CyberWire Daily

Latest Episodes:

Remapping privacy. Dec 15, 2023

Show notes

Google boosts Maps privacy, a court shields password disclosure, feds foil a massive scam operation, Iran-Israel cyber tensions escalate, Idaho National Labs reports a significant data breach, a security engineer's cybercrime confession. N2K’s Rick Howard reports from the recent MITRE ATT&CK con, speaking with Blake Strom of Microsoft about 10 years of the MITRE ATT&CK Framework. And Brian Krebs' relentless investigation into the Target breach.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today, N2K’s Rick Howard recently attended the MITRE ATT&CK Con. While there, Rick spoke with Blake Strom of Microsoft and they discussed 10 years of MITRE ATT&CK Framework.

Selected Reading

Google is rolling out new protections for our location data (The Washington Post)

Four men indicted in $80 million ‘pig butchering’ scheme (CNBC)

Just In: Crypto Hacker Shakeeb Ahmed Admits to $12 Million Heist (BET US)

Suspects can refuse to provide phone passcodes to police, court rules (Ars Technica)

Gaza Cybergang | Unified Front Targeting Hamas Opposition (Sentinal Labs)

Israeli CEO recruits Muslim hackers to fight Hamas in cyberwarfare (The Jerusalem Post)

Personal Information of 45,000 Individuals Stolen in Idaho National Laboratory Data Breach (Securityweek)

Ten Years Later, New Clues in the Target Breach (krebsonsecurity)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Taking down the storm. Dec 14, 2023

Show notes

Microsoft takes down the Storm-1152 cybercrime operation. “GambleForce” is a newly discovered threat actor. The SVR exploits a JetBrains TeamCity vulnerability. US Postal Service impersonation. Malicious ads associated with Zoom. An update on the cyberattack against Kyivstar. Apache issues a Struts 2 security advisory. The FCC adopts new data breach rules. In our latest Threat Vector segment, David Moulton and Palo Alto Networks Madeline Sedgwick discuss the skills and methods necessary for understanding threat actor intent and behaviors. And the State Department's Global Engagement Center is under fire.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On the Threat Vector segment with Palo Alto Networks Unit 42’s David Moulton, hear about decoding cyber adversaries. David discusses unveiling intent and behavior in the world of threat hunting with Madeline Sedgwick.

Selected Reading

Microsoft disrupts cybercrime operation selling fraudulent accounts to notorious hacking gang (TechCrunch+)

New hacker group GambleForce targets government and gambling sites in Asia Pacific using SQL injections (Group-IB)

Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally (Joint Advisory)

Malvertisers zoom in on cryptocurrencies and initial access (MalwareBytes)

Russian hacker group claims responsibility for Kyivstar cyberattack (The Kyiv Independent)

New Critical RCE Vulnerability Discovered in Apache Struts 2 - Patch Now (The Hacker News)

FCC Adopts Updates to Data Breach Rules, Sets Up Privacy Battle (Bloomberg Law)

State Dept.’s Fight Against Disinformation Comes Under Attack (The New York Times)

Threat Vector.

In this Threat Vector segment, David Moulton and Palo Alto Networks Madeline Sedgwick discuss the skills and methods necessary for understanding threat actor intent and behaviors. Madeline, a Senior Cyber Research Engineer and Threat Analyst for the Cortex Xpanse team at Palo Alto Networks, shares insights into how analyzing adversary behavior helps in anticipating threats and avoiding guesswork. They discuss the value of understanding both system dynamics and human behavior in cybersecurity, emphasizing that cyber adversaries are limited by the same laws of internet physics.

Please share your thoughts with us for future Threat Vector segments by taking our brief survey.

To learn what is top of mind each month from the experts at Unit 42 sign up for their Threat Intel Bulletin.

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The United Kingdom's catastrophic ransomware attack. Dec 13, 2023

Show notes

The UK faces a looming threat of a catastrophic ransomware attack. The Senate confirms a new National Cyber Director. The rivalry between malware groups BatLoader and FakeBat. BazarCall phishing attack and its unusual use of Google Forms. A serious vulnerability threatens K-12 student data. Spiderman game developer Insomniac Games becomes the latest ransomware victim. Today’s guest is Tim Starks from the Washington Post’s Cybersecurity 202 with China’s influence operations in Taiwan, along with a look back at 2023. We'll touch on Microsoft's Patch Tuesday and why outdated password policies are still a problem.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today’s guest is Tim Starks from the Washington Post’s Cybersecurity 202. Tim and Dave discuss China’s influence operations in Taiwan, along with a look back at 2023.

Selected Reading

UK at high risk of ‘catastrophic ransomware attack’, report says (The Guardian)

Roll Call Vote 118th Congress - 1st Session (United States Senate)

How Does Access Impact Risk? (IST)

API and App Security: Q3 2023 Snapshot (ThreatX)

The Kids Aren’t Alright: Vulnerabilities in Edulog Portal Revealed K-12 Student Location Data (tenable)

Press and pressure: Ransomware gangs and the media (Sophos)

BazarCall Attack Leverages Google Forms to Increase Perceived Credibility (Abnormal)

Two Competing, Russian-Speaking Cybercrime Groups Attack Employees from 23 Companies in the Manufacturing, Software, Legal, Retail, and Healthcare Sectors Using Malicious Google Ads (esentire)

Spider-Man 2 developer Insomniac Games hit by Rhysida ransomware attack (cyberdaily)

Microsoft Patch Tuesday December 2023 (Sans)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

An internet blackout. Dec 12, 2023

Show notes

A cyberattack on Ukraine's largest telecom operator. Ukraine's GUR claims a hit on Russia's tax service, while the fate of the ALPHV/BlackCat group remains shrouded in mystery. The Air Force disciplines members over a classified documents breach, and Apple releases urgent security updates. From Spain, a significant arrest in the Kelvin Security hacking group. On today’s Industry Voices segment, my conversation with Andre Durand, CEO and Founder of Ping Identity, on digital experiences, brand trust and loyalty, behaviors and attitudes towards security, authentication and fraud. Plus, a cautionary tale about burning bridges.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices segment, we speak with Andre Durand, the CEO and Founder of Ping Identity. Andre discusses the state of digital experiences. Ping recently commissioned a study to better understand the changing sentiments around digital experiences, brand trust and loyalty, behaviors and attitudes towards security, authentication and fraud, as well as digital wallets and the use of decentralized identity.

Selected Reading

Ukraine’s Mobile Operator Kyivstar Facing ‘Powerful’ Cyberattack (Bloomberg)

Ukraine's top mobile operator hit by biggest cyber attack of war so far (Reuters)

GUR says it has hacked servers of Russian tax service (Interfax-Ukraine)

ALPHV/BlackCat Site Downed After Suspected Police Action (Infosecurity Magazine)

BlackCat ransomware site down amidst rumours of law enforcement action (Computing)

No confirmation on rumored ALPHV/BlackCat site takedown by law enforcement (SC Media)

Cloudflare 2023 Year in Review (Cloudflare)

Bitsight and Google collaborate to reveal global cybersecurity performance (Bitsight)

15 Air National Guardsmen disciplined in Discord server leak (C4ISRNET)

Apple emergency updates fix recent zero-days on older iPhones (Bleeping Computer)

Kelvin Security hacking group leader arrested in Spain (Bleeping Computer)

Cloud engineer gets 2 years for wiping ex-employer’s code repos (Bleeping Computer)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

China sets sights on US critical infrastructure. Dec 11, 2023

Show notes

China allegedly targets US critical infrastructure, while a small Irish village goes without water due to an Iranian CyberAv3ngers attack. The EU sets a global precedent with new AI regulations. Unraveling the latest maneuvers of the Lazarus Group. The Sandman APT's links to Chinese cyber threats. "5Ghoul" vulnerabilities represent a new challenge in telecom security. The deceptive dangers of the MrAnon infostealer in a booking app. The GRU's phishing tactics lead to the spread of Headlace malware. On today’s Solution Spotlight segment, Kristie Grinnell from DXC Technology talks with N2K’s President Simone Petrella about DXC’s “All in on Cyber” program. And 23andMe's controversial update to its terms and conditions.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Solution Spotlight segment, Kristie Grinnell from DXC Technology talks with N2K’s President Simone Petrella about DXC’s “All in on Cyber” program. Kristie is DXC’s Senior Vice President and Chief Information Officer.

Selected Reading

China’s cyber army is invading critical US services (Washington Post)

Hackers hit Erris water in stance over Israel (Western People)

FBI: Cyberattack against Aliquippa water authority was a targeted 'escalation' on overlooked technology (Post Gazette)

White House aide says Iranian hack of US waterworks is call to action (C4ISRNet)

EU reaches deal on landmark AI bill, racing ahead of US (Washington Post)

Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang (Cisco Talos)

Sandman APT | China-Based Adversaries Embrace Lua (SentinelOne)

5Ghoul : Unleashing Chaos on 5G Edge Devices (Singapore University of Technology and Design)

MrAnon Stealer Spreads via Email with Fake Hotel Booking PDF (Fortinet)

ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware (Security Intelligence)

23andMe changes terms of service amid legal fallout from data breach (Axios)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: Tracy Maleeff: Ask more people to dance. [Analyst] [Career Notes] Dec 10, 2023

Show notes

Cyber analyst, Tracy Maleeff, shares her unexpected journey from the library to cybersecurity and offers advice for those both seeking to make a change and those doing the hiring. It's not just about the invitation, it's more than that. Our thanks to Tracy for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

AWS in Orbit: Monitoring critical road infrastructure at scale with Alteia and the World Bank. [T-Minus AWS in Orbit] Dec 09, 2023

Show notes

You can learn more about AWS in Orbit at space.n2k.com/aws.

Baptiste Tripard is the Chief Marketing Officer at Alteia. Aiga Stokenberga is the Senior Transport Economist at the World Bank.

We explore how Alteia and the World Bank are leveraging AWS's cloud, AI, and space capabilities to monitor critical road networks at scale to support large scale infrastructure investments. From road networks to bridges, they share real-world applications that are making a difference in emerging economies.

AWS in Orbit is a podcast collaboration between N2K and AWS to offer listeners an in-depth look at the transformative intersection of cloud computing, space technologies, and generative AI. You can learn more about AWS in Orbit at space.n2k.com/aws.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our weekly intelligence roundup, Signals and Space, and you’ll never miss a beat. And be sure to follow T-Minus on LinkedIn and Instagram.

Selected Reading

AWS Aerospace and Satellite

AWS re:Invent

Alteia and the World Bank assess and enhance road infrastructure data quality at scale using AWS

Audience Survey

We want to hear from you! Please complete our short survey. It’ll help us get better and deliver you the most mission-critical space intel every day.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at space@n2k.com to request more info.

Want to join us for an interview?

Please send your pitch to space-editor@n2k.com and include your name, affiliation, and topic proposal.

Learn more about your ad choices. Visit megaphone.fm/adchoices

On the hunt for popping up kernel drives. [Research Saturday] Dec 09, 2023

Show notes

Dana Behling, researcher from Carbon Black, sharing their work on "Hunting Vulnerable Kernel Drivers." The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers, six of which allow kernel memory access, accepting firmware access.

TAU reported the issues to the vendors whose drivers had valid signatures at the time of discovery, but only two vendors fixed the vulnerabilities. TAU is calling for more comprehensive approaches in the future than the current banned-list method used by Microsoft. The research states "By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges."

The research can be found here:

Hunting Vulnerable Kernel Drivers

Learn more about your ad choices. Visit megaphone.fm/adchoices

Russia here, Russia there, Russia everywhere. Dec 08, 2023

Show notes

Legal action against Star Blizzard's FSB operators. A critical Bluetooth vulnerability has been discovered. How the GRU faked celebrity videos in its Doppelgänger campaign. The persistence of Log4j vulnerabilities. Lack of encryption as a contributor to data loss. Supply chain breaches plague the energy sector. Our guest is Allan Liska, creator of a new comic book featuring the adventures of Johnny Dollar, a hard-nosed cyber insurance investigator. And Russian activists make clever use of QR codes.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Guest Allan Liska, creator of Green Archer Comics, shares the first installment in a new comic book series: "Yours Truly, Johnny Dollar #1." The series follows the adventures of Johnny Dollar, a hard-nosed cyber insurance investigator, as he takes on ransomware attacks, insider threats and more. The series is based on a popular radio serial of the same name that ran from 1949 through 1962, now reimagined for the digital age.

Selected Reading

Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns (CISA)

The cyberattacks also allegedly took aim at U.S. energy networks and American spies. (Wall Street Journal)

Russian Star Blizzard hackers linked to efforts to hamper war crimes investigation (The Guardian)

U.S. Takes Action to Further Disrupt Russian Cyber Activities (US Department of State)

Rewards for Justice (Rewards for Justice)

Two Russian Nationals Working with Russia’s Federal Security Service Charged with Global Computer Intrusion Campaign (US Department of Justice)

United States and the United Kingdom Sanction Members of Russian State Intelligence-Sponsored Advanced Persistent Threat Group (US Department of Treasury)

Critical Bluetooth Flaw Exposes Android, Apple & Linux Devices to Takeover (DarkReading)

Obfuscation and AI Content in the Russian Influence Network “Doppelgänger” Signals Evolving Tactics (Recorded Future)

Russian influence and cyber operations adapt for long haul and exploit war fatigue (Microsoft)

State of Log4j Vulnerabilities: How Much Did Log4Shell Change? (Veracode)

ESG Report Operationalizing Encryption and Key Management (Fortanix)

Russian opposition activists use QR codes to spread anti-Putin messages (The Record)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our 5 question survey as we continually work to improve the show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

New vulnerability packs a punch. Dec 07, 2023

Show notes

Unpacking LogoFAIL's threat to Windows and Linux. The US DHS's new healthcare cybersecurity strategy, and dual Russian influence campaigns. A look at supply chain risks, increased bot activity in retail, Meta's end-to-end encryption in Messenger and Android's Autospill vulnerability. On today’s Industry Voices segment, we welcome Todd Thorsen, CISO from CrashPlan, with insights on data resiliency. And the discovery of an alleged software 'kill switch' in Polish trains.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On today’s Industry Voices segment, we welcome Todd Thorsen, CISO from CrashPlan. Todd discusses data resiliency.

In an era where ransomware and malicious attacks are relentless, even the most secure organizations are not immune. These attacks can cripple organizations financially, operationally, and damage their reputation and compliance standing. My guest today is Todd Thorsen, CISO from CrashPlan. In this sponsored Industry Voices segment, we delve into crucial strategies for bolstering data resiliency.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/232

Selected Reading

Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack (Ars Technica)

CISA, NSA, FBI and International Cybersecurity Authorities Publish Guide on The Case for Memory Safe Roadmaps (CISA)

The Case for Memory Safe Roadmaps (Joint release)

HEALTHCARE SECTOR CYBERSECURITY (US Department of Health and Human Services)

HHS releases cybersecurity strategy for health care sector (American Hospital Association)

Fake Taylor Swift Quotes Are Being Used to Spread Anti-Ukraine Propaganda (WIRED)

Obfuscation and AI Content in the Russian Influence Network “Doppelgänger” Signals Evolving Tactics (Recorded Future)

Britain summons Russian ambassador over years-long FSB cyberespionage campaign (Reuters)

NCSC exposes Russian cyber attacks on UK political processes (ComputerWeekly)

Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns (NCSC)

Defending Democracy (NCSC)

The State of Supply Chain Defense: Annual Global Insights Report (BlueVoyant)

2023 Holiday Bad Bot Report (Kasada)

Facebook and Messenger to automatically encrypt messages (BBC)

Your mobile password manager might be exposing your credentials (TechCrunch)

Dieselgate, but for trains – some heavyweight hardware hacking (BadCyber)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Our TOPPODCAST Picks

Follow Us

Stay Connected

CyberWire Guest

Selected Reading

Want to hear your company in the show?

CyberWire Guest

Selected Reading

Threat Vector.

Want to hear your company in the show?

CyberWire Guest

Selected Reading

Want to hear your company in the show?

CyberWire Guest

Selected Reading

Want to hear your company in the show?

CyberWire Guest

Selected Reading

Share your feedback.

Want to hear your company in the show?

Selected Reading

Audience Survey

Want to hear your company in the show?

Want to join us for an interview?

CyberWire Guest

Selected Reading

Share your feedback.

Want to hear your company in the show?

CyberWire Guest

Selected Reading

Want to hear your company in the show?

Related Podcasts

Links

Stay Connected