Government of the Republic of Trinidad and Tobago
gov.tt

Securing the Nation's Digital Infrastructure

Ransomware Joint Advisory

This is a joint cyber security advisory from the Trinidad and Tobago Cyber Security Incident Response Team (TT-CSIRT), Trinidad and Tobago Police Service Cyber and Social Media Unit (TTPS CSMU) and the National Information and Communication Technology Company Limited (iGovTT). This advisory serves to warn all entities within Trinidad and Tobago about increased ransomware attacks …

Increased Cyber Activity in Trinidad and Tobago and the Region

The Trinidad and Tobago Cyber Security Incident Response Team (TT-CSIRT) has observed a sharp increase in malicious cyber activity targeting local and regional entities over the past two (2) months. The TT-CSIRT is urging all entities (public and private) to adopt a heightened state of awareness and be guided by the following: Top Threats to …

Ransomware Response Checklist

The following information is taken from the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Should your organization be a victim of ransomware, TT-CSIRT strongly recommends responding by using the following checklist. Be sure to move through the first three steps in sequence. Detection and Analysis Determine which systems were impacted, and immediately isolate them. If …

Ransomware Prevention

The following information is taken from the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Be Prepared Refer to the best practices and references below to help manage the risk posed by ransomware and support your organization’s coordinated and efficient response to a ransomware incident. Apply these practices to the greatest extent possible based on availability …

TT-CSIRT-402.13.04.22: Microsoft Security Updates April 2022

Microsoft has released updates to address multiple vulnerabilities in Microsoft software. An attacker can exploit some of these vulnerabilities to take control of an affected system. The list of updates addresses several critical vulnerabilities, one of which is being actively exploited in the wild by threat actors. The TT-CSIRT strongly encourages users and administrators to …

TT-CSIRT-401.11.04.22: FortiClient Vulnerabilities

Fortinet has released security updates to address multiple vulnerabilities in FortiClient for Windows and Linux. An attacker could exploit some of these vulnerabilities to take control of an affected system or access sensitive information. TT-CSIRT encourages users/administrators to review the following releases from Fortinet and apply the necessary updates: FortiClient (Windows) – Privilege Escalation FortiClient …

TT-CSIRT-400.10.12.21: Apache Log4j Critical RCE Vulnerability

The Apache Software Foundation has released a security advisory to address a remote code execution vulnerability (CVE-2021-44228) affecting Log4j versions 2.0-beta9 to 2.14.1. A remote attacker could exploit this vulnerability to take control of an affected system. Log4j is an open-source, Java-based logging utility widely used by enterprise applications and cloud services. This vulnerability is …

TT-CSIRT-399.10.11.21: Critical Vulnerability in Palo Alto GlobalProtect Portal

A critical (9.8/10) memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.17. TT-CSIRT encourages administrators to review the following release from Palo Alto …

TT-CSIRT-398.05.10.21: TTCSIRT ADVISORY – Fortinet and Expiring Let’s Encrypt Certificates

Please be advised, with the current issue of certain sites being presented with an invalid or expires SSL Certificate when attempting to gain access, Fortinet was made aware by customers in the early hours of September 30th that TLS connections to web sites using Let’s Encrypt certificates were failing. Our first response was to validate the certificate …

TT-CSIRT-397.27.09.21: TTCSIRT ADVISORY – VMware vCenter Server Vulnerability Under Active Exploit

VMware has disclosed that its vCenter Server is affected by an arbitrary file upload vulnerability—CVE-2021-22005—in the Analytics service. A malicious cyber actor with network access to port 443 can exploit this vulnerability to execute code on vCenter Server. VMware confirmed reports that CVE-2021-22005 is being exploited in the wild. Security researchers are also reporting mass …