1.0 Introduction
As the Malaysian holiday for “Hari Raya Aidilfitri” approaches over the weekend and many of us will be leaving for a holiday break, we would like to alert System Administrators and Internet users to ensure sufficient security measures have been implemented before leaving for the holidays.
Between January and February 2025, the Cyber999 Incident Response Centre received 1,029 incidents. The most reported incidents are fraud, content-related (data breaches), malicious code, intrusion, and intrusion attempts. Figure 1 below shows the list of incidents by category.
Figure 1: Statistics of incidents by category
Since early this year, several security incidents have occurred, such as intrusions, ransomware, SparkCat Malicious App, data breaches, scam call impersonation and WhatsApp message impersonation. We have released several Security Alert & Advisory to alert, warn and guide Internet users on these threats. In addition, we have produced advisories on software vulnerabilities and product updates. Below are the links to the Security Alert and Advisory:
- https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5
- https://www.mycert.org.my/portal/advisory?id=MA-1068.052024
- https://www.mycert.org.my/portal/advisory?id=MA-1034.022024
- https://www.mycert.org.my/portal/advisory?id=MA-1254.022025
- https://www.mycert.org.my/portal/advisory?id=MA-1260.022025
Thus, we highly recommend that System Administrators and Malaysian Internet users refer to our Security Alerts and Advisories to practice the necessary steps to prevent security incidents and minimise impacts with preventive measures in place.
System Administrators should practice additional precautions against any possibilities of intrusions, DDoS, phishing attacks, and malware activities such as ransomware during the festive season by implementing proper preventive measures against the threats. Data practices and Web Hosting Companies should also take extra precautions against any software or third-party add-ons they're running by applying the latest patches or upgrades to prevent intrusions that may exploit unpatched applications.
Financial Institutions must also be vigilant against any possibilities of phishing and fraudulent activities that target Internet banking. Customers must be adequately advised to avoid becoming victims of phishing and fraudulent activities by applying safe browsing, safe email practices, and safe Internet banking practices. Organisations must ensure the contact information of System Administrators is made available in the event of a security incident that occurs at or originates from your site.
System administrators and Internet users must be aware of these threats and vulnerabilities, apply necessary patches and updates, and refer to security alerts and advisories published by Cyber999 on current threats and vulnerabilities.
2.0 Recommendations
Listed below are some recommendations for System Administrators:
- Ensure systems, applications and third-party add-ons are updated with the latest upgrades and security patches.
- If you're running older operating systems or software versions, ensure they are upgraded to the latest versions. Older versions may have vulnerabilities that intruders can exploit. In addition, please make sure that your web-based applications and network-based appliances are patched accordingly.
- For the latest patches, service packs, and upgrades, refer to your respective vendors' websites. Otherwise, you may also refer to our website for the latest security advisory.
- Ensure the anti-virus software running on hosts and email gateways is updated with the latest signature files and can scan all files.
- Ensure your systems are appropriately configured to avoid incidents such as information disclosure and directory listing caused by system misconfiguration.
- Make sure logging of systems and servers is always enabled.
- Perform regular backups of all critical information to limit the impact of data or system loss and help expedite recovery. Ideally, the backup must be done daily, on a separate media and stored offline at an alternate site.
- It is recommended that organisations apply a defence-in-depth strategy to protect their networks. Firewalls, intrusion prevention systems (IPS), and network and host-based intrusion detection systems (IDS) can prevent and log most generic attacks.
Additional recommendations on ransomware security best practices can be referred to here:
Additional Recommendations on data breach security best practices can be referred to here:
Following are some recommendations for home users:
- Ensure your PCs and browsers are updated with the latest upgrades and security patches.
- Install anti-virus software on your PCs to scan and block malware. The Antivirus should be regularly updated with the latest signature files to detect new worms and viruses.
- Do not simply click on links and attachments that they receive via social networking sites or emails. Take extra precautions when opening the links and attachments.
- Do not fall victim to online scams. Take precautions against online scams that target Internet users.
- Users are recommended the following tips and guidelines on safe Internet at our CyberSAFE website.
- Perform regular backups of all critical information to limit the impact of data or system loss and help expedite recovery. Ideally, the backup must be done daily, and this data should be kept on a separate device and stored offline at an alternate site.
Additional recommendations on scam call security best practices can be referred to here:
- https://www.mycert.org.my/portal/advisory?id=MA-1028.022024
- https://www.mycert.org.my/portal/advisory?id=MA-1068.052024
Please note that incidents can be reported through our reporting channels, as below, and our staff is on duty to respond to them. If you need to report a critical incident, please call the Cyber999 Incident Response Centre via the 24x7 On Call Incident Reporting channel.
Generally, CyberSecurity Malaysia advises users to be updated with the latest security announcements by the vendor and to follow best practice security policies to determine which updates should be applied.
For further enquiries, please get in touch with us through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 on call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web:
https://www.mycert.org.my