Threats and Risks

All US federal agencies that fall under the Federal Civilian Executive Branch are required to secure their systems against the bug by July 18

The flaw has also exposed the locations of a number of sensitive sites in the country.

Intel says an attack probably wouldn't work outside a lab environment

Cyber-criminal groups have recently ramped up their use of Ransomware-as-a-Service (RaaS) BlackCat/ALPHA-V, first identified by security researchers in November 2021, and upped the ante by publishing the hacked data on a dedicated website.

Reports of Ukrainian media organisations receiving emails with compromised Word docs, and AsyncRAT Trojan delivered by groups exploiting the unpatched flaw

Sophisticated malware uses a variety of methods to evade detection

Microsoft has still not provided a fix for the flaw

Word attack is possible even with macros turned off, no patch yet available

EnemyBot is fast integrating exploits for recently announced vulnerabilities to improve its capabilities.

OAS Platform used in many industrial IoT and SCADA systems has bugs that could be exploited for unauthorised access and remote code execution