TLP: CLEAR
1.0 Introduction
CyberSecurity Malaysia, via the Cyber999 Incident Response Centre, have been
receiving cyber incidents targeting Malaysian organisations and citizens. The
incidents involved data breaches, ransomware, credential compromise, server
compromise, web defacements and fraud. Hence, we release this Alert to advise
System Administrators and Internet users, in general, to be cautious of ongoing
cyber attacks.
2.0 Impact
- Commercial
risk through disclosure of commercially sensitive information to third
parties
- Disruption
to operations and critical online services
- Potential
breach of personal data
- Loss
of data integrity
3.0 Recommendations
The following are best practices and recommendations for System Administrators:
- Ensure that systems, applications, and
third-party add-ons are updated with the latest upgrades and security
patches. If you are running older versions of operating systems or
software, upgrade them to the latest version, as older versions are more
vulnerable and can be easily manipulated by intruders. Additionally, to
maintain security, apply patches to your web-based applications and
network-based appliances. Refer to your respective vendors' websites
for the latest patches, service packs and upgrades.
- Update
the antivirus software running on hosts and email gateways with the latest
signature files. Ensure the settings are configured to scan all files to
detect potential threats and maintain optimal protection.
- Configure
systems properly to avoid incidents such as information disclosure and
directory listing due to system misconfiguration.
- Always enable logging of system and
server activities and keep them for a sufficient period.
- Regularly backup critical information to
minimise the impact of data or system loss and to accelerate the recovery
process. Perform daily backup to separate media and store them offline at
an alternate site.
- It is recommended that organisations
apply a defence-in-depth strategy to protect their networks. Firewalls,
intrusion prevention systems (IPS), end-point detection mechanisms, network
and host-based intrusion detection systems (IDS) could help to prevent and
log most generic attacks.
- Data Centres and Web Hosting Companies
should beware of any software or third-party add-ons they are running by
applying the latest patches or upgrades to prevent intrusions that may
exploit unpatched applications.
- Organisations must ensure the contact
information of System Administrators is made available in the event of a
security incident at or originating from your site.
- Financial Institutions must be vigilant
against phishing and fraudulent activities targeting Internet banking.
Customers must be adequately advised to avoid becoming victims of these
scams by applying safe browsing, email, and Internet banking practices.
- System Administrators must immediately
report any suspicious activities they observe in systems and networks
under their administration to the relevant authorities and seek
assistance. Incidents can be reported to the Cyber999 Incident Response
Centre through the reporting channels provided at the end of the page, and
we will respond accordingly. To report any critical incident, call
Cyber999 via the 24x7 On Call Incident Reporting channel.
The following are best practices and
recommendations for general public users:
- Do Not Click Suspicious Links or Attachments – Avoid opening unexpected links or attachments, especially from unknown or unverified senders.
- Verify Sender Identity – Carefully check the sender’s email address and domain before responding or clicking on any links. Be cautious of lookalike or spoofed email addresses.
- Be Alert to Urgent or Unusual Requests – Treat emails requesting sensitive information, financial transactions, or urgent actions with caution, even if they appear to come from senior management.
- Use Strong and Unique Passwords – Create strong passwords and avoid reusing the same password across multiple accounts.
- Enable Multi-Factor Authentication (MFA) – Use MFA wherever possible to provide an additional layer of account security.
- Verify Requests Through Alternate Channels – Confirm sensitive requests through a phone call, official messaging platform, or face-to-face communication.
- Avoid Using Personal Email for Work Purposes – Do not use personal email accounts to conduct official business or store sensitive organisational information.
- Keep Devices and Applications Updated – Regularly update operating systems, browsers, and applications to reduce security vulnerabilities.
- Report Suspicious Emails Immediately – Inform the IT or security team promptly if a suspicious email is received or interacted with.
- Be Cautious with Public Wi-Fi – Avoid accessing sensitive email accounts over unsecured public networks without a VPN.
Please follow the best practices and guidelines
accordingly to prevent any unwanted incidents from occurring.
For further enquiries about this Security Alert or
to report a security incident, please contact us through the following
channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: www.cybersecurity.my