Threats Tagged 't1584.003'

Multiple U.S. federal agencies have issued a joint advisory about active exploitation campaigns targeting programmable logic controllers (PLCs) in critical infrastructure sectors such as government facilities, water systems, and energy. Attackers scan for internet-exposed industrial control systems and use legitimate engineering software with valid credentials to appear as authorized technicians. They manipulate controller logic and operator displays to conceal their activities. This campaign affects equipment from Rockwell Automation, Schneider Electric, and Siemens. Unlike a prior 2023 campaign, this ongoing activity has caused confirmed operational disruptions and financial losses. The exploitation leverages architectural weaknesses rather than software vulnerabilities and accesses systems through specific network ports.

MediumCampaignUnited States#industrial control systems#critical infrastructure#water facilities

A coordinated law enforcement operation led by France and the Netherlands has successfully taken down First VPN, a service extensively used by ransomware operators, fraudsters, and data thieves to conceal their criminal activities. The operation, which took place from May 19-20, resulted in the dismantling of 33 servers, seizure of three domains, and a house search of the administrator in Ukraine. The VPN service had been advertised on Russian-language cybercrime forums for years, accepting anonymous payments and providing infrastructure specifically designed for illicit use. Investigators gained access to the user database, generating 83 intelligence packages shared internationally, information on 506 users distributed globally, and advancing 21 investigations. The service had appeared in almost every major cybercrime investigation supported by Europol in recent years.