# MA-1046.032024: MyCERT Advisory - Recent Increase in Cyber Attacks Targeting Malaysia

**Date:** 19 Mar 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1046.032024  
**Advisory ID:** MA-1046.032024

---

**1.0 Introduction**
Cyber999 Incident Response Centre of CyberSecurity Malaysia has lately observed a significant increase in cyber security incidents targeting Malaysia. The attacks targeted websites and networks belonging to corporate organisations and the government in Malaysia.  As a preventive measure, we release this alert to advise organisations to take necessary steps to secure and protect their systems against unwanted incidents and other security threats.
**2.0 Impact**
Successful attacks will affect the confidentiality, integrity, and availability of data in the affected systems of the organisations. This may lead to further impacts on organisations' business activities.
List of impacts:
- Identity theft can lead to unauthorised access activities.
- Network infrastructure compromised.
- Business operations or services are disrupted due to permanent or temporary loss of sensitive data belonging to an organisation.
- A data breach can result in reputational harm to organisations and diminish trust in digital transformation programmes.
**3.0 Targeted Systems**
Based on our observation, the attackers target networks and web applications vulnerable to publicly known attack techniques, unpatched systems, systems that lack security controls, use of weak passwords, and misconfiguration.
**4.0 Recommendation**
CyberSecurity Malaysia advises all system owners to be alert and take the necessary action to secure their websites and networks. Below are some recommendations for immediate protection against recent cyber-attacks:
**4.1 Recommendations for System Administrators:**
1. Organisations must proactively monitor and screen for compromised credentials potentially due to Info stealers infection. Info stealers could be part of a bigger attack like ransomware. Hence, compromised credentials must be immediately rectified by changing the passwords to strong passwords.
2. Implementing password revocation to enforce password changing.
3. Encourage employees to use secure password managers and longer passphrases, avoid using the same password for multiple accounts and set reminders to change passwords after several months.
4. Restrict access authorisations according to user roles and develop an authorisation policy to secure idle accounts; automatically lock accounts and alert IT staff after several failed login attempts.
5. Review Active Directory (AD) to locate and close existing backdoors, such as compromised service accounts, which often have administrative privileges and are often targeted by attackers who aim to steal credentials.
6. Update security patches and antivirus software regularly.
7. Perform Data backups daily and test regularly. Place backup copies in a remote location.
8. Conduct Information Security(IS) awareness training for all staff at least once a year.
9. Do not download suspicious files from an unknown sender.
10. Conduct Disaster Recovery Plan review and update, if necessary.
11. Conduct a Business Continuity Plan review and update, if necessary.
12. Multi-factor authentication, such as Microsoft and Google Authenticator, is advised for implementation to identify and protect the businesses' critical assets and access to critical information systems.
Below are steps to implement multi-factor authentication for Microsoft 365:
a) Enable multi-factor authentication for a user.
Use the following steps to enable multi-factor authentication for a user:
- Log in to your Microsoft 365 Control Panel.
- From the left menu, select Office 365 Admin centre.
- From the top menu, select multi-factor authentication.
- Select the check box next to the user you need to enable multi-factor authentication for.
- Under quick steps, select Enable.
- When you are prompted, select enable multi-factor auth.
- The selected user is now able to configure multi-factor authentication for their account.
b) Require a user multi-factor authentication.
To require a user to use multi-factor authentication, you must enforce multifactor authentication for their account.
Use the following steps to enforce multi-factor authentication for a user:
- Log in to your Microsoft 365 Control Panel.
- From the left menu, select Microsoft 365 Admin Centre.
- From the top menu, select Multi-factor authentication.
- Select the check box next to the user you need to enforce multi-factor authentication for.
- Under quick steps, select Enforce.
- When you are prompted, select enforce multi-factor auth, then close.
- The selected user is now required to configure and use multi-factor authentication for their account.
c) Reset existing multi-factor authentication configuration for a user.
Your user may lose access to the device they used to register with multi-factor authentication. When this occurs, you need to reset their multi-factor settings so that they can re-register.
Use the following steps to reset the existing multi-factor authentication configuration for a user:
- Log in to your Microsoft 365 Control Panel.
- From the left menu, select Microsoft 365 Admin Centre.
- From the top menu, select Multi-factor authentication.
- Select the check box next to the user you need to enforce multi-factor authentication.
- Under quick steps, select Manage user settings.
- Select the check box next to Require selected users to provide contact methods again.
- Select save, then close.
- The selected user can now log in to their Office 365 account and re-register with multi-factor authentication.
d) Disable multi-factor authentication for a user.
Use the following steps to disable multi-factor authentication for a user:
- Log in to your Microsoft 365 Control Panel.
- From the left menu, select Microsoft 365 Admin Centre.
- From the top menu, select Multi-factor authentication.
- Select the check box next to the user you need to disable multi-factor authentication.
- Under quick steps, select Disable.
- When you are prompted, select yes, then close.
- The selected user will no longer be able to use multi-factor authentication with their account.
Below are steps to implement multi-factor authentication using Google Authenticator:
a) Download the app from Google Play or App Store.
b) Navigate to the Security page.
- The second section on that page is titled **Multifactor Authentication.**
Current Password: Enter your DreamHost account password.
- Multifactor Authentication Type: Click the dropdown menu to choose which of the two Google methods you’d like to use:
- Google Authenticator, Time-Based (recommended)
- Google Authenticator, Counter-Based
c) Click the Get Started button.
- You will see a QR Code and a 16-digit secret key that you will need to activate Multifactor Authentication.
d) Use the Google Authenticator app to scan the QR code.
- If your device does not have a camera, you can manually enter the 16-digit secret key shown below the QR code into the app.
- If you have multiple devices running Google Authenticator, scan the QR code or enter the key on every device you want to use with your DreamHost account.
e) When the Google Authenticator app displays a 6-digit passcode, enter it in the passcode field.
- If you use counter-based codes, you may need to press the refresh button to display the first code.
f) Click the Activate! Button and DreamHost’s server are synced to your device.
- You will see a ‘Success!’ confirmation box appear.
g) Disabling MFA in the panel
- Navigate to the Security page and click the Disable button on the MFA section.
- A success message appears, confirming its deletion.
Generally, CyberSecurity Malaysia advises users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>