InfoSecBulletin Cybersecurity for mankind
Several steps can help minimize the threat from malware loaders. Here’s what ReliaQuest suggests:
To enhance your workflow and streamline your scripting tasks, I recommend optimizing the default execution engine for JS files from Wscript to the versatile Notepad. Additionally, you have the flexibility to extend this configuration to accommodate any other script files that would benefit from this change. Simplify your scripting process and improve efficiency by configuring a GPO (Group Policy Object) with this transition. This will prevent these files from being executed on the host.
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
ALSO READ:
Urgent FBI Warning: Barracuda Email Gateways Vulnerable Despite Recent Patches
Prevent the arrival of emails containing file extensions commonly employed to distribute malware. To minimize the risk of malware and unauthorized activity, it is advisable to implement firewall and proxy configurations that limit the ability of company assets to establish arbitrary internet connections.
Restrict the usage of remote-access software unless it is absolutely necessary for an individual’s job. Alternatively, implement stronger monitoring measures to identify any potential misuse. This software is a favorite among cybercriminals, especially IABs and ransomware operators, as it allows them to easily gain and retain access to networks.
We should disable ISO mounting since it has become an increasingly effective method for evading antivirus or endpoint detection systems.
To enhance security, it is crucial to implement USB access control as well as Group Policy Objects (GPOs) to effectively prevent any unauthorized execution of autorun commands. If business conditions permit, it would be prudent to consider disabling access to any removable media.
Provide comprehensive training for your staff to effectively identify social-engineering tactics that are commonly utilized on the web. Additionally, ensure that your team has an accessible and appropriate channel to promptly report any suspicious emails or other potentially malicious activities they come across.
