Author: matthewframe

Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure

Posted on by matthewframe

The FBI, CISA, NSA assess pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems. Pro-Russia hacktivist groups—Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16, and affiliated groups—are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage. Targeted sectors include Water and Wastewater Systems, Food and Agriculture, and Energy.

More information on this alert can be found here.

BRICKSTORM Backdoor CISA Alert

Posted on by matthewframe

The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Canadian Centre for Cyber Security (Cyber Centre) assess People’s Republic of China (PRC) state-sponsored cyber actors are using BRICKSTORM malware for long-term persistence on victim systems. CISA, NSA, and Cyber Centre are releasing this Malware Analysis Report to share indicators of compromise (IOCs) and detection signatures based off analysis of eight BRICKSTORM samples. CISA, NSA, and Cyber Centre urge organizations to use the IOCs and detection signatures to identify BRICKSTORM malware samples.

More information on the alert can be found on the CISA website here.

Winter Weather Preparedness

Posted on by matthewframe

Winter storms can bring a combination of freezing temperatures, snow, ice, and extended power outages that pose significant challenges to water systems. Even brief periods of extreme cold can impact treatment processes, freeze exposed equipment, limit staffing, and disrupt transportation and chemical deliveries. Preparing now helps ensure continued safe operation and reliable service throughout the winter season.

Key preparedness reminders for waterworks:

  • Inspect and protect vulnerable equipment such as exposed pipes, meters, chemical feed lines, and outdoor instrumentation.
  • Verify backup power systems and ensure fuel, generators, and transfer switches are ready for potential outages.
  • Confirm employee call-down lists and ensure staff understand inclement weather reporting procedures.
  • Review chemical inventory and resupply plans in case road conditions delay deliveries.
  • Coordinate with local emergency management and monitor updates from the National Weather Service.

Prepare for customer impacts such as frozen service lines and potential low-pressure events

Being proactive with winter storm readiness supports operational resilience, protects infrastructure, and ensures the continued delivery of safe drinking water to Virginia communities. More information on winter weather and emergency preparedness can be found here.

Lead and Copper Rule Revisions Guidance

Posted on by matthewframe

EPA has introduced the Lead and Copper Rule Revisions (LCRR) and Lead and Copper Rule Improvements (LCRI). ODW staff have compiled resources for utilities to ensure they properly implement the rule changes and additions.

Information can be found here

Microsoft Sharepoint Vulnerabilities

Posted on by matthewframe

The U.S. EPA is issuing this alert to inform water and wastewater system owners and operators of the need for increased vigilance surrounding the use of Microsoft SharePoint.  While the scope and impact continue to be assessed, the chain, publicly reported as “ToolShell,” provides unauthenticated access to systems and authenticated access through network spoofing, respectively, and enables malicious actors to fully access SharePoint content, including file systems and internal configurations, and execute code over the network.  See a full update regarding this release on the CISA’s Webpage.