Alert on Potential Cyber Attack on Malaysian Domains

For technical teams

1. Organisations are advised to be vigilant and take the following actions: Official source
2. Monitor your environment closely for any anomalies and mass scanning attempts; Ensure all your critical ICT assets are installed with the latest security patches and updates; Be wary of unsolicited emails that have links with/without attachments; Ensure that anti-virus/anti-malware signatures are up to date and functioning well; Review the logs of your firewalls and other security devices for anomalies from time to time; Review the configurations of your firewalls and other security appliances from time to time; Block or restrict access to every port such as port 3389 (RDP), port 5900 (VNC), port 22 (SSH) and services except for those that should be publicly available; Make sure logging of systems and servers are always enabled; Make sure your system password is strong and secured. Change the password if needed; Make sure the login pages for the system administrators are not publicly accessible; Perform regular backup of all critical data to minimise the impact of data or system loss and to help expedite the recovery process. Ideally, the backup must be done daily, on a separate media and stored offline at an alternate site; If you suspect any of your servers have been compromised, isolate the identified server immediately, reset all usernames and passwords and initiate incident handling; Perform hardening on all your Internet-facing applications; and Report any anomalies detected within your network and enterprise environment to NC4. Official source