Critical Infrastructure Security

Manufacturing firms are the most attacked industry, according to KnowBe4 research.

Only 12% of critical infrastructure professionals disclosed ransomware attacks against their organizations during the past 12 months, with half of the intrusions affecting either the OT network alone or both IT and OT networks.

Such a breach was conducted through SIM swapping, with Eric Council Jr., also known as Easymunny, Ronin, and AGiantSchnauzer, and his co-conspirators crafting a false identity using information from a third party with access to SEC's X account, the indictment showed.

In a post on its extortion portal earlier this week, BianLian alleged the theft of BCHP's emails, finance and HR data, personally identifiable information and health records, database dumps, health insurance records, and child-related data although the lack of any data leak and ransom payment deadline suggests possible negotiations with the health provider.

Attackers hijack legitimate commands and run malicious code to launch supply chain attacks.

Such elevated prevalence of online devices in the U.S. has been attributed to the highly decentralized nature of its health system, a report from Censys revealed.

Malicious QR code messages have also been increasingly leveraged to compromise the sector, with Office 365 used to send over 15,000 of such messages to education entities, a Microsoft Threat Intelligence report showed.

Such escalating threats, which are exacerbated by being increasingly undetected by traditional security software, have not corresponded to improved security practices, with 95% of flawed OSS components still being downloaded during the past year despite the availability of more secure versions, according to a study from Sonatype.