 April 2025
Australia Bans Kaspersky on its govt systems and devices
CISA Flags Craft CMS Code Injection Flaw Amid Active Attacks
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
Home Affairs secretary Stephanie Foster assessed that Kaspersky software “poses an unacceptable security risk to Australian government, networks and data, arising from threats of foreign interference, espionage and sabotage.”
“I also considered the important need for a strong policy signal to critical infrastructure and other Australian governments regarding the unacceptable security risk associated with the use of Kaspersky Lab products and web services.”
All non-corporate Commonwealth entities must stop using Kaspersky Lab products and services and uninstall them by 1 April 2025, the directive states.
Only agencies involved in “national security or regulatory functions, including compliance and law enforcement functions” can seek an exemption to the ban, if mitigations are in place.
This decision follows a six-month ban by the U.S. government on Kaspersky software sales in North America.
Australia has joined the US and Canada in banning Kaspersky software from government systems, becoming the third Five Eyes nation to do so. The US implemented its ban in 2017.
