Situation update

• Kazakhstan continues to experience significant nationwide unrest with major disruptive impacts across sectors. As a result, President Tokayev called on the Collective Security Treaty Organization (CSTO), the Russian-dominated regional security bloc, for help in quelling the violence. Some 2,500 Russia troops deployed to Kazakhstan to help secure strategic infrastructure and assist domestic security forces.
• President Tokayev issued a critical "red-level" terror alert for the country, classifying all protesters as "terrorists" and empowering local security forces to shoot on sight and without warning. The order also allows security forces broad ability to search and seize, block movement, and monitor telecom activity. At least 130 protesters have been killed thus far while at least 20 security personnel have also been killed in the unrest since 04 January. 
• While the scale of protest activity and violence has reportedly began to diminish outside Almaty, an unknown number of Kazakhstani police and military have joined protesters or been disarmed. Additionally, weapons depots have been looted, raising the specter of heavy violence in the future.
• The city of Almaty continues to experience unrest and clashes through 07 January, with reports of an explosion in the northeastern part of the city followed by a chemical smell. Additional violence is likely in central Almaty and other parts of the city. 
• An internet blackout continues in Kazakhstan, along with disruptions to telecom services, making it difficult to confirm government reporting on the situation. All internet-dependent industries continue to face disruptions.
• Grocery stores, banks, and gas stations continue to experience supply or security issues.
• Both Almaty International Airport and Nur-Sultan International Airport are reportedly under Russian military control, with no commercial or private flight operations allowed; however, Air Astana will reportedly resume services from Nur-Sultan airport later today, with international flights to Dubai and Moscow and domestic flights to Atyrau, Shymkent and Turkestan. Additional international services to Frankfurt and Kutaisi (Georgia) will resume on 8 January 2022 and to Istanbul on 9 January 2022.
  

Situation update

• Overnight on 04-05 January 2022 and through the morning, at least 5,000 people took to the streets of the commercial capital Almaty, the political capital Nur-Sultan, Aktau, and other cities to protest rising fuel prices and shortages. As the protests expanded, they grew more broadly antigovernmental in nature.
• The unrest in Almaty turned violent, with protesters setting fire to the Akimat government building near Republic Square. Security forces used rubber bullets, tear gas, and flash grenades to attempt to clear protesters. At least 200 protesters and 100 police officers have been injured in the unrest in Almaty alone.
• Reports indicate President Tokayev accepted the resignation of the Prime Minister along with government ministers.
• There is now an internet blackout in Kazakhstan, along with disruptions to telephone services and several websites have been blocked as well. 
• Protesters reportedly entered and occupied Almaty International Airport during afternoon hours local time on 05 January, prompting evacuation of airport staff. Passengers had been evacuated earlier in the day as a precaution.
• Protesters reportedly entered and occupied Almaty International Airport during afternoon hours local time on 05 January, prompting evacuation of airport staff. Passengers had been evacuated earlier in the day as a precaution.
• President Tokayev declared a state of emergency, which includes a 2300-0700 curfew, for Almaty and the Mangistau region, while a curfew is in effect for the capital Nur-Sultan. Both are set to last until at least 19 January. 

Situation update

• On 20 December 2021, the U.S. Department of State declared a “Level 4: Do Not Travel Advisory” for Ukraine, citing “increased threats from Russia.” This warning comes amid a major Russian military buildup along Ukraine’s borders that began in late March. Starting in November, Russia began to mobilize its logistics and other military support units in a deliberate and highly overt manner, giving Moscow the ability to initiate offensive operations in Ukraine with little notice or warning.

Latest DEVELOPMENTS

• Concern over the Omicron variant appears to be lessening as more data comes out. A preliminary study in South Africa shows Omicron to cause significantly less severe illness than the Delta variant or the original strain of COVID-19. The study showed that hospital admissions are significantly lower during the Omicron-driven fourth wave—38 admissions per 1,000, compared with 101 per 1,000 during the Delta-driven wave, and 131 per 1,000 when the Beta variant was dominant.

• While the Omicron variant does appear to evade immunity much more than other variants, the data out of South Africa shows that the Pfizer-BioNTech vaccine’s efficacy against severe illness and hospitalization was still about 70 percent after two doses. 

• Data out of Britain shows that after six months, two doses of the AstraZeneca vaccine provided no protection at all from infection from Omicron. Two doses of Pfizer-BioNTech had an effectiveness of just 34 percent. But a Pfizer-BioNTech booster had an effectiveness of 75 percent against infection.

• As a result of the positive data, and its own surge, the United Kingdom reversed course on banning travel from southern Africa, and removed all countries from its "Red List" on 15 December. 

• While the UK dropped its travel bans, others have issued new bans on travel:

  • France has banned all travel to and from the UK starting 18 December, unless there is a compelling reason, due to concerns over the surge in cases in the UK. 

  • South Korea and Hong Kong have issued new travel bans for multiple countries, including in Africa and elsewhere. 

     

INCIDENT

On 09 December 2021, sources identified a significant security flaw within the popular online game Minecraft. The bug allowed attackers to change messaging settings that made the Log4j logging application connect to external addresses, allowing attackers access to the system.

Tracked CVE-2021-22448 (CVSS score: 10.0), the flaw concerns a case of remote code execution in Log4j, a Java-based open-source Apache logging framework broadly used in enterprise environment applications to record events and messages generated by software applications. Because Log4j is open source (free), it is used widely. Apache Log4j is part of the Apache Logging Project. By and large, usage of this library is one of the easiest ways to log errors, which is why most Java developers use it. Many large software companies and online services use the Log4j library: Amazon, Apple iCloud, Cisco, Cloudflare, ElasticSearch, Red Hat, Steam, Tesla, Twitter, and many more. The bug has scored a perfect 10 of 10 in the Common Vulnerability Scoring System (CVSS) rating system, indicative of the severity of the issue.

Since its initial discovery, intelligence suggests that the vulnerability has been built into Linux-based high speed robot networks (botnets), and is exploiting industrial controls, internet of things devices, and now, crypto mining systems.

Global Guardian has been actively monitoring this activity beginning approximately 24 hours before it was publicly announced, having received advanced notice from confidential intelligence sources. To date, we have blocked all known events for our current Cyber Security clients and are actively protecting all network and devices from this vulnerability through firewalls and secure workstation security software.

CORRECTIVE ACTION

The Cybersecurity and Infrastructure Security Agency (CISA) has provided Apache Log4j Vulnerability Guidance. To view, click here. In addition, we recommend:

• You disallow any gaming in your environment and close all running instances of the game and the Minecraft Launcher. Users will need to start the Launcher again, following which the patched version will download automatically.
• Anyone with an application containing Log4j immediately pays attention to this vulnerability and ensure you have a web application firewall (WAF) installed. If you have any questions, contact our team today. Global Guardian can provide guidance on installing firewalls and securing your networks. 

Latest DEVELOPMENTS

• On 26 November, the World Health Organization named the Omicron variant a "new variant of concern" after it had been identified a day earlier by scientists in South Africa. Omicron is spreading rapidly in South Africa, displacing Delta as the dominant strain among new cases, though it is unclear if Omicron originated in South Africa.
• Omicron has been detected in South Africa, Botswana, and in travelers to Australia, Belgium, Britain, Canada, Czech Republic, Denmark, Germany,  Israel, Italy, the Netherlands, Portugal, and Hong Kong. This list will grow in the coming days and weeks. 
• As a reaction to Omicron, many countries have banned flights from southern Africa, while several countries have significantly adjusted restrictions or banned all travel outright;
  
  
  • Israel - banned all foreign travelers until at least 11 December. Returning nationals must quarantine
  • Morocco - banned all incoming flights for at least the next two weeks.
  • Japan - indefinite entry ban for all foreign nationals.
  • Australia - flight suspension and entry ban for travelers and flights from southern Africa. Quarantine mandate and self-isolation requirement imposed for all international arrivals in Victoria, New South Wales, and Australian Capital Territory.

• While it is too soon to compare the symptoms and severity of Omicron to other iterations of the SARS-CoV-2 virus, Omicron has a number of mutations affecting the spike protein, raising concerns over possible immune evasion and increased transmissibility, as was seen with Delta, which currently comprises 99% of cases globally. 
• Pfizer-BioNTech expects to receive lab data on the Omicron variant within the next two weeks. It says that they can adapt mRNA vaccine within six weeks and possibly ship initial batches within 100 days in event of escape variant.
• Moderna has told investors that it is evaluating a full booster dose of original vaccine, studying two multi-valent boosters, and plans on launching an Omicron-specific booster.
• Johnson and Johnson has announced that it is already testing its vaccine’s efficacy against the new variant of concern.
• Novavax is on pace to file for U.S. EUA before 2022. It has already applied for approval in the EU and Canada. Novavax is developing a new version of its vaccine and it will begin testing and manufacturing in the next few weeks.

Situation Update

• On 02 November 2021, the U.S. Department of State declared a “Level 4: Do Not Travel Advisory” for Ethiopia, restricting U.S. Embassy personnel from traveling outside of Addis Ababa and advising all U.S. citizens in Ethiopia to leave the country.
  
  
• The advisory comes after rebel groups – the Tigray People's Liberation Front (TPLF) and the Oromo Liberation Army (OLA) – seized two strategically important towns 235 miles north of the capital along Ethiopia’s north-south A2 highway, effectively splitting the country in two. Armed conflict and civil unrest continue in Amhara, Afar, and Tigray.
  
  
• The Ethiopian central government declared a six-month state of emergency and authorities in Addis Ababa and the state of Amhara have also called on residents to register any weapons and prepare to fight. The state of emergency gives the government wide legal power to arrest anyone suspected of providing financial, material, or moral support to the rebel group. Reports of the arrests of ethnic Tigray in Addis have circulated over the past several days.
  
  
• Addis Ababa Bole International Airport (HAAB/ADD) is still fully operational; however, it is unclear if ADD will remain open to commercial flights should conflict reach the outskirts of the city. Flights are reported to be fully booked, as diplomats, expatriates, government officials, and Ethiopian citizens flee Addis.

Latest DEVELOPMENTS

• The United States will lift international travel restrictions on 08 November for fully vaccinated individuals. Those vaccines approved by the World Health Organization (WHO) will be accepted. In addition, the U.S. land borders with Canada and Mexico will re-open to fully vaccinated leisure travelers. A negative test will still be required for international air arrivals.

• Australia is expected to lift restrictions on international travel in November, several months earlier than anticipated, due to high vaccination rates inside the country. At least 58 percent of the country has been fully vaccinated, just ahead of the United States.

• Cases, hospitalizations, and deaths have all steadily declined in the U.S. Hotspots are now focused in the upper Midwest where earlier cool temperatures have led to more indoor activity. 

Situation Update

On 16 October, assailants in Port-au-Prince, Haiti kidnapped 17 members of an Ohio-based Anabaptist Christian aid group, including five children. The victims include 16 Americans and one Canadian. Local police suspect the involvement of the 400 Mawozo gang, who also kidnapped five priests and two nuns earlier this year.

Situation update

At approximately 1100 local time, sniper fire was reported against members and supporters of Lebanon’s Shia Hezbollah and the Amal Movement near the Palace of Justice in the Tayouneh area of Beirut, southeast of the city center.