Advisory

Emergency fix for Exchange Y2K Bug admin 04 Jan 2022

BACKGROUND
 
Microsoft has released an emergency fix for a year 2022 bug that is breaking email delivery on on-premise Microsoft Exchange servers. Email is getting stuck in the queue, and these errors are caused by Microsoft Exchange checking the version of the FIP-FS antivirus scanning engine and attempting to store the date in a signed int32 variable.

FluBot Malware admin 08 Dec 2021

BACKGROUND

Malicious text messages are being spammed to mobile users, containing a link which redirects Android users to download FluBot malware. The language and wording of the text message can vary, such as: 
•    You have a voicemail message.
•    Your parcel is out for delivery. Click the link to track your parcel.
•    Someone would like to share a photo album with you.
•    Your Android device is infected with malware. You must install this security update to remove the malware.

Telephone Interview for Population and Housing Census (BPP) 2021 admin 15 Nov 2021

BACKGROUND

BIBD COVID-19 Relief Fund Phishing Scam admin 09 Nov 2021

BruCERT has received reports of a phishing email that claims to be from "BIBD Bank Darussalam Brunei" offering a COVID-19 relief fund to its customers.

BIBD COVID-19 Relief Fund Phishing Scam

Brunei Postal Services Department Phishing Scam admin 02 Nov 2021

BACKGROUND

BruCERT has received a report of a phishing scam involving Brunei Postal Services Department. An SMS message which appears to be from "Brunei Post" informs the recipient that their package has been relocated to a post office branch due to unpaid postage fees. The message includes a shortened link that will redirect the user to a fake website post-bn.com where they will be asked to enter their full name and credit card details.

IMPACT

Fake COVID-19 Relief Fund admin 19 Sep 2021

BACKGROUND

Critical security update for Apple devices admin 17 Sep 2021

BACKGROUND

Apple has released security updates for iPhones, iPads, Apple Watches and Mac computers to address vulnerabilities (CVE-2021-30860 and CVE-2021-30858) that were being exploited by Pegasus spyware.
The bug allowed for a "zero-click" install of the spyware which is capable of stealing data, passwords, and activating a phone's microphone or camera.

IMPACT

May lead to arbitrary code execution on affected products.

SYSTEM AFFECTED 

Apple devices running iOS, macOS and watchOS.

Extortion scam utilizing Pegasus spyware admin 24 Aug 2021

BACKGROUND

Fake Fast Food Delivery Website admin 19 Aug 2021

BACKGROUND

Due to the challenging pandemic situation in Brunei Darussalam where the population is advised to stay at home, cybercriminals are taking the opportunity to phish sensitive and confidential information by creating a fake website for well-known fast-food chains.

Example:
https:// bn-mcdelivery .ru

This website appears to be hosted in Russia, and offers meals at a very low price, with many menu items that are not available in Brunei outlets.

Modus Operandi

Microsoft Exchange Server Vulnerability 'ProxyShell' admin 17 Aug 2021

BACKGROUND
      
Attackers are now actively exploiting Microsoft Exchange Servers using ‘ProxyShell’ vulnerability to install backdoors for later access, which uses three chained MS vulnerabilities to perform unauthenticated, remote code execution. These chained vulnerabilities are exploited remotely through Microsoft Exchange's Client Access Service (CAS) running on port 443 in IIS.
 
The three chained vulnerabilities used in ‘ProxyShell’ attacks are: