MPCERT issues security advisory to Madhya Pradesh government departments
The advisory follows a LockBit ransomware attack on a government computer system in the state.
The Madhya Pradesh Computer Emergency Response Team (MPCERT) has issued a high-level cybersecurity advisory to government departments in Madhya Pradesh, according to the Free Press Journal.
The advisory comes after a recent LockBit ransomware attack targeted a government computer system. The measures aim to protect Windows computers, servers, and Active Directory environments from such cyberattacks.
MPCERT noted that attackers exploit system vulnerabilities, unsecured remote access, and stolen credentials to infiltrate networks. These attackers may move across systems, escalate privileges, steal sensitive data, and encrypt files.
The advisory identifies warning signs including unauthorised network activity, ransom notes, suspicious file extensions, the deletion of backups, cleared event logs, and disabled security services. Domain administrators are noted as being particularly vulnerable.
Departments have been advised to use updated, genuine operating systems, maintain endpoint detection and antivirus systems, enforce strong passwords, and enable multi-factor authentication. MPCERT also recommended restricting Remote Desktop Protocol access and maintaining three copies of backups.
In the event of an attack, the advisory states that affected systems should be isolated immediately without being shut down to preserve forensic evidence and memory.