CyberWire Daily

Latest Episodes:

AWS in Orbit: Securing the space frontier with AI cybersecurity solutions. [T-Minus AWS in Orbit] Nov 18, 2023

Show notes

Buffy Wajvoda is the Global Leader for Space Solutions Architecture at AWS Aerospace and Satellite. In this extended conversation, we dive into how AWS is supporting cybersecurity in the space domain. You can learn more at AWS re:Invent.

AWS in Orbit is a podcast collaboration between N2K and AWS to offer listeners an in-depth look at the transformative intersection of cloud computing, space technologies, and generative AI. You can learn more about AWS in Orbit at space.n2k.com/aws.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our weekly intelligence roundup, Signals and Space, and you’ll never miss a beat. And be sure to follow T-Minus on LinkedIn and Instagram.

Selected Reading

AWS re:Invent

The security attendee’s guide to AWS re:Invent 2023- AWS Blog

Viasat Deploys Resilient Tactical Edge Capability with AWS- YouTube

How We Sent an AWS Snowcone into Orbit- AWS Blog

How to improve your security incident response processes with Jupyter notebooks- AWS Blog

Supporting security assessors in the Canadian public sector with AWS and Deloitte- AWS Blog

Establishing hybrid connectivity within a Canadian Centre for Cyber Security Medium Cloud reference architecture- AWS Blog

Evolving cyber threats demand new security approaches – The benefits of a unified and global IT/OT SOC- AWS Blog

Audience Survey

We want to hear from you! Please complete our short survey. It’ll help us get better and deliver you the most mission-critical space intel every day.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at space@n2k.com to request more info.

Want to join us for an interview?

Please send your pitch to space-editor@n2k.com and include your name, affiliation, and topic proposal.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyber escalation in a hybrid war, and some notes on the markets, both gray and C2C. Nov 17, 2023

Show notes

Scattered Spider prompts warnings from CISA and the FBI. Phobos ransomware is an affiliate crimeware-as-a-service program. A "hack-for-hire" contractor. “Scama” in the C2C market. Our guest is Lee Clark from the RH-ISAC with a look at Holiday Season Cyber Threat Trends. Tim Eades from Cyber Mentor Fund shares recent trends in cyber venture capital, with tips on finding a good match. And the tempo of cyber operations in Russia's hybrid war.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/220

Selected reading.

FBI and CISA Release Advisory on Scattered Spider Group (Cybersecurity and Infrastructure Security Agency | CISA)

FBI warns on Scattered Spider hackers, urges victims to come forward (Reuters)

U.S. officials urge more information sharing on prolific cybercrime group (CyberScoop)

A deep dive into Phobos ransomware, recently deployed by 8Base group (Cisco Talos Blog)

Understanding the Phobos affiliate structure and activity (Cisco Talos Blog)

Elephant Hunting | Inside an Indian Hack-For-Hire Group (SentinelOne)

How an Indian startup hacked the world (Reuters)

Scama: Uncovering the Dark Marketplace for Phishing Kits (Vade Secure)

Ukraine Tracks a Record Number of Cyber Incidents During War (Bank Info Security)

Russia will target other countries for web attacks, Ukraine cyber defence chief warns (The Irish Times)

Sandworm Linked to Attack on Danish Critical Infrastructure (Infosecurity Magazine)

Why cyber war readiness is critical for democracies (Help Net Security)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Shopping during wartime? Focus, people. Nov 16, 2023

Show notes

Cyber safety for the holidays. Using regulatory risk to pressure a ransomware victim. A call for regulatory action against a supply chain threat. Rhysida malware: a warning and a description. Extending local breaches in Google Workspace. Protestware in open-source products. GRU's Sandworm implicated in campaign against Danish electrical power providers. Jason Meller, Founder & CEO of Kolide joins us as part of our sponsored Industry Voices segment to discuss the findings from The Shadow IT Report. In this Threat Vector segment, David Moulton sits down with Sama Manchanda, a consultant at Unit 42 to discuss the fascinating world of social engineering attacks. And donation scams: exploiting sympathy.

In this Threat Vector segment, David Moulton engages in an enlightening conversation with Sama Manchanda, a consultant at Unit 42. The duo embarks on an exploration of the fascinating world of social engineering attacks, delving into the distinct characteristics of phishing, smishing, and vishing.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/219

Threat Vector

Please share your thoughts with us for future Threat Vector segments by taking our brief survey.

To learn what is top of mind each month from the experts at Unit 42 sign up for their Threat Intel Bulletin.

Selected reading.

New Visa Report Tells Consumers to Stay Alert this Holiday Shopping Season (Business Wire)

Ransomware gang files SEC complaint over victim’s undisclosed breach (BleepingComputer)

11-14-2023 EFF Letter to FTC re: Malware on Android TV Set-Top Boxes (EFF)

#StopRansomware: Rhysida Ransomware (Cybersecurity and Infrastructure Security Agency | CISA)

Investigating the New Rhysida Ransomware (Fortinet Blog)

Analyzing Rhysida Ransomware Intrusion (Fortinet Blog)

The Chain Reaction: New Methods for Extending Local Breaches in Google Workspace (Bitdefender)

Protestware taps npm to call out wars in Ukraine, Gaza (ReversingLabs)

Russia's Sandworm Linked to Unprecedented Danish Energy Hack (Bloomberg).

Russian Hackers Linked to 'Largest Ever Cyber Attack' on Danish Critical Infrastructure (The Hacker News)

Denmark hit with largest cyberattack on record (Cybernews)

Attackers Exploit Crisis for Fraudulent Crypto Donations (Abnormal)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Examining the current state of security orchestration. [CyberWire-X] Nov 16, 2023

Show notes

In this episode of CyberWire-X, N2K’s CSO, Chief Analyst, and Senior Fellow, Rick Howard, is joined by guest Rohit Dhamankar, Fortra's Vice President of Product Strategy, and Hash Table member Steve Winterfeld, Akamai's Advisory CISO to discuss CISO initiatives such as vendor consolidation, automation, and attack surface management as a way to determine if it’s possible to achieve both increased security maturity and decreased operational load. This session covers common mistakes when adopting security technologies, including the pros and cons of AI, and how to better collaborate together.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A quick Patch Tuesday retrospective, and then a look at what the threat groups are up to. Nov 15, 2023

Show notes

A look back at Patch Tuesday. BlackCat uses malicious Google ads. Social engineering in the third quarter of 2023. Are small businesses in denial about ransomware? Molerats have some new tools. Israel turns to NSO Group's Pegasus to search for hostages taken by Hamas. Tim Starks from the Washington Post examines the potential aftermath of a Russian group hitting a Chinese bank. In our Learning Layer, Sam Meisenberg helps a student understand and create a strategy for the CISSP CAT. And a cyberespionage campaign is attributed to Russia's SVR.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/218

Selected reading.

Adobe Releases Security Updates for Multiple Products | CISA (Cybersecurity and Infrastructure Security Agency CISA)

Fortinet Releases Security Updates for FortiClient and FortiGate (Cybersecurity and Infrastructure Security Agency | CISA)

VMware Releases Security Update for Cloud Director Appliance (Cybersecurity and Infrastructure Security Agency | CISA)

CISA Releases Two Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency | CISA)

Microsoft Releases October 2023 Security Updates (Cybersecurity and Infrastructure Security Agency | CISA)

Microsoft November 2023 Patch Tuesday fixes 5 zero-days, 58 flaws (BleepingComputer)

SAP Security Patch Day for November 2023 (Onapsis)

The ALPHV/BlackCat Ransomware Gang is Using Google Ads to Conduct… (eSentire)

Q3 2023 Threat Landscape Report: Social Engineering Takes Center Stage (Kroll)

OpenText Cybersecurity 2023 Global Ransomware Survey: The risk perception gap (OpenText Blogs)

TA402 Uses Complex IronWind Infection Chains to Target Middle East-Based Government Entities (Proofpoint)

Israel's NSO unleashes controversial spyware in Gaza conflict (Axios)

APT29 Attacks Embassies Using CVE-2023-38831 (NCSCC)

Cyber-espionage operation on embassies linked to Russia’s Cozy Bear hackers (Record)

Learn more about your ad choices. Visit megaphone.fm/adchoices

The cyber underworld is getting a bit faster and a lot looser, and the gangs may be drawing some unwelcome attention. Nov 14, 2023

Show notes

CISA and the FBI issue an update on Royal Ransomware. A look at Smash-and-grab ransomware attacks as well as Cloud vulnerabilities. A pre-Black Friday look at card skimmers. Fences, and their place in organized cybercrime. DP World Australia restores port operations. Joe Carrigan on scammers taking advantage of the Bitrex crypto market being shut down. In our Industry Voices segment, Usama Houlila from CrossRealms International shares his insights on the pivotal role of AI in cybersecurity. And LockBit may be drawing unwelcome attention to itself.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/217

Selected reading.

#StopRansomware: Royal Ransomware (Cybersecurity and Infrastructure Security Agency | CISA)

FBI: Royal ransomware asked 350 victims to pay $275 million (BleepingComputer)

The Song Remains the Same: The 2023 Active Adversary Report for Security Practitioners (Sophos)

Why 93% of Security Leaders Say Cloud Security Requires Zero Trust Segmentation (Illumio Cybersecurity Blog)

Malwarebytes Labs Reveals 50% Uptick in Credit Card Skimming in Advance of the Holiday Shopping Season (PR Newswire)

Credit card skimming on the rise for the holiday shopping season (Malwarebytes)

The Fencers: The Lynchpin of Organized Retail Crime Enterprise (Nisos)

DP World cyberattack blocks thousands of containers in ports (BleepingComputer)

Operations at Major Australian Ports Significantly Disrupted by Cyberattack (SecurityWeek)

Australian Ports Recover From Cyber Incident (Bank Info Security)

DP World: Australia sites back online after cyber-attack (BBC News)

Australian ports resume some operations after major cyberattack (CNN)

Australia Cyberattack Leaves 30,000 Containers Stuck at Ports (Bloomberg)

Hacking Gang Behind Attack on Largest Global Lender Says It Got Ransom Payment (Bloomberg)

Gang says ICBC paid ransom over hack that disrupted US Treasury market (Reuters)

After a surprise cyberattack, the world's largest bank had to shuffle a USB stick around Manhattan to do business (PC Gamer)

WSJ News Exclusive | ICBC Hackers Used Methods Previously Flagged by U.S. Authorities (Wall Street Journal)

Inside Wall Street's scramble after ICBC hack (Reuters)

Did a ransomware gang mess up by attacking a U.S. arm of China’s biggest bank? (Washington Post)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ransomware and DDoS hit diverse sectors. The DDoS is a nuisance, the ransomware more serious. Nov 13, 2023

Show notes

Australian ports are recovering from a cyberattack. SysAid is hit by Cl0p user Lace Tempest. Ransomware targets China's largest bank. LockBit doxes Boeing as Boeing hangs tough on paying ransom. Docker Engine for DDoS. Rick Howard looks at the SEC’s targeting of SolarWinds’ CISO. And Anonymous Sudan claims attacks on ChatGPT and Cloudflare.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/216

Selected reading.

Freight giant DP World recovers from cyber attack, but warns investigation and remediation is 'ongoing' (ABC)

DP World port operations in Australia recovering after cyber-attack (The Loadstar)

Ransomware attack against China's largest bank. (CyberWire)

China's biggest lender ICBC hit by ransomware attack (Reuters)

Ransomware attack on ICBC disrupts trades in US Treasury market (Financial Times)

Hackers Hit Wall Street Arm of Chinese Banking Giant ICBC (Wall Street Journal)

LockBit finally publishes its proof-of-hack as Boeing hangs tough. (CyberWire)

SysAid On-Prem Software CVE-2023-47246 Vulnerability (SysAid)

Critical Vulnerability: SysAid CVE-2023-47246 (Huntress)

SysAid Zero-Day Vulnerability Exploited By Lace Tempest (Rapid7)

SysAid vulnerability exploited. (CyberWire)

OracleIV - A Dockerised DDoS Botnet (Cado Security)

Anonymous Sudan and OpenAI. (CyberWire)

Russia-Linked Hackers Claim Credit for OpenAI Outage This Week (Bloomberg)

Major ChatGPT Outage Caused by DDoS Attack (SecurityWeek)

Anonymous Sudan and Skynet claim Cloudflare DDoS takedown (Cyber Daily)

Cloudflare website downed by DDoS attack claimed by Anonymous Sudan (BleepingComputer)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Grace Cassy: Actions speak louder than words. [Associate Fellow] [Career Notes] Nov 12, 2023

Show notes

Grace Cassy, and Associate Fellow from Ten Eleven Ventures sits down to share her career path, getting her to where she is now. Grace spent 10 years in the UK Diplomatic Service, working on global security policy in Asia, Europe, and the Americas. Earlier in her career she was an advisor to Prime Minister Tony Blair, specializing in Asia and national security. She also co-founded Epsilon Advisory Partners, a strategy and growth firm working with world-leading global technology companies and investors. Now she is a Co-founder at CyLon and is an Early Stage Investor in cybersecurity companies. She says "I think we probably don't need too many more words, but we definitely need a bit more action." We thank Grace for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Shields Ready for attacks against critical infrastructure. These may be indiscriminate, and they may be opportunistic. Nov 09, 2023

Show notes

CISA, FEMA, and Shields Ready. Ransomware operators exploit 3rd-party tools. A Bittrex bankruptcy phishing campaign. Spammers abuse Google Forms quizzes. Imperial Kitten in action against Israeli targets. Iranian cyberattacks against Israel are called "reactive and opportunistic." In our sponsored Industry Voices segment, Adam Bateman from Push Security outlines how attackers are targeting cloud identities. Luke Vander Linden from RH-ISAC speaks with Target's Ryan Miller and Leah Schwartzman about the evolving fraud landscape retailers are facing with the holidays approaching. And Sandworm and Ukraine's power grid: 2022 attacks may foreshadow the winter of 2023 and 2024.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/215

Selected reading.

Shields Ready | CISA (Cybersecurity and Infrastructure Security Agency CISA)

DHS Unveils New Shields Ready Campaign to Promote Critical Infrastructure Security and Resilience (FEMA)

US Urges Critical Infrastructure Firms to Get “Shields Ready” (Infosecurity Magazine)

US launches “Shields Ready” campaign to secure critical infrastructure (CSO Online)

DHS Launches New Critical Infrastructure Security and Resilience Campaign (SecurityWeek)

Ransomware Actors Continue to Gain Access through Third Parties and Legitimate System Tools (FBI)

Phishing Attack Driven by Bittrex Bankruptcy (Abnormal)

Spammers abuse Google Forms’ quiz to deliver scams (Cisco Talos Blog)

IMPERIAL KITTEN Deploys Novel Malware Families in Middle East-Focused Operations (CrowdStrike)

Microsoft shares threat intelligence at CYBERWARCON 2023 (Microsoft Security)

Iran and Hamas showed no signs of cyber coordination in run-up to war, researchers say (Washington Post)

Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology (Mandiant)

Russian spies behind cyber attack on Ukraine power grid in 2022 - researchers (Reuters)

Hackers Linked To Russian Intelligence Blamed For 2022 Ukraine Grid Disruption (RadioFreeEurope/RadioLiberty)

Ukraine updates: Russia hacked Kyiv's power grid — report – DW – 11/09/2023 (Deutsche Welle)

Russian Hackers Used OT Attack to Disrupt Power in Ukraine Amid Mass Missile Strikes (SecurityWeek)

Energy security at forefront of NATO-Ukraine Council meeting (NATO)

Learn more about your ad choices. Visit megaphone.fm/adchoices

No major threats showed up in yesterday’s US elections, so now we can start thinking about the risk during the holidays. Nov 08, 2023

Show notes

CISA claims "No credible threats" to yesterday's US elections. Criminals seek to profit from the .ai top level domain. A Singapore resort sustains a cyberattack. A look ahead at holiday cyber threats. A major Chinese cyberespionage effort against Cambodia. The four cyber phases of a hybrid war. Robert M. Lee from Dragos explains how outside forces affect OT and critical infrastructure security. Our guest is Dan Neault of Imperva sharing how organizations are behind the eight-ball when relying upon real-time analytics. Cyber and electronic threats to space systems.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/214