Computer hardware manufacturer ASUS was the victim of a sophisticated attack that left backdoor malware embedded in their update software. The researchers estimate half a million Windows machines received the malicious backdoor through the ASUS update server, although the attackers appear to have been targeting only about 600 of those systems. The malware searched for targeted systems through their unique MAC addresses, reached out to a command-and-control server the attackers operated, and installed additional malware on those machines. Supply-chain attacks are starting to grow in number and complexity – make sure that you have a plan to address them.
A recent survey of the 22,000 new vulnerabilities that were discovered in 2018 indicates that 1/3 have public exploits and 50% can be exploited remotely. Ensure that you have total visibility into all of your endpoints and that they are patched and up to date.