The IT Nerd

In a report released Friday, CISA said it saw a 201% increase in its Cyber Hygiene (CyHy) service enrollment from critical infrastructure organizations between Aug. 1, 2022, through Aug. 31, 2024.

Of the 7,791 critical infrastructure organizations that enrolled in the agency’s vulnerability scanning service during that period. The following industries lead the surge:

• Communications – 300% 
• Emergency services – 268%
• Critical manufacturing – 243%
• Water and wastewater systems 242%

CISA cited a steady decrease in the number of monitored exploitable services from 12 services per CyHy enrollee in August 2022 to roughly 8 apiece. The number of KEV tickets also declined, with critical-severity KEVs falling 50% and high-severity KEVs dropping by 25%. 

Remediation times for SSL vulnerabilities fell as well, with tickets resolved in less than 50 days, down from about 200 days as of August 2022.

CISA’s report also highlighted the high exposure rate of operational technology protocols to the public internet: 

• 63% – Government services and facilities
• 10% – IT
• 10% – Energy
• 5% – Healthcare

Lawrence Pingree, VP, Dispersive.io had this to say:

  “I think it’s admirable that CISA offers a free scanning service. It’s no surprise that enterprises leverage the free service to check for vulnerabilities, given you get a report regularly from the government for free (no cost). Seeking to find any vulnerabilities in your external attack surface is certainly one of the first priorities that enterprises should have. Keep in mind, it doesn’t necessarily represent the only way that attackers can breach an environment, and there’s no guarantee that a zero day isn’t used instead. Attackers just rotate to whatever they need to in order to accomplish their goals. So, if the external surface is too much of a challenge, they rotate to third parties, or malware+phishing, or even social engineering. The importance of my past research work in preemptive cyber defense (PCD) and automated moving target defense (AMTD) at Gartner was to point to the need to move to preemptive models instead of the whack-a-mole we play with vulnerabilities and patching.”

I am pretty impressed by this as it shows that organizations may actually be taking cybersecurity seriously. That is a good thing as we’ve seen what happens when cyber criminals are allowed to run wild.

Emily Phelps, Director, Cyware follows with this:

  “CISA’s Cyber Hygiene service growth reflects the critical sectors’ increasing focus on cybersecurity, but the report also highlights persisting risks, like high exposure of operational technology protocols. Improved remediation times are encouraging, but organizations must go beyond addressing vulnerabilities to build resilience against evolving threats. Protecting critical infrastructure demands real-time threat detection, intel and defensive strategy sharing, coordinated responses, and robust strategies to secure essential services.”

The CISA has recently put out a Binding Operational Directive on Implementing Secure Practices for Cloud Services:

Malicious threat actors have increasingly targeted cloud environments and evolved tactics to gain initial cloud access. In recent cybersecurity incidents, the improper configuration of security controls in cloud environments introduced substantial risk and resulted in actual compromises. To combat these threats, the Cybersecurity and Infrastructure Security Agency (CISA) initiated the Secure Cloud Business Applications (SCuBA) project. Through the SCuBA project, CISA developed Secure Configuration Baselines, providing consistent and manageable cloud security configurations and assessment tools, allowing agencies and CISA to improve security for Federal Civilian Executive Branch (FCEB) assets hosted in cloud environments. This Directive requires agencies to implement a set of SCuBA Secure Configuration Baselines for certain Software as a Service (SaaS) products widely used in the FCEB, deploy CISA developed automated configuration assessment tools to measure against the required baselines, integrate with CISA’s continuous monitoring infrastructure, and remediate deviations from the secure configuration baselines. These steps reduce risks highlighted by recent adversary activity and increase resiliency for FCEB agencies against cyber threats. 

Jim Routh, Chief Trust Officer, Saviynt had this comment:

“IT Hygiene is a way of describing an enterprise’s capabilities to identify IT assets, manage the configuration of those assets, apply vulnerability management to those assets and to update those assets when necessary. The new Directive from CISA is requiring federal agencies to improve their IT Hygiene for cloud hosted services supporting their needs. The configuration management requirements in cloud computing are different from IT assets hosted in proprietary data centers. Federal agencies with legacy infrastructure (non-cloud) must apply a different way to manage the configuration of cloud hosted IT assets that includes discovery, asset inventory management, configuration management and vulnerability management.”

Paul Zolfaghari, President, Saviynt follow up with this:

“As we navigate an increasingly complex cyber landscape, the issuance of Binding Operational Directive 25-01 by the Cybersecurity and Infrastructure Security Agency (CISA) represents a pivotal advance in cloud security. This directive underscores our collective commitment to not only securing our nation’s digital infrastructure but also setting a benchmark for future cloud security measures. By mandating secure configuration baselines and integrating continuous monitoring, CISA is leading the charge in fortifying our federal networks against sophisticated cyber threats. This proactive approach is essential in ensuring the resilience and security of our cloud environments, and we are proud to support these vital initiatives.”

The CISA really has a great grasp as to what it needs to do to ensure that government does not become a target for threat actors. Private industry needs to copy what they are doing as they are really on the ball.

 UPDATE: Chris Botelho, Sr. Solutions Engineer, LimaCharlie adds this:

“The directive forces these agencies to modernize their security controls in order to better protect against malicious actors and software. Given the increase in activity of both nation-state actors and ransomware groups targeting third-parties that contract with the federal government rather than the federal government itself, it has become even more important to not only ensure federal systems are protected, but also the organizations that the federal government contracts with in order to protect data and prevent large-scale incidents. Malicious actors will always go for the weakest link in the chain, which currently are the SMBs that frequently don’t have the knowledge, time, expertise, or budget for implementing recommended security controls.

“Most of the controls being required by the directive are part of Microsoft’s own best practices and should already in place. The controls and scanner are provided for free from CISA, so they can be implemented without any licensing costs. If an organization is using an enterprise M356 license, then they will likely have all the required controls available to them. However, organizations using F3 licenses or purchasing their M365 subscriptions through a third-party provider will likely need to upgrade their licenses or purchase additional licenses to gain access to the security controls required by the directive, such as Microsoft Purview. There will also be a time cost to implement the controls and update internal policies such as password management policies to reflect the new control requirements.

“Controls required by federal agencies frequently influence the controls implemented by private businesses both directly, through direct implementation of the controls based on the agency’s requirements, but also indirectly through regulatory bodies such as HITRUST and PCI-DSS that adopt the federal agency’s requirements as part of their own requirements. Additionally, by adopting federal controls, the effort required by leadership to create their own security controls is reduced while providing a tested and vetted method for ensuring the controls are implemented and can be easily tested through readily-available tools such as CISA’s SCuBA, without additional cost.

“The biggest challenge will be changing the user and management mindset for many of the historical security controls that no longer apply or work in today’s computing environments as well as the cost that would be involved if a business’s current license(s) don’t include the controls prescribed by the mandate. This could be something such as MFA, which may not be included in a business’s current service license and historically is seen by many as an unnecessary extra step, but significantly increases the authentication security of a business. Additionally, there may be regulations in place that a business has to follow that are in conflict with the CISA directive. For example, the new controls require that passwords are set to never expire. Historically, the industry standard was to change passwords every 60-90 days. However, research has shown that this actually decreases password security, but many organizations still do this because it has been the practice for decades and regulations such as PCI-DSS still require it.”

Earlier this week, CISA released its The 2025-2026 International Strategic Plan aimed at enhancing global collaboration to address cyber threats to critical infrastructure.

The plan recognizes the intricate and geographically dispersed nature of cyber risks, emphasizing the importance of quickly sharing threat information and risk reduction guidance with international partners.

CISA International Strategic Plan Goals sets out three goals for CISA to achieve over the 2025-2026 period:

1. Bolster the Resilience of Foreign Infrastructure on which the US Depends – CISA will work with interagency and international partners to identify and understand which international systems and assets are critical and assess how they are vulnerable to create strategies to manage shared risks.
2. Strengthen Integrated Cyber Defense – CISA plans to collaborate with partners, international organizations, and NGOs to shape global cybersecurity practices and standards, promoting widespread cyber safety and security.
3. Unify Agency Coordination of International Activities – The CISA Stakeholder Engagement Division will create a governance structure to advise on international issues and clearly outline the agency’s international priorities. This will involve enhancing systematic information sharing across CISA to ensure situational awareness of ongoing and future international activities.

CISA will also focus on enhancing the skills of its workforce to better influence the international landscape including developing training programs for employees overseas and providing guidance on international affairs for all traveling staff.

“In following this plan, CISA will improve coordination with our partners and strengthen international relationships to reduce risk to the globally interconnected and interdependent cyber and physical infrastructure that Americans rely on every day,” CISA Director Jen Easterly commented.

Emily Phelps, Director, Cyware:

“CISA’s 2025-2026 International Strategic Plan underscores the urgency of an interconnected approach to securing critical infrastructure across borders. As cyber threats grow increasingly complex and far-reaching, swift, collaborative information-sharing becomes essential to mitigate risks that could impact not just a single nation but the global landscape. CISA’s commitment to bolstering the resilience of international assets and systems vital to U.S. security reflects a forward-thinking acknowledgement of interdependencies in today’s cyber ecosystem. The focus on strengthening integrated cyber defenses and establishing clearer governance structures is a strategic leap towards a unified, cohesive response to these shared threats. This approach—fostering resilience, enhancing standards, and emphasizing interagency coordination—can set a precedent for global cybersecurity initiatives, reinforcing that collective defense is the linchpin in navigating future cyber challenges.”

A collective approach to defending critical infrastructure is the way to go. And once again I applaud the CISA in terms of leading the way. Hopefully other countries take this just as seriously as the CISA does.

Yesterday, CISA published a joint advisory stating that Iranian hackers are acting as initial access brokers to gain access to critical infrastructure organizations to collect credentials and network data that can be sold on cybercriminal forums to enable cyberattacks by other threat actors. 

The government agencies warn that since October 2023, Iranian actors have used brute force, such as password spraying, and MFA ‘push bombing’ or fatigue to compromise user accounts and obtain access to organizations.

Once threat actors obtain persistent access, they typically register their own devices with the organization’s MFA system, collect more credentials, escalate privileges, and learn about the breached systems and the network, allowing them to move laterally and identify other points of access and exploitation.

The agencies made numerous recommendations including but not limited to:

• Reviewing authentication logs for failed logins
• Looking for MFA registrations with MFA in unexpected locales/devices
• Checking for suspicious privileged account use after resetting passwords 
• Applying user account mitigations after password resets
• Investigating unusual activity in typically dormant accounts
• Scanning for unusual user agent strings

The alert is co-authored by the FBI, NSA, the Communications Security Establishment Canada, the Australian Federal Police, and the Australian Signals Directorate’s Australian Cyber Security Centre.

Evan Dornbush, former NSA cybersecurity expert has some perspective on this:

   “Google released a report noting 70% of exploited flaws disclosed in 2023 were zero-days. Mandiant released a report noting attackers have incredibly decreased the time it takes to convert a disclosed flaw into an easily-available exploit product. Microsoft released a report noting that 78% of nation state activity is against the private sector, often in the form of for-profit actions. And CISA in collaboration with the UK and Australia are noting that criminals and governments are working together, sharing tools and access.

“The essential insight here is the necessity to evolve from purely reactive posturing, and shift to take proactive measures as part of one’s applied cybersecurity strategy. The amount of money criminals can earn is getting too little attention. It is too costly to defend, and too cheap to attack, and until we can affect a paradigm shift, things will continue to escalate.”

This is another one of those documents that’s required reading if your job is to keep your organization from getting pwned. Something that is getting harder to do these days.

UPDATE: I have two more comments on this. Starting with Avishai Avivi, CISO, SafeBreach:

“The CISA alert of Iranian cyber actors’ brute force and credential access activity is a good reminder – especially during cybersecurity awareness month – that these malicious actors are working to abuse ‘Multifactor Authentication (MFA) Exhaustion.’ If, as a good cyber-aware person, you’ve enabled MFA on your social networking, WhatsApp or other messaging apps, and bank accounts, you may have grown used to getting and approving MFA requests. The malicious actors hope you won’t pay attention and approve any MFA push notification you may receive. So, as a reminder, when you are prompted to authorize a session, please take a quick second to verify that you are the one who made that request. Malicious actors are constantly testing credentials they’ve obtained through breaches. They hope that the combination of these credentials and MFA exhaustion will let them take over your account. While the CISA alert specifically mentions critical infrastructure as the target of these malicious actors, this diligence is important to prevent access to your work and personal accounts.”

Followed by James Winebrenner, Chief Executive Officer, Elisity:

“On October 16, 2024, FBI, CISA, NSA, and other global government agencies published an advisory about how Iranian cyber actors recently compromised critical infrastructure organizations using brute force attacks and MFA bombing, then performed network discovery and lateral movement. This is just one more example of a nation-state cyber attack that used lateral movement. Also in 2024, China’s Volt Typhoon group compromised IT networks of multiple critical infrastructure organizations in the U.S., using lateral movement to access operational technology assets for potential disruptive attacks. North Korean hackers targeted aerospace and defense organizations with a new ransomware variant called FakePenny, using lateral movement for intelligence gathering. A modern identity-based microsegmentation platform would detect and prevent such unauthorized lateral movement attempts, preventing attackers from accessing sensitive systems even if initial credentials are compromised. CISOs and security architects want to look for a platform that provides comprehensive asset discovery and visibility and enables identity-based policies that enforce least-privilege access across users, devices, and applications, significantly reducing the attack surface and stopping threat actors from moving laterally within the network.”

Finally Ryan Patrick, VP of Adoption, HITRUST:

“In response to the recent joint advisory issued by the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and their international counterparts, HITRUST acknowledges the escalating threat posed by Iranian cyber actors who are actively targeting critical infrastructure sectors, including healthcare and public health (HPH).

We recognize the critical importance of safeguarding sensitive data and systems in these highly targeted industries. The advisory highlights the need for organizations across healthcare, government, energy, and information technology to reinforce their defenses against advanced tactics, including brute force credential attacks. Cybercriminals are increasingly sophisticated in their efforts to exploit vulnerabilities and sell access to compromised networks, putting critical infrastructure at risk. A key aspect of preventing these attacks lies in integrating threat intelligence into cybersecurity strategies. HITRUST emphasizes that assessments and controls informed by up-to-date threat intelligence are crucial in identifying and mitigating emerging risks. By embedding intelligence-driven controls into their operational security, organizations can proactively defend against evolving tactics used by cybercriminals, including brute force attacks. This continuous monitoring and refinement process allows for stronger protection of sensitive data and critical infrastructure.

We encourage all organizations, especially those in the healthcare and public health sectors, to review the joint cybersecurity advisory and ensure that appropriate safeguards are in place, including the use of strong authentication methods, continuous monitoring, and proactive threat intelligence. HITRUST will continue to support these efforts by delivering the tools and resources necessary to meet the highest standards of information protection and compliance.”

The CISA put out an alert that caught my eye yesterday:

CISA continues to respond to active exploitation of internet-accessible operational technology (OT) and industrial control systems (ICS) devices, including those in the Water and Wastewater Systems (WWS) Sector. Exposed and vulnerable OT/ICS systems may allow cyber threat actors to use default credentials, conduct brute force attacks, or use other unsophisticated methods to access these devices and cause harm.   

CISA urges OT/ICS operators in critical infrastructure sectors to apply the recommendations listed in Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity to defend against this activity. To learn more about secure by design principles and practices, visit CISA’s Secure by Design webpage. For more information and guidance on protection against the most common and impactful threats, tactics, techniques, and procedures, visit CISA’s Cross-Sector Cybersecurity Performance Goals.

The word “Unsophisticated” is what caught my eye. That’s because this warning comes after the Arkansas City water treatment facility cyberattack:

The City of Arkansas City revealed that its water treatment facility had been breached on September 22. The city notified relevant authorities and moved the water plant to manual control to ensure safe operations.

Evan Dornbush, former NSA cybersecurity expert had this comment:

  “CISA’s guidance of recommended practices may be ideal for defenders who are well staffed or are perhaps building out new networks.

  “In terms of overall practicality, changing default passwords and patching and moving HMI devices behind firewalls or hardened VNC can be laborious.

  “Keeping with defense in depth philosophy, it may be more efficient for established OT/ICS operators to add a network detection capability to their existing infrastructure. Using modern advancements in computation, the market is full of quality options for those looking to glean intelligence from their network data.

  “Subscribing to a cyber threat intelligence platform is another low-friction avenue. Those purport to increase awareness of known exploited vulnerabilities (KEV) which can help steer defenders towards highest priority infrastructure.”

I truly hope that organizations take these warnings seriously. There’s enough evidence out there that should suggest that not doing so will end badly for all concerned.

As the 2024 election nears, election officials finalize preparations to protect themselves against the most common threats seen targeting voters and campaigns. CISA recently released an Election Infrastructure Cybersecurity Readiness and Resilience Checklist, providing guidance on potential security incidents that may impact election infrastructure. 

Tom Marsland, VP of Technology for Cloud Range who has personally led live-fire simulation attacks on election infrastructure, including forensic analysis of voting machines and misinformation campaigns, has shared his thoughts on CISA’s checklist:

This checklist by CISA is a great reminder to election officials and participants about the basics – however, with less than two months until the election, many of these will be hard to implement if not at least begun already.  That said, it provides a clean slate for officials to take a step back and give their practices of cyber hygiene a holistic overview, and an honest look as they enter the final stages of preparation. I’ll repeat the findings from CISA that our elections are as secure as they’ve ever been. We really have to stay on top of misinformation campaigns and social engineering in that realm, but this is a great product for CISA, and I hope we see it used. 

A great way for election officials to test their readiness against the checklist provided by CISA is by conducting hands-on, tabletop exercises that test the organizations policies and playbooks against the very items called out in the checklist. Lessons learned from table top exercises should be incorporated into the organization’s continuous improvement, made actionable, and tracked to completion.

The CISA has put out a number of these sorts of checklists. But checklists aren’t good if they’re not followed. So here’s hoping that this one is followed as this November’s elections are going to be extremely important to the future of the US.

This week, CISA announced a new plan to align the “collective operational defense capabilities” of over 100 US central Government agencies outside defense to reduce their cyber-risk.

CISA notes in the plan that there is currently “no cohesive or consistent baseline security posture” across agencies, which fails to consider the current threat environment and the complex digital ecosystem.

The plan, known as FOCAL, for Federal Civilian Executive Branch (FCEB) Operational Cybersecurity Alignment, sets out both “broad organizing concepts for federal cybersecurity” and tactical guidance agencies should implement in the coming year. It covers five areas of cybersecurity including:

1. Asset management
2. Vulnerability management
3. Defensible architecture
4. Cyber supply chain risk management
5. Incident detection and response

While CISA stresses that each FCEB agency has its own mission, supported by its own networks and systems, with standardization and consistency, CISA also believes that a collective approach to cybersecurity will further reduce risks across all federal cyber defenses as agencies interact with each other and share data.

Emily Phelps, Director, Cyware had this to say:

  “CISA’s FOCAL plan highlights the value of collective defense in securing the federal cyber landscape. This approach leverages the strengths and knowledge of each entity to build a more robust defense against evolving threats. The interconnected nature of today’s digital ecosystem means that vulnerabilities in one area can ripple across others, making a collective defense strategy essential for reducing risk. By fostering collaboration, information sharing, and standardization, agencies can more effectively defend against sophisticated cyber adversaries while reinforcing the overall security of the nation’s critical infrastructure.”

Stephen Gates, Principal Security SME, Horizon3.ai follows with this:

  “This initiative is not just necessary—it’s long overdue. Now is the time to embrace a proven strategy that aligns with the five key objectives outlined in the plan. Organizations must begin by assessing their own environments, using the same tactics, techniques, and procedures (TTPs) that adversaries use. This ensures they’re effectively managing high-risk assets, identifying and mitigating exploitable vulnerabilities, and fortifying their architectures. This approach should extend to their supply chain, ensuring partners meet the same standards, and that incident detection and response systems are proven to be fully operational.”

This is a good move by the CISA who has a history of coming up with good initiatives to improve cybersecurity inside and outside government. This is something that seriously needs to be copied by the private sector as I think you will see that this is going to be highly effective in terms of deterring cyberattacks.

In a Federal Register posting yesterday, the Federal Highway Administration (FHWA) said that it would adopt the CISA-designed Cyber Security Evaluation Tool, a voluntary program created to help organizations “in identifying, detecting, protecting against, responding to, and recovering from cyber incidents”.

The FHWA said it’s adopting the tool because it’s often called in to deal with cyber incidents with federal and state agencies “whose primary missions revolve around securing critical transportation infrastructure,” and this should streamline the process.

   “The FHWA provides subject matter expertise to those agencies in identifying potential physical and cybersecurity threats and appropriate mitigation efforts.

   “When presented with physical or cybersecurity questions, concerns or incidents from State, local, Tribal, and Territorial transportation authorities, or other stakeholders, FHWA routinely assists in connecting these entities to security-focused government agencies, including the Transportation Security Administration, the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation,” the posting states.

The announcement comes after the Transportation Department solicited public feedback on the tool in March. The goal was to avoid building a duplicative cyber tool and to take advantage of the work already done by CISA. 

Emily Phelps, Director, Cyware:

  “The Federal Highway Administration’s decision to adopt a streamlined cybersecurity evaluation tool is a prime example of how leveraging existing frameworks can prevent inefficiencies and unnecessary complexity. Rather than reinventing the wheel, organizations are empowered to strengthen their cybersecurity posture without overwhelming their tech stacks or stretching resources thin. This kind of inter-agency cooperation fosters resilience by aligning efforts, avoiding redundant solutions, and ensuring that critical infrastructure is protected from evolving threats in a cost-effective manner. Ultimately, the collective defense approach is key to sustainable, effective cybersecurity.”

This is a move that will reap benefits in the long term. Hopefully this is something that other sectors copy and implement because more robust cybersecurity with a consistent approach to delivering cybersecurity is always better.

The CISA have put out an advisory on Iran-linked threat actors known as Fox Kitten who are using their exploits for both government espionage and commercial ransomware operations:

This advisory outlines activity by a specific group of Iranian cyber actors that has conducted a high volume of computer network intrusion attempts against U.S. organizations since 2017 and as recently as August Compromised organizations include U.S.-based schools, municipal governments, financial institutions, and healthcare facilities. This group is known in the private sector by the names Pioneer Kitten, Fox Kitten, UNC757, Parisite, RUBIDIUM, and Lemon Sandstorm. The actors also refer to themselves by the moniker Br0k3r, and as of 2024, they have been operating under the moniker “xplfinder” in their channels. FBI analysis and investigation indicate the group’s activity is consistent with a cyber actor with Iranian state-sponsorship.

The FBI previously observed these actors attempt to monetize their access to victim organizations on cyber marketplaces. A significant percentage of the group’s US-focused cyber activity is in furtherance of obtaining and maintaining technical access to victim networks to enable future ransomware attacks. The actors offer full domain control privileges, as well as domain admin credentials, to numerous networks worldwide. More recently, the FBI identified these actors collaborating directly with ransomware affiliates to enable encryption operations in exchange for a percentage of the ransom payments.

Adam Maruyama, Field CTO of Garrison Technology had this to say:

“CISA’s recent advisory regarding the joint governmental espionage and commercial ransomware activities of Iran-linked cyber group Fox Kitten shows how groups with the capabilities to attack some of the world’s most hardened networks are turning those capabilities to the broader commercial space. Increasing pressure from Fox Kitten and similarly equipped actors against commercial companies, particularly in non-regulated sectors, raises the stakes significantly in their fight against ransomware and other network intrusions. 

“To put it simply, the architecture and technologies commercial companies use to detect and respond to low-to-moderate sophistication cyber attacks lacks the ability to effectively prevent and deter highly sophisticated cyber criminals and nation-state actors.

“If the trend of blurred lines between nation-state and criminal actors continues, commercial entities will need to augment their defenses by using defense-grade, high-assurance technology that aims to prevent, rather than detect, malicious activity using techniques like hardware-enforced isolation/access and content disarm and reconstruction (CDR). Unlike most commercial cybersecurity solutions, which analyze content and determines whether it’s malicious or not, these technologies treat all content as potentially malicious and use innovative methods to recreate safe, inert versions before content enters an organization’s systems.”

This is a great example of “good enough” security not being nearly “good enough” and nation-state exploits being used against a broader target set. Thus organizations need to shift their thinking and defence strategies to not be the next victim of these groups.

This is something that you should likely pay attention to.  Cybersecurity agencies from Australia, Canada, Germany, Japan, New Zealand, South Korea, the U.K., and the U.S. have released a joint advisory about  China-linked cyber espionage group APT40 and its ability to co-opt exploits for newly disclosed security flaws within hours or days of public release. Which is of course very bad for all of us.

Rogier Fischer, CEO, Hadrian had this comment:

“We know of its existence since 2009. For the past 15 years, this Chinese state-sponsored threat group has been targeting maritime, defense, aerospace, engineering, and research institutions across the United States, Europe, and Asia-Pacific,” observed Rogier Fischer, CEO of Dutch cybersecurity service Hadrian.

Although its modus operandi includes old-as-the-earth methods such as spear-phishing campaigns, exploitation of web vulnerabilities, deployment of custom malware, and credential harvesting, they stand apart by utilising advanced persistence mechanisms, robust command and control infrastructure, and obfuscation techniques to evade detection, he explained.

According to him, understanding APT40’s strategic targeting helps prioritise defenses around critical sectors and sensitive data.

“To protect against APT40, it is essential to implement advanced threat detection systems and maintain continuous network monitoring to identify and respond to suspicious activities,” he said.”Regularly update and patch software to close exploitable vulnerabilities. Segment networks to limit lateral movement and develop a robust incident response plan to quickly address and mitigate security incidents,” he added.

These sorts of warnings don’t come out every day. Thus they need to be heeded and action needs to be taken so that organizations don’t end up becoming the next victim of groups like APT40.