NCSC-TAD-2110-003
الرقم المرجعي: NCSC-TAD-2110-003CVSS 0
MalKamak Targets Global Aerospace & Telecoms Firms
- نوع التهديد:
- غير متوفر
- مستوى المشاركة (TLP):
- CLEAR
- CVE:
- غير متوفر
نظرة عامة
A new Iranian threat actor named “MalKamak” conducted “Operation GhostShell” by utilizing ShellClient RAT to target the aerospace and telecommunications industries in the U.S., Russia, Europe, but mainly in the Middle East.
إجراءات الحد من المخاطر والإجراءات الفورية
- 01
Email content filtering. Whitelist allowed attachment types (including archives and nested archives). Analyze/sanitize hyperlinks, PDF and Microsoft Office attachments. Quarantine Microsoft Office macros.
- 02
Application whitelisting of approved/trusted programs to prevent execution of unapproved/malicious programs including .exe, DLL, scripts.
- 03
User application hardening. Configure web browsers to block Flash (ideally uninstall it), ads and Java on the Internet.
- 04
Web content filtering. Whitelist allowed types of web content and websites with good reputation ratings. Block access to malicious domains and IP addresses, ads, anonymity networks and free domains.
- 05
Protect your workstations and servers. We continue to encourage customers to follow our Protect Your Computer guidance of enabling a firewall, getting software updates, and installing antivirus software.
المراجع
القطاعات المتأثرة
- تقنية المعلومات والاتصالات