ACSC ransomware profile – Royal

Royal ransomware is likely associated with Russian-speaking cybercrime actors Context: Royal is a ransomware variant first observed in September 2022, used by cybercriminals to conduct ransomware attacks against multiple sectors and organisations worldwide, including Australia. Once gaining access to a victim’s environment, cybercriminals use this ransomware for similar purposes to other…

Read More

An introduction to securing smart places

System failures in smart places could have significant consequences Introduction The ACSC has released a new publication An Introduction to Securing Smart Places to assist public and private organisations in securely implementing and sustaining smart place technology. The highly connected nature of our cities and towns’ public and private infrastructure creates efficiencies…

Read More

ACSC participation in Asia Pacific Computer Emergency Response Team

Ransomware poses one of the most significant threats to Australian organisations The capability of leading economies in the Asia-Pacific region to respond to serious cyber security incidents has been tested through annual drills designed to lift cyber security cooperation and capability among members. The drills are organised by the Asia…

Read More

Exploitation of Microsoft Office vulnerability: Follina

Affected Australian organisations should take appropriate action. Background / What has happened? Microsoft has disclosed a remote code execution (RCE) vulnerability in the Microsoft Support Diagnostic Tool (MSDT). This vulnerability, dubbed “Follina”, can be exploited by an attacker sending a URL to a vulnerable machine. Successful exploitation allows an attacker…

Read More

Multiple vulnerabilities present in F5 products

F5 released a security advisory relating to multiple Critical and High rated CVE’s. Update Multiple Critical and High-risk vulnerabilities exist in certain versions of F5 products. As of 10 May 2022, the ACSC is aware of malicious cyber actors actively exploiting vulnerable versions of F5 products in Australia and globally.…

Read More

APT cyber actors exploiting Microsoft Exchange and Fortinet vulnerabilities

Advisory issued by FBI, CISA, ACSC and NCSC. A joint cybersecurity advisory is the result of an analytic effort among the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre (ACSC), and the United Kingdom’s National Cyber Security Centre (NCSC) to highlight…

Read More

Malicious cyber actors are actively targeting Australians

Key cyber threats affecting Australia and provides vital advice on to protect businesses online. The Australian Cyber Security Centre (ACSC) has released its  Annual Cyber Threat Report 2020–21, highlighting the key cyber threats affecting Australian systems and networks, and uses strategic assessments, statistics, trends analysis, and case studies to describe…

Read More

APCERT drill themed supply chain attack through spear-phishing

APAC countries come together to reflect on real-life cyber security incidents. The Asia Pacific Computer Emergency Response Team has successfully completed its annual drill to test the response capability of leading Computer Security Incident Response Teams (CSIRT) within the Asia Pacific economies. The theme of this year’s APCERT Drill is…

Read More

Global cyber agencies share top routinely exploited vulnerabilities

Four of the most targeted vulnerabilities in 2020 involved remote work. The US Cybersecurity and Infrastructure Security Agency (CISA), Australian Cyber Security Centre (ACSC), United Kingdom’s National Cyber Security Centre (NCSC) and Federal Bureau of Investigation (FBI) released a joint cybersecurity advisory highlighting the top Common Vulnerabilities and Exposures (CVEs) routinely…

Read More

SonicWall devices targeted with ransomware utilising stolen credentials

Review their networks for the presence of affected SonicWall products. The Australian Cyber Security Centre has issued an alert over SonicWall, a network and cyber security appliance vendor, reporting that ransomware activity is currently targeting their Secure Mobile Access (SMA) and Secure Remote Access (SRA) products. This ransomware activity is…

Read More