Monday, February 22, 2021
Thursday, February 18, 2021
pfSense Plus 21.02-RELEASE and pfSense CE 2.5.0-RELEASE Now Available
We are excited to announce the release of pfSense® Plus software version 21.02 and pfSense Community Edition (CE) software version 2.5.0, now available for new installations and upgrades!
https://www.netgate.com/blog/pfsense-plus-21-02-release-and-pfsense-ce-2-5-0-release-now-available.html
Detecting and Blocking Malware Threats with SIEM and EDR
The post Detecting and Blocking Malware Threats with SIEM and EDR appeared first on LogRhythm.
https://logrhythm.com/detecting-and-blocking-malware-threats-with-siem-and-edr/
Sent from my iPhone
Thursday, November 5, 2020
Cisco discloses AnyConnect VPN zero-day with public PoC exploits
Cisco discloses AnyConnect VPN zero-day with public PoC exploits
https://www.bleepingcomputer.com/news/security/cisco-discloses-anyconnect-vpn-zero-day-with-public-poc-exploits/
https://www.bleepingcomputer.com/news/security/cisco-discloses-anyconnect-vpn-zero-day-with-public-poc-exploits/
Cisco has disclosed today a zero-day vulnerability in the Cisco AnyConnect Secure Mobility Client software with proof-of-concept exploit code publicly available. [...]
Friday, October 30, 2020
Security Onion Essentials training available now for FREE!
Security Onion Essentials training available now for FREE!
https://blog.securityonion.net/2020/10/security-onion-essentials-training.html
https://blog.securityonion.net/2020/10/security-onion-essentials-training.html
We've just released Security Onion Essentials training for our new Security Onion 2 platform and it's FREE! You can find it on our website at:
https://securityonion.net/training
AA20-302A: Ransomware Activity Targeting the Healthcare and Public Health Sector [feedly]
AA20-302A: Ransomware Activity Targeting the Healthcare and Public Health Sector
https://us-cert.cisa.gov/ncas/alerts/aa20-302a
Original release date: October 28, 2020 | Last revised: October 29, 2020
https://us-cert.cisa.gov/ncas/alerts/aa20-302a
Original release date: October 28, 2020 | Last revised: October 29, 2020
Summary
This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 7 framework. See the ATT&CK for Enterprise version 7 for all referenced threat actor tactics and techniques.
This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS). This advisory describes the tactics, techniques, and procedures (TTPs) used by cybercriminals against targets in the Healthcare and Public Health Sector (HPH) to infect systems with Ryuk ransomware for financial gain.
CISA, FBI, and HHS have credible information of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers. CISA, FBI, and HHS are sharing this information to provide warning to healthcare providers to ensure that they take timely and reasonable precautions to protect their networks from these threats.
Click here for a PDF version of this report.
Key Findings
- CISA, FBI, and HHS assess malicious cyber actors are targeting the HPH Sector with Trickbot malware, often leading to ransomware attacks, data theft, and the disruption of healthcare services.
- These issues will be particularly challenging for organizations within the COVID-19 pandemic; therefore, administrators will need to balance this risk when determining their cybersecurity investments.
Technical Details
Threat Details
Since 2016, the cybercriminal enterprise behind Trickbot malware has continued to develop new functionality and tools increasing the ease, speed, and profitability of victimization. What began as a banking trojan and descendant of Dyre malware, now provides its operators a full suite of tools to conduct a myriad of illegal cyber activities. These activities include credential harvesting, mail exfiltration, cryptomining, point-of-sale data exfiltration, and the deployment of ransomware, such as Ryuk. In early 2019, the FBI began to observe new Trickbot modules named Anchor, which cyber actors typically used in attacks targeting high-profile victims—such as large corporations. These attacks often involved data exfiltration from networks and point-of-sale devices. As part of the new Anchor toolset, Trickbot developers created anchor_dns, a tool for sending and receiving data from victim machines using Domain Name System (DNS) tunneling.
anchor_dns is a backdoor that allows victim machines to communicate with command and control (C2) servers over DNS to evade typical network defense products and make their malicious communications blend in with legitimate DNS traffic. anchor_dns uses a single-byte XOR cipher to encrypt its communications, which have been observed using key 0xB9. Once decrypted, the string anchor_dns can be found in the DNS request traffic.
Trickbot Indicators of Compromise
After successful execution of the malware, Trickbot copies itself as an executable file with a 12-character (includes .exe), randomly generated file name (e.g. mfjdieks.exe) and places this file in one of the following directories.
- C:\Windows\
- C:\Windows\SysWOW64\
- C:\Users\[Username]\AppData\Roaming\
The malware may also drop a file named anchorDiag.txt in one of the directories listed above.
Prior to initiating communications with the C2 server, the malware uses an infection marker of Global\fde345tyhoVGYHUJKIOuy, typically found in the running memory of the victim machine.
Part of the initial network communications with the C2 server involves sending information about the victim machine such as its computer name/hostname, operating system version, and build via a base64-encoded GUID. The GUID is composed of /GroupID/ClientID/with the following naming convention:
/anchor_dns/[COMPUTERNAME]_[WindowsVersionBuildNo].[32CharacterString]/.
The malware uses scheduled tasks that run every 15 minutes to ensure persistence on the victim machine. The scheduled task typically uses the following naming convention.
[random_folder_name_in_%APPDATA%_excluding_Microsoft]
autoupdate#[5_random_numbers] (e.g., Task autoupdate#16876).
After successful execution, anchor_dns further deploys malicious batch scripts (.bat) using PowerShell commands.
The malware deploys self-deletion techniques by executing the following commands.
cmd.exe /c timeout 3 && del C:\Users\[username]\[malware_sample]cmd.exe /C PowerShell \"Start-Sleep 3; Remove-Item C:\Users\[username]\[malware_sample_location]\"
The following domains found in outbound DNS records are associated with anchor_dns.
kostunivo[.]comchishir[.]commangoclone[.]comonixcellent[.]com
This malware used the following legitimate domains to test internet connectivity.
ipecho[.]netapi[.]ipify[.]orgcheckip[.]amazonaws[.]comip[.]anysrc[.]netwtfismyip[.]comipinfo[.]ioicanhazip[.]commyexternalip[.]com
The anchor_dns malware historically used the following C2 servers.
23[.]95[.]97[.]5951[.]254[.]25[.]115193[.]183[.]98[.]6691[.]217[.]137[.]3787[.]98[.]175[.]85
Ryuk Ransomware
Typically Ryuk has been deployed as a payload from banking Trojans such as Trickbot. (See the United Kingdom (UK) National Cyber Security Centre (NCSC) advisory, Ryuk Ransomware Targeting Organisations Globally, on their ongoing investigation into global Ryuk ransomware campaigns and associated Emotet and TrickBot malware.) Ryuk first appeared in August 2018 as a derivative of Hermes 2.1 ransomware, which first emerged in late 2017 and was available for sale on the open market as of August 2018. Ryuk still retains some aspects of the Hermes code. For example, all of the files encrypted by Ryuk contain the HERMES tag but, in some infections, the files have .ryk added to the filename, while others do not. In other parts of the ransomware code, Ryuk has removed or replaced features of Hermes, such as the restriction against targeting specific Eurasia-based systems.
While negotiating the victim network, Ryuk actors will commonly use commercial off-the-shelf products—such as Cobalt Strike and PowerShell Empire—in order to steal credentials. Both frameworks are very robust and are highly effective dual-purpose tools, allowing actors to dump clear text passwords or hash values from memory with the use of Mimikatz. This allows the actors to inject malicious dynamic-link library into memory with read, write, and execute permissions. In order to maintain persistence in the victim environment, Ryuk actors have been known to use scheduled tasks and service creation.
Ryuk actors will quickly map the network in order to enumerate the environment to understand the scope of the infection. In order to limit suspicious activity and possible detection, the actors choose to live off the land and, if possible, use native tools—such as net view, net computers, and ping—to locate mapped network shares, domain controllers, and active directory. In order to move laterally throughout the network, the group relies on native tools, such as PowerShell, Windows Management Instrumentation (WMI), Windows Remote Management , and Remote Desktop Protocol (RDP). The group also uses third-party tools, such as Bloodhound.
Once dropped, Ryuk uses AES-256 to encrypt files and an RSA public key to encrypt the AES key. The Ryuk dropper drops a .bat file that attempts to delete all backup files and Volume Shadow Copies (automatic backup snapshots made by Windows), preventing the victim from recovering encrypted files without the decryption program.
In addition, the attackers will attempt to shut down or uninstall security applications on the victim systems that might prevent the ransomware from executing. Normally this is done via a script, but if that fails, the attackers are capable of manually removing the applications that could stop the attack. The RyukReadMe file placed on the system after encryption provides either one or two email addresses, using the end-to-end encrypted email provider Protonmail, through which the victim can contact the attacker(s). While earlier versions provide a ransom amount in the initial notifications, Ryuk users are now designating a ransom amount only after the victim makes contact.
The victim is told how much to pay to a specified Bitcoin wallet for the decryptor and is provided a sample decryption of two files.
Initial testing indicates that the RyukReadMe file does not need to be present for the decryption script to run successfully but other reporting advises some files will not decrypt properly without it. Even if run correctly, there is no guarantee the decryptor will be effective. This is further complicated because the RyukReadMe file is deleted when the script is finished. This may affect the decryption script unless it is saved and stored in a different location before running.
According to MITRE, Ryuk uses the ATT&CK techniques listed in table 1.
Table 1: Ryuk ATT&CK techniques
| Technique | Use |
|---|---|
| System Network Configuration Discovery [T1016] | Ryuk has called GetIpNetTable in attempt to identify all mounted drives and hosts that have Address Resolution Protocol entries. |
Masquerading: Match Legitimate Name or Location [T1036.005] | Ryuk has constructed legitimate appearing installation folder paths by calling GetWindowsDirectoryW and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as C:\Users\Public. |
| Process Injection [T1055] | Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread. |
| Process Discovery [T1057] | Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes. |
| Command and Scripting Interpreter: Windows Command Shell [T1059.003] | Ryuk has used cmd.exe to create a Registry entry to establish persistence. |
| File and Directory Discovery [T1083] | Ryuk has called GetLogicalDrives to enumerate all mounted drives, and GetDriveTypeW to determine the drive type. |
| Native API [T1106] | Ryuk has used multiple native APIs including ShellExecuteW to run executables; GetWindowsDirectoryW to create folders; and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection. |
| Access Token Manipulation [T1134] | Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege. |
| Data Encrypted for Impact [T1486] | Ryuk has used a combination of symmetric and asymmetric encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory. |
| Service Stop [T1489] | Ryuk has called kill.bat for stopping services, disabling services and killing processes. |
| Inhibit System Recovery [T1490] | Ryuk has used vssadmin Delete Shadows /all /quiet to delete volume shadow copies and vssadmin resize shadowstorage to force deletion of shadow copies created by third-party applications. |
| Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1047.001] | Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. |
| Impair Defenses: Disable or Modify Tools [T1562.001] | Ryuk has stopped services related to anti-virus. |
Mitigations
For a downloadable copy of IOCs, see AA20-302A.stix.
Plans and Policies
CISA, FBI, and HHS encourage HPH Sector organizations to maintain business continuity plans—the practice of executing essential functions through emergencies (e.g., cyberattacks)—to minimize service interruptions. Without planning, provision, and implementation of continuity principles, organizations may be unable to continue operations. Evaluating continuity and capability will help identify continuity gaps. Through identifying and addressing these gaps, organizations can establish a viable continuity program that will help keep them functioning during cyberattacks or other emergencies. CISA, FBI, and HHS suggest HPH Sector organizations review or establish patching plans, security policies, user agreements, and business continuity plans to ensure they address current threats posed by malicious cyber actors.
Network Best Practices
- Patch operating systems, software, and firmware as soon as manufacturers release updates.
- Check configurations for every operating system version for HPH organization-owned assets to prevent issues from arising that local users are unable to fix due to having local administration disabled.
- Regularly change passwords to network systems and accounts and avoid reusing passwords for different accounts.
- Use multi-factor authentication where possible.
- Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs.
- Implement application and remote access allow listing to only allow systems to execute programs known and permitted by the established security policy.
- Audit user accounts with administrative privileges and configure access controls with least privilege in mind.
- Audit logs to ensure new accounts are legitimate.
- Scan for open or listening ports and mediate those that are not needed.
- Identify critical assets such as patient database servers, medical records, and teleheatlh and telework infrastructure; create backups of these systems and house the backups offline from the network.
- Implement network segmentation. Sensitive data should not reside on the same server and network segment as the email environment.
- Set antivirus and anti-malware solutions to automatically update; conduct regular scans.
Ransomware Best Practices
CISA, FBI and HHS do not recommend paying ransoms. Payment does not guarantee files will be recovered. It may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. In addition to implementing the above network best practices, the FBI, CISA and HHS also recommend the following:
- Regularly back up data, air gap, and password protect backup copies offline.
- Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, secure location.
User Awareness Best Practices
- Focus on awareness and training. Because end users are targeted, make employees and stakeholders aware of the threats—such as ransomware and phishing scams—and how they are delivered. Additionally, provide users training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.
- Ensure that employees know who to contact when they see suspicious activity or when they believe they have been a victim of a cyberattack. This will ensure that the proper established mitigation strategy can be employed quickly and efficiently.
Recommended Mitigation Measures
System administrators who have indicators of a Trickbot network compromise should immediately take steps to back up and secure sensitive or proprietary data. Trickbot infections may be indicators of an imminent ransomware attack; system administrators should take steps to secure network devices accordingly. Upon evidence of a Trickbot infection, review DNS logs and use the XOR key of 0xB9 to decode XOR encoded DNS requests to reveal the presence of Anchor_DNS, and maintain and provide relevant logs.
GENERAL RANSOMWARE MITIGATIONS — HPH SECTOR
This section is based on CISA and Multi-State Information Sharing and Analysis Center (MS-ISAC)'s Joint Ransomware Guide, which can be found at https://www.cisa.gov/publication/ransomware-guide.
CISA, FBI, and HHS recommend that healthcare organizations implement both ransomware prevention and ransomware response measures immediately.
Ransomware Prevention
Join and Engage with Cybersecurity Organizations
CISA, FBI, and HHS recommend that healthcare organizations take the following initial steps:
- Join a healthcare information sharing organization, H-ISAC:
- Health Information Sharing and Analysis Center (H-ISAC): https://h-isac.org/membership-account/join-h-isac/
- Sector-based ISACs - National Council of ISACs: https://www.nationalisacs.org/member-isacs
- Information Sharing and Analysis Organization (ISAO) Standards Organization: https://www.isao.org/information-sharing-groups/
- Engage with CISA and FBI, as well as HHS—through the HHS Health Sector Cybersecurity Coordination Center (HC3)—to build a lasting partnership and collaborate on information sharing, best practices, assessments, and exercises.
Engaging with the H-ISAC, ISAO, CISA, FBI, and HHS/HC3 will enable your organization to receive critical information and access to services to better manage the risk posed by ransomware and other cyber threats.
Follow Ransomware Best Practices
Refer to the best practices and references below to help manage the risk posed by ransomware and support your organization's coordinated and efficient response to a ransomware incident. Apply these practices to the greatest extent possible based on availability of organizational resources.
- It is critical to maintain offline, encrypted backups of data and to regularly test your backups. Backup procedures should be conducted on a regular basis. It is important that backups be maintained offline or in separated networks as many ransomware variants attempt to find and delete any accessible backups. Maintaining offline, current backups is most critical because there is no need to pay a ransom for data that is readily accessible to your organization.
- Use the 3-2-1 rule as a guideline for backup practices. The rule states that three copies of all critical data are retained on at least two different types of media and at least one of them is stored offline.
- Maintain regularly updated "gold images" of critical systems in the event they need to be rebuilt. This entails maintaining image "templates" that include a preconfigured operating system (OS) and associated software applications that can be quickly deployed to rebuild a system, such as a virtual machine or server.
- Retain backup hardware to rebuild systems in the event rebuilding the primary system is not preferred.
- Hardware that is newer or older than the primary system can present installation or compatibility hurdles when rebuilding from images.
- Ensure all backup hardware is properly patched.
- In addition to system images, applicable source code or executables should be available (stored with backups, escrowed, license agreement to obtain, etc.). It is more efficient to rebuild from system images, but some images will not install on different hardware or platforms correctly; having separate access to needed software will help in these cases.
- Create, maintain, and exercise a basic cyber incident response plan and associated communications plan that includes response and notification procedures for a ransomware incident.
- Review available incident response guidance, such as CISA's Technical Approaches to Uncovering and Remediating Malicious Activity https://us-cert.cisa.gov/ncas/alerts/aa20-245a.
- Help your organization better organize around cyber incident response.
- Develop a cyber incident response plan.
- The Ransomware Response Checklist, available in the CISA and MS-ISAC Joint Ransomware Guide, serves as an adaptable, ransomware- specific annex to organizational cyber incident response or disruption plans.
- Review and implement as applicable MITRE's Medical Device Cybersecurity: Regional Incident Preparedness and Response Playbook (https://www.mitre.org/sites/default/files/publications/pr-18-1550-Medical-Device-Cybersecurity-Playbook.pdf).
- Develop a risk management plan that maps critical health services and care to the necessary information systems; this will ensure that the incident response plan will contain the proper triage procedures.
- Plan for the possibility of critical information systems being inaccessible for an extended period of time. This should include but not be limited to the following:
- Print and properly store/protect hard copies of digital information that would be required for critical patient healthcare.
- Plan for and periodically train staff to handle the re-routing of incoming/existing patients in an expedient manner if information systems were to abruptly and unexpectedly become unavailable.
- Coordinate the potential for surge support with other healthcare facilities in the greater local area. This should include organizational leadership periodically meeting and collaborating with counterparts in the greater local area to create/update plans for their facilities to both abruptly send and receive a significant amount of critical patients for immediate care. This may include the opportunity to re-route healthcare employees (and possibly some equipment) to provide care along with additional patients.
- Consider the development of a second, air-gapped communications network that can provide a minimum standard of backup support for hospital operations if the primary network becomes unavailable if/when needed.
- Predefine network segments, IT capabilities and other functionality that can either be quickly separated from the greater network or shut down entirely without impacting operations of the rest of the IT infrastructure.
- Legacy devices should be identified and inventoried with highest priority and given special consideration during a ransomware event.
- See CISA and MS-ISAC's Joint Ransomware Guide for infection vectors including internet-facing vulnerabilities and misconfigurations; phishing; precursor malware infection; and third parties and managed service providers.
- HHS/HC3 tracks ransomware that is targeting the HPH Sector; this information can be found at http://www.hhs.gov/hc3.
Hardening Guidance
- The Food and Drug Administration provides multiple guidance documents regarding the hardening of healthcare and specifically medical devices found here: https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity.
- See CISA and MS-ISAC's Joint Ransomware Guide for additional in-depth hardening guidance.
Contact CISA for These No-Cost Resources
- Information sharing with CISA and MS-ISAC (for SLTT organizations) includes bi-directional sharing of best practices and network defense information regarding ransomware trends and variants as well as malware that is a precursor to ransomware.
- Policy-oriented or technical assessments help organizations understand how they can improve their defenses to avoid ransomware infection: https://www.cisa.gov/cyber-resource-hub.
- Assessments include Vulnerability Scanning and Phishing Campaign Assessment.
- Cyber exercises evaluate or help develop a cyber incident response plan in the context of a ransomware incident scenario.
- CISA Cybersecurity Advisors (CSAs) advise on best practices and connect you with CISA resources to manage cyber risk.
- Contacts:
- SLTT organizations: CyberLiaison_SLTT@cisa.dhs.gov
- Private sector organizations: CyberLiaison_Industry@cisa.dhs.gov
Ransomware Quick References
- Ransomware: What It Is and What to Do About It (CISA): General ransomware guidance for organizational leadership and more in-depth information for CISOs and technical staff: https://www.us-cert.cisa.gov/sites/default/files/publications/Ransomware_Executive_One-Pager_and_Technical_ Document-FINAL.pdf
- Ransomware (CISA): Introduction to ransomware, notable links to CISA products on protecting networks, specific ransomware threats, and other resources: https://www.us-cert.cisa.gov/Ransomware
- HHS/HC3: Ransomware that impacts HPH is tracked by the HC3 and can be found at www.hhs.gov/hc3
- Security Primer – Ransomware (MS-ISAC): Outlines opportunistic and strategic ransomware campaigns, common infection vectors, and best practice recommendations: https://www.cisecurity.org/white-papers/security-primer-ransomware/
- Ransomware: Facts, Threats, and Countermeasures (MS- ISAC): Facts about ransomware, infection vectors, ransomware capabilities, and how to mitigate the risk of ransomware infection: https://www.cisecurity.org/blog/ransomware- facts-threats-and-countermeasures/
- HHS Ransomware Fact Sheet: https://www.hhs.gov/sites/default/files/RansomwareFactSheet.pdf
- NIST Securing Data Integrity White Paper: https://csrc.nist.gov/publications/detail/white-paper/2020/10/01/securing-data-integrity-against-ransomware-attacks/draft
Ransomware Response Checklist
Remember: Paying the ransom will not ensure your data is decrypted or that your systems or data will no longer be compromised. CISA, FBI, and HHS do not recommend paying ransom.
Should your organization be a victim of ransomware, CISA strongly recommends responding by using the Ransomware Response Checklist located in CISA and MS-ISAC's Joint Ransomware Guide, which contains steps for detection and analysis as well as containment and eradication.
Consider the Need For Extended Identification or Analysis
- If extended identification or analysis is needed, CISA, HHS/HC3, or federal law enforcement may be interested in any of the following information that your organization determines it can legally share:
- Recovered executable file
- Copies of the readme file – DO NOT REMOVE the file or decryption may not be possible
- Live memory (RAM) capture from systems with additional signs of compromise (use of exploit toolkits, RDP activity, additional files found locally)
- Images of infected systems with additional signs of compromise (use of exploit toolkits, RDP activity, additional files found locally)
- Malware samples
- Names of any other malware identified on your system
- Encrypted file samples
- Log files (Windows Event Logs from compromised systems, Firewall logs, etc.)
- Any PowerShell scripts found having executed on the systems
- Any user accounts created in Active Directory or machines added to the network during the exploitation
- Email addresses used by the attackers and any associated phishing emails
- A copy of the ransom note
- Ransom amount and whether or not the ransom was paid
- Bitcoin wallets used by the attackers
- Bitcoin wallets used to pay the ransom (if applicable)
- Copies of any communications with attackers
Upon voluntary request, CISA can assist with analysis (e.g., phishing emails, storage media, logs, malware) at no cost to support your organization in understanding the root cause of an incident, even in the event additional remote assistance is not requested.
- CISA – Advanced Malware Analysis Center: https://www.malware.us-cert.gov/MalwareSubmission/pages/submission.jsf
- Remote Assistance – Request via Central@cisa.gov
Contact Information
CISA, FBI, and HHS recommend identifying and having on hand the following contact information for ready use should your organization become a victim of a ransomware incident. Consider contacting these organizations for mitigation and response assistance or for purpose of notification.
- State and Local Response Contacts
- IT/IT Security Team – Centralized Cyber Incident Reporting
- State and Local Law Enforcement
- Fusion Center
- Managed/Security Service Providers
- Cyber Insurance
To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI's 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by email at CyWatch@fbi.gov. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact. To request incident response resources or technical assistance related to these threats, contact CISA at Central@cisa.gov.
Additionally, see CISA and MS-ISAC's Joint Ransomware Guide for information on contacting—and what to expect from contacting—federal asset response and federal threat response contacts.
Disclaimer
This document is marked TLP:WHITE. Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol, see https://cisa.gov/tlp.
References
- CISA Emergency Services Sector Continuity Planning Suite
- CISA MS-ISAC Joint Ransomware Guide
- CISA Tip: Avoiding Social Engineering and Phishing Attacks
- FBI PSA: "High-Impact Ransomware Attacks Threaten U.S. Businesses and Organizations"
- Health Industry Cybersecurity Tactical Crisis Response
- Health Industry Cybersecurity Practices (HICP)
- HHS - Ransomware Spotlight Webinar
- HHS - Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients
- HHS - Ransomware Briefing
- HHS - Aggressive Ransomware Impacts
- HHS - Ransomware Fact Sheet
- HHS - Cyber Attack Checklist
- HHS - Cyber-Attack Response Infographic
- NIST - Data Integrity Publication
- NIST - Guide for Cybersecurity Event Recovery
- NIST - Identifying and Protecting Assets Against Ransomware and Other Destructive Events
- NIST - Detecting and Responding to Ransomware and Other Destructive Events
- NIST - Recovering from Ransomware and Other Destructive Events
Revisions
- October 28, 2020: Initial version
This product is provided subject to this Notification and this Privacy & Use policy.
Brooklyn & Vermont hospitals are latest Ryuk ransomware victims [feedly]
Brooklyn & Vermont hospitals are latest Ryuk ransomware victims
https://www.bleepingcomputer.com/news/security/brooklyn-and-vermont-hospitals-are-latest-ryuk-ransomware-victims/
https://www.bleepingcomputer.com/news/security/brooklyn-and-vermont-hospitals-are-latest-ryuk-ransomware-victims/
Wyckoff Heights Medical Center in Brooklyn and the University of Vermont Health Network are the latest victims of the Ryuk ransomware attack spree covering the healthcare industry across the U.S. [...]
Attacks exploiting Netlogon vulnerability (CVE-2020-1472) [feedly]
Attacks exploiting Netlogon vulnerability (CVE-2020-1472)
https://msrc-blog.microsoft.com/2020/10/29/attacks-exploiting-netlogon-vulnerability-cve-2020-1472/
Microsoft has received a small number of reports from customers and others about continued activity exploiting a vulnerability affecting the Netlogon protocol (CVE-2020-1472) which was previously addressed in security updates starting on August 11, 2020. If the original guidance is not applied, the vulnerability could allow an attacker to spoof a domain controller account that could be …
https://msrc-blog.microsoft.com/2020/10/29/attacks-exploiting-netlogon-vulnerability-cve-2020-1472/
Microsoft has received a small number of reports from customers and others about continued activity exploiting a vulnerability affecting the Netlogon protocol (CVE-2020-1472) which was previously addressed in security updates starting on August 11, 2020. If the original guidance is not applied, the vulnerability could allow an attacker to spoof a domain controller account that could be …
Attacks exploiting Netlogon vulnerability (CVE-2020-1472) Read More »
Tuesday, June 2, 2020
Wednesday, May 6, 2020
ChefConf Online Session Recordings: Chef Infra Week
https://blog.chef.io/chefconf-online-session-recordings-chef-infra-week/
Hello Chefs!
Are you new to the wonders of Automation and Chef Infra? Or are you a battle-scarred professional looking for some deep magic to manage your Chef Server with ease? ChefConf Online has some sessions for you!
Join us this week as we record some of the ChefConf Online sessions for Chef Infra. This is your chance to see a preview of the ChefConf content and interact with our speakers. We'll be recording on various days and times, so hopefully some sessions will work for you. No need to book out your whole day. And if you miss your favorite, sign up for ChefConf at chefconf.io and all the sessions will be available for free starting June 2 on our video on demand platform!
To sign up to attend these recording sessions and the others we have planned for May, visit chefconf.io/session-recordings.
So take a look at this great stuff:
Monday, May 4, 12pm PDT / 3pm EDT
Justin Rivait of CUNA Mutual Group returns to ChefConf with Mise en Place – Preparing Your Organization for a Successful Chef Infra Journey:
The hardest part of integrating Chef Infra into an organization isn't learning the technical aspect – it's helping others to understand "The Why", and to build a solid community of practitioners. Culinary students often learn the concept of "Mise en Place", or "Everything in its Place". From champions, to technical challenges – come learn from my organizations' lessons that enabled us to scale Chef out, and the epics and features that would have helped us grow faster and become more successful earlier in our journey.
As organizations look to bring new tools in to increase the quality of their infrastructure and speed software delivery, it's often engineers that identify what may be able to improve these processes. Generally what follows is a business case presented to leadership in order to secure funding, an initial purchase order, and then a discovery period for those engineers and their product or service owners on how to make the tool work well in their unique ecosystems. For many, it's tempting to start automating and delivering right away – to just get something out there to show value. Often there is low hanging fruit that can be pointed to as a success story – but it's the more complicated patterns that can slow adoption down. In order for real success to happen there must be a strong community and willingness to change the ways in which we work, as well as support from the bottom of the organization all the way to the business leaders that partner with IT. We can increase velocity and adoption of new tools and ideas by following the concept of "Mise en place", or "Everything in its Place" by laying a solid foundation for Chef, or any other new tool or concept in our organizations to remove friction and make new ideas become successful realities.
Come learn how we developed a community of practitioners, built support for Chef, and laid the groundwork for Chef to not only survive, but to excel in our organization. In this talk we'll share how to build a strong business case for Chef to garner support and build new champions. We'll also cover some epics and features that we think are critical to the success of Chef in an organization. Finally, we'll talk about some thoughts around removing friction from the development lifecycle for Chef Infra to make it easier to learn and use.
Tuesday May 5, 10am PDT / 1pm EDT
Join Dan-Joe Lopez from SAP for Chef Infra for Dummies: How SAP Ramps Up New Developers:
Are you new to Chef, configuration management, or automation in general? Are you looking for a quick intro to get you started? This talk is for you!
The SAP DevOps Center of Excellence is a global enablement team, helping our developer teams to adopt the DevOps culture and practices. We act as a knowledge base on topics, technologies and best practices surrounding automation, continuous integration, continuous delivery, micro architecture, etc.
We often work with the development teams to create custom solutions and pipelines, most of which include some chef management. As we work with new development teams, or add members to our own team, we have to quickly ramp up their knowledge of Chef Infra.
In this talk, we'll share with you how we ramp up knowledge in SAP to get our colleagues working with Chef fast and efficiently. You can expect to learn:
- The basic concepts of declarative configuration management and how it differs from scripted automation.
- Important terms you'll hear at ChefConf.
- The anatomy of a Chef cookbook.
- The process of a Chef client execution.
- How the Chef Infra Client and Server work together.
- Where to find resources to expand your knowledge and get your questions answered.
Wednesday May 6, 2pm PDT / 5pm EDT
Chef's Matt Ray presents Chef and Terraform: Better Together:
HashiCorp's Terraform is a popular open-source Infrastructure as Code tool that allows us to quickly provision and manage infrastructure across the cloud. There are a wide variety of complementary integrations between Chef Infra, Habitat, and InSpec with Terraform that enhance the ease of managing infrastructure, applications, and compliance. This talk will dive into what's available and provide live demos of the Terraform integrations working together as we discuss how these complementary technologies achieve the goals of Infrastructure as Code.
Thursday May 7, 12pm PDT / 3pm EDT
Already a seasoned Chef Infra user? Take a deep dive into the Chef Server API with Mark Gibbons.
Sometimes the knife command just isn't what you want when interacting with the Chef server. Chef Manage is going away or gone. The Chef Server API offers convenient access to the functions behind the knife commands. Web apps using the API can allow access to sensitive interfaces in a controlled manner.
Some of the functions the API gets used for include managing organizations, managing secrets via Vault, working with cookbooks and nodes, and managing the users on the team. We have many shared orgs with restricted (read only) access that receive updates via CI/CD only. We needed to allow access to organization and user information. How does a user ask for access to an organization when they can't display the information? How does a use find which organization owns a server? We also wanted to address auditing issues and to find a replacement for some Chef Manage functions and extension functions. We worked through these issues and more via the API.
Thursday May 7, 3pm PDT / 6pm EDT
Automating your environment is a marathon, not a sprint. Graham Davison shares his journey in his talk Third Time's a Charm: Introducing and Evolving a Chef Infra Implementation:
This talk will follow a five-year journey with Chef Infra. We will start with its introduction to an existing on-premise infrastructure and scaling as the environment grew. As we scaled, we extended some of the Chef command-line tools to ease deployment.
Next, we will explore the successful and less successful approaches to moving into a hybrid cloud infrastructure in AWS. We built AMIs using Packer and Chef Infra, but ended up with forked cookbook implementations for on-premise and cloud environments.
Finally, we will explore a cloud-centric deployment integrating AWS features with Chef Infra and Chef InSpec, and adopting Policyfiles.
Sign up for ChefConf Online!
These sessions and more will be available following our keynotes on June 2! If you miss the recording dates, register to attend on June 2 and you'll have access to all sessions on our video on demand platform. Plus you'll have access to other fun events, chats, and Q&A with our team. Don't miss it! Sign up today at chefconf.io.
The post ChefConf Online Session Recordings: Chef Infra Week appeared first on Chef Blog.
Subscribe to:
Posts (Atom)