CyberWire Daily

Latest Episodes:

Encore: Kathleen Booth: Get your foot in the door and prove your worth. [Marketing] [Career Notes] Jan 14, 2024

Show notes

Vice President of Marketing, Kathleen Booth, shares her career path from political science and international development to marketing for a cybersecurity company. Early dreams of acting morphed into goals of making the world a better place. Chief marketer and podcaster Kathleen is doing just that. She shares how proving your worth can lead to success. Listen for Kathleen's advice on getting your foot in the door. Our thanks to Kathleen for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Dual Russian cyber gangs hit 23 companies. [Research Saturday] Jan 13, 2024

Show notes

Ryan Westman, Senior Manager, Threat Intelligence, eSentire's Threat Response Unit (TRU), is discussing their research "Two Russian-speaking cyber gangs attack employees from 23 different companies." They are using malicious Google ads, promoting popular business software such as Zoom, Slack, and Adobe.

The customers targeted are companies in the manufacturing, software, legal, retail and healthcare industries. The attacking threat actors belong to the Russian-speaking Malware-as-a-Service (MaaS) groups called BatLoader and FakeBat.

The research can be found here:

Two Competing, Russian-Speaking Cybercrime Groups Attack Employees from 23 Companies in the Manufacturing, Software, Legal, Retail, and Healthcare Sectors Using Malicious Google Ads

Learn more about your ad choices. Visit megaphone.fm/adchoices

Casting a wider hiring net. Jan 12, 2024

Show notes

The Feds look to cast a wider hiring net. Legislators focus on deepfakes. Cookie stealers bypass MFA on Google accounts. A Fast food hiring chat bot got hacked. Medusa casts her gaze toward extortion. Akira ransomware is active in Finland. GitLab patches critical vulnerabilities. Bosch thermostats are vulnerable to some hot firmware. CSAM vendors’ crypto sophistication grows. CISA released ICS advisories. On our Solution Spotlight, N2K’s Simone Petrella speaks with Kim Jones, Director of Intuit's CyberCRAFT team, about the SEC's heightened focus on cybersecurity. And a little listener feedback, Karaoke style.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Solution Spotlight, N2K’s Simone Petrella discusses a possible hurdle with Kim Jones, Director of Intuit's CyberCRAFT team. They talk about the SEC's heightened focus on cybersecurity.

Selected Reading

An analysis of cyberattacks against Danish energy infrastructure. Cryptomining campaign targets weak SSH passwords. (CyberWire)

White House moves to ease education requirements for federal cyber contracting jobs (CyberScoop)

State Legislators Tighten A.I. Rules to Combat Deceptive Election Ads (New York Times)

Info-stealers can steal cookies for permanent access to your Google account (Malwarebytes)

Hackers Break into AI Hiring Chatbot, Could Hire and Reject Fast Food Applicants (404 Media)

Medusa Ransomware Turning Your Files into Stone (Unit 42 by Palo Alto Networks)

Akira ransomware attackers are wiping NAS and tape backups (Help Net Security)

Urgent: GitLab Releases Patch for Critical Vulnerabilities - Update ASAP (The Hacker News)

Vulnerability Puts Bosch Smart Thermostats at Risk of Compromise (Infosecurity Magazine)

Child Abusers Are Getting Better at Using Crypto to Cover Their Tracks (WIRED)

CISA Releases Nine Industrial Control Systems Advisories (CISA)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Unveiling the Shadow Strike: A zero-day assault on Ivanti VPN users. Jan 11, 2024

Show notes

A zero-day hits Ivanti VPN customers. CISA highlights an active MS Sharepoint Server flaw. Cisco patches a critical vulnerability. Atomic Stealer gets updates. Sensitive school emergency planning documents are exposed online. The FCC reports on risky communications equipment. The White House will introduce new cybersecurity requirements for hospitals. Mandiant explains their X-Twitter hack. Our guest is Palo Alto Networks’ Unit 42’s David Moulton, host of the new Threat Vector podcast. And we are shocked - shocked! - to learn that an online sex for money scheme is a scam.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Guest David Moulton from Palo Alto Networks joins us to talk about Threat Vector. It’s Unit 42’s segment turned podcast on the N2K media network.

Selected Reading

Ivanti customers urged to patch vulnerabilities allegedly exploited by Chinese state hackers (The Record)

CISA Urges Patching of Exploited SharePoint Server Vulnerability (SecurityWeek)

Critical Cisco Unity Connection flaw gives attackers root privileges. Patch now! (CVE-2024-20272) (Help Net Security)

Atomic Stealer Gets an Upgrade - Targeting Mac Users with Encrypted Payload (The Hacker News)

FCC's Reimbursement Program shows progress in removing national security risks from communication networks (Industrial Cyber)

After Barrage of Hacks, Hospitals Will Face New Federal Cybersecurity Rules Tied to Funding (The Messenger)

US School Shooter Emergency Plans Exposed in a Highly Sensitive Database Leak (WIRED)

Mandiant’s X Account Was Hacked in Brute-Force Password Attack (Infosecurity Magazine)

Believing they would be paid a fortune for having sex with women, hundreds of Indian men scammed out of cash (Graham Cluely)

Threat Vector Links.

To get more information on Medusa ransomware, listen to this episode of Threat Vector.

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A pivotal global menace. Jan 10, 2024

Show notes

The World Economic Forum names AI a top global threat. The SEC suffers social media breach. The FTC settles with a data broker over location data sales. A massive data leak hits Brazil. Chinese researchers claim and AirDrop hack. A major real estate firm suffers data theft. Pikabot loader is seeing use by spammers. Ukraine’s Blackhit hits Russia’s M9 Telecom. Stuxnet methods are revealed. A Patch Tuesday rundown. Our guest is Tim Eades from the Cyber Mentor Fund to discuss the growing prevalence of restoration as a part of incident response. And Hackers could screw up a wrench.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Guest Tim Eades from Cyber Mentor Fund joins us to discuss the growing prevalence of restoration as a part of incident response.

Selected Reading

AI-powered misinformation is the world's biggest short-term threat, Davos report says (AP News)

NSA: Benefits of generative AI in cyber security will outweigh the bad (IT Pro)

SEC account on X ‘compromised’ and regulator has not approved bitcoin ETFs (MarketWatch)

SEC did not have 2FA enabled: X safety team on fake Bitcoin ETF post (Cointelegraph)

FTC Order Prohibits Data Broker X-Mode Social and Outlogic from Selling Sensitive Location Data (Federal Trade Commission)

Entire population of Brazil possibly exposed in massive data leak (Security Affairs)

China says state-backed experts crack Apple's AirDrop (Digital Journal)

Fidelity National Financial says hackers stole data on 1.3 million customers (TechCrunch)

Water Curupira Hackers Launch Pikabot Malware Attack on Windows Machine (GBHackers On Security)

Ukrainian “Blackjack” Hackers Take Out Russian ISP (Infosecurity Magazine)

Ukraine is on the front lines of global cyber security (Atlantic Council)

Dutch Engineer Used Water Pump to Get Billion-Dollar Stuxnet Malware Into Iranian Nuclear Facility: Report (SecurityWeek)

New research paper explores post-quantum cryptography for critical infrastructure cybersecurity (Industrial Cyber)

AI Helps U.S. Intelligence Track Hackers Targeting Critical Infrastructure (Wall Street Journal)

Hewlett Packard Enterprise nears $13 billion deal to buy Juniper Networks (Reuters)

January Patch Tuesday: New year, more Windows bugs (The Register)

Cybersecurity Advisory: Apache Struts Vulnerability CVE-2023-50164 (Uptycs)

Hackers can infect network-connected wrenches to install ransomware (Ars Technica)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Swatting on the rise. Jan 09, 2024

Show notes

Swatting is on the rise. LoanDepot, the Toronto Zoo and the World Council of Churches all confirm ransomware attacks. Iran-linked hackers target Albania. Sea Turtle focuses on espionage and information theft. Fake “security researchers” offer phony ransomware recovery services. Could AI make KYC EOL? Avast enhances Babuk decryption. Joe Carrigan looks at the human side of email security. And a group of midwives fail to deliver.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today, we are joined by Joe Carrigan from JHU ISI on the human elements that impact email security

Selected Reading

Tanya Chutkan, the judge overseeing Trump's federal election interference case, appears to be victim of 'swatting'

Special counsel Jack Smith was targeted by attempted swatting on Christmas Day

LoanDepot Takes Systems Offline Following Ransomware Attack

Toronto Zoo hit by ransomware attack | Cybernews

Rhysida ransomware gang takes responsibility for attack on World Council of Churches

Wiper malware found in analysis of Iran-linked attacks on Albanian institutions

Turkish espionage campaigns in the Netherlands

"Security researcher" offers to delete data stolen by ransomware attackers

Gen AI could make KYC effectively useless | TechCrunch

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A conclusion on the xDedic Marketplace investigation. Jan 08, 2024

Show notes

The DOJ concludes its xDedic Marketplace investigation. A cyberattack shuts down a major mortgage lender. The Swiss Air Force suffers third party breach. An update on SilverRAT. The Space Force emphasizes collaboration for effective cyber growth. The DOE announces cyber resilience funding. Merck reaches a settlement on NotPetya. NIST warns of AI threats. Our guest is Dragos CEO Robert M. Lee, with a look at intellectual property theft in manufacturing. And Chump Change fines for big tech.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today, we are joined by Robert M. Lee, founder and CEO of Dragos, to discuss intellectual property theft in manufacturing.

Selected Reading

AsyncRAT campaign targets US infrastructure. (CyberWire)

19 Individuals Worldwide Charged In Transnational Cybercrime Investigation Of The xDedic Marketplace (US Department of Justice)

Space Force is crafting in-house cyber teams but sees need for closer work with USCYBERCOM (Nextgov/FCW)

Energy Department has cyber threats to infrastructure in mind with $70 million funding offer (FedScoop)

Swiss Air Force documents exposed via cyber attack on third party (BeyondMachines.net)

Major IT, Crypto Firms Exposed to Supply Chain Compromise via New Class of CI/CD Attack (SecurityWeek)

Merck settles with insurers who denied $700 million NotPetya claim (The Record)

Syrian Threat Group Peddles Destructive SilverRAT (DarkReading)

NIST Warns of Security and Privacy Risks from Rapid AI System Deployment (The Hacker News)

Mortgage firm loanDepot cyberattack impacts IT systems, payment portal (BleepingComputer)

Big Tech has already made enough money in 2024 to pay all its 2023 fines (Proton)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore:Johannes Ullrich: Superhero origin stories and lessons that last. [Education] [Career Notes] Jan 07, 2024

Show notes

Dean of Research, Johannes Ullrich, relays his experiences from studying the hard sciences to his career shift to cybersecurity. Basic principles, superhero origin stories, physics labs and radiation all figure in. And there’s a lot in common with network security best practices. Have a listen to what Johannes has learned and what he hopes to impart on his students. Our thanks to Johannes for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Diving deep into Phobos ransomware. [Research Saturday] Jan 06, 2024

Show notes

Guilherme Venere from Cisco Talos joins to discuss their research on "A deep dive into Phobos ransomware, recently deployed by 8Base group." Cisco Talos discovered that 8Base’s Phobos ransomware payload contains an embedded configuration, which is a significant difference between 8Base’s Phobos variant and other Phobos samples that have been observed in the wild since 2019.

In this 2-part research series, Talos conducts a deep dive into the Phobos ransomware, including its affiliate structure, activity and capabilities, as well as the one private key that could enable decryption of all the samples analyzed.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Disruptions to the internet. Jan 05, 2024

Show notes

BGP attack disrupts Internet service. Data breach law firm breached. Remcos RAT returns. Poison packages in the PyPI repository. Hacktivist personae and GRU fronts. BreachForums impresario re-arrested. Cyber National Mission Force gets a new leader. On our Solution Spotlight, Simone Petrella talks with ISC2 CEO Clar Rosso about putting a dent in the cybersecurity workforce gap. LinkedIn as a dating platform?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Solution Spotlight, N2K President Simone Petrella talks with ISC2 CEO Clar Rosso about putting a dent in the cybersecurity workforce gap through empowerment, breaking down barriers and expanding Diversity, Equity and Inclusion (DE&I) initiatives.

Selected Reading

BGP attack disrupts Internet service. Pirated Zeppelin ransomware source code for sale in a C2C souk. BreachForums impresario re-arrested. (CyberWire)

Hacker hijacks Orange Spain RIPE account to cause BGP havoc (Bleeping Computer)

RIPE Account Hacking Leads to Major Internet Outage at Orange Spain (SecurityWeek)

Law firm that handles data breaches was hit by data breach (TechCrunch)

UAC-0050 Group Using New Phishing Tactics to Distribute Remcos RAT (The Hacker News)

EXPERTS FOUND 3 MALICIOUS PACKAGES HIDING CRYPTO MINERS IN PYPI REPOSITORY (SecurityAffairs)

BreachForums administrator detained after violating parole (The Record)

Russian hackers wiped thousands of systems in KyivStar attack (Bleeping Computer)

US military’s Cyber National Mission Force gets a new chief (The Record)

The Hottest New Dating Site: LinkedIn (Business Insider)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices