Cyber Defense eMagazine October Edition for 2021

#2 Florida’s water system
A hacker gained unauthorised access to the system controlling a 15,000-person Florida city's water
treatment plant and attempted to contaminate the water supply with a caustic chemical, exposing a threat
cybersecurity experts say has grown as systems have become more computerised and accessible via
the internet.
The hacker who used a remote access application shared by plant personnel to enter the system at the
city of Oldsmar's water treatment plant temporarily boosted the amount of sodium hydroxide by a factor
of one hundred (from 100 parts per million to 11,100 parts per million).
#3 Microsoft Exchange mass cyber attack
Microsoft's popular Exchange mail server service for businesses has been found to have had several
zero-day vulnerabilities. After learning about vulnerabilities, highly-skilled bad actors identified as the
Hafnium gang from China actively attacked four zero-day vulnerabilities in Exchange Server, affecting
millions of Microsoft clients across the world.
Cybercriminals used security flaws to construct a backdoor into Microsoft's corporate clients' networks,
allowing them to inject malware, ransomware, steal patented technical documents, trade secrets, and
other sensitive data. Using the ProxyLogon vulnerability, ransomware rushed in and started
compromising Microsoft Exchange servers. On the evening of March 9th 2021, BleepingComputer
reported on a new piece of file-encrypting malware named DearCry being used in attacks on Exchange
servers.
#4 Airplane Manufacturer Bombardier
Bombardier, a well-known Canadian jet manufacturer, experienced a data breach in February 2021. The
hack exposed the confidential information of suppliers, customers, and approximately 130 Costa Rican
employees. An unauthorised individual had gained access to the data by exploiting a weakness in a thirdparty
file-transfer application, according to the inquiry. The stolen information was then leaked onto a site
which was operated by the Clop ransomware gang.
The faulty software, although not named by Bombardier, has been widely reported as being the Accellion
FTA package. Since the attack on the New Zealand central bank in December 2020, attackers have been
targeting Accellion clients. Some of those targeted, however, discover that stolen material is being
transferred to a dark web site in an apparent attempt to extort money from the companies. The site has
previously been exploited by the Clop ransomware gang in double-dip extortion attempts, according to
FireEye.
Cyber Defense eMagazine – October 2021 Edition 35
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.