REVIEW OF INCIDENTS IN OCTOBER 2023
JSC "State Technical Service" informs that in October of this year, over 20 million cyber attacks were blocked using the Unified Internet Access Gateway (ESDI).
Andromeda has become the most common types of botnet in the networks of state, local executive bodies, organizations of the quasi-public and private sectors of the Republic of Kazakhstan.Botnet, Mariposa.Botne and Mozi.Botnet. One type of botnet has been identified in the private sector – njRAT.Botnet.
Compared to the previous month, in October, GTS JSC recorded a decrease in the number of cases related to the spread of malicious software (VPO) by 19.2%. The largest number is registered with local executive bodies.
Last month, 28 IP addresses using Juniper Networks Junos products were discovered in the interface of the J-Web operating system on SRX series firewalls and EX switches, potentially exposed to vulnerabilities with a high level of criticality of the identifier CVE-2023-36845.Vulnerability CVE-2023-36845 allows attackers to change a certain PHP environment variable in the Juniper Networks Junos J-Web OS on the EX and SRX series, which will lead to a partial loss of integrity, providing an opportunity to create a chain of vulnerabilities. Notifications and recommendations on how to fix the vulnerability have been sent to the owners of IP addresses, information about the incident is posted on the website CERT.GOV.KZ in the recommendations section.
GTS JSC informs that during the analysis of spam reports received from the Unified E-Mail Gateway (ESEP) equipment, as well as during the processing of information security incidents received from Kazakhstani users, government agencies, critical information and communication infrastructure facilities, local executive bodies and legal entities in October 2023 48 cases were recorded related to sending spam with malicious attachments, emails with fraudulent content and a link to phishing/fraudulent resources. Spam mailings and malicious email attachments detected as a result of the analysis of the e-mail logs have been quarantined and have not been delivered to the target recipients.
In addition, October was remembered for information about the most critical vulnerability in Cisco products (CVSS 9.9 out of 10). The company has released a security update that addresses this vulnerability. For the purpose of informing on the official website of the NSRKI CERT.GOV.KZ Recommendations were posted for organizations using Cisco FMC (Firepower Management Center) without the latest updates, and employees of information security departments of state, local executive bodies and quasi-public sector organizations were also informed.
In general, in light of the above-mentioned threats, attention should be focused on the use of integrated security solutions and measures, including improved threat detection and prevention mechanisms, regular updates of security software and user training in the field of cybersecurity.
If you encounter an information security incident, please let us know by toll-free number 1400 (around the clock), by following the link to the telegram bot @KZ_CERT_chat_bot or by email: incident@cert.gov.kz
