CCTR.13.March.24
Board cyber security tool kits, Volt Typhoon and new ML attacks
Last updated
Board cyber security tool kits, Volt Typhoon and new ML attacks
Last updated
Good cybersecurity is essential for improving cyber resilience, enabling organisations to withstand and recover from cyberattacks. The National Cyber Security Centre Board Toolkit assists board members in asking the right questions to understand the organisation's cyber risk profile, supporting effective decision-making and risk management. Board members don't require technical expertise in cybersecurity, but they should have sufficient knowledge to engage in discussions with key staff. Ref Microsoft warns that new tax phishing scams are targeting taxpayers, impersonating trusted sources, and using urgency tactics to steal personal and financial data. These scams are on the rise during tax season, with specific groups like new taxpayers, recent immigrants, and small business owners who file taxes independently being prime targets due to their potentially limited familiarity with tax procedures. Ref SlashNext has uncovered a new attack technique known as "Conversation Overflow," which involves cloaking emails to bypass machine learning (ML) security controls, allowing malicious payloads to enter enterprise networks. In this attack, threat actors trick ML tools by splitting emails into visible and hidden sections, with the hidden part containing innocuous text and blank spaces inserted to evade detection. This approach targets ML algorithms' focus on deviations from normal communications rather than malicious content, making it a potent threat to organisations. Ref Cybersecurity and Infrastructure Security Agency released guidance to counter the threat Microsoft posed by Volt Typhoon (PRC State-Sponsored Actor) related activities. Volt Typhoon is strategically positioning itself within U.S. critical infrastructure networks to disrupt or destroy essential services in case of heightened geopolitical tensions or military conflicts involving the United States and its allies. Ref An interesting trend has emerged as a prominent New Zealand advertising and interactive media company investigates a data breach that could impact over 2.5 million individuals. Although the company has not officially confirmed the breach, threat actors are reportedly attempting to exploit the stolen data by contacting victims and demanding payments. Ref
