1.0 Introduction
The Cyber999 Incident Response Centre recently received an increasing number of cyber incidents launched by the Threat Actor (TA) named “INDOHAXSEC”. These attacks target both the government and private sector organisations in Malaysia. The incidents involved data breaches, credential compromise, and web defacements. The objectives behind these cyberattacks appear to be the dissemination of hate messages aimed at Malaysia and the disruption of online services within the country.
2.0 Impact
- Impact on Government reputation and operation
- Commercial risk through disclosure of commercially sensitive information to third parties
- Disruption to operations and critical online services
- Potential breach of personal data
- Loss of data integrity
3.0 Recommendations
The following are best practices and recommendations for System Administrators:
The following are best practices and recommendations for System Administrators:
- Ensure that systems, applications, and third-party add-ons are updated with the latest upgrades and security patches. If you are running older versions of operating systems or software, upgrade it to the latest version, as older versions are more vulnerable and can be easily manipulated by intruders. Additionally, to maintain security, apply patches to your web-based applications and network-based appliances.
- Refer to your respective vendors' websites for the latest patches, service packs and upgrades. Otherwise, you may also refer to the below link for the latest advisories on security patches and upgrades that we publish:
- Update the Anti-virus software running on hosts and email gateways with the latest signature files. Ensure the settings are configured to scan all files to detect potential threats and maintain optimal protection.
- Configure systems properly to avoid incidents such as information disclosure and directory listing due to system misconfiguration.
- Always enable logging systems and server activities and keep them in a sufficient period.
- Regularly backup critical information to minimise the impact of data or system loss and to accelerate the recovery process. Perform daily backup to separate media and store them offline at an alternate site.
- It is recommended that organisations apply a defence-in-depth strategy to protect their networks. Firewalls, intrusion prevention systems (IPS), and network and host-based intrusion detection systems (IDS) can prevent and log most generic attacks.
- Data Centres and Web Hosting Companies should beware of any software or third-party add-ons they are running by applying the latest patches or upgrades to prevent intrusions that may exploit unpatched applications.
- Organisations must ensure the contact information of System Administrators is made available in the event of a security incident at or originating from your site.
- Financial Institutions must be vigilant against phishing and fraudulent activities targeting Internet banking. Customers must be adequately advised to avoid becoming victims of these scams by applying safe browsing, email, and Internet banking practices.
- System Administrators must immediately report any suspicious activities they observe in systems and networks under their administrations to the relevant authorities and seek assistance. Incidents can be reported to the Cyber999 Incident Response Centre through the reporting channels provided at the end of the page, and we will respond accordingly. To report any critical incident, call Cyber999 via the 24x7 On Call Incident Reporting channel.
CyberSecurity Malaysia has published several advisories related to data breaches and web defacement containing security best practices and guidelines:
- https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=89250373-af1e-4145-85de-c7b2020a09fc
- https://www.mycert.org.my/portal/advisory?id=MA-821.102021
- https://www.mycert.org.my/portal/advisory?id=MA-893.112022
- https://www.mycert.org.my/portal/advisory?id=MA-744.082019
- https://www.mycert.org.my/portal/advisory?id=MA-798.122020
Please follow the best practices and guidelines accordingly to prevent any unwanted incidents from occurring.
For further enquiries about this Security Alert or to report a security incident, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web:
https://www.mycert.org.my