AEROSPACE TECH WEEK’s Post

The U.S. government revealed that the Chinese hacking group Volt Typhoon infiltrated critical U.S. infrastructure networks for over five years, targeting sectors like energy and transportation. Utilizing “living off the land” tactics, they blended malicious activities with normal operations, making detection difficult. This operation threatens to disrupt essential services, highlighting the need for advanced cybersecurity measures to protect against such sophisticated and stealthy threats. Volt Typhoon’s tactics include leveraging multi-hop proxies and conducting extensive reconnaissance to maintain long-term, undetected access to targeted networks, posing significant risks to national security. Often, the initial access for these breaches or attacks comes from third-party services or applications linked to the critical infrastructure. These external parties are usually small businesses or startups prioritizing service delivery at lower costs over implementing stringent security measures. https://lnkd.in/gqt2ytFr #criticalinfrastructure #CNI #OTSecurity

🔴 A new cyber espionage threat, TIDRONE, is targeting #drone manufacturers in Taiwan—potentially compromising #military operations. #TIDRONE uses custom #malware like #CXCLNT and #CLNTEND to #exploit #system #vulnerabilities and #steal #sensitive #data. 🔘 Trend Micro is tracking the adversary under the moniker TIDRONE, stating the activity is espionage-driven given the focus on military-related #industry chains. 🔘 The exact initial access vector used to breach targets is presently unknown, with Trend Micro's analysis uncovering the deployment of custom malware such as CXCLNT and CLNTEND using remote desktop tools like #UltraVNC. 🔘 An interesting commonality observed across different victims is the presence of the same enterprise resource planning (ERP) software, raising the possibility of a supply #chain #attack. 🔘 The attack chains subsequently go through three different stages that are designed to facilitate privilege escalation by means of a User Access Control (UAC) bypass, credential dumping, and defense evasion by disabling antivirus products installed on the hosts. 🔘 Both the backdoors are initiated by sideloading a rogue DLL via the Microsoft Word application, allowing the threat actors to harvest a wide range of sensitive information, 🔘 CXCLNT comes equipped with basic upload and download file capabilities, as well as features for clearing traces, collecting victim information such as file listings and computer names, and downloading next-stage portable executable (PE) and DLL files for execution. 🔘 CLNTEND, first detected in April 2024, is a discovered remote access tool (RAT) that supports a wider range of network protocols for communication, including #TCP, #HTTP, #HTTPS, #TLS, and #SMB (port 445). 🔘 “The consistency in file compilation times and the threat actor's operation time with other Chinese espionage-related activities supports the assessment that this campaign is likely being carried out by an as-yet unidentified Chinese-speaking threat group," security researchers Yu-Lin Lee and Vickie Su said. #rcc #cybersecurity #espionage #data #intelligence #dnsc #cyberint

The U.S. Coast Guard Cyber Command (CGCYBER) announced on Monday that network-connected #OT (operational technology) introduces potential vulnerabilities to the #marine environment (ME). Organizations within the marine infrastructure are increasingly adopting internet-connected OT systems, thereby expanding the attack surface for #cyberthreats. “In 2023, Coast Guard Cyber Protection Teams (CPTs) found that OT network segments often contained an organization’s most critical and most vulnerable systems. In most cases, CPTs observed OT systems running End-of-Life software with known exploitable vulnerabilities (KEV),” the @CGCYBER detailed in its second annual Cyber Trends and Insights in the Marine Environment (CTIME) report. “Additionally, #OTsystems often utilize vulnerable network protocols allowing for further exploitation and privilege escalation. These risks are further exacerbated when #OTnetworks lack sufficient access controls, allowing adversaries to jump from the information technology (IT) networks to the OT networks. This could allow adversaries to deliver effects in the physical domain.” #Threatlandscape #Criticalinfrastructure https://lnkd.in/dyVAUccg

Two zero-day #vulnerabilities in Ivanti products revealed last week are being exploited en masse worldwide, with over 1700 devices already compromised, Volexity has warned. The security vendor said in a blog post yesterday that victims come from a variety of sectors including #government, #military, #telecoms, #technology, #finance, #consulting and #aerospace. “Victims are globally distributed and vary greatly in size, from small businesses to some of the largest organizations in the world, including multiple Fortune 500 Companies across multiple industry verticals,” it warned. “On Sunday, January 14 2024, Volexity had identified over 1700 ICS VPN appliances that were compromised with the GiftedVisitor webshell. These #appliances appear to have been indiscriminately targeted, with victims all over the world.” Volexity believes the #threatactor behind these compromises is the same Chinese group (#UTA0178) first observed exploiting the zero-day vulnerabilities back in December 2023. #cybersecurity

The PAGER Cyberattack of September 17, 2024, represents a chilling evolution in the landscape of cyber warfare, where the fusion of cyber and physical elements has led to unprecedented levels of destruction and loss of life. The sophisticated supply chain interference and remote detonation of pagers underscore the escalating risks and vulnerabilities inherent in our increasingly interconnected world. The indiscriminate nature of the attack, resulting in civilian casualties, raises significant ethical and legal concerns, highlighting the urgent need for enhanced cybersecurity measures, real-time threat detection systems, and a comprehensive legal framework to govern the use of cyber weapons. Ina nutshell, it is clear that securing global supply chains, building resilience against cyber-physical attacks, and establishing ethical guidelines for cyber operations are paramount to preventing such devastating attacks in the future. https://lnkd.in/eRBmtYge

"he is surprised by how many enterprise CISOs today are overly reliant on their defenses and explicitly not preparing for EDR/XDR evasion tactics. They are overestimating the capabilities of their traditional EDR platforms. These technologies are being disabled and the attacks are successfully occurring" 😳😲😬 There goes that major investment down the drains 🤑⬇️💰 Firstly, EDR/XDR is only considered for first line defense - and has no added value without a robust and well executed security architecture (like NW segregation, 0trust) and having an active security incident response team!! 🤼👍🏻 Secondly, never rely on just one line of defense - always use layered defenses and be proactively alert with metrics !! 📐📏 What's the old saying? 🤔 'Never put all your eggs in one basket' 🐣🥚🍳 Stay Vigilant and Keep Safe!! #defense #edrxdr #layered https://lnkd.in/ee2ZDXdY

The frustrating part of this story comes from the Joint Guidance: Identifying and Mitigating Living Off the Land Techniques. Which Volt Typhoon and many other APTs are known for to remain undetected. In the guidance it states something that in my experience in defending against LOTL tactics in IT/OT environments is entirely false, at least when unpredictability and deception are in play for defenders as an Active Cyber Defense. "... There is no foolproof solution to fully prevent or detect LOTL activity, but by applying these best practices organizations can best position themselves for more effective detection and mitigation." There were 5 best practices from log rotation to UEBA, nothing was mentioned about the powerful countermeasure to LOTL tactics, deception...... #cybersecurity #cyberresilience MITRE Engage #criticalinfrastructure #defenseindepth #apt

#securityprofessionals, this is a bit of a follow-up on the ‘China hackers in US infrastructure’ story; it appears that they’ve had access much longer than expected: “US authoring agencies have recently observed indications of Volt Typhoon actors maintaining access and footholds within some victim IT environments for at least five years.” #china #us #cybersecurity #infrastructure #infrastructuresecurity #volttypoon #hackers #threatlandscape https://lnkd.in/em5gGJui

The increasing sophistication of #cyberattacks and the growing susceptibility of public IT infrastructures demand robust strategies for crisis management and risk mitigation. IT disruptions amidst cyber-crises can significantly affect the functionality of critical infrastructures and essential services so they must be dealt urgently to avoid physical, economic, and/or reputational damage. Cyber-attacks have become a key part of intelligence and military operations and also criminal activities. Without proper measures, countries, cities, infraestructures, etc.. are vulnerable to disruption by these threats and that is why the connection between cybersecurity and safety is a matter of crucial importance for industry, goverments, etc. At QA&TEST Safety and Cybersecurity, we will delve into the intersection of #safety and #cybersecurity, empowering us to navigate this dynamic and critical landscape. We will engage in discussions with industry experts as we explore strategies, tools, and methodologies for safeguarding critical assets and protecting the well-being of individuals and communities. Register now 👉 https://n9.cl/jx6s3r #qatest #conference #conferences #software #April #Madrid #Spain

With data centres now being designated as critical national infrastructure by the UK government, their importance in keeping the digital economy running and safeguarding our personal data has never been clearer. As the demand for these facilities grows, so too does the need for robust protection and security around them. At Siddall and Hilton, we understand the critical role that secure fencing plays in safeguarding sensitive infrastructure like data centres. Our welded mesh solutions are built to offer high security and durability, providing essential protection against both physical and cyber threats. It’s not just about securing property – it’s about securing the future of technology and the economy. As these sites become even more integral to our daily lives, we’re proud to play a part in protecting the infrastructure that keeps the digital world running. #DataCentres #CriticalInfrastructure #Security #FencingSolutions #SiddallAndHilton