CyberWire Daily

Latest Episodes:

Cybercriminals at the service of the state, and an array of new underworld tools. Nov 07, 2023

Show notes

Data brokers offer information on active US military personnel. Current BlueNoroff activity. A new Gootloader variant is active in the wild. Atlassian vulnerabilities actively exploited. The prevalence of breaches. Update on a Barracuda vulnerability. Hacktivism and the cyber course of the Hamas-Israel war. Bot-hunting in Ukraine. Microsoft’s Ann Johnson from Afternoon Cyber Tea speaks with Sharon Barber, Chief Information Officer at Lloyds Banking Group, about cyber trends in financial services. Ben Yelin looks at the ease of purchasing US military personnel data from data brokers And election security is in the news–an off-year election is an election nonetheless.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/213

Selected reading.

Researchers find sensitive personal data of US military personnel is for sale online (CNN)

How foreigners can buy data on US military members, for the right price (POLITICO)

GootBot - Gootloader's new approach to post-exploitation (Security Intelligence)

BlueNoroff strikes again with new macOS malware (Jamf)

GootBot - Gootloader's new approach to post-exploitation (Security Intelligence)

Rapid7-Observed Exploitation of Atlassian Confluence CVE-2023-22518 (Rapid7)

Armis Research Finds One-Third of Global Organizations Experienced Multiple Security Breaches in Last 12 Months (Armis)

Technical analysis: Barracuda Email Security Gateway by Quentin Olagne (Vectra)

Maccabi Tel Aviv basketball team website comes under cyber attack (The Jerusalem Post)

The Digital Frontline of the Israel-Hamas Conflict Could Extend Long After the War (Inkstick)

Five attack vectors that businesses should focus on in the wake of the Israel-Hamas war (SC Media)

Israel’s cyber defense chief tells CNN he is concerned Iran could increase severity of its cyberattacks (CNN)

SBU blocks 76 bot farms with 3 mln fake accounts since start of full-scale war (Interfax-Ukraine)

On Election Day, CISA and Partners Coordinate on Security Operations (Cybersecurity and Infrastructure Security Agency)

Cerby Releases “Threat Briefing: Social Media Security and Elections Volume II,” Providing a Detailed Analysis of Security Gaps in Social Media Platforms (Cerby)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Precautions, preparations, and resilience against cybercrime and hacktivism. Nov 06, 2023

Show notes

A precautionary shutdown at a major US mortgage lender. Call centers as targets. A push to decouple data and identity. The cyber front in the Hamas-Israeli war. Hacktivism and state-sponsored cyberattacks against Israel. The instructive case of TASS and managing influence operations. Deepen Desai from Zscaler talking about the TOITOIN Trojan. Our guest is Joe Nocera, of PwC sharing their latest Global Digital Trust Insights survey and the impact of the SEC's new cybersecurity disclosure rules. And cybercrime on the side of Ukraine (or at least, cybercrime against Russia).

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/212

Selected reading.

Mortgage Giant Mr. Cooper Shuts Down Systems Following Cyberattack (SecurityWeek)

TransUnion Report Shows Fraud Attacks on Financial Industry Call Centers Rising (Transunion)

A Bold New Plan to Make Cloud Computing More Secure (IEEE Spectrum)

The Cyberwarfare Front of the Israel-Gaza War (The National Interest)

Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors (Unit 42)

GhostSec offers Ransomware-as-a-Service Possibly Used to Target Israel (Uptycs)

Kremlin Sacks TASS Chief for Wagner Mutiny Coverage (The Moscow Times)

Russia's 2nd-Largest Insurer Rosgosstrakh Hacked; 400GB of Data Sold Online (Hackread - Latest Cybersecurity News, Press Releases & Technology Today)

Learn more about your ad choices. Visit megaphone.fm/adchoices

CyberCon 2023: A unique mix of critical infrastructure and cybersecurity. [Special Edition] Nov 05, 2023

Show notes

As we progress in this technological age, both cybersecurity and critical infrastructure continue to be at the forefront of prevention, protection, mitigation, and recovery conversation topics. From a frontline worker to the top of the C-Suite, security is something we all should be aware of and concerned about. The CyberCon event began in 2018 and provides an opportunity to learn more about cybersecurity and critical infrastructure as well as collaborate with fellow security professionals.

Dave Bittner recently spoke at CyberCon 2023 at Bismarck State College in North Dakota. While there, he had the opportunity to interview 4 members of the conference planning committee (all past or current chairs of the event) for a better understanding of the event, its focus on a mix of critical infrastructure and cybersecurity, and how the event has evolved over the years.

Dave speaks with:

Troy Walker, Director of Sales and Marketing at Dakota Carrier Network & 2023 conference chair, sharing the history of CyberCon its unique focus on critical infrastructure and cybersecurity.
Tony Aukland, Technology Outreach Manager for the State of North Dakota IT & previous conference chair, giving us the truth about CyberCon and its origin story.
Bill Heinzen, Information Security Team Lead at National Information Solutions Cooperative and previous event chair, talking about developing the cybersecurity candidate pool in North Dakota.
John Nagel, CEO and Founder of CYBERNET SECURITY and past event chair, discussing sustainability of the CyberCon and its critical infrastructure focus.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jeffrey Wheatman: Sometimes you just need to open the raincoat. [Career Notes] Nov 05, 2023

Show notes

Jeffrey Wheatman, Cyber Risk Evangelist, from Black Kite joins to share his amazing story. As a strategic thought leader with extensive expertise in cybersecurity, Jeffrey Wheatman is regarded foremost as an expert in guiding public sector clients and Fortune 500 companies in connection with their cyber risk management programs. In his current role as Cyber Risk Evangelist at Black Kite, Jeffrey works to get the message out about the business impact of third-party risk and solutions to treat those risks. Jeffrey shared his career, along with is passion for cyber by explaining some of the roles he did moving up into his role today. He says as a leader we all need to be aware of the fact that "We make mistakes and I I'm a, I'm a big believer in sharing those mistakes and I think it's important to open the raincoat as it were, and let people understand that we're not perfect, we all need help and then that way they feel comfortable coming to you and asking for help" We thank Jeffrey for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Sandman doesn't slow malware down. [Research Saturday] Nov 04, 2023

Show notes

Aleksandar Milenkoski and JAGS from SentinelOne sits down to share their work on "Sandman APT | A Mystery Group Targeting Telcos with a LuaJIT Toolkit." After observing a new threat activity cluster by an unknown threat actor in August of this year, SentinelLabs dubbed it Sandman.

The research states "Sandman has been primarily targeting telecommunication providers in the Middle East, Western Europe, and the South Asian subcontinent." Sandman has deployed a novel modular backdoor utilizing the LuaJIT platform, they call this malware "LuaDream," which exfiltrates system and user information, paving the way for further precision attacks.

The research can be found here:

Sandman APT | A Mystery Group Targeting Telcos with a LuaJIT Toolkit

Learn more about your ad choices. Visit megaphone.fm/adchoices

In the offense-defense see-saw, the defense seems to be rising. Nov 03, 2023

Show notes

An Apache vulnerability is being used to install ransomware. Exploitation of Citrix vulnerability in the wild. AP sustains DDoS attack. HHS reaches settlement in HIPAA data breach incident. More evidence of OSINT's reach. On the Solution Spotlight: Simone Petrella and Rick Howard speak with Ben Rothke about his article and thoughts on "Is there really an information security jobs crisis?" Andrea Little Limbago from Interos joins us to discuss SEC and the disclosure rules. And, Microsoft draws a lesson from Russia's war: cyber defense now has the advantage over cyber offense.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/211

Selected reading.

Critical Apache ActiveMQ Vulnerability Exploited to Deliver Ransomware (SecurityWeek)

HelloKitty ransomware now exploiting Apache ActiveMQ flaw in attacks (BleepingComputer)

Critical Vulnerability: Exploitation of Apache ActiveMQ CVE-2023-46604 (Huntress)

Suspected Exploitation of Apache ActiveMQ CVE-2023-46604 (Rapid7)

HHS’ Office for Civil Rights Settles Ransomware Cyber-Attack Investigation (U.S. Department of Health and Human Services)

AP news site hit by apparent denial-of-service attack (AP News)

Associated Press hit by Anonymous Sudan DDoS attack? (Tech Monitor)

Satellites and social media offer hints about Israel's ground war strategy in Gaza (NPR)

Revisiting the Gaza Hospital Explosion (New York Times)

Microsoft Vows to Revamp Security Products After Repeated Hacks (Bloomberg)

A new world of security: Microsoft’s Secure Future Initiative (Microsoft On the Issues)

Announcing Microsoft Secure Future Initiative to advance security engineering (Microsoft Security)

Ukraine at D+617: Advantage defense. (CyberWire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

The beginning of an international consensus on AI governance may be emerging from Bletchley Park. Nov 02, 2023

Show notes

Bletchley Declaration represents a consensus starting point for AI governance. Lazarus Group prospects blockchain engineers with KANDYKORN. Boeing investigates ‘cyber incident’ affecting parts business. NodeStealer’s use in attacks against Facebook accounts. Citrix Bleed vulnerability exploited in the wild. MuddyWater spearphishes Israeli targets in the interest of Hamas. India to investigate alleged attacks on iPhones. Tim Starks from the Washington Post on the SEC’s case against Solar Winds. In today’s Threat Vector segment David Moulton from Unit 42 is joined by Matt Kraning of the Cortex Expanse Team for a look at Attack Surface Management. And Venomous Bear rolls out some new tools.

On the Threat Vector segment, David Moulton, Director of Thought Leadership for Unit 42, is joined by Matt Kraning, CTO of the Cortex Expanse Team. They dive into the latest Attack Surface Management Report.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/210

Threat Vector

Read the Attack Surface Management Report.

Please share your thoughts with us for future Threat Vector segments by taking our brief survey.

To learn what is top of mind each month from the experts at Unit 42 sign up for their Threat Intel Bulletin.

Selected reading.

The Bletchley Declaration by Countries Attending the AI Safety Summit, 1-2 November 2023 (GOV.UK)

US Vice President Harris calls for action on "full spectrum" of AI risks (Reuters)

Elastic catches DPRK passing out KANDYKORN (Elastic Security Labs)

North Korean Hackers Targeting Crypto Experts with KANDYKORN macOS Malware (The Hacker News)

Lazarus used ‘Kandykorn’ malware in attempt to compromise exchange — Elastic (Cointelegraph)

An info-stealer campaign is now targeting Facebook users with revealing photos (Record)

Mass Exploitation of 'Citrix Bleed' Vulnerability Underway (SecurityWeek)

MuddyWater eN-Able spear-phishing with new TTPs | Deep Instinct Blog (Deep Instinct)

Centre's Cyber Watchdog CERT-In To Probe iPhone "Hacking" Attempt Charges (NDTV.com)

Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla) (Unit 42)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hacktivism in two hybrid wars (with an excursus on gastropods). Nov 01, 2023

Show notes

The Hamas-Israel war continues to be marked by hacktivism. Arid Viper's exploitation of Arabic speaker's Android devices. Iran shows improved cyberespionage capabilities. A URL shortener in the C2C market. Taking down the Mozi botnet. Ransomware in healthcare. Two are Russians arrested on treason charges, accused of hacking for Ukraine. In our sponsored Industry Voices segment, Anna Belak from Sysdig shares a new threat framework for the cloud. Rick Howard previews his new online course on cyber security first principles. And no, Russia hasn’t really replaced its currency with Arctic Ocean gastropods.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/209

Selected reading.

‘Hacktivists’ join the front lines in Israel-Hamas war (C4ISRNet)

The global cyber divide between Gaza and Israel - IT-Online (IT-Online)

Arid Viper disguising mobile spyware as updates for non-malicious Android applications (Cisco Talos Blog)

In Cyberattacks, Iran Shows Signs of Improved Hacking Capabilities (New York Times)

FBI ‘keeping a close eye’ on Iranian hackers as Israel-Hamas war intensifies (Record)

Why Iran Is Gambling on Hamas (Foreign Affairs)

To Aid and Abet: Prolific Puma Helps Cybercriminals Evade Detection (Infoblox Blog)

Who killed Mozi? Finally putting the IoT zombie botnet in its grave (ESET)

The State of Ransomware in Healthcare 2023 (Sophos)

Russian security service detains two hackers allegedly working for Ukraine (Record)

Pro-Ukraine group says it breached Russian card payment system (Record)

Learn more about your ad choices. Visit megaphone.fm/adchoices

What would it take to get you kids into a nice, late-model malware mealkit? Oct 31, 2023

Show notes

Malicious packages are found attached to NuGet. Russia will establish its own substitute for VirusTotal. Commodity tools empower low-grade Russian cybercriminals. Malware mealkits, and other notes from the cyber underground. Insights from a Cybersecurity workforce study. Mr Security Answer Person John Pescatore looks at MFA. Drew Rose from Living Security on the very scary human side of cyber attacks. And more details from President Biden’s Executive Order on artificial intelligence.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/208

Selected reading.

IAmReboot: Malicious NuGet packages exploit loophole in MSBuild integrations (ReversingLabs)

Russia to launch its own version of VirusTotal due to US snooping fears (Record).

Russian hacking tool floods social networks with bots, researchers say (Record)

How Kopeechka, an Automated Social Media Accounts Creation Service, Can Facilitate Cybercrime (Trend Micro)

HP Wolf Security Threat Insights Report Q3 2023 (HP Wolf Security)

How the Economy, Skills Gap and Artificial Intelligence are Challenging the Global Cybersecurity Workforce (ISC2)

Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (The White House)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Bringing AI up right–realizing its potential without its becoming a threat. (And how deepfakes might be an informational fleet-in-being.) Oct 30, 2023

Show notes

The Hive ransomware gang may be back, and rebranded. Coinminers exploit AWS IAM credentials. LockBit claims to have obtained sensitive information from Boeing. Ukrainian auxiliaries disrupt Internet service in Russian-occupied territory, while internet and telecoms are down in Gaza. Deepfakes have an effect even when they're not used. Joe Carrigan explains executive impersonations on social media. Our guest is David Brumley, cybersecurity professor at Carnegie Mellon and CEO of software security firm, ForAllSecure, discussing spooky zero days and vulnerabilities. And President Biden releases a US Executive Order on artificial intelligence.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/207