Warning: Hackers
Hackers are massively attacking organizations in Uzbekistan. UZCERT has issued an urgent warning.
Uzbekistan has issued an urgent warning regarding hacker attacks. The Cybersecurity Center, operating through the UZCERT service, has issued an urgent alert for government agencies and commercial enterprises in the country. Specialists have detected a massive wave of cyberattacks carried out via the Remote Desktop Protocol (RDP). In some cases, the attackers have already penetrated information systems and encrypted the data stored there.
According to UZCERT, the investigation identified several foreign IP addresses associated with the infrastructure used to manage the malicious attacks. Preliminary analysis has shown that hackers have gained unauthorized access to a number of national information systems. Data encryption has already been detected on some compromised computers and servers. The investigation into the incidents is ongoing.
In this regard, specialists strongly recommend that organizations using RDP immediately review their security settings. If remote access is not essential, it is recommended to temporarily disable it. If the service is mission-critical, the connection should be restricted using a VPN or trusted IP addresses, Network Level Authentication (NLA) enabled, and standard port 3389 should not be left open to internet access.
Furthermore, UZCERT recommends changing passwords for all accounts with RDP access, enabling multi-factor authentication, thoroughly reviewing security logs, analyzing suspicious network activity, and conducting additional scans of servers and workstations for signs of compromise.
If signs of a hack or infection are detected, the system should be immediately disconnected from the network, all possible digital evidence should be preserved, and the incident should be reported to UZCERT for further investigation.
Previously, cases of unauthorized access to corporate email accounts of employees of higher education institutions and government organizations have been recorded in Uzbekistan. The UzCERT Cybersecurity Center's Information Security Incident Response Team also urged specialists and information security officials to urgently strengthen security measures.