UK NCSC Announces Resilience Initiatives

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week: the U.K. cyber agency announced resiliency initiatives, the Iberian blackout under investigation, dueling cybersecurity advisories from India and Pakistan, Delta must face a lawsuit linked to CrowdStrike outage, Mirai botnet exploited flaws in GeoVision and Chinese Smishing Kit ‘Panda Shop’ targeted victims globally.

See Also: Top 10 Technical Predictions for 2025

The U.K. cyber agency announced Thursday two initiatives intended to beef up the resilience of British critical infrastructure. Cyber Resilience Test Facilities, unveiled by the National Cyber Security Centre at the CyberUK conference, will allow technology vendors to test the resilience of their products. The agency will also launch Cyber Adversary Simulation, an accreditation process for companies that will facilitate cyber resilience testing.

The NCSC said it will open multiple centers allowing allow low-technology vendors to independently audit their IT infrastructure. The initiative will also adopt a new assurance methodology, different from existing regulatory requirements, the agency added.

“Through testing their response to simulated cyberattacks, the UK’s most critical infrastructure will be further empowered to defend against evolving online threats,” said Jonathon Ellison, NCSC director for national resilience.

Hackers are exploiting vulnerabilities in end-of-life GeoVision IoT devices and Samsung’s MagicINFO server to expand the Mirai botnet, according to research from Akamai, Arctic Wolf and Huntress.

Akamai observed attacks in April targeting GeoVision devices through two OS command injection flaws – CVE-2024-6047 and CVE-2024-11120 – to download and run an ARM variant of Mirai dubbed LZRD. The botnet abuses the /DateSetting.cgi endpoint to inject commands through the szSrvIpAddr parameter. Other vulnerabilities include exploits of older bugs in Hadoop yarn, CVE-2018-10561, and DigiEver systems. The campaign appears linked to a group known as “InfectedSlurs.”

Arctic Wolf reported active exploitation of CVE-2024-7399 in Samsung MagicINFO 9 Server, a path traversal flaw enabling attackers to write arbitrary files and execute code via crafted JSP files. Samsung patched the issue in August 2024 but Huntress found the latest version still to be vulnerable.

With many affected GeoVision devices no longer supported, experts urge users to upgrade hardware. The U.S. Cybersecurity and Infrastructure Security Agency added the GeoVision flaws to its Known Exploited Vulnerabilities catalog, mandating mitigation or device decommissioning by May 28.

A massive April 28 power outage plunged Spain and Portugal into darkness, disrupting transportation, telecommunications and essential services in some places for up to 24 hours. Grid operators in both countries have ruled out cyberattacks as the cause, attributing the blackout to sudden energy losses and grid instability. “There was no type of intrusion whatsoever in the control systems that might have caused the incident,” a top executive of Spanish electricity provider Red Eléctrica told reporters.

Despite these assessments, political leaders were unable to fully leave behind the prospect of a cyberattack. Spanish Prime Minister Pedro Sánchez repeated several times since the outage that he has not discarded the possibility of a cyberattack.

Spanish newspaper El Independiente on Tuesday reported that self-styled hacktivists Dark Storm Team, along with NoName057, claimed that day to have cut electricity in some NATO countries, an assertion that cybersecurity experts treat with skepticism. Spain’s high court opened an investigation on April 29.

Rising tensions between India and Pakistan resulted in dueling cybersecurity advisories from each side of the Kashmiri border. India launched military strikes against Pakistan on Wednesday, targeting what it said was “terrorist infrastructure” in Pakistan. The missile attack followed an April 22 attack that killed 26 people in a popular vacation spot in Indian-administered Kashmir. India said the attacks are linked to Lashkar-e-Taiba, Islamist militants based in Pakistan.

Indian stock exchange BSE warned firms to beef up cyber defenses, urging “precautionary measures on potential cyber risks including high-impact cyberattacks such as ransomware, supply chain intrusions, DDoS attacks, website defacement and malware,” a widely reported Thursday circular stated.

The National Cyber Emergency Response Team of Pakistan published a “high priority advisory in response to an escalating border situation with a neighboring country.” The CERT asserted that adversaries are launching “sophisticated cyberattacks” against critical networks, advising vigilance against phishing attacks, clicking strange links and scanning unknown QR codes.

India and Pakistan have gone to war three times since separating in 1947 following independence from Great Britain. The two countries have additionally fought dozens of skirmishes over the status of Kashmir, a Muslim-majority Himalayan region under the control of both governments.

A proposed class action lawsuit against Delta over delayed or canceled flights last July due to a botched update by cybersecurity company CrowdStrike mainly survived an attempt by the Atlanta airliner to have it dismissed in court.

U.S. District for the District of Northern Georgia Judge Mark Cohen ruled that five out of nine plaintiffs can pursue breach of contract claims against Delta, which canceled approximately 7,000 flights during the incident. The airliner estimates the outage resulted in $500 million in lost revenue and additional costs.

A group of five plaintiffs can proceed with claims under the Montreal Convention, an international treaty governing airline liability.

Delta itself is suing CrowsStrike over the incident, filing a complaint in Georgia superior court invoking Georgia state anti-hacking statute to accuse the cybersecurity firm of “installing an exploit in Delta systems” by automatically rolling out an update affecting the Windows operating system kernel (See: Delta Air Lines Sues CrowdStrike Over July System Meltdown).

A China-based cybercriminal group developed a smishing toolkit named “Panda Shop,” facilitating widespread phishing attacks via iMessage, uncovered researchers at Resecurity. The kit enables attackers to impersonate postal and delivery services, including India Post, USPS and Royal Mail, to deceive users into revealing personal and financial information. By exploiting compromised Apple iCloud accounts, the group sends fraudulent messages containing malicious links that direct recipients to counterfeit websites. These sites prompt victims to input sensitive data under the guise of package delivery updates. The Panda Shop kit is distributed through Telegram channels. Researchers identified vulnerabilities within the kit, enabling them to access data from over 108,000 victims.

Other Stories from Last Week

With reporting from Information Security Media Group’s Akshaya Asokan in Manchester, United Kingdom and David Perera in Northern Virginia.