Ensign has observed a pattern of abnormal queries on public DNS servers through its DNS Anomaly Behavioural Model, a proprietary tool of Ensign Labs team. The anomalies included sharp spikes of DNS requests within a short time-frame, and a sequence of suspicious DNS queries with no subsequent TCP/UDP traffic upon resolution of the domain name. Our team of analysts investigated the anomalies further, and the details of the analysis can be found in this report.
&nbsp;
Highlights from the advisory include:
<ul>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Insights on the suspicious DNS requests</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Details of the public web storage site housing the DNS queries</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Network profile analysis</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Conclusion and recommendations</li>
</ul>
</ul>
</ul>
</ul>
</ul>

Ensign Labs' DNS anomaly behavioural model detects suspicious DNS queries.

Ensign has observed a pattern of abnormal queries on public DNS servers through its DNS Anomaly Behavioural Model, a proprietary tool of Ensign Labs team.

Suspicious DNS Queries May 2020 | Threat Advisories

Driven by the Industrial Internet of Things (IIoT), the convergence of IT and OT has brought about radical changes and improvements in gathering data that helps organisations in their decision-making, as well as in monitoring their performance and environments. But while such efficiencies increase, so do the associated risks due to the expanding OT ecosystems&rsquo; attack surfaces.
In the recent webinar, &ldquo;Securing Today&rsquo;s OT Environments&rdquo;, Ensigns&rsquo; panel of experts shared their real-world experiences and expertise on the subject, as well as the best practices for mitigating the evolving threats.
&nbsp;
The topics of the webinar included:
<ul type="disc">
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; OT Cyber Threat Landscape</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Adoption of security best practices and international standards</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; How to formulate a cohesive IT and OT cybersecurity strategy</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Steps to enhance your cybersecurity maturity</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Emergence of Industrial IoT and its impact on cybersecurity</li>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>

Gain insights into the risks resulting from the expansion of OT ecosystems’ attack surfaces, and the best practices for mitigating them.

In this webinar, we discussed the OT cyber threat landscape, security best practices, enhancing cybersecurity maturity, and Industrial IoT's impact.

Securing Today's OT Environments | Cybersecurity Webinars

Cyber threats loom larger than before as organisations adopt a hybrid working model, coupled with the need for digital transformation powered by cloud and automation. This in turn sees organisations expand their attack surfaces, which will also result in an increased exposure to cyber threats. The Ensign-IDC Infobrief&nbsp;draws information from Ensign&rsquo;s 2021 Cyber Threat Landscape Report to help CISOs better address cyber risks for their organisations. Download the Infobrief now as we zoom into what stands at the top of the CISO&rsquo;s security agenda. These include:
&nbsp;
<ul style="list-style-position: inside;">
<li>Engendering the trust of the customers by securing customer data, privacy, and experience</li>
<li>Empowering employee flexibility and productivity while meeting security needs</li>
<li>Adopting a secure-by-design hybrid architecture&nbsp;</li>
<li>Developing a trusted secure ecosystem</li>
</ul>

The Ensign-IDC Infobrief looks into the CISO’s (Chief Information Security Officers) agenda. Gain insights into how CISOs are able to better address cyber risks, and understand the importance of an intelligence-led approach to fend off the cyberthreat onslaught.

The Ensign-IDC Infobrief draws information from Ensign’s 2021 Cyber Threat Landscape Report to help CISOs better address cyber risks for their organisations.

Ensign-IDC Infobrief | Threat Insights

Commentary: Alvin Lee, Ensign InfoSecurity&rsquo;s Head of Infrastructure Security
Both industrial Internet of Things (IIoT) and operational technology (OT) belong to the category of cyber-physical systems (CPS) as they share an infrastructure that straddles between the physical and digital world. As such, the cyber risks that these systems are exposed to will continue to grow as more IoT devices become connected to the OT systems. This greatly expands organisations' digital attack surfaces that threat actors can exploit to infiltrate critical infrastructures. At the same time, many OT systems are traditionally designed to focus on safety and reliability, with very little consideration on security by design. Consequently, the confluence of OT and IT systems introduces a plethora of vulnerabilities to IoT/OT infrastructures, and exposes them to an unprecedented level of cyber risk.
The CPS&rsquo; vulnerability to cyber attacks, and the huge damage these attacks can potentially inflict on the physical world make these systems very attractive targets to certain groups of threat actors. Any successful cyber attack against IIoT and OT systems can result in grave, real-world consequences, including the loss of lives, safety failures, service disruptions and production downtime.
In 2020 alone, Israel&rsquo;s water management facilities were hit by two cyber attacks, where the command and control systems of wastewater treatment plants, pumping stations, and sewage were compromised. Honda Motor also experienced a cyberattack that brought global operations to a halt, including the car factories in Ohio and Turkey, as well as at motorcycle plants in India and South America.
Evidently, organisations will need to adopt new cyber security approaches to mitigate the IIoT and OT risks and strengthen their security posture. It begins with formulating a long-term, effective strategy that embraces a fundamental Zero-Trust mindset for users of IIoT and OT systems, and other devices.
Creating a Zero Trust architecture requires organisations to have an in-depth understanding of all IIoT and OT systems on the network, including the identity of every device that touches the network, business context, traffic flows and resource dependencies. This enables organisations to make context-based segmentation decisions that would reduce business risk without unduly impacting availability. Organisations can consider using agentless device visibility and continuous network monitoring for IIoT and OT devices to achieve this.&nbsp;
Organisations should also look at enforcing privileged access to critical IT and OT infrastructure; and segment IIoT devices and OT systems into appropriate zones and conduits to reduce the impact radius in the event of a cyber breach. Additionally, organisations should look at containing vulnerable devices, legacy applications and operating systems that cannot be patched or taken offline within separate zones to reduce the attack surface.
&nbsp;

Alvin Lee, Ensign InfoSecurity's Head of Infrastructure Security highlights the importance of protecting cyber-physical systems against cyber attacks.

Organisations will need to adopt new cyber security approaches to mitigate the IIoT and OT risks and strengthen their security posture.

Growing Cyber Threats Against Cyber-Physical Systems | Featured Editorials

Embrace the power of Zero Trust Architecture (ZTA) for robust cybersecurity. With strict access controls and continuous verification, ZTA eliminates inherent trust in users and devices, ensuring secure networks regardless of their location.
&nbsp;
Watch the informative video to learn about key elements like least privilege access control, continuous monitoring, and more.

Embrace the power of Zero Trust Architecture for robust cybersecurity.

In this webinar, we explore the power of Zero Trust Architecture (ZTA) for robust cybersecurity. Watch the webinar today.

Why is Zero Trust Important? | Cybersecurity Webinars

In a recent live interview with&nbsp;MONEYFM 89.3, our resident expert &ndash; Low Chee Juee (Vice President of Consulting), shared key findings of the Ensign Threat Landscape Report 2020. Listeners of the&nbsp;Prime Time&nbsp;show learnt more about the top threat vectors and most targeted industries in 2019, and how enterprises can protect themselves as the cyber threat landscape continues to evolve rapidly. He also discussed the potential risks arising from the current pandemic situation, as well as the rollout of 5G.
Here are some highlights from the interview:
<ul type="disc">
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Sharing of the top cyber threat vectors and most targeted industries in 2019</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Details on APT32 &ndash; the largest threat actor in the region</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; The evolution of cyber attacks in today&rsquo;s climate</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Practices that organisations should adopt in the face of digitalisation and rise of 5G</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Essential cyber security strategy practices</li>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>

Our resident expert, Low Chee Juee, shared key findings of the Ensign Threat Landscape Report 2020 in an interview with MONEYFM 89.3.

Listeners of the Prime Time show learnt more about the top threat vectors and most targeted industries in 2019, and how enterprises can protect themselves as the cyber threat landscape continues to evolve rapidly.

Interview Feature on MoneyFM 89.3 | Interviews

The Personal Data Protection (Amendment)&nbsp;Bill, which was introduced on 2 Nov 2020, aims to help businesses securely harness data for new business opportunities and, at the same time, strengthen their data security practices needed in the ever-evolving cyber threat environment.
&nbsp;
Under the Amendment Bill, new sets of regulations will be imposed, such as the Mandatory Data Breach Notification that requires organisations doing business in Singapore to report the occurrence of any notifiable data breach to the PDPC within 72 hours. The maximum financial penalty for failing to provision data protection will also be raised to 10% of an organisation's annual turnover in Singapore or SGD1,000,000, whichever is higher.
&nbsp;
Jointly organised by Ensign and SMU School of Law, to learn more about:
<ul type="disc">
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Legal implications of the Personal Data Protection (Amendment)&nbsp;Bill</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Key policy changes and their impact to organisational procedures</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; How to manage and respond effectively to data breach incidents​​​​​​​​​​​​</li>
<li style="display: flex; align-items: flex-start;">&nbsp;</li>
</ul>
</ul>
</ul>
</ul>

Learn about the legal implications of the PDPA Amendment Bill, key policy changes and the impact to organisational procedures, as well as how to manage and respond effectively to data breach incidents.

In this webinar, jointly organised by Ensign and SMU School of Law, we explore the legal implications of the Personal Data Protection (Amendment) Bill.

PDPA 2.0. Manage. Respond. Report. | Cybersecurity Webinars

The unfortunate truth about cyber attacks is&nbsp;that, sometimes, they are successful. This could be due to organisations&rsquo; lack of cybersecurity controls, inadequate cyber hygiene practices, poor cyber crisis management, or the lack of resources in&nbsp;combating highly&nbsp;resourced and sophisticated threat actors. This was the case of a&nbsp;BlackCocaine&nbsp;ransomware attack which occurred in a banking and financial software company.
&nbsp;
The Ensign Hunt and Incident Response Operations (HIRO) team was activated to investigate.&nbsp;It provided support to the targeted company, deploying&nbsp;containment measures to mitigate the impact of the breach. Download the case study to learn more.

This case study looks into a BlackCocaine ransomware attack that hit a banking and financial software company. Gain insights into how Ensign’s Hunt and Incident Response Operations (HIRO) team deployed containment measures to mitigate the impact of the breach.

BlackCocaine Ransomware Case Study | Resources

Ensign IR Case Study - Investigation into BlackCocaine Ransomware

The Monetary Authority of Singapore released the revised Technology Risk Management Guidelines (MAS-TRMG) in January 2021&nbsp;to establish stronger governance, and strengthen cyber resiliency in the financial sector. It&rsquo;s aimed at combating the industry&rsquo;s evolving cyber threats, and minimising risks to supply chains.&nbsp;This guide discusses the key changes in the revised MAS-TRMG, and Ensign&rsquo;s recommendations.
&nbsp;Highlights of the eBook include:
<ul type="disc">
<li>12 key changes of the revised MAS-TRMG</li>
<li>What financial institutions need to look out for</li>
<li>How Ensign can help</li>
</ul>
&nbsp;Download our eBook to find out more.
&nbsp;

Download the eBook to find out more about the 12 key changes of the revised MAS-TRM Guidelines, along with Ensign’s recommended approach.

Download this essential guide providing insights into the revised Monetary Authority of Singapore Technology Risk Management (MAS-TRM) Guidelines 2021. 

Cybersecurity Guide on the Revised MAS-TRM Guidelines 2021 | Cybersecurity Ebooks

Situation
Singtel, a major internet service provider in Singapore, shared on its website on 11 February 2021 that a nearing end-of-life third-party file-sharing system provided by Accellion called FTA (File Transfer Application) has been illegally accessed by unidentified hackers. There is an alleged SQL injection vulnerability on Accellion FTA that an adversary can exploit to install a web shell on the victim&rsquo;s system. A web shell is a malicious script that typically includes different functionalities such as file listing, downloading of files and clean-up on compromised system. An adversary can make use of the web shell to gain control of the server to perform various activities on the file sharing server leading to a potential data breach.
Our Actions
<ul type="disc">
<li data-list="1" data-level="1">We have reviewed the indicators of compromise, and our SOCs have been tasked to support affected clients in threat identification as required.&nbsp;</li>
<li data-list="1" data-level="1">We do not operate any Accellion systems and are reviewing the use of file transfer type applications within our organisation.</li>
<li data-list="2" data-level="1">Deep analysis will be conducted to uncover attack trends, patterns and TTPs (tactics-techniques-procedures) as information becomes available - these insights will be shared when ready.</li>
</ul>
Our Recommendations
<ul type="disc">
<li>For organisations who are using the Accellion FTA, we recommend that you apply the latest fixes and patches&nbsp;to Accellion FTA.&nbsp;If an update or migration is not possible, we advise you&nbsp;to disable and isolate systems hosting the FTA software.&nbsp;</li>
<li>Ensure that your anti-virus, endpoint protection and firewall applications are updated with the latest definition so that your systems can be protected against new cyber threats.&nbsp;</li>
<li>Perform application and network log reviews to identify possible data exfiltration such as abnormal file size transfer or unusual network connections.&nbsp;</li>
<li>Assess the need to store, handle or transfer sensitive and personal data (e.g. customer database or CVs of job applications) on web and/or publicly accessible servers.</li>
<li data-list="0" data-level="1">Please refer to the following links for more in-depth recommendations:</li>
<ul type="circle">
<li data-list="0" data-level="2">Guidepoint:&nbsp;<a href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.guidepointsecurity.com%2Faccellion-fta-targeted-by-file-downloading-web-shell%2F&amp;data=04%7C01%7Cjeslyn_teo%40ensigninfosecurity.com%7C720ffbd4f5d14117a20908d8ce52ddce%7Cd5cb08f4d38848b2bc028ecce3c63fce%7C1%7C0%7C637486202614175751%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=FZie4IWn7FpfEX9rvlz4r7k0gGaieIqRCiS4ozs4asg%3D&amp;reserved=0" data-sf-ec-immutable="">https://www.guidepointsecurity.com/accellion-fta-targeted-by-file-downloading-web-shell/</a></li>
</ul>
</ul>
As investigations are underway, we are expecting additional malware and TTPs to be uncovered. We will continue to provide updates on the incident, and inform you about additional recommendations.
If you suspect that you could have been affected by the incident, you can contact us for digital forensic and incident response services. You can take preemptive measures to protect your assets against new and unknown threats through our threat hunting and threat intelligence programme. Contact us at&nbsp;<a href="mailto:marketing@ensigninfosecurity.com" data-sf-ec-immutable="">marketing@ensigninfosecurity.com</a>&nbsp;for more information.&nbsp;

Ensign's plans and procedures in response to the recent breach involving Accellion.

Singtel, a major internet service provider in Singapore, shared on its website on 11 February 2021 that a nearing end-of-life third-party file-sharing system provided by Accellion called FTA (File Transfer Application) has been illegally accessed by unidentified hackers.

Accellion FTA Breach | Threat Advisories

The Situation On 9 February 2021, Palo Alto&lsquo;s threat intelligence team Unit 42 disclosed the discovery of BendyBear &ndash; a highly sophisticated cyber espionage tool. BendyBear is alleged to have similarity in code behaviour and features as that of the WaterBear malware family, which was used by cyber espionage group BlackTech. BendyBear is an updated version designed to work with modern 64-bit systems. It uses anti-forensic techniques and the malicious payload is loaded in memory, thus making it challenging to detect. Its main function is to download more malicious payloads from attacker&rsquo;s controlled command and control (C2) server.&nbsp;
Our&nbsp;Commitment We expect more updates on BendyBear, and will continue to keep a close watch and provide relevant insights and recommendations to the community. Throughout this festive period, Ensign continues to be available to clients who require assistance on any cyber-related matters. Our Actions
Ensuring our customers are secured - Security of our clients is key
<ul type="disc">
<li>Our SOCs have updated our detection capabilities based on the latest IOCs published, and we have compressed our in-house SOC processes to review and update such detection rules to keep pace with the rollout of such information.</li>
<li>We continue to maintain timely patch updates for our critical systems to ensure that we eradicate known vulnerabilities in our environment.&nbsp;</li>
<li>Our SOCs have been tasked to support clients who may be affected in threat identification, if&nbsp;required.&nbsp;</li>
</ul>
&nbsp;Enhanced Monitoring
<ul type="disc">
<li>We are stepping up our SOC operations to keep tabs of the evolving situation, and handle any response actions required.&nbsp;</li>
<li>Deep analysis is ongoing to uncover attack trends, patterns and TTPs (tactics-techniques-procedures) - these insights will be shared when ready.&nbsp;</li>
</ul>
&nbsp;Our Recommendations
<ul type="disc">
<li>Review and update existing security rulesets with relevant indicators of compromise to identify suspicious activities.</li>
<li>Review network logs to identify TCP port 443 traffic that does not conform to proper SSL or any other known applications.</li>
<li>Where feasible, block unknown outbound TCP traffic in security policies.</li>
<li>Keep up with software updates, and mitigate identified critical vulnerabilities.</li>
<li>Enhance perimeter and endpoint defence with whitelisting, behaviour analysis and sandboxing techniques using advanced endpoint &amp; network security solutions.</li>
<li>Please refer to the following links for more in-depth information on BendyBear:</li>
<ul type="circle">
<li>Palo Alto :&nbsp;<a href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fblog.paloaltonetworks.com%2F2021%2F02%2Fu42-bendybear%2F&amp;data=04%7C01%7Cjeslyn_teo%40ensigninfosecurity.com%7Cc83a17f4a67c4e6a92ab08d8cef5df68%7Cd5cb08f4d38848b2bc028ecce3c63fce%7C1%7C0%7C637486902710791189%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=4WhMTgp5iKmA1M6AjpNyxxSk5J%2Bs2YFJqbJppyVIHnw%3D&amp;reserved=0" data-sf-ec-immutable="">https://blog.paloaltonetworks.com/2021/02/u42-bendybear/</a></li>
<li>Palo Alto :&nbsp;<a href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbendybear-shellcode-blacktech%2F&amp;data=04%7C01%7Cjeslyn_teo%40ensigninfosecurity.com%7Cc83a17f4a67c4e6a92ab08d8cef5df68%7Cd5cb08f4d38848b2bc028ecce3c63fce%7C1%7C0%7C637486902710801144%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=UY8gKjxfb5Pxmro5lUZx4XK7YTJThMOgBawJQz931tI%3D&amp;reserved=0" data-sf-ec-immutable="">https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/</a></li>
</ul>
</ul>
We are expecting additional IOCs and TTPs to be uncovered. We will continue to provide updates on the incident, and inform you about additional information.
If you suspect that you could have been affected by the malware, you can contact us for digital forensic and incident response services. You can take preemptive measures to protect your assets against new and unknown threats through our threat hunting and threat intelligence programme.&nbsp;&nbsp;Contact us at&nbsp;<a href="mailto:Marketing@ensigninfosecurity.com" data-sf-ec-immutable="">marketing@ensigninfosecurity.com</a>&nbsp;for more information.
&nbsp;

Ensign's plans and procedures in response to BendyBear.

On 9 February 2021, Palo Alto‘s threat intelligence team Unit 42 disclosed the discovery of BendyBear – a highly sophisticated cyber espionage tool.

Ensign’s Plans and Procedures in Response to Bendybear

The Situation
Multiple firmware vulnerabilities had been discovered in the Dell BIOSConnect feature available on multiple models of consumer and business laptops, desktops, tablets, including devices protected by Secure Boot and Secured-core PCs. Normally, this feature is used to update the system firmware or perform OS recovery, however vulnerabilities that exist, would enable an attacker to remotely execute code in the pre-boot environment.
Dell recommends that users disable and avoid using BIOSConnect firmware update, OS recovery, and HTTPS boot features manually from the BIOS setup menu or the Dell Command Control remote system management tool. When available, customers should apply the BIOS updates for their system via an executable from the OS after manually checking the hashes against those published by Dell other than BIOSConnect. The History
Firmware attacks targeting enterprises are up over the past two years and they have become a&nbsp;hot target for cybercrime as operating systems become more secure, attackers are increasingly shifting their attention to firmware, which is less visible, more fundamental and rarely well protected
The TrickBot malware which has been around since 2016, and evolving over time had in 2020, added a module&nbsp;to inspect devices for firmware vulnerabilities that could enable attackers to read, write, or erase the UEFI/BIOS firmware. In 2019, Asus computers were also targeted by hackers (now known as ShadowHammer) in the form of a malicious firmware update. In October 2018, a rare&nbsp;firmware rootkit&nbsp;was detected targeting diplomats and nongovernmental organisations. Russian advanced persistent threat group Sednit deployed the first firmware-level rootkit&nbsp;seen in the wild.
What we are seeing are attacks based on exploiting hardware designs and what differentiates this type of attacks is that consumers don&rsquo;t have any control over the hardware design and manufacturing. The shift in attackers focus are becoming more prevalent as OS becomes more secure and firmware remains less visible and rarely well protected.&nbsp;
 Ensign Posture &amp; Monitoring
Ensign InfoSecurity provides a complete inventory and health check for enterprise firmware and hardware components.
In addition, with regular vulnerability scanning of these components, we enable any organisation to extend its visibility and security beyond the traditional endpoints.
Ensign has in place a well-defined enterprise security vulnerability management framework where configuration and patches are dutifully tested and rolled out as they become available. &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Ensign has also stepped up monitoring operations and will advise clients of any anomalies detected from the monitored event logs.
 Our Recommendations
<ul type="disc">
<li>For those using Dell hardware that are not enterprise-managed:</li>
<ul type="circle">
<li>Immediately disable Dell BIOSConnect, OS recovery, and HTTPS boot features feature from the BIOS setup page</li>
<li>Do not run &ldquo;BIOS Flash Update &ndash; Remote&rdquo; until the system is updated with a remediated version of the BIOS</li>
<li>Patch Dell&rsquo;s firmware via an executable from the OS after manually checking the hashes against those published by Dell</li>
</ul>
</ul>
(Refer to Dell&rsquo;s webpage for detailed info at&nbsp;<a href="https://www.dell.com/support/kbdoc/en-au/000188682/dsa-2021-106-dell-client-platform-security-update-for-multiple-vulnerabilities-in-the-supportassist-biosconnect-feature-and-https-boot-feature" data-sf-ec-immutable="">https://www.dell.com/support/kbdoc/en-au/000188682/dsa-2021-106-dell-client-platform-security-update-for-multiple-vulnerabilities-in-the-supportassist-biosconnect-feature-and-https-boot-feature</a>)
<ul type="disc">
<li>For those using Dell hardware that are enterprise-managed:</li>
<ul type="circle">
<li>Inform respective IT team to see if you are affected and await further instructions for the fix </li>
</ul>
<li>Know your assets to increase your visibility into your network</li>
<ul type="circle">
<li>Use device discovery and find affected devices on your network for remediation/mitigation</li>
<li>Put in place a hardware and software inventory tracking system </li>
</ul>
<li>Implement a stringent vulnerability and patch process especially for Internet connected systems </li>
<li>Keep systems fully patched at all levels, OS, application and firmware</li>
</ul>
<ul>
<li>Enable platform security features such as Secure Boot and BIOS Admin Password </li>
<li>Regularly conduct vulnerability scanning </li>
<li>Scan your environment for indicators of compromise (IOC) where available</li>
</ul>
Ensign will continue to provide updates on the incident and inform you of additional recommendations. We can help you to secure your firmware/hardware security. If you suspect that you have been compromised, you can contact us for digital forensic and incident response services. You can also take&nbsp;preemptive&nbsp;measures to protect your assets against new and unknown threats through our threat hunting and threat intelligence programme. Contact us at&nbsp;<a href="mailto:marketing@ensigninfosecurity.com" target="_blank" rel="noopener" data-sf-ec-immutable="">marketing@ensigninfosecurity.com</a>&nbsp;for more information.&nbsp; References:
<a href="https://eclypsium.com/2021/06/24/biosdisconnect/" data-sf-ec-immutable="">https://eclypsium.com/2021/06/24/biosdisconnect/</a>
<a href="https://www.bleepingcomputer.com/news/security/dell-supportassist-bugs-put-over-30-million-pcs-at-risk/" data-sf-ec-immutable="">https://www.bleepingcomputer.com/news/security/dell-supportassist-bugs-put-over-30-million-pcs-at-risk/</a>
<a href="https://cromwell-intl.com/cybersecurity/hardware.html" data-sf-ec-immutable="">https://cromwell-intl.com/cybersecurity/hardware.html</a>
<a href="https://www.csoonline.com/article/3410046/hardware-and-firmware-vulnerabilities-a-guide-to-the-threats.html" data-sf-ec-immutable="">https://www.csoonline.com/article/3410046/hardware-and-firmware-vulnerabilities-a-guide-to-the-threats.html</a>
<a href="https://www.techrepublic.com/article/microsofts-new-security-tool-will-discover-firmware-vulnerabilities-and-more-in-pcs-and-iot-devices/" data-sf-ec-immutable="">https://www.techrepublic.com/article/microsofts-new-security-tool-will-discover-firmware-vulnerabilities-and-more-in-pcs-and-iot-devices/</a>

Hardware / Firmware Vulnerabilities discovered in over 100 Dell models.

Multiple firmware vulnerabilities had been discovered in the Dell BIOSConnect feature available on multiple models of consumer and business laptops, desktops, tablets, including devices protected by Secure Boot and Secured-core PCs. 

Dell Hardware / Firmware Vulnerabilities  | Threat Advisories

The Situation&nbsp;
On Friday&nbsp;2&nbsp;July&nbsp;2021, Kaseya reported that&nbsp;its VSA Remote Monitoring and Management Software has been compromised to distribute&nbsp;REvil&nbsp;ransomware to multiple managed services providers running the software, potentially infecting unspecified numbers of their 40,000 installed customer base.&nbsp;
The malware appears to have been delivered through an automatic update of the Kaseya VSA client management and monitoring software.&nbsp; According to Kaseya, it affects only Kaseya VSA software running on on-premise servers while SaaS versions remain unaffected.&nbsp; Kaseya has issued a security advisory warning its customers to immediately shut down their on-premise VSA servers to prevent the attack from spreading.
&nbsp;
Managed Malware Delivery&nbsp;
The&nbsp;researchers&rsquo;&nbsp;current&nbsp;breakdown of the attack has shown that the outbreak was delivered via a malicious update payload&nbsp;sent to&nbsp;VSA servers, and in&nbsp;turn,&nbsp;to the VSA agent applications running on managed Windows devices.
This was achieved using a zero-day exploit of the server platform&nbsp;for&nbsp;which&nbsp;Kaseya was rushing&nbsp;out a patch.&nbsp;This vulnerability gave REvil cover in several ways: It&nbsp;allowed initial compromise through a trusted channel, and leveraged trust in the VSA agent code&mdash;reflected in<a style="color: blue;" title="https://helpdesk.kaseya.com/hc/en-gb/articles/229014948-Anti-Virus-Exclusions-and-Trusted-Apps" href="https://helpdesk.kaseya.com/hc/en-gb/articles/229014948-Anti-Virus-Exclusions-and-Trusted-Apps" target="_top" data-sf-ec-immutable="">&nbsp;anti-malware software exclusions that Kaseya require</a>s&nbsp;for&nbsp;setting up its&nbsp;application and agent &ldquo;working&rdquo; folders. Anything executed by the Kaseya Agent Monitor&nbsp;was therefore ignored because of those exclusions&mdash;which allowed REvil to deploy its dropper without scrutiny.
More details on the anatomy of attack can be found at:
<a style="color: blue;" title="https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/" href="https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/" data-sf-ec-immutable="">https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/</a>
&nbsp;
The History&nbsp;
REvil recruits affiliates to distribute the&nbsp;ransomware&nbsp;for them and are thought to be based in&nbsp;Russia&nbsp;due to the fact that the group does not target Russian&nbsp;organisations.&nbsp;&nbsp;
Ransomware code used by REvil resembles the code used by&nbsp;DarkSide, suggesting that DarkSide could be a partner of REvil.&nbsp;REvil and Darkside use similarly structured ransom notes and the same code to check that the victim is not located in a&nbsp;Commonwealth of Independent States&nbsp;(CIS) country.&nbsp;
Cybersecurity experts believe REvil is an offshoot from a previous notorious, but now-defunct hacker gang, GandCrab.&nbsp;This is suspected due to the fact that REvil first became active directly after GandCrab shutdown, and that the ransomware both share a significant amount of code.&nbsp;
&nbsp;
Ensign's Posture&nbsp;
Ensign has stepped up monitoring and checks to ensure the security of our clients.&nbsp;&nbsp;Ensign&rsquo;s managed detection and response and AI-based cyber analytics can help&nbsp;clients detect&nbsp;and prevent the execution of ransomware.&nbsp; Our Managed Security Services are unaffected by the compromise of Kaseya VSA. &nbsp;Ensign will continue to provide updates on the incident and inform you of additional recommendations.
 Our Recommendations&nbsp;
<ul type="disc">
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Users of Kaseya VSA to&nbsp;immediately&nbsp;shut down&nbsp;your VSA server until further notice from Kaseya, meanwhile existing customers are encouraged to get the &ldquo;Compromise Detection Tool&rdquo; by sending an email&nbsp;<a href="mailto:support@kaseya.com" data-sf-ec-immutable="">support@kaseya.com</a>&nbsp;to begin recovery process if impacted</li>
<li style="display: flex; align-items: flex-start;">&nbsp;</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull;&nbsp;&nbsp; Scan your endpoints/network for indicators of compromise (IOC) <a href="https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/" data-sf-ec-immutable="">https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/</a> <a href="https://www.joesandbox.com/analysis/809013#iocs" data-sf-ec-immutable="">https://www.joesandbox.com/analysis/809013#iocs</a> <a href="https://github.com/pgl/kaseya-revil-cnc-domains/blob/main/revil-kaseya-cnc-domains.txt" data-sf-ec-immutable="">https://github.com/pgl/kaseya-revil-cnc-domains/blob/main/revil-kaseya-cnc-domains.txt</a>&nbsp; </li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Enable tamper protection for Windows Defender because the ransomware attempts to disable Windows Defender -&nbsp;<a href="https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide" data-sf-ec-immutable="">https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide </a></li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Take reference from CISA recommendations to review your&nbsp;systems,&nbsp;and apply mitigating measures to reduce the risk of compromise by ransomware&nbsp;&nbsp; </li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Implement security solutions to segregate and protect your environment (e.g.&nbsp;firewalls, proxies, web filtering, mail filtering, endpoint detection and response)&nbsp; </li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Maintain a ransomware-resilient backup strategy with at least a copy&nbsp;offline </li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Keep systems fully patched&nbsp;</li>
<li style="display: flex; align-items: flex-start;">&nbsp;</li>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
Please contact us for further assistance if required, or for further advice on how to strengthen your security posture against similar incidents.&nbsp; Contact us at&nbsp;<a style="color: blue;" href="mailto:marketing@ensigninfosecurity.com" data-sf-ec-immutable="">marketing@ensigninfosecurity.com</a>&nbsp;for more information.&nbsp;&nbsp;
&nbsp;
References:&nbsp;
<a style="color: blue;" href="https://www.kaseya.com/potential-attack-on-kaseya-vsa/" data-sf-ec-immutable="">https://www.kaseya.com/potential-attack-on-kaseya-vsa/</a>&nbsp;
<a style="color: blue;" href="https://us-cert.cisa.gov/ncas/current-activity/2021/07/02/kaseya-vsa-supply-chain-ransomware-attack" data-sf-ec-immutable="">https://us-cert.cisa.gov/ncas/current-activity/2021/07/02/kaseya-vsa-supply-chain-ransomware-attack</a>&nbsp;
<a style="color: blue;" href="https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/" data-sf-ec-immutable="">https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/</a>&nbsp;
<a style="color: blue;" href="https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-200-companies-in-msp-supply-chain-attack/" data-sf-ec-immutable="">https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-200-companies-in-msp-supply-chain-attack/</a>&nbsp;
<a style="color: blue;" href="https://www.theverge.com/2021/7/2/22561252/revil-ransomware-attacks-systems-using-kaseyas-remote-it-management-software" data-sf-ec-immutable="">https://www.theverge.com/2021/7/2/22561252/revil-ransomware-attacks-systems-using-kaseyas-remote-it-management-software</a>&nbsp;
<a style="color: blue;" href="https://www.itnews.com.au/news/kaseya-supply-chain-ransomware-attack-hits-msp-customers-566858" data-sf-ec-immutable="">https://www.itnews.com.au/news/kaseya-supply-chain-ransomware-attack-hits-msp-customers-566858</a>&nbsp;

On Friday 2 July 2021, Kaseya reported that its VSA Remote Monitoring and Management Software has been compromised to distribute REvil ransomware to multiple managed services providers running the software, potentially infecting unspecified numbers of their 40,000 installed customer base. 

REvil Supply Chain Ransomware Attack Against Kaseya VSA and Multiple Managed Service Providers | Threat Advisories

We would like to share with you the plans and procedures we've put in place in response to the cyber attack campaign&nbsp;operated by threat actor group, NOBELIUM.&nbsp;
&nbsp;
The Situation Microsoft Threat Intelligence Center (MSTIC) has uncovered an evolving and sophisticated wide-scale malicious email campaign operated by NOBELIUM, the group behind last year's SolarWinds supply chain attack. It was observed that the campaign operated since January 2021 with the group evolving its attack tactics in delivering the malicious package.&nbsp; Like most phishing tactics, the attackers attempt to lure users into opening the e-mail, followed by either opening a malicious file or clicking a malicious link.&nbsp;An example of&nbsp;this&nbsp;nature&nbsp;included e-mails purportedly originating from the USAID government agency with a lure referencing foreign threats to the 2020 US Federal Elections. It contained a malicious link that would result in a redirection request to download an ISO file&nbsp;on&nbsp;to&nbsp;the victims system. The ISO file contained both decoy and malicious files.&nbsp;If&nbsp;an&nbsp;unsuspecting victim&nbsp;opened&nbsp;the malicious files, the malware infection&nbsp;would&nbsp;begin, providing persistent remote access to the attackers.&nbsp; Interestingly,&nbsp;the phishing message and delivery method were&nbsp;not the only evolving factors&nbsp;in the campaign. In one of the more targeted waves, no ISO payload was delivered, but additional profiling of the target device was performed by an actor-controlled web server after a user clicked the link. If the device targeted was an Apple iOS device, the user was redirected to another server under NOBELIUM control, where the since-patched zero-day exploit for CVE-2021-1879 was served.&nbsp; The History NOBELIUM, a group connected to Russia, has historically targeted government&nbsp;and non-government&nbsp;organisations, think tanks, military, IT service providers, health technology and research, and telecommunications providers. In this case, Microsoft&nbsp;reported&nbsp;at least a quarter of targets work with international development, humanitarian, and human rights work. The phishing attack has so far targeted some 3,000 accounts at more than 150&nbsp;organisations&nbsp;across multiple&nbsp;industries&nbsp;based in the United States and Europe. The victims span 24 countries, though most attacks were aimed at the US.&nbsp; The following industries&nbsp;have been&nbsp;observed&nbsp;being&nbsp;targeted thus far:&nbsp;
<ul type="disc">
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; NGOs</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Research Institutions</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Government Agencies</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; International Agencies</li>
</ul>
</ul>
</ul>
</ul>
</ul>
&nbsp;&nbsp;&nbsp;
Microsoft further noted that this campaign differs significantly from NOBELIUM operations that ran from September 2019 until January 2021, which included the compromise of the SolarWinds Orion platform. It is likely that these observations represent changes in the actor&rsquo;s tradecraft and possible experimentation following widespread disclosures of previous incidents.&nbsp; Ensign Posture &amp; Monitoring Ensign has stepped up monitoring operations for our clients for both cloud and on-premise infrastructure. Our Managed Detection and Response platform and our proprietary machine learning analytics can detect and block malicious artifacts. Coupled with network layer defence, our protection controls prevent applications or users from accessing malicious sites. We have performed rounds of checks to verify security configurations and patches are up-to-date.&nbsp; Our Recommendations
<ul type="disc">
<ul style="list-style-position: inside;">
<ul style="list-style-position: inside;">
<ul style="list-style-position: inside;">
<ul type="disc">
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Keep systems fully patched.</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Scan your environment for indicators of compromise (IOC) &ndash; see Microsoft Reference below.</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Turn on cloud-delivered protection in your anti-virus software to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a huge majority of new and unknown variants.&nbsp;</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Run Endpoint Detection and Response (EDR) in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft anti-virus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode (EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach.).&nbsp;</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Enable network protection to prevent applications or users from accessing malicious domains and other malicious content on the Internet.&nbsp;</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Enable investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume.&nbsp;</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Use device discovery to increase your visibility into your network by finding unmanaged devices on your network and onboarding them to Microsoft Defender for Endpoint.&nbsp;</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Enable multifactor authentication (MFA) to mitigate compromised credentials.&nbsp;</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Turn on the following attack surface reduction rule to block or audit activity associated with this threat: Block all Office applications from creating child processes (assess impact before enabling).&nbsp;</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Regularly conduct security awareness training Ensign will continue to provide updates on the incident and inform you of additional recommendations.&nbsp;</li>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
 If you require further cybersecurity advice or services, please contact us at&nbsp;<a style="color: blue;" href="mailto:marketing@ensigninfosecurity.com" data-sf-ec-immutable="">marketing@ensigninfosecurity.com</a>. References:&nbsp; <a style="color: blue;" href="https://beta.darkreading.com/attacks-breaches/solarwinds-attackers-impersonate-usaid-in-advanced-email-campaign" data-sf-ec-immutable="">https://beta.darkreading.com/attacks-breaches/solarwinds-attackers-impersonate-usaid-in-advanced-email-campaign</a> <a style="color: blue;" href="https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/" data-sf-ec-immutable="">https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/</a> <a style="color: blue;" href="https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/" data-sf-ec-immutable="">https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/</a>
&nbsp;

Ensign’s plans and procedures in response to the NOBELIUM threat actor group’s cyber attack campaigns.

Ensign Threat Advisory: SolarWinds Attackers NOBELIUM’s Next Wave | Threat Advisories

The Situation
On 2 March 2021, Microsoft released several security updates for Microsoft Exchange Server 2013, 2016 and 2019 to address vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) that have been used in limited targeted attacks. These vulnerabilities can allow an attacker to gain unauthorised access to mailboxes and perform remote code execution.&nbsp;
Microsoft has detected multiple Zero-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. In the attacks observed, the threat actors exploited these vulnerabilities to access Exchange Server and install additional malware to facilitate long-term access to victim environments. Webshell was used as a technique to escalate and maintain persistent access on an already compromised exchange server. Microsoft Threat Intelligence Center (MSTIC) attributes this campaign with high confidence to&nbsp;HAFNIUM, based on observed victimology, tactics and procedures. On 4 March and 5 March 2021, Microsoft provided more resources to help customers investigate and identify threats coming from HAFNIUM through indicators of compromise provided in the links below:
<a style="color: blue;" href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmsrc-blog.microsoft.com%2F2021%2F03%2F05%2Fmicrosoft-exchange-server-vulnerabilities-mitigations-march-2021%2F&amp;data=04%7C01%7CLeonardo_Jamorabo%40ensigninfosecurity.com%7Cc2a188ad82bc41db136008d8e1e31582%7Cd5cb08f4d38848b2bc028ecce3c63fce%7C1%7C0%7C637507712734917315%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=TdB8qfUdtIZVWSnjEiH2GVpJIiitsu5XByL1tohtzv4%3D&amp;reserved=0" data-sf-ec-immutable="">https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/</a>
<a style="color: blue;" href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2021%2F03%2F02%2Fhafnium-targeting-exchange-servers%2F%23scan-log&amp;data=04%7C01%7CLeonardo_Jamorabo%40ensigninfosecurity.com%7Cc2a188ad82bc41db136008d8e1e31582%7Cd5cb08f4d38848b2bc028ecce3c63fce%7C1%7C0%7C637507712734927266%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=amIA%2FZzYdJ5v0Ia9tnqTR4r2ZtuJ%2FsZUrWh8Ketwfi0%3D&amp;reserved=0" data-sf-ec-immutable="">https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/#scan-log</a>
&nbsp;
Ensign Posture &amp; Monitoring
Ensign has performed rounds of checks to confirm that the flaw does not affect our infrastructure.&nbsp;
Ensign has also stepped up monitoring operations, and will advise clients of any anomalies detected from the monitored event logs.
 Our Recommendations
<ul type="disc">
<li>Check patch levels and install security patches to fix the vulnerabilities on affected exchange servers. If installation of security patches is not possible, implement IIS Re-Write Rules and disable Unified Messaging (UM), Exchange Control Panel (ECP) VDir, and Offline Address Book (OAB) VDir Services as interim mitigation.</li>
<li>Scan exchange log files for indicators of compromise.</li>
<li>Perform threat hunting on affected servers and network to identify possible compromised system in your organisations.</li>
<li>Harden current security controls (e.g. Endpoint Detection and Response, Firewall, NIDS) to identify and block malicious activities and suspicious outbound traffic to blacklisted C2 infrastructure.</li>
<li>Take reference from CISA recommendations to review your systems and apply mitigating measures on the Microsoft Exchange Server Vulnerabilities (CISA recommendations &ndash;&nbsp;<a style="color: blue;" href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fus-cert.cisa.gov%2Fncas%2Falerts%2Faa21-062a&amp;data=04%7C01%7CLeonardo_Jamorabo%40ensigninfosecurity.com%7Cc2a188ad82bc41db136008d8e1e31582%7Cd5cb08f4d38848b2bc028ecce3c63fce%7C1%7C0%7C637507712734927266%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=fnJ8jpaNsErkNB6k%2BiRkw%2F6dJ1QPz1B9Pt5iNcfMh8Y%3D&amp;reserved=0" data-sf-ec-immutable="">https://us-cert.cisa.gov/ncas/alerts/aa21-062a</a>).</li>
</ul>
Ensign will continue to provide updates on the incident, and inform you of additional recommendations. If you suspect that you have been compromised, you can contact us for digital forensic and incident response services. You can also take preemptive measures to protect your assets against new and unknown threats through our threat hunting and threat intelligence programme. Contact us at <a style="color: blue;" href="mailto:marketing@ensigninfosecurity.com" target="_blank" rel="noopener" data-sf-ec-immutable="">marketing@ensigninfosecurity.com</a>;for more information.
 References:
<a style="color: blue;" href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmsrc-blog.microsoft.com%2F2021%2F03%2F02%2Fmultiple-security-updates-released-for-exchange-server%2F&amp;data=04%7C01%7CLeonardo_Jamorabo%40ensigninfosecurity.com%7Cc2a188ad82bc41db136008d8e1e31582%7Cd5cb08f4d38848b2bc028ecce3c63fce%7C1%7C0%7C637507712734937229%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=FVmNhB8cJQomph2mXLlAm1Jh5Hfb1ZUbNJEh18crreU%3D&amp;reserved=0" data-sf-ec-immutable="">https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/</a>
<a style="color: blue;" href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2021%2F03%2F02%2Fhafnium-targeting-exchange-servers%2F&amp;data=04%7C01%7CLeonardo_Jamorabo%40ensigninfosecurity.com%7Cc2a188ad82bc41db136008d8e1e31582%7Cd5cb08f4d38848b2bc028ecce3c63fce%7C1%7C0%7C637507712734937229%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=5tJQoHaB%2BJqIA0%2FWPOUd3VVRUwNuL6cnB%2F2lSdHTsMk%3D&amp;reserved=0" data-sf-ec-immutable="">https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/</a>
<a style="color: blue;" href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.volexity.com%2Fblog%2F2021%2F03%2F02%2Factive-exploitation-of-microsoft-exchange-zero-day-vulnerabilities%2F&amp;data=04%7C01%7CLeonardo_Jamorabo%40ensigninfosecurity.com%7Cc2a188ad82bc41db136008d8e1e31582%7Cd5cb08f4d38848b2bc028ecce3c63fce%7C1%7C0%7C637507712734947177%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=lSzPM0%2FyEYY9P7GnGD%2BDyVoDA11y2s1F8lWLl5v1blQ%3D&amp;reserved=0" data-sf-ec-immutable="">https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/</a>

Ensign's plans and procedures in response to the Microsoft exchange server vulnerabilities which compromised over 20,000 organisations.

Microsoft Exchange Server Vulnerabilities | Threat Advisories

Situation
A cyber attack on Friday has crippled critical infrastructure in the US.&nbsp; It caused&nbsp;Colonial Pipeline, the source of nearly half the US East Coast&rsquo;s fuel supply&nbsp;to shut down 5,550 miles of pipe, stranding countless barrels of gasoline, diesel and jet fuel on the Gulf Coast. &nbsp;The relatively new ransomware group known as&nbsp;DarkSide&nbsp;targeted attacks against their information technology (IT) network. Currently, there is no indication that their operational technology (OT) networks have been directly affected by the ransomware.
Like other ransomware platforms, DarkSide adheres to the current best practice of double extortion, demanding separate sums to unlock any files and servers, and promise to destroy any data stolen from the victim.
After gaining an initial foothold in the network, the attackers collect files and credentials, and exfiltrate them. They then use PowerShell to download the ransomware binary and proceed to move laterally with the main goal of conquering the Domain Controller (DC). After exfiltrating all sensitive information, they then distribute the binary to other assets in the environment, encrypting sensitive data such as finance, private information and partners documents for maximum damage.
&nbsp;
Background
First surfacing on Russian language hacking forums in August 2020, DarkSide is a ransomware-as-a-service platform that cybercriminals can use to infect companies with ransomware and carry out negotiations and payments with victims.&nbsp;DarkSide says it targets only big companies, and forbids affiliates from attacking certain industries, including healthcare, funeral services, education, public sector and non-profits.
DarkSide has shown itself to be ruthless with victim companies that have deep pockets. In January 2021, a negotiation was observed between the DarkSide crew and a $15 billion U.S. victim company that was hit with a $30 million ransom demand.
A cyber threat intel vendor had assessed (finding at &ldquo;moderate&rdquo; confidence) that some of the criminals behind DarkSide hail from another ransomware outfit called &ldquo;REvil,&rdquo; a.k.a. &ldquo;Sodinokibi&rdquo;. REvil&nbsp;is widely considered to be the newer name for GandCrab, a ransomware-as-a-service offering that closed shop in 2019 after bragging that it had extorted more than $2 billion.
&nbsp;
Ensign Posture &amp; Monitoring
Ensign provides advanced cybersecurity services which can detect and prevent the execution of ransomware such as this incident. &nbsp;Ensign has stepped up monitoring operations, and will advise clients of any anomalies detected from the monitored event logs.&nbsp; We have performed rounds of checks to verify security configurations are up-to-date.
&nbsp;
Our Recommendations
<ul>
<li>CII asset owners and operators to adopt a heightened state of awareness</li>
<li>Keep systems fully patched</li>
<li>Regularly backup files remotely</li>
<li>Implement security solutions to segregate and protect your environment (e.g. firewalls, proxies, web filtering, mail filtering, endpoint detection and response)</li>
<li>Scan your endpoints for indicators of compromise (IOC) -&nbsp;<a href="https://otx.alienvault.com/pulse/60821a187be8d208269c103c" data-sf-ec-immutable="">https://otx.alienvault.com/pulse/60821a187be8d208269c103c</a></li>
<li>Take reference from CISA recommendations to review your systems and apply mitigating measures to reduce the risk of compromise by ransomware &ndash;&nbsp;<a href="https://us-cert.cisa.gov/sites/default/files/2021-05/AA21-131A_DarkSide_Ransomware.pdf" data-sf-ec-immutable="">https://us-cert.cisa.gov/sites/default/files/2021-05/AA21-131A_DarkSide_Ransomware.pdf</a>. &nbsp;&nbsp;</li>
</ul>
&nbsp;
Ensign will continue to provide updates on the incident and inform you of additional recommendations. If you suspect that you have been compromised, you can contact us for digital forensic and incident response services. You can also take&nbsp;preemptive&nbsp;measures to protect your assets against new and unknown threats through our threat hunting and threat intelligence programme. Contact us at&nbsp;<a href="mailto:marketing@ensigninfosecurity.com" target="_blank" rel="noopener" data-sf-ec-immutable="">marketing@ensigninfosecurity.com</a>&nbsp;for more information.&nbsp;
&nbsp;
References:
<a style="color: blue;" href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" data-sf-ec-immutable="">https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/</a>
&nbsp;
<a style="color: blue;" href="https://www.cybereason.com/blog/cybereason-vs-darkside-ransomware" data-sf-ec-immutable="">https://www.cybereason.com/blog/cybereason-vs-darkside-ransomware</a>
&nbsp;
<a style="color: blue;" href="https://www.hstoday.us/subject-matter-areas/infrastructure-security/darkside-ransomware-cisa-fbi-advisory-on-best-practices-for-preventing-business-disruption-from-ransomware-attacks/" data-sf-ec-immutable="">https://www.hstoday.us/subject-matter-areas/infrastructure-security/darkside-ransomware-cisa-fbi-advisory-on-best-practices-for-preventing-business-disruption-from-ransomware-attacks/</a>

Ensign's plans and procedures in response to Darkside Ransomware.

Ensign Threat Advisory: DarkSide Ransomware | Threat Advisories

As cybersecurity challenges grow, traditional tools struggle with the vast amount of data and increasingly sophisticated attacks. Ensign addresses this with AI, which excels at processing large data sets to identify anomalies and cluster related data points. This approach is vital for detecting malicious activities within networks, not just at the perimeter.&nbsp;
&nbsp;
Download the full case study to see how Ensign used AI to enhance cybersecurity and protect against complex threats.&nbsp;
&nbsp;
As featured on Cyber Security Agency of Singapore (CSA)&rsquo;s <a class="text-secondary-B300" href="https://www.csa.gov.sg/Tips-Resource/publications/2024/singapore-cyber-landscape-2023" target="_blank" rel="nofollow noopener">Singapore Cyber Landscape 2023 Report</a>.&nbsp;

As cybersecurity challenges grow, traditional tools struggle with the vast amount of data and increasingly sophisticated attacks. Ensign addresses this with AI, which excels at processing large data sets to identify anomalies and cluster related data points.

Download the full case study to see how Ensign used AI to enhance cybersecurity and protect against complex threats. 

AI for Cyber Defence: A Case Study Approach | Cybersecurity Ebooks

Update as of 22 July 2024, 1137hrs
&nbsp;
The Situation
CrowdStrike, a prominent cybersecurity company, released a defective content update to the Falcon sensor product on 19 July 2024, causing widespread disruptions to 8.5 million Windows devices. The glitch led to systems crashing as well as displaying a blue screen error and becoming stuck in rebooting loops.
&nbsp;
The global IT outage had significant economic and societal impacts, highlighting the reliance of enterprises running critical services on CrowdStrike. In the aftermath of the CrowdStrike incident, opportunistic cybercriminals and threat actors wasted no time in attempting to take advantage of the situation.
&nbsp;
There has already been a sharp rise in CrowdStrike-themed domain registrations &ndash; threat actors are registering new websites made to look official and potentially trick IT personnel or members of the public into downloading malicious software or handing over sensitive private details.&nbsp; Unofficial code is being released claiming to help organisations recover from the widespread outages.
&nbsp;

On 19 July 2024, CrowdStrike's defective Falcon sensor update disrupted 8.5 million Windows devices, causing crashes and reboot loops. This global IT outage had significant impacts, leading cybercriminals to exploit the situation with fake CrowdStrike-themed domains, tricking users into downloading malicious software or divulging sensitive information.

CrowdStrike, a prominent cybersecurity company, released a defective content update to the Falcon sensor product on 19 July 2024, causing widespread disruptions to 8.5 million Windows devices. 

Threats and Opportunistic Cybercrime Arising From the Crowdstrike Incident | Threat Advisories

Featuring Dr Jonathan Goh, Head of Machine Learning, Ensign InfoSecurity
&nbsp;
In this video, Dr Jonathan Goh, Head of Machine Learning at Ensign InfoSecurity, explains how OT analytics and machine learning are transforming the way we defend critical infrastructure&mdash;such as water plants and power grids&mdash;against modern cyber threats.
&nbsp;
Today&rsquo;s operational environments are inundated with alerts from disconnected systems, often lacking the necessary context for swift and informed decision-making.
&nbsp;
Dr Goh outlines Ensign&rsquo;s hybrid approach, which combines machine learning with rule-based analytics to not only detect anomalies but also pinpoint their exact location within industrial systems. By correlating these anomalies with network telemetry and threat intelligence, mapped against the MITRE ATT&amp;CK for ICS framework, operators gain rapid, contextual insight into potential threats.
&nbsp;
&nbsp;
🔗 Read the full article: <a class="text-secondary-B300 hover:underline" href="/resources/featured-editorials/how-ot-analytics-and-machine-learning-are-rewriting-industrial-defence">Seeing Machines: How OT Analytics and Machine Learning Are Rewriting Industrial Defence</a>

There is something quietly momentous happening inside the most unassuming facilities in the world—water treatment plants, power substations, and manufacturing floors. They don’t look like battlegrounds. But they are.

Discover how OT analytics and machine learning bring context-aware detection to critical infrastructure, reshaping cybersecurity for industrial systems.

From Noise to Insight: How OT Analytics Pinpoint Real Threats in Critical Infrastructure

Learn how data can be an indispensable tool in the fight against phishing. Gain insights into the role data science plays in detecting threats already entrenched in the digital environment. To find out more, read Frontier Enterprise&rsquo;s article featuring Ensign&rsquo;s Vice-President of Data Science, Quek Han Yang.
&nbsp;
<a style="color: blue;" href="https://ensign.global/43V2GmD" target="_blank" rel="noopener">Click here</a> to read more.

In a Frontier Enterprise article, Ensign’s Data Science Vice-President, Quek Han Yang, elaborates on the role that data plays in building a proactive cybersecurity posture.

Gain insights into the role data science plays in detecting threats already entrenched in the digital environment.

Data: A Key Weapon in Your Cybersecurity Arsenal | Featured Editorials

Watch the on-demand webinar and take control of your cyber defence.
&nbsp;
AI-powered cybercrime is evolving at breakneck speed. Ransomware, phishing, and advanced persistent threats (APTs) are becoming more sophisticated &mdash; and harder to detect. But what if you could turn the tables and trap attackers before they strike?
&nbsp;
In this exclusive session, we reveal how Managed Deception enables you to take control of the game &mdash; turning cyberattacks into intelligence-gathering opportunities.
&nbsp;
In this webinar, you&rsquo;ll learn how to:
&nbsp;
<ul class="pl-6" style="list-style-type: disc; list-style-position: outside; margin-left: 1.5rem;">
<li>Defeat AI-Driven Cyber Threats -&nbsp;See how deception technology outwits AI-enhanced attacks like ransomware and phishing.</li>
<li>Trap Hackers Before They Strike -&nbsp;Discover how decoys and breadcrumbs lure attackers into controlled environments, providing real-time intelligence while protecting your crown jewels.</li>
<li>Prepare for the Future of Cyber Defence -&nbsp;Understand how deception helps you stay ahead in an era of AI-powered threats.</li>
</ul>
&nbsp;
Don&rsquo;t miss this opportunity to gain actionable insights and strengthen your defences against today&rsquo;s &mdash; and tomorrow&rsquo;s &mdash; cyber threats.

In this exclusive session, we reveal how Managed Deception enables you to take control of the game — turning cyberattacks into intelligence-gathering opportunities.

Watch our on-demand webinar on managed deception technology. Learn how to trap hackers, defeat AI-driven cyber threats, and strengthen your defenses.

Cyber Deception Webinar: Outsmart AI Threats | On-Demand Webinar

It is critical for organisations to double down on immediate actions required to identify systems surrounding the Apache Log4j vulnerability. The initial Apache Log4j vulnerability (CVE-2021-44228) on 9 Dec 2021, which was assigned a maximum CVSS score of 10.0, led to the massive reconnaissance and exploitation activity by threat actors leveraging on the bug. Ensign has published this supplementary threat advisory to complement the&nbsp;<a style="color: blue;" href="/resources/34" data-sf-ec-immutable="">Threat Advisory: Apache Java Logging Library Log4j Critical RCE Vulnerability</a>.
&nbsp;
In this advisory, we answer the top three questions about the impact of the Log4j vulnerability:
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Why the urgency to mitigate and remediate Log4j vulnerability?</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Why is there so much patching to do?</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Do we need to scan our systems using various Log4j scanners?</li>
</ul>
</ul>
</ul>

Gain a better understanding of how and why organisations are doubling down on immediate actions surrounding the Log4J vulnerability.

The initial Apache Log4j vulnerability (CVE-2021-44228) on 9 Dec 2021, which was assigned a maximum CVSS score of 10.0, led to the massive reconnaissance and exploitation activity by threat actors leveraging on the bug.

Understanding The Impact of Apache Log4j Vulnerability | Threat Advisories

&nbsp;
Ensign's Head of Advisory and Emerging Business, Gaurav Keerthi, was featured on the Kopi Time podcast with Taimur Baig, Managing Director and Chief Economist at DBS Bank, &nbsp;where they delved into the dynamic and ever-evolving cybersecurity landscape.
&nbsp;
During the conversation, Gaurav shared insights on the intersection of geopolitics and cybersecurity, including the rise of state-sponsored and independent attacks on critical infrastructure such as power grids, healthcare systems, and airports. He also highlighted the implications of advanced technologies like AI and quantum computing, which are both reshaping threats and enabling innovative defence strategies.
&nbsp;
Gaurav emphasised the importance of resilience in cybersecurity&mdash;shifting from the pursuit of perfect immunity to creating systems capable of recovering swiftly after an attack. This approach helps organisations manage risks effectively in an era where cybercrime is a billion-dollar economy.
&nbsp;
🎧 Catch the <a class="text-secondary-B300" href="https://youtu.be/ZNAY-qnKQZY?si=2g87uoeDNldsT5SA" target="_blank" rel="noopener">full episode</a> to explore how technology and strategic risk management are shaping the future of cybersecurity.

Ensign's Head of Advisory and Emerging Business, Gaurav Keerthi, was featured on the Kopi Time podcast with Taimur Baig, Managing Director and Chief Economist at DBS Bank,  where they delved into the dynamic and ever-evolving cybersecurity landscape.

Tech and Security With Gaurav Keerthi | Featured Editorials

By Jeremy Moke, Director of Ensign InfoSecurity&rsquo;s Operations Centre, Malaysia
&nbsp;
Ransomware is no longer just a cybersecurity threat but an economic weapon holding critical industries hostage. Once considered an inconvenience limited to locking up files, ransomware has evolved into a sophisticated business model that disrupts operations, exploits regulatory loopholes, and systematically coerces organisations into submission. Its effects are no longer confined to IT departments but have real-world consequences, crippling businesses, public services, and entire economies.
&nbsp;
In Ensign InfoSecurity&rsquo;s <a class="text-secondary-B300" href="/resources/threat-insights/cyber-threat-landscape-report-2024" target="_blank" rel="noopener">2024 Cyber Threat Landscape Report</a>, Ransomware-as-a-Service (RaaS) emerged as the most common cybercrime model; the lack of any permanent solution introduced more challenges for law enforcement authorities. In Malaysia, ransomware incidents surged by 53% in just one quarter, rising from 17 to 26 reported cases, according to<a class="text-secondary-B300" href="https://mycert.org.my/portal/advisory?id=SR-027.092024" target="_blank" rel="nofollow noopener"> MyCERT&rsquo;s Q2 2024 report</a>.

Once considered an inconvenience limited to locking up files, ransomware has evolved into a sophisticated business model that disrupts operations, exploits regulatory loopholes, and systematically coerces organisations into submission.

Avoiding Double Ransomware Extortion And The Price of One | Featured Editorials

The cybersecurity landscape has become even more daunting in 2020, with events in the recent months posing numerous challenges for organisations. Escalating political tensions, increasing healthcare concerns with COVID-19, and accelerated digitalisation efforts to support remote work and contactless transactions have dramatically transformed digital attack surfaces, impacting technology transformation processes.&nbsp;
&nbsp;
Prepared by Teo Xiang Zheng, Head of Advisory, Ensign Consulting, this report aims to provide insights into the threats and trends observed by Ensign InfoSecurity in the global cyber environment 2020. These include an increase in threat actor activities, incidents of compromise due to expanding digital attack surface, exploitation of the COVID-19 situation and cyber supply chain, as well as threat actor attention paid to contact tracing solutions.
&nbsp;
Highlights of the report include:
<ul>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Summary of the observed threats and trends</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Cybersecurity implications arising from the COVID-19 pandemic</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Suggestions on how to mitigate the threats</li>
</ul>
</ul>
</ul>
</ul>

Learn about the threats and trends observed by Ensign InfoSecurity in 2020, as well as suggestions on how to mitigate them.

Download this report to discover insights on the threats and trends observed by Ensign InfoSecurity in the global cyber environment.

Cybersecurity for Organisations in 2020: Threats, Trends & Mitigation | Threat Insights

The Russia-Ukraine conflict has escalated to the cyberspace, drawing partisan response and actions coming from supporters of the warring nations. The tension has spilt over beyond the area of conflict, and organisations siding with either side must be prepared for potential disruptions to their operations, and other repercussions.
&nbsp;
This Executive Brief contains a comprehensive summary of the threat assessment resulting from observations on the conflict from January to 25 March 2022. It summarises the observed&nbsp;attacks&rsquo; effects and their implications. We have provided recommendations that organisations and businesses can consider to prevent being part of the collateral damage from the conflict.
&nbsp;
This Executive Brief supplements the earlier published technical threat advisory, which can be accessed&nbsp;<a style="color: blue;" title="https://www.ensigninfosecurity.com/analysis-insights/content/2022/02/26/impact-of-cyber-attacks-amidst-ukraine-crisis" href="/resources/41" target="_blank" rel="noopener" data-sf-ec-immutable="">here</a>.

This Executive Brief summarises the observed attacks’ effects and their implications. We have provided recommendations that organisations and businesses can consider to prevent being part of the collateral damage from the conflict.

This Executive Brief contains a comprehensive summary of the threat assessment resulting from observations on the conflict from January to 25 March 2022. 

Executive Brief on the Cyber Impact of Russia-Ukraine Conflict | Threat Advisories

As businesses in the banking and finance industry transform and introduce more digital platforms to interact with clients, cyber risks have increased in tandem, especially during this unprecedented pandemic period.&nbsp;
&nbsp;
In a recent interview with&nbsp;Thomson Reuters, Ensign&rsquo;s Senior Vice President of Technology &amp; Capabilities, Lee Shih Yen, shared key findings of the Ensign Cyber Threat Landscape Report 2020, and explained why the finance sector remains a lucrative target for cybercriminals.&nbsp;
&nbsp;
Here are some highlights from the interview:
<ul type="disc">
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Top cyber threats faced by organisations in 2019</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; 2020 cybercrime trends, and rise in COVID-19 themed phishing attacks</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Insights on how to overcome cybercrime challenges</li>
</ul>
</ul>
</ul>
</ul>
&nbsp;

As businesses in the banking and finance industry transform and introduce more digital platforms to interact with clients, cyber risks have increased in tandem, especially during this unprecedented pandemic period. 

Interview Feature in Thomson Reuters Regulatory Intelligence Report | Interviews

By Teo Xiang Zheng, VP of Advisory, Ensign InfoSecurity
&nbsp;
In 2025, cybercrime is poised to become a global economic force, costing the world an alarming US$12 trillion. This staggering figure would rank it as the third-largest economy in the world, surpassing the GDP of Germany and Japan.&nbsp;
&nbsp;
Attack surfaces will expand as businesses accelerate their digital transformation, making cyber resilience a critical survival skill.
&nbsp;
Three key cybersecurity trends are poised to dominate in 2025: Ransomware's growing sophistication, artificial intelligence enabling more potent attacks, and geopolitical tensions driving tech bifurcation. Together, they create a complex and volatile cybersecurity landscape.
&nbsp;

In 2025, cybercrime is poised to become a global economic force, costing the world an alarming US$12 trillion. This staggering figure would rank it as the third-largest economy in the world, surpassing the GDP of Germany and Japan. 

In 2025, cybercrime is poised to become a global economic force, costing the world an alarming US$12 trillion.

Fortifying the Digital Frontier in 2025 | Featured Editorials

<div class="OutlineElement Ltr SCXW1486410 BCX0">
Joining us are host - Gaurav Keerthi (Head of Advisory and Emerging Business), subject matter expert - Teo Xiang Zheng (Vice President of Advisory), and special guest - Mike Cunningham (R&amp;D Program Manager, Center for Threat-informed Defense, MITRE Engenuity).&nbsp;&nbsp;
</div>
<div class="OutlineElement Ltr SCXW1486410 BCX0">
&nbsp;
</div>
<div class="OutlineElement Ltr SCXW1486410 BCX0">
In the episode, we'll dive deep into the topic of mitigating cyber threats in Asia through Threat-informed Defence. We'll discuss the unique cyber threat landscape in Asia and its contrasts with other regions. We'll also introduce the concept and importance of threat-informed defence and explain how organisations can enhance their cyber defence strategies using the MITRE ATT&amp;CK framework. The discussion includes real-world examples of threat detection techniques and cybersecurity scoring, offering practical steps for implementing effective cyber defences and understanding adversaries.&nbsp;
</div>

In this episode, we'll dive deep into the topic of mitigating cyber threats in Asia through Threat-informed Defence. 

In this episode, we cover Asia's cyber threats, threat-informed defence, and using MITRE ATT&CK to enhance organisational cybersecurity.

EnsiderVoices Episode 3 | Cybersecurity Podcast

The Cyber Security Agency of Singapore (CSA) has published the CCoP 2.0 for Critical Information Infrastructure which came into effect on 4 July 2022, superseding the previous versions of the code. Its aim is to establish stronger governance and strengthen cyber resiliency in the 11 CII sectors. Download this eGuide to learn more about the 16 key changes in the revised CCoP, and the recommended approaches and solutions to meet the requirements

Learn more about the key changes in the revised Cybersecurity Code of Practice, and how Ensign can help Critical Information Infrastructure Owners manage cyber risks, and become compliant with the new code

Download this eGuide to learn more about the 16 key changes in the revised CCoP, and the recommended approaches and solutions to meet the requirements.

CCoP 2.0 for Critical Information Infrastructure (CII) | Cybersecurity Ebooks

By Adithya Nugraputra, Head of Consulting at Ensign InfoSecurity Indonesia
&nbsp;
The Trend of Ransomware Attacks - one of the types of cyberattacks aimed at obtaining ransom has dramatically increased globally. Throughout 2023, several significant global organizations such as Toyota, the National Basketball Association (NBA), and AXA have been recorded as victims of ransomware attacks. According to the United States government, ransomware attacks have disrupted services and businesses, affecting banks, government offices, hospitals, energy companies, and various industries. In 2022, organizations worldwide detected 493.33 million cases of ransomware attacks, a significant increase from 304.64 million cases in 2020. There was a spike in 2021, with the number of ransomware attacks reaching 623.25 million cases, driven by factors such as the widespread adoption of remote work systems due to the pandemic, which created new opportunities for cybercriminals. Although it decreased slightly in 2022, reported cases of ransomware attacks remained significantly higher compared to 2020.&nbsp;
&nbsp;
In Indonesia, ransomware has targeted various critical organizations, ranging from marketplaces and banking to the public sector. The Threat Landscape Report 2023, Fourth Edition by Ensign InfoSecurity, indicates the financial sector as one of the four favorite targets for cyberattacks in Indonesia. The National Cyber and Crypto Agency also mentioned ransomware as one of the three most frequent incidents of cyberattacks in Indonesia. At least 17 ransomware attacks with the publication of sensitive data occurred throughout 2023.&nbsp;

The byline explores global and Indonesian cybersecurity threats, as well as the pivotal role AI plays in streamlining incident response, enhancing threat hunting capabilities, and efficiently processing extensive data. Adithya Nugraputra shares how organisations can utilise AI to prioritise threat analysis, forecast potential threats, and proactively thwart attacks, ultimately enhancing resilience in the ever-evolving cyber landscape.

By integrating generative AI techniques, attackers can create highly realistic voice phishing schemes, and increase the likelihood of ransom payments.

Role of Artificial Intelligence in Combating Ransomware | Featured Editorials

The use of technology in ship operations and management is placing&nbsp;maritime organisations at a risk of cyber-attacks. The ramifications of these cyber-attacks are wide-ranging, stemming from ship collisions to possible cargo losses, pollution, and even disruption in port operations.
&nbsp;
In this opinion piece on Seatrade Maritime, Ensign&rsquo;s Head of Advisory, Teo Xiang Zheng, explains measures maritime organisations can take to shore up their cyber defences. These include leveraging the cyber community for cyber threat information, bolstering organisations&rsquo; cybersecurity hygiene, or even reviewing and revising crisis management plans and playbooks.&nbsp;
&nbsp;
Click <a href="https://ensign.global/3q8upm1" target="_blank" rel="noopener">here </a>to read more about what Xiang Zheng had to say.

Maritime organisations face increasing cyber threats as they leverage on technology in their operations and management processes. Ensign’s Head of Advisory,   
Teo Xiang Zheng explains how maritime organisations can shore up their cyber defences in this opinion piece on Seatrade Maritime.

The use of technology in ship operations and management is placing maritime organisations at a risk of cyber-attacks. 

Bracing For the Rising Tide of Cyber Threats Against the Maritime Industry | Featured Editorials

Protect your sensitive information with Ensign's Data Loss Prevention (DLP) Suite. Safeguard intellectual property, personal details, and financial information while ensuring compliance and reducing cyber breach risks. Aligned with NIST&rsquo;s cybersecurity framework, Ensign&rsquo;s DLP Suite can secure your oragnisation&rsquo;s data across all platforms.

Data loss due to cyberattacks poses significant risks, impacting not only individual companies but entire economies.

As the digital world struggles to deal with the onslaught of more prevalent and pernicious threats, the pressure on the Banking, Financial Services &amp; Insurance (BFSI) industry to perform has never been greater. To drive growth and increase customer trust, financial institutions are taking advantage of various platforms such as mobile, cloud, and social&mdash;exposing them to further cybersecurity risks.
&nbsp;
As customers continue to move away from physically transacting with banks and other institutions, more enhanced investment in securing mobile and web-based services must be seriously considered to keep up with customer behaviour and expectations.
&nbsp;
Read the ebook and learn more about:
<ul type="disc">
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Digitalisation trends</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; The industry&rsquo;s cybersecurity risks and threats</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; MAS&rsquo; proposed cybersecurity guidelines</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; How to manage risks</li>
</ul>
</ul>
</ul>
</ul>
</ul>

Download our eBook to find out how the BFSI industry is adopting disruptive technology, and the cyber risks arising from it.

Critical Infrastructure (CI) in Hong Kong, including banking, telecommunications, and transportation, is crucial for societal and economic well-being. Disruptions to CI networks threaten public safety and security. Globally, jurisdictions mandate CI operators to safeguard systems, prepare for cyber incidents, and report breaches. Hong Kong&rsquo;s upcoming legislation, the Protection of Critical Infrastructure (Computer System) Bill slated to be passed in 2025, aims to bolster CI cybersecurity.
&nbsp;
Download the eBook for more details on strengthening your CI defences.

Globally, jurisdictions mandate CI operators to safeguard systems, prepare for cyber incidents, and report breaches. Hong Kong’s upcoming legislation, the Protection of Critical Infrastructure (Computer System) Bill slated to be passed in 2025, aims to bolster CI cybersecurity.

Download this essential guide on Hong Kong’s upcoming legislation, the Protection of Critical Infrastructure (Computer System) Bill slated to be passed in 2025.  

Protection of Critical Infrastructure (Computer System) Bill | Cybersecurity Ebooks

Taking advantage of the rapid adoption of digital technology and accelerated use of digital payments, cyber threat actors are increasingly targeting payments and payments-related infrastructure. Amidst this landscape, the PCI Security Standards Council (PCI SSC) issued Version 4.0 of the PCI DSS on March 31, 2022, shifting the standard's focus to outcome-based requirements.
&nbsp;
Download this eBook to find out how to remain PCI DSS compliant.

The Payment Card Industry Data Security Standard (PCI DSS) was developed to 
encourage and enhance payment card account data security, as well as facilitate the broad adoption of consistent data security measures globally.

Find out more on how PCI DSS develops a baseline of technical and operational requirements 
designed to protect account data. 

Download this essential guide detailing the pivotal updates in the Payment Card Industry Data Security Standard (PCI DSS V4.0).

Cybersecurity Guide on the PCI DSS 4.0 | Cybersecurity Ebooks

Ransomware&nbsp;attacks have come to greater notoriety in recent times. The&nbsp;DarkSide incident, in particular, compromised a US-based critical infrastructure, causing a widespread disruption to its services, and lives of many. This has reportedly gained the perpetrators a huge amount of payout. Other prominent&nbsp;ransomware&nbsp;attacks in 2021 included attacks on AXA Insurance that was reported in May 2021, and Kaseya in July 2021.
Ransomware&nbsp;perpetrators are also evolving their tactics, techniques and procedures in their cyber operations. These include the Ransomware-as-a-Service model, and double extortion approach used by cyber criminals, which results in increased success rates that puts organisations at greater risk.
&nbsp;
Download the Ensign Anti-Ransomware Suite to learn more about:
&nbsp;
<ul>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; The&nbsp;increasing sophistication and advancement of&nbsp;ransomware&nbsp;campaigns</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Ensign&rsquo;s defence approaches to curb&nbsp;ransomware&nbsp;threats from materialising</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Recommendations to prevent, detect, and respond to ransomware attacks</li>
</ul>
</ul>
</ul>
</ul>

Ensign's Anti-Ransomware Suite equips organisations with capabilities to prevent, detect, and respond to advanced ransomware threats.

Download the Ensign Anti-Ransomware Suite Factsheet to learn about ransomware advancements and key defence strategies.

Ensign Anti-Ransomware Suite | Resources

Traditional security testing often leaves organisations with assumptions rather than assurance. Breach and Attack Simulation (BAS) changes that by continuously and safely emulating real-world cyberattacks to validate the effectiveness of your security controls. It exposes misconfigurations, integration gaps, and unseen vulnerabilities that attackers could exploit &mdash; all without disrupting operations. Ensign&rsquo;s BAS service goes further, delivering tailored simulations, expert remediation guidance, and managed integration with your existing tools. The result is continuous, measurable assurance that your security investments are performing as intended and keeping pace with today&rsquo;s evolving threats.

Breach and Attack Simulation (BAS) safely simulates real-world attacks to validate defences, reveal blind spots, and provide continuous assurance of cyber readiness.

Ensign BAS emulates real attacks to validate controls, expose gaps, and guide remediation—safely and continuously.

Breach and Attack Simulation (BAS) | Continuous Validation of Cyber Defences

The Ensign Cyber Threat Landscape Report 2021 provides insights into the most prevalent threats we observed in 2020 in Asia Pacific, more specifically in Singapore, Malaysia, Hong Kong and South Korea. It also presents the cybersecurity outlook for 2021.
&nbsp;
Highlights from the report include:
<ul>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Covid-19-themed and phishing threats</li>
</ul>
<ul>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Top threat activities observed across the MITRE ATT&amp;CK Tactics, Techniques and Procedures</li>
</ul>
<ul>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Top malware groups</li>
</ul>
<ul>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Top threat actor group</li>
</ul>
<ul>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Cybersecurity outlook&nbsp;for&nbsp;2021</li>
</ul>
<ul>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Conclusion and key learnings</li>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>

Gain insights into the attackers’ tactics, techniques, and procedures, as well as detailed accounts of their impact on Asia-Pacific organisations in 2020.

The Ensign Cyber Threat Landscape Report 2021 provides insights into the most prevalent threats we observed in 2020 in Asia Pacific.

Cyber Threat Landscape Report 2021 | Threat Insights

In a recent interview with Channel 8 News, Teo Xiang Zheng provided valuable insights into the alarming surge of cyber threats. Watch the video <a style="color: blue; text-decoration: underline;" title="Ch8 Interview" href="https://ensign.global/3CKhidi" data-sf-ec-immutable="">here</a>.

In a recent interview with Channel 8 News, Teo Xiang Zheng provided valuable insights into the alarming surge of cyber threats.

CH8 Broadcast Interview | Interviews

In 2019, the number of cyber threats continued to rise, compromising and putting the spotlight on some critical infrastructure sectors and high-profile organisations. Find out the top threat attack vectors enterprises faced, as well as the most targeted industries in Singapore the previous year.

Find out the top threat attack vectors enterprises faced in 2019.

Hackers have evolved their tactics from email phishing, to now include smishing with a high level of realism, as part of their delivery methods in their cyber attack campaigns. In September 2021, The Singapore Police Force also reported at least 150 victims falling for similar scams.
&nbsp;
Through Ensign&rsquo;s Smishing Protection, we protect organisations, and their consumers, from such attacks.
&nbsp;
Download the factsheet to learn more about:
<ul type="disc">
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; The Ensign Smishing Protection approach</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Our novel and unique data science technique in detecting phishing and smishing</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Benefits and value to your organisation</li>
</ul>
</ul>
</ul>
</ul>

Learn more about Ensign Smishing Protection, and how we can protect you against smishing attacks.

The Ensign Cyber Threat Landscape Report 2020&nbsp;provides detailed insights into the&nbsp;most prevalent threats observed in Singapore&rsquo;s&nbsp;cyber landscape. Through detailed analysis of key&nbsp;security insights and threat intelligence&nbsp;information, the report identifies the cyber threats&nbsp;and trends that Singapore faced in 2019. It also offers threat insights based on the stages of the&nbsp;MITRE ATT&amp;CK&reg; framework, as well as the best&nbsp;practices for safeguarding against cyber threats.
&nbsp;
<div>
Highlights from the report include:
<ul>
<li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Details on the top cyber attack vectors</li>
<li style="display: flex; align-items: flex-start;">&bull; Insights into the most targeted industries</li>
<li style="display: flex; align-items: flex-start;">&bull; Top threat attack sources</li>
<li style="display: flex; align-items: flex-start;">&bull; Threat insights based on the stages of the MITRE ATT&amp;CK&reg; framework</li>
<li style="display: flex; align-items: flex-start;">&bull; Analysis of the most active attack groups in 2019</li>
<li style="display: flex; align-items: flex-start;">&bull; Best practices and recommendations</li>
<li style="display: flex; align-items: flex-start;">&nbsp;</li>
</ul>
<a style="color: blue;" href="https://ensign.global/3OFb4SF" target="_self">CLICK HERE</a> to find out more about the Ensign Cyber Threat Intelligence service.
</li>
</ul>
</div>

Gain detailed insights into the most prevalent threats observed in Singapore’s cyber landscape in 2019.

As financial institutions (FIs) increasingly adopt new technologies, they also expose themselves to new risks that cyber criminals readily exploit. Possessing sensitive data that&rsquo;s highly valued, FIs continue to be the main targets of attacks. In light of this, the Hong Kong Monetary Authority (HKMA) released the Cybersecurity Fortification Initiative (CFI) 2.0.&nbsp;
&nbsp;
Ensign InfoSecurity&nbsp;has produced a guide that provides insights into the key changes in the CFI 2.0 and the Cyber Resilience Assessment Framework (C-RAF), as well as how Ensign can help FIs implement them.

This eBook expands on the key changes to HKMA’s CFI 2.0, and the C-RAF, as well as highlights how Ensign can help FIs benefit from them.

Download this essential guide providing insights on the Cybersecurity Fortification Initiative (CFI) 2.0 released by the Hong Kong Monetary Authority (HKMA). 

Cybersecurity Guide on the HKMA CFI 2.0  | Cybersecurity Ebooks

In an environment where cyber threats evolve faster than traditional defences, static, compliance-driven assessments are no longer enough. Continuous Threat Exposure Management (CTEM) introduces a proactive, business-aligned approach that continuously identifies, validates, and prioritises cyber risks based on real-world impact. By integrating seamlessly with your existing security tools, CTEM provides real-time visibility into your organisation&rsquo;s true exposure landscape. Supported by Ensign&rsquo;s ITSM/ITSO-as-a-Service, it not only uncovers vulnerabilities but also ensures timely remediation and risk governance &mdash; closing the loop from discovery to resolution and driving continuous cyber resilience.

CTEM continuously validates and prioritises cyber risks, integrating with existing defences to reduce exposures and enhance organisational resilience.

Ensign’s CTEM continuously validates defences, prioritises risks by business impact, and ensures remediation — turning visibility into action for lasting cyber resilience.

Continuous Threat Exposure Management (CTEM) | Proactive Cyber Exposure Reduction

While the world&rsquo;s economy slows down, and business operations globally come to an alarming halt, opportunistic cybercriminals are thriving and targeting enterprises, more particularly those from the healthcare sector. In an interview with CNA, Ensign's Senior Vice President of Technology and Capabilities, Lee Shih Yen, spoke about the rise of cyberattacks in the healthcare industry, and how the threat landscape has evolved as a result of the Covid-19 pandemic.
Watch the interview here:&nbsp;<a href="https://www.channelnewsasia.com/watch/rise-cyber-attacks-across-all-sectors-march-april-healthcare-tops-list-attacks-video-1469336" data-sf-ec-immutable="">CNA-Interview</a>&nbsp;

Ensign's Senior Vice President of Technology and Capabilities, Lee Shih Yen, spoke about the rise of cyberattacks in the healthcare industry in an interview with CNA.

Today, the unseen threat of cyberattacks and online scams is not confined to major corporations and governments, but also small businesses and everyday online activities of ordinary citizens.&nbsp; &nbsp; So, is cybersecurity akin to public goods like street lighting, clean water and national security, or is it a private entity that individual users and organisations should manage independently? By drawing parallels with water sanitation to the last car in the showroom, the discourse drives home the importance of clear demarcation between individual and state responsibilities in the cyber realm. It also explores the various models on the provision of cybersecurity, from regulatory intervention to subsidies and indirect state implementation. &nbsp; This thought-provoking commentary, authored by Mr Gaurav Keerthi in his role as Adjunct Senior Fellow with the Centre of Excellence for National Security, and concurrently Ensign InfoSecurity&rsquo;s Head of Advisory and Emerging Business, sheds light on the integral role of cybersecurity, exploring its essence, both for private and public good.
&nbsp;
Read the opinion piece featured on TODAY <a style="color: blue;" href="https://ensign.global/3twx8ac" target="_blank" rel="noopener">here</a>
Read the full commentary published on RSIS&nbsp;<a style="color: blue;" href="https://www.rsis.edu.sg/rsis-publication/rsis/is-cybersecurity-a-public-or-private-good/" target="_blank" rel="noopener">here</a>

As cyber threats continue to escalate, the debate intensifies over the respective roles and responsibilities of governments, businesses, and individual digital application users in ensuring online safety. In this commentary, Gaurav Keerthi discusses the integral role of cybersecurity, exploring its essence, both as a private and public good.

Is cybersecurity a public good, like street lighting, or should users and organisations manage it independently?

Is Cybersecurity a Public or Private Good? | Featured Editorials

In this podcast episode, we are joined by hosts Teo Xiang Zheng (Vice President of Advisory) and Bach HD (Senior Consultant) from Ensign InfoSecurity, along with our special guest, Benjamin Ang (Senior Fellow; Head of Centre of Excellence for National Security; Head of Digital Impact Research) from RSIS, NTU.
&nbsp;
We'll delve into the unique cyber threat landscape of Asia. Through the advocacy and adoption of threat-informed defence approaches, we'll discuss the unique insights and threat groups we've observed in the region. Organisations should take note of these insights to inform their cyber strategies and defences. We'll also uncover the power of collaboration between the public, private, and academic sectors in strengthening cybersecurity, exploring the far-reaching benefits that these partnerships bring to communities for developing the cyber ecosystem across the region. Lastly, we'll explore ASEAN's pivotal role in shaping regional and international cybersecurity policies, offering an insider's perspective on their influence.

In this podcast episode, we delve into the unique cyber threat landscape of Asia. Through the advocacy and adoption of threat-informed defence approaches, we'll discuss the unique insights and threat groups we've observed in the region

In this episode, we cover Asia's cyber threats, threat-informed defence, public-private partnerships, and ASEAN's role in cybersecurity policy.

EnsiderVoices Episode 2 | Cybersecurity Podcast

Data scientists from Ensign&rsquo;s Labs presented their research&nbsp;entitled&nbsp;&ldquo;TypoSwype: An Imaging Approach to Detect Typo-Squatting" during the IEEE NTMS 2021 Conference. The study highlights considerations pertaining to keyboard distances, a main vulnerability exploited by typo-squatting techniques.&nbsp; The study also aims to address the lack of a widely accepted approach for keyboard distances by leveraging on state-of-the-art image recognition techniques.

Ensign Labs’ research highlights how TypoSwype can detect Typo-Squatting.

Data scientists from Ensign’s Labs presented their research entitled “TypoSwype: An Imaging Approach to Detect Typo-Squatting" during the IEEE NTMS 2021 Conference.

TypoSwype: An Imaging Approach to Detect Typo-squatting | Featured Editorials

As the digital landscape rapidly expands with the proliferation of XIoT (Extended Internet of Things)&nbsp;devices, organisations are increasingly finding their cybersecurity postures lagging behind its demands.&nbsp;This expansion has brought about significant challenges, such as the lack of clear visibility into the&nbsp;networked XIoT assets and the corresponding risk and vulnerability exposures.
&nbsp;
To keep up with the continuous pace of digital transformation, critical infrastructure industries such as&nbsp;manufacturing, and healthcare, must evolve beyond traditional vulnerability management of their&nbsp;Cyber-Physical Systems (CPS). They should create a broader and more dynamic programme for&nbsp;managing their overall exposure to risk.
&nbsp;
This requires a specialised approach that enables these organisations to create an Exposure Management programme that takes into account asset complexities, unique governance, and business-critical operational outcomes of CPS environments. This encompasses a repeatable cycle of measures that optimise security beyond traditional means such as patching or playbooks.

As the digital landscape rapidly expands with the proliferation of XIoT (Extended Internet of Things)
devices, organisations are increasingly finding their cybersecurity postures lagging behind its demands.
This expansion has brought about significant challenges, such as the lack of clear visibility into the
networked XIoT assets and the corresponding risk and vulnerability exposures.

Critical infrastructure operators must move beyond traditional vulnerability management to keep pace with digital transformation.

Exposure Management-as-a-Service (EMaaS) | Service Factsheet

By Nicky Au, General Manager, Ensign InfoSecurity, Greater China
&nbsp;
Hong Kong has been hit by a spate of cyberattacks in the last year, notably British engineering firm&rsquo;s HKD200 million deepfake video conference scam and a series of ransomware attacks targeting the government, healthcare and education sectors. Worsened by the rampant abuse of Artificial Intelligence (AI) to manipulate truths, it is evident that no entity is immune to becoming a victim of cyberattacks, regardless the scale of its business or industry sector.
&nbsp;
Ransom as the primary motive for cyberattacks
 Ensign InfoSecurity (&ldquo;Ensign&rdquo;), Asia&rsquo;s largest comprehensive cybersecurity solutions provider, identified ransom as the primary objective in 69% of all observed attacks in the Greater China Region in 2023. This is one of the key insights highlighted in Ensign&rsquo;s fifth edition of the Cyber Threat Landscape Report, which draws on Ensign&rsquo;s proprietary and cyber threat intelligence sources.

Hong Kong has been hit by a spate of cyberattacks in the last year, notably British engineering firm’s HKD200 million deepfake video conference scam and a series of ransomware attacks targeting the government, healthcare and education sectors.

Worsened by the rampant abuse of AI, it is evident that no entity is immune to cyberattacks, regardless the scale of its business or industry sector.

Strengthening Cybersecurity Against AI-Driven Threats | Featured Editorials

Today&rsquo;s exponential growth in data is unlikely to go away anytime soon. In fact, it looks set to escalate, which makes the amendments to the PDPA timelier than ever. The Cybersecurity Guide on the Personal Data Protection (Amendment) Bill provides insights into the PDPA, and the steps Singapore organisations can take to better manage their sensitive data, and mitigate the risks.&nbsp;
&nbsp;
Highlights of the ebook include:
<ul type="disc">
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Strengthening consumer trust through organisational accountability</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Ensuring effectiveness of enforcement</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Enhancing consumer autonomy</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Supporting data use for innovation</li>
<ul style="list-style-position: inside;">
<li style="display: flex; align-items: flex-start;">&bull; Ensign&rsquo;s recommendations</li>
</ul>
</ul>
</ul>
</ul>
</ul>
</ul>

Download our ebook to find out the key changes of the amendment bill and their impact on Singapore organisations.

Cybersecurity Guide on the Personal Data Protection (Amendment) Bill | Cybersecurity Ebooks

Cybersecurity Guide on the Personal Data Protection (Amendment) Bill

The cyber threat landscape is evolving at a pace that few anticipated. The volume of attacks has surged, but it is their increasing sophistication that raises the most concern. Reports indicate that nation-state hackers have significantly increased their attempts to infiltrate critical infrastructure in recent years, though precise figures vary. The growing sophistication of these attacks highlights the urgent need for enhanced defences. At the same time, Cybersecurity Ventures projects that cybercrime will cost the world $10.5 trillion annually by 2025 (Cybersecurity Ventures, 2016). No industry is immune&mdash;healthcare, finance, manufacturing, small businesses, and government agencies all remain in the crosshairs.
&nbsp;
Yet, despite this stark reality, many organisations continue to rely on outdated security measures that fail to address modern threats. The notion that a well-maintained firewall and an antivirus programme can keep attackers at bay is dangerously outdated. A better approach involves understanding the adversaries&mdash;who they are, what drives them, and how they operate. Security today must be proactive, leveraging intelligence on threat actors' tactics and methods to stay one step ahead. A reactive stance, dealing with breaches only after they occur, is no longer a viable option.

Understanding the different types of cyber attackers is only part of the equation. The real challenge lies in transforming this awareness into a robust defence strategy.

Understanding the Three Types of Cyber Attackers | Featured Editorials

&nbsp;
For decades, our online existence has been defined by the strength of our passwords. The era of &lsquo;password123&rsquo; may be behind us, but for many individuals and organisations, security still begins and ends with a hodgepodge of characters that supposedly shield us from digital threats. Yet as cyberattacks become more sophisticated and artificial intelligence (AI) continues to evolve, the notion of safeguarding mere numbers and codes feels increasingly quaint. The new frontier of data protection is not about memorising yet another 12-character passphrase, but about recognising and defending what makes us who we are&mdash;our very identities.
&nbsp;
This shift is unfolding in multiple arenas. Traditional multi-factor authentication (MFA) mechanisms, for example, are no longer just about sending a text message to confirm a login attempt. Biometric data, such as facial recognition and fingerprint scanning, is rapidly supplanting PIN codes. Behavioural analytics&mdash;monitoring the unique ways we type, swipe, and pause on screen&mdash;are also joining the mix to reinforce identity checks. In other words, the digital sphere is starting to mirror the physical one, where identity extends beyond a few static details to encompass the full breadth of how we move, act, and interact.

The new frontier of data protection is not about memorising yet another 12-character passphrase, but about recognising and defending what makes us who we are—our very identities.

From Passwords to Personas: Shifting from Number Protection to Identity Preservation | Featured Editorials

By Gaurav Keerthi, Head of Advisory and Emerging Business, Ensign InfoSecurity
&nbsp;
In an increasingly digital world, disruptions are inevitable, and recent incidents highlight the impact on everyday lives. A failed software update by CrowdStrike led to device crashes and queues at airports, while a vulnerability in Mobile Guardian&rsquo;s platform saw Singaporean students lose essential revision notes weeks before exams. Mobile Guardian&rsquo;s services were terminated by The Ministry of Education. In each instance, we are left asking: can such disruptions be prevented, or is mitigation the real focus?
&nbsp;
Digitalisation offers undeniable advantages but brings with it significant risks. Complex systems mean that even minor issues can escalate quickly, leaving end-users&mdash;like students, businesses, and consumers&mdash;as collateral damage. As reliance on digital infrastructure deepens, we must question not just how to prevent these disruptions but also how to better insulate ourselves against their effects.

Digitalisation offers undeniable advantages but brings with it significant risks. Complex systems mean that even minor issues can escalate quickly, leaving end-users—like students, businesses, and consumers—as collateral damage. As reliance on digital infrastructure deepens, we must question not just how to prevent these disruptions but also how to better insulate ourselves against their effects.

Complex systems mean that even minor issues can escalate quickly, leaving end-users—like students, businesses, and consumers—as collateral damage. 

Dealing with Digital Disruptions | Featured Editorials

The modern world runs on an intricate web of digital infrastructure so deeply embedded in everyday life that most people never stop to consider its fragility. Power grids, transport networks, hospitals, financial systems&mdash;each an essential pillar of society, each more connected than ever, and each astonishingly vulnerable. In the Asia-Pacific region, the digital revolution has unfolded at breakneck speed, bringing progress, innovation, and economic growth. But beneath this transformation lies an uncomfortable reality: APAC&rsquo;s critical infrastructure has become a playground for cyber adversaries.
&nbsp;
Once, cyberattacks were primarily about financial gain&mdash;stealing credit card details, holding data for ransom, defrauding companies. Those days are over. Today&rsquo;s cyber adversaries think bigger. They infiltrate networks not to steal, but to persist, manipulate, and, when necessary, dismantle. It has almost become too easy&mdash;penetrating critical systems is now as simple as flipping a switch. The perpetrators are not just cybercriminals looking for quick paydays, but state-backed groups, hacktivists, and digital mercenaries, each with a strategic agenda. They have recognised what governments and corporations often refuse to admit: the region&rsquo;s essential services are woefully underprepared for the scale and sophistication of modern cyber warfare.

In the Asia-Pacific region, the digital revolution has unfolded at breakneck speed, bringing progress, innovation, and economic growth. But beneath this transformation lies an uncomfortable reality: APAC’s critical infrastructure has become a playground for cyber adversaries.

In the Asia-Pacific region, the digital revolution has unfolded at breakneck speed, bringing progress, innovation, and economic growth.