Who We Are
SRG Security Resource Group Inc. is a Canadian company dedicated to providing world-class Protective Security Guard and Patrol and Cyber Security services. Founded in the spring of 1996, SRG provides solutions and services for people and organizations across Canada.
SRG Security Resource Group Inc. is a wholly owned subsidiary of Input Capital Corp.
Cyber Security Bulletin: Microsoft Cyber Security Updates
This notice is sent as an update to the recent Microsoft Exchange cyber security issues. Microsoft has issued several security patches to address the cyber security issues. Information on business systems shows that unpatched systems internationally continue to exist including within Canada. Some of these systems within Canada have been further compromised with malware. Malicious actors are actively scanning using automated tools to identify unpatched servers
On 11 March 2021, Microsoft Security Intelligence issued a Tweet stating that a new family of ransomware, known as DearCry, is being leveraged by actors exploiting the recently disclosed Exchange vulnerabilities. In addition to DearCry, multiple proofs of concepts leveraging the Exchange vulnerabilities resulting in remote code execution have been made publicly available. These vulnerabilities are being leveraged to gain a foothold within an organization’s network for malicious activity which includes but is not limited to ransomware and the exfiltration of data.
It is strongly recommended that organizations with unpatched external facing servers perform the following:
Note: All updates (CU and the security update) must be run as administrator and Microsoft has noted that multiple reboots may be required. Additional information on patching is available through Microsoft’s tech community blog.
Organizations are encouraged to confirm that no signs of malicious activity have been detected and that both the CU and security update are successful prior to returning the server to service.
Microsoft has published out-of-band Security Updates to address critical vulnerabilities in multiple Exchange products:
Volexity has also published a blog detailing observed activity of actors remotely exploiting a zero-day server-side request forgery (SSRF) vulnerability in Microsoft Exchange (CVE-2021-26855)[2]. This method of exploitation does not require authentication and can be accomplished through remote access to a vulnerable external facing Exchange server over HTTPS.
Microsoft has reported the following vulnerabilities were used by actors to gain access to victim systems:
After exploiting these vulnerabilities to gain initial access, malicious actors deploy web shells on the compromised server. Web shells potentially allow actors to steal data and perform additional malicious actions that lead to further compromise.
Reminder: For your protection, please ensure you follow Microsoft’s instructions on recent Microsoft Security Updates
Please reach out to us with your concerns or for more information on how to protect yourself and your business.
Cyber Security Bulletin: SolarWinds Supply-Chain Compromise
On 13 December, 2020 SolarWinds disclosed a security advisory outlining recent malicious activity impacting SolarWinds Orion Platform resulting from a supply chain compromise. The SolarWinds technology is used by many businesses to manage their network environments including mapping and capacity planning. This is a widespread campaign by a “highly evasive” actor gaining access to numerous public and private organizations around the world.
Through trojanizing SolarWinds Orion Platform software updates, actors were successfully able to distribute malware. This campaign may have begun as early as Spring 2020 and is reported as currently ongoing. Post compromise activity leverages multiple techniques to evade detection and obscure their activity, which includes lateral movement and data theft.
SolarWinds has provided guidance on how to identify the version of Orion Platform organizations are using and to check which hotfixes organizations have applied. If an organization cannot upgrade immediately, please follow the guidelines securing an Orion Platform instance.
An additional hotfix release, 2020.2.1 HF 2 is anticipated to be made available Tuesday, December 15, 2020. SolarWinds recommends that all customers update to release 2020.2.1 HF 2 once it is available, as the 2020.2.1 HF 2 release both replaces the compromised component and provides several additional security enhancements.
In addition to the fixes being posted by SolarWinds, the following recommendations are mitigation techniques that could be deployed as first steps to address the risk of trojanized SolarWinds software in an environment. SRG encourages organizations review the below recommendations and action those based on an organization’s own risk-based assessment:
If malicious activity is discovered in an environment, SRG recommends conducting a comprehensive investigation and designing and executing a remediation strategy driven by the investigative findings and details of the impacted environment.
Please reach out to us with your concerns or for more information on how to protect yourself and your business.
Cyber Security Bulletin: FireEye Cyber Security Breach
This Cyber Security alert is intended for organizations that utilize this technology as part of their cyber security protection program.
On December 8, 2020, cyber security firm FireEye disclosed that it was recently a victim of a targeted security breach by a threat actor.
The threat actors were successful at infiltrating the internal network and acquire red team security assessment tools. FireEye is currently investigating and initial findings show no evidence of customer data exfiltration and at this time cannot state confidently whether these tools will be used or publicly disclosed by the threat actors..
These FireEye tools are used by customers to simulate real-world cyber attacks and test themselves in a near-real type of environment. Users of these technologies should review FireEye released methods of detecting the use of those red team tools in the event the threat actors use them for attack purposes.
Further actions for Consideration:
Please reach out to us with your concerns or for more information on how to protect yourself and your business.
Cyber Security Bulletin: Phishing Attack Campaigns Target MS Teams Users
A new attack vector has been identified specific to those organizations that use Microsoft Teams for collaboration with internal teams as well as with your customers. The phishing campaign pretends to be an automated message from Microsoft Teams. In reality, the attack aims to steal Office 365 recipients’ login credentials.
Teams is Microsoft’s popular collaboration tool, which has particularly risen in popularity among remote workforces during the pandemic. This particular campaign was sent to between 15,000 to 50,000 Office 365 users with suspicion that additional campaigns will be forthcoming. Because Microsoft Teams is an instant-messaging service, recipients of this notification might be more apt to click on it so that they can respond quickly to whatever message they think they may have missed based on the notification.
The initial phishing email displays the name “There’s new activity in Teams,” making it appear like an automated notification from Microsoft Teams. Within the body of the email, there are three links appearing as ‘Microsoft Teams’, ‘(contact) sent a message in instant messenger’, and ‘Reply in Teams’,” according to researchers. Clicking on any of these leads to a fake website that impersonates the Microsoft login page. The phishing page asks the recipient to enter their email and password.
Further, the phishing landing page also looks convincingly like a Microsoft login page with the start of the URL containing “microsftteams.” If recipients are convinced to input their Microsoft credentials into the page, they are unwittingly handing them over to attackers, who can then use them for an array of malicious purposes – including account takeover. See one sample of the phishing email below.
In May, a similar convincing campaign that impersonated notifications from Microsoft Teams in order to steal the Office 365 credentials of employees circulated, with two separate attacks that targeted as many as 50,000 different Teams users.
Users are warned to be diligent in reading all invites such as described above and when in doubt, delete the email and not click on any of the display areas.
Please reach out to us with your concerns or for more information on how to protect yourself and your business.
Cyber Security Bulletin: Increased Threat from Emotet Malware Campaigns
Since July 2020 there has been an increase in malicious activity associated with Emotet malware campaigns. Emotet has been frequently observed working in tandem with Trickbot and Ryuk malware in a persistent attempt to compromise computer systems within Canada. These threats have been successfully used to attack many Canadian companies since 2019.
Emotet is an advanced botnet attached to email. Once a system is infected by Emotet, additional malware, including Trickbot and Ryuk may be implanted on the system resulting in data exfiltration or attempts to extort the victim.
Emotet malware can be spread through untargeted bulk spam emails (such as shipping notifications, or “past-due” invoices), as well as what appear to be targeted malicious emails (spear phishing). Targeted emails are particularly effective as they appear to come from a trusted source, often from someone with whom the email recipient has recently been in communication.
Furthermore, Emotet email campaigns have been observed to be leveraging both ‘thread hijacking’, a technique where malicious emails are inserted into existing email threads, and using password-protected zip files to avoid detection by network defenses. These techniques result in convincing messages that an unaware recipient may believe to be trustworthy and encouraged to download malware by opening an attachment (a macro-enabled Microsoft Word document or PDF) or clicking a malicious link.
SUGGESTED ACTIONS
Please reach out to us with your concerns or for more information on how to protect yourself or your business.