Alerts and Advisories
Alerts & Advisories
Akira Ransomware
17 Oct 2023
Akira is a ransomware group which was first observed in March 2023. Akira ransomware actors typically gain access to victims’ devices by using compromised credentials. Its operators use multi-extortion tactics, steal victims’ critical data and encrypts devices and files before demanding outrageous ransom payments. Victims who fail to comply with their demands will be listed on their TOR-based website along with the stolen data.
cURL Vulnerability (CVE-2023-38545 and CVE-2023-38546)
12 Oct 2023
cURL, powered by libcurl, is a popular command-line tool for transferring data specified with URL syntax. It supports a wide range of protocols such as FTP(S), HTTP(S), IMAP(S), LDAP(S), MQTT, POP3, RTMP(S), SCP, SFTP, SMB(S), SMTP(S), TELNET, WS, and WSS. Almost every single internet-connected device uses cURL or libcurl (directly or indirectly). This includes almost all Linux based OS and other OS, servers, printers, Android devices, cars, smart devices, all IoT devices, etc.
Apple Security Update Fixes Vulnerabilities Linked To Pegasus Spyware
11 Sep 2023
Apple has released security updates for iOS, macOS, iPadOS and watchOS to fix two zero-day vulnerabilities which have been exploited in the wild to compromise Apple products without any interaction from the victim. The exploit allows attackers to target victims with NSO Group’s Pegasus Spyware, without any interaction from the targeted user.
Urgent Update For Apple Devices To Address Zero-Day Bug
16 Jul 2023
Apple users are strongly advised to install an urgent Rapid Security Response (RSR) update to address a vulnerability that impacts fully patched iPhones, Macs, and iPads. The RSR patches includes updates for the latest versions of macOS, iOS, iPadOS, and Safari.
Royal Ransomware Targeting Critical Infrastructure
9 Mar 2023
Organizations in critical infrastructure sectors including communications, education, public healthcare, and manufacturing are facing increasing threat by attacks involving Royal ransomware.
Ransomware Attacks Exploiting VMware Bug to Target ESXi Servers
6 Feb 2023
A new wave of ransomware attacks targeting VMware ESXi hypervisors are exploiting a known vulnerability CVE-2021-21974 on unpatched systems. The issue is an Open Service Location Protocol (OpenSLP) heap-overflow vulnerability that can lead to remote code execution.
Critical Vulnerability in FortiOS SSL-VPN Targeting Governments
27 Jan 2023
Fortinet has issued a warning on a vulnerability affecting several versions of Fortinet FortiOS used in its FortiGate secure socket layer virtual private network (SSL VPN) and firewall products. The security flaw is tracked as CVE-2022-42475 which is rated Critical and assigned a CVSS score of 9.3 out of 10. The attacks are said to be complex and highly targeted at “governmental or government-related targets.” FortiOS is a network security operating system developed by Fortinet, Inc which provides a comprehensive set of networking and security features for organizations across all industries.
End-of-Life Cisco Business Routers Vulnerable to Remote Attacks
25 Jan 2023
Cisco has warned of two security vulnerabilities affecting Small Business Routers which have reached end-of-life (EoL). Both vulnerabilities could allow a remote attacker to bypass authentication or execute arbitrary commands on the underlying operating system of an affected device.
Spike in Telegram Hijacking in Brunei
19 Jan 2023
Telegram takeover involving a money transfer scam has been active in Brunei Darussalam since last year and a recent spike in this scam has been reported to BruCERT in the past month. This is a worrying trend as a growing number of individuals have fallen victim and transferred funds ranging from $200 to $1,000 to the scammers. It is suspected that the number of unreported cases is much higher. The scam is initiated by hijacking a user’s Telegram account, then using the compromised account to request for money from people in the user’s contact list.
Dridex Malware Targeting MacOS
10 Jan 2023
Dridex, also known as Bugat and Cridex, is a banking malware that steals sensitive data from infected machines, and also deliver and execute malicious modules. Previously targeting Windows computers, it is now targeting Macs to spread by using email attachments that look like regular documents.
Securing your WhatsApp account
30 Nov 2022
WhatsApp is one of the most common communication methods used in our country. Therefore, it is of utmost importance to take precautionary measures to secure your account. Compromised WhatsApp accounts may lead to risks such as data leakage and identity theft, among others.
Local Bank Phone Scam
10 Nov 2022
BruCERT has received several reports of a phone scam impersonating a local bank in an attempt to obtain sensitive information such as name, identity card number, credit card details and other personally identifiable information (PII).