The Cybersecurity and Infrastructure Security Agency reported that Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining techniques to target and steal sensitive data from organizations worldwide.
Details: CISA said:
-
The actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts.
-
To help mitigate against this activity, organizations should prioritize disabling unused services and ports, sanitizing web application inputs to prevent injection attacks, implementing multifactor authentication for all services, and applying timely patches to reduce risks of compromise.
Resource: ICBA last month released a white paper to help community banks address the challenges of securing cyber insurance coverage, with a particular focus on artificial intelligence issues.