Re-posted from SECURITY BUZZ by Genady Vishnevetsky, Chief Info Security Officer  Stewart Title Guaranty Company

There's a new phishing campaign that's using a clever trick - corrupted Word documents. This technique allows malicious content to pass through to the user without detection by any email security tools.

The attacker intentionally (slightly) corrupts the attached Word document so that antivirus and security scanners can't scan it. Because the file has a .docx extension, when the unsuspicious victim opens it, Microsoft Word detects the corruption and asks the user if they want to repair it. If the user confirms, Word will repair and open the file.

Inside the recovered file is a QR code that leads to a credential harvesting page that steals both the user's credential and the MFA.

The timing of this attack is impeccable. Security firm Any.Run, which discovered it, found that the email appeared to come from Human Resources and focused on end-of-the-year benefits and bonus payouts.

Takeaways:

• Hackers frequently time and theme their attacks to seasonal, disaster or business events - always stay alert during business seasonality (i.e., end-of-month, quarter, year activities, benefits, payouts, income-tax events)
• Attackers continuously attempt to find ways to stay under the radar of security technologies - always proceed with caution
  • Every attachment from an unknown source should be considered malicious until proven otherwise
  • Any new behavior (recovery of corrupted attachment) should be a red flag
• QR codes have alarmingly become mainstream for cybercrooks due to the inability to analyze the destination with the naked eye. Scrutinize all QR codes and avoid using them in emails and attachments if possible.
• Do not enter any credentials on the site you landed on from the email or attachments unless it came from a trusted and verified source

The New York State Department of Financial Services (DFS) alerts all regulated entities to take immediate action to investigate and, if applicable, to mitigate the following cybersecurity threat.

On November 7, 2023, the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) released guidance for addressing a critical vulnerability designated as CVE-2023-4966 which impacts multiple versions of Citrix NetScaler ADC and Gateway products. The vulnerability, also known as Citrix Bleed, could allow a cyber actor to take control of an affected system.

Threat actors are actively exploiting this vulnerability. According to Citrix’s website, there are reports of session hijacking and targeted attacks. Citrix strongly urges all affected users to immediately install recommended builds and to terminate and clear all active and persistent sessions. Please refer to the Citrix Security Blog for details and the necessary commands.

An additional vulnerability has been found in customer-managed instances of Citrix NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) CVE-2023-4967.

Exploitation of these vulnerabilities can result in deployment of ransomware, data theft, and business disruption.

DFS advises all regulated entities to assess promptly the risk to their organization, customers, consumers, and third-party service providers based upon the evolving information and to take action to mitigate risk. As you assess risk, we recommend reviewing the CISA Alert and the Citrix Security Bulletin and Security Blog.

Regulated entities are reminded to report Cybersecurity Incidents that meet the criteria of 23 NYCRR Section 500.17(a) as promptly as possible and within 72 hours at the latest via the secure DFS Portal. As of December 1, 2023, regulated entities who decide to make cyber extortion payments must report such payments to DFS within 24 hours and within 30 days provide a description of the rationale for, and diligence undertaken in connection with, making such payment. For more information, visit DFS’s Cybersecurity Resource Center.

From: SCCO Alerts
Sent: Thursday, September 29, 2022 4:56 PM
Subject: UPDATE
 

Over the last several days we have been working hard to bring back the applications used to perform title searches. Our IT staff, along with the County IT staff, have worked around the clock to get us to the point where can open our office for searching Monday at 8:00 a.m.


We will have roughly 120 terminals available throughout the Clerk’s Office for searches to be conducted. At this point we believe all of the programs you are accustom to using will be available. There are still some issues we are working out through testing which we hope to resolve over time. There are currently two printers available and we are working towards bring additional ones online.

What to expect.

Please expect the system to be slower than you may be accustom to. We know this to be an issue and are working in the background to alleviate the issue over time. 

While we believe there will we sufficient work stations available, in the event there is not, we ask that you be respectful and allow others access when you know the terminal will not be used for a period of time. We understand the demands being placed on you and the amount of work that has accumulate over the last two weeks. It is important we all work together. 

The building will be open near normal business hours to start as we assess our computer equipment capacity and provide necessary maintenance. It is our goal to increase business hours once we confirm the computer environment can handle the increased volume of use. 

Your cards will be required to print and you may add funds to them by filling out the attached form and leaving it with the Public Access counter staff. We will add the funds to your cards throughout the day starting Friday so they will be available for use Monday morning. Payments need to be made by check and we can add funds to only one card per check (in the short term). This form will also be available at the counter by the printers.

As for recordings and other related filings, our staff will be working towards getting our systems up to once again provide those services. I do not have any timeframe that can be provided but please be assured we are working as hard and fast as possible to get those functions up and running soon. We will provide further details as we progress.

We appreciate your patience as we work through this difficult and unprecedented situation. We are sure by working collectively and with respect for one another we will get through this period and return to “normal” in due course.