InfoSecBulletin Cybersecurity for mankind
CISA, NSA, FBI, and other US and international partners released a joint fact sheet called “People’s Republic of China State-Sponsored Cyber Activity: Actions for Critical Infrastructure Leaders.” This publication includes contributions from various partners.
U.S. Department of Energy (DOE)
MITRE discloses 2024 CWE Top 25 critical software flaw
Python NodeStealer: harvest credit card and Facebook Ads Manager
Cisco Talos
Over 60% of Emails with QR Codes are spam
CERT-In Flags Multiple Critical Vulnerabilities in Zoom app
Daily Security Digest Dated 11/23/24
SafetyDetectives’ Research
Malware evades Microsoft Defender and 2FA, stealing $24K in crypto (video)
Over 145,000 ICS Across 175 Countries Found Exposed Online
World to see AI powered “human washing machines”
Hacker compromised over 2000 Palo Alto Networks Firewalls
“Forces Penpals” exposed US and UK Military Social Network’s 1 Million Records
U.S. Environmental Protection Agency (EPA)
U.S. Transportation Security Administration (TSA)
U.S. Department of Treasury
Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC)
Canadian Centre for Cyber Security (CCCS) a part of the Communications Security Establishment (CSE)
United Kingdom’s National Cyber Security Centre (NCSC-UK)
New Zealand’s National Cyber Security Centre (NCSC-NZ)
The US authoring agencies believe that “Volt Typhoon”, a group sponsored by the People’s Republic of China, is trying to position themselves on IT networks using living off the land (LOTL) techniques. They aim to carry out cyber attacks against critical infrastructure in the US in case of a major crisis or conflict with the US. The fact sheet alerts leaders of critical infrastructure about this urgent risk and provides guidance on how to protect their organization from this threat.
CISA and its partners recommend that leaders of critical infrastructure organizations read the joint fact sheet to defend against the Volt Typhoon threat. For more information, see the guidance on identifying and mitigating Living off the Land Techniques. Visit Secure by Design for information on secure by design principles and practices.
