Fall is that time magical time of year when you start to receive a lot of “ACTION REQUIRED” emails from ITS. Why do we keep bothering you about updating your operating system? If your computer is working, why mess with it?
One of the answers to those questions: Cozy Bear
Who is Cozy Bear?
“Cozy Bear” is a state-sponsored Russian cyber-espionage group, known for targeting outdated and unpatched software. They stay in business by prowling around for outdated and unpatched software. Sometimes their hunt is easy. The moment a company releases a software update, they check out what vulnerabilities it fixes, then peek around the web for companies and people who haven’t installed it yet. Every day you click “Remind me Later” is another day for Cozy Bear to take a swipe.
Don’t let Cozy Bear get too cozy
Every year, Microsoft and Apple roll out new Operating System updates and phase out support for older versions. Updates don’t just add features, they are full of patches that keep criminal groups like Cozy Bear at bay. Most system updates just take a few minutes. Just do it when prompted!
- Turn on automatic updates whenever possible
- Check regularly that operating systems, browsers, apps, and devices are updated
- Restart devices when updates require it so that security fixes can be fully applied
How do I update my OS?
If you need to update your OS, chances are you’ve already received an email (or five!) from the ITS department with information about scheduled pushed updates, or instructions for how to do it yourself.
- If you’re on a Windows device, here is how to update to Windows 11 25H2.
- If you’re on a Mac, you can update to one of the three most recent macOS versions (Tahoe, Sequoia, or Golden Gate) using Software Update.
Sources:
https://www.huntress.com/threat-library/threat-actors/cozy-bear-apt29
October is National Cybersecurity Awareness Month, an annual collaborative effort between government and industry to ensure we have the resources you need to maintain your security online. Throughout October, we’ll be sending you tips on protecting your information and avoiding malicious attempts to extract your personal data. Visit its.weill.cornell.edu/cybersecurity for more info.