‘PseudoManuscrypt’ Mass Spyware Campaign Targets 35K Systems

Researchers have tracked new spyware – dubbed “PseudoManuscrypt” because it’s similar to “Manuscrypt” malware from the Lazarus advanced persistent threat APT group – that’s attempted to scribble itself across more than 35,000 targeted computers in 195 countries. Kaspersky researchers said in a...

PseudoManuscrypt: a mass-scale spyware attack campaign

In June 2021, Kaspersky ICS CERT experts identified malware whose loader has some similarities to the Manuscrypt malware, which is part of the Lazarus APT groups arsenal. In 2020, the group used Manuscrypt in attacks on defense enterprises in different countries. These attacks are described in th...

Mitsubishi Electric GX Works2

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/high attack complexity Vendor: Mitsubishi Electric Equipment: GX Works2 Vulnerability: Improper Handling of Length Parameter Inconsistency 2. RISK EVALUATION Successful exploitation of this vulnerability may cause a...

CISA Releases Security Advisory for Hillrom Welch Allyn Cardiology Products

CISA has released an Industrial Controls Systems Medical Advisory ICSMA detailing a vulnerability in multiple Hillrom Welch Allyn cardiology products. An attacker could exploit this vulnerability to take control of an affected system. CISA encourages technicians and administrators to review...

WECON LeviStudioU

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: WECON Technology Co., Ltd WECON Equipment: LeviStudioU Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow arbitrary code execution. 3. TECHNICAL DETAILS...

Researches Detail 17 Malicious Frameworks Used to Attack Air-Gapped Networks

Four different malicious frameworks designed to attack air-gapped networks were detected in the first half of 2020 alone, bringing the total number of such toolkits to 17 and offering adversaries a pathway to cyber espionage and exfiltrate classified information. "All frameworks are designed to...

Hitachi Energy PCM600 Update Manager

1. EXECUTIVE SUMMARY CVSS v3 6.7 Vendor: Hitachi Energy Equipment: PCM600 Update Manager Vulnerability: Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to bypass the certificate validation and install an untrusted software...

Covert-Control - Google Drive, OneDrive And Youtube As Covert-Channels - Control Systems Remotely By Uploading Files To Google Drive, OneDrive, Youtube Or Telegram

Control systems remotely by uploading files to Google Drive, OneDrive, Youtube or Telegram using Python to create the files and the listeners. It allows to create text files, images, audio or videos, with the commands in cleartext or encrypted using AES. covert-googledrive.py - Control systems...

Siemens Mendix

1. EXECUTIVE SUMMARY CVSS v3 4.0 ATTENTION: Low attack complexity Vendor: Siemens Equipment: Mendix Vulnerability: Use of Web Browser Cache Containing Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a local attacker to read cached documents by...

mySCADA myDESIGNER

1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Low attack complexity Vendor: mySCADA Equipment: myDESIGNER Vulnerability: Relative Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow for remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The...

Siemens NX JT Translator

1. EXECUTIVE SUMMARY CVSS v3 3.3 ATTENTION: Low attack complexity Vendor: Siemens Equipment: NX Vulnerabilities: Out-of-bounds Read, Access of Uninitialized Pointer 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead to access violation and arbitrary code execution on...

ICSwiki

This is an offensive tool for ICS Industrial Control Systems testing. It is a collection of scripts and tools for identifying and exploiting vulnerabilities in ICS protocols, specifically IEC-60870-5-104 and IEC-61850-8-1. The tool is designed to send identify requests and extract vendor name,...

CISA Issues Warning On Cyber Threats Targeting Water and Wastewater Systems

The U.S. Cybersecurity Infrastructure and Security Agency CISA on Thursday warned of continued ransomware attacks aimed at disrupting water and wastewater facilities WWS, highlighting five incidents that occurred between March 2019 and August 2021. "This activity—which includes attempts to...

Covert-Tube - Youtube As Covert-Channel - Control Systems Remotely And Execute Commands By Uploading Videos To Youtube

A program to control systems remotely by uploading videos to Youtube using Python to create the videos and the listener, emulating some malware I was reading about. It allows to create videos with frames formed of simple text, QR codes with cleartext or QR codes using AES encryption. Create a vid...

Johnson Controls exacqVision Server Bundle

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Exacq Technologies, a subsidiary of Johnson Controls, Inc. Equipment: exacqVision Server Bundle Vulnerability: Improper Privilege Management= 2. RISK EVALUATION Successful exploitation of this...

CISA, NIST Says Use Cybersecurity Control Systems

The agencies conducted a crosswalk of existing cybersecurity documents and identified nine categories to be used as the foundation for preliminary control systems cybersecurity performance goals...

CISA Releases Security Advisory for Honeywell Experion and ACE Controllers

CISA has released an Industrial Controls Systems ICS advisory detailing multiple vulnerabilities affecting all versions of Honeywell Experion Process Knowledge System C200, C200E, C300, and ACE controllers. A remote attacker could exploit some of these vulnerabilities to take control of an affect...

Johnson Controls Sensormatic Electronics KT-1

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sensormatic Electronics, LLC., a subsidiary of Johnson Controls, Inc. Equipment: KT-1 Vulnerability: Authentication Bypass by Capture-replay 2. RISK EVALUATION Successful exploitation of this...

Siemens APOGEE and TALON

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: APOGEE and TALON Vulnerability: Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the...

Advantech WebAccess

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Advantech Equipment: WebAccess Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow remote code execution. 3. TECHNICAL DETAILS 3.1...