CyberWire Daily

View Top 200 Chart

Back to Rankings Page

News
**CyberWire Daily**

The daily cybersecurity news and analysis industry leaders depend on. Published each weekday, the program also includes interviews with a wide spectrum of experts from industry, academia, and research organizations all over the world.

Latest Episodes:

The Malware Mash! [Bonus] Oct 30, 2023

Show notes

Enjoy this CyberWire classic.

They did the Mash...they did the Malware Mash...

Learn more about your ad choices. Visit megaphone.fm/adchoices

Nicole Sundin: Women helping women. [Chief Product Officer] [Career Notes] Oct 29, 2023

Show notes

Nicole Sundin, a Chief Product Officer from Axio sits down to discuss her career path and what it is like to be a woman in the cybersecurity field. As a UX leader, Nicole has devoted her entire career to building awareness around the benefits of usable security and human-centered security to the broader cybersecurity community. She also shares some of her background as she moved her way up the later to get to where she is today. As a female in a male-dominated industry, Nicole shares her unique insights on embracing the responsibility of serving as a role model to women aspiring to contribute to the cybersecurity field, and the importance of building a diverse team. She says "Really, it's about building community in your organization and outside your organization of strong women or strong friends that you have that you can lean on when you know you're the only person in the room." We thank Nicole for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

No rest for the wicked HiatusRAT. [Research Saturday] Oct 28, 2023

Show notes

Danny Adamitis from Lumen's Black Lotus Labs sits down to discuss their work on "No Rest For The Wicked: HiatusRAT Takes Little Time Off In A Return To Action." Last March Lumen's Black Lotus Lab researchers discovered a novel malware called HiatusRAT that targeted business-grade routers.

The research states "In the latest campaign, we observed a shift in reconnaissance and targeting activity; in June we observed reconnaissance against a U.S. military procurement system, and targeting of Taiwan-based organizations." This shift in information gathering and targeting preference exhibited in the latest campaign is synonymous with the strategic interest of the People’s Republic of China according to the 2023 ODNI threat assessment.

The research can be found here:

No Rest For The Wicked: HiatusRAT Takes Little Time Off In A Return To Action

Learn more about your ad choices. Visit megaphone.fm/adchoices

Social engineering as a blunt instrument–almost like swatting without the middleman. Oct 27, 2023

Show notes

Eastern European gangs overcome their reservations about working with anglophone criminals. Mirth Connect is vulnerable to a critical flaw. A look at a mercenary spyware strain. “PepsiCo” as phishbait. Ben Yelin explains the FCC’s renewed interest in Net Neutrality. Our guest is Wade Baker from the Cyentia Institute with insights on measuring risk. And Europol thinks police should take a good look at quantum computing and law enforcement.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/206

Selected reading.

Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction (Microsoft Security)

MGM Resorts hackers 'one of the most dangerous financial criminal groups’ (Record)

Critical Mirth Connect Vulnerability Could Expose Sensitive Healthcare Data (SecurityWeek)

Examining Predator Mercenary Spyware (HYAS)

Fresh Phish: The Case of the PepsiCo Procurement Ploy (INKY)

U.S. Tries New Tack on Russian Disinformation: Pre-Empting It (New York Times)

ESET APT Activity Report Q2–Q3 2023 (We Live Security)

Russian hackers claim takedown of WA’s Transperth transport agency with DDoS attack (Cyber Daily)

The Second Quantum Revolution: The impact of quantum computing and quantum technologies on law enforcement (Europol Innovation Lab)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Some intelligence services understand the value of being underestimated. Oct 26, 2023

Show notes

StripedFly gets reclassified. YoroTrooper is interested in the Commonwealth of Independent States. The current state of DDoS attacks. Ukrainian hacktivists deface Russian artists' Spotify pages. Trolls amplify a Musky meme. In our Industry Voices segment, Matt Howard from Virtru explains securing data at the employee edge. Our guest is Seth Blank from Valimail, to discuss email security and DMARC. And while trolls might like Mr.Musk, the crooks heart Mr. Gosling.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/205

Selected reading.

Sophisticated StripedFly Spy Platform Masqueraded for Years as Crypto Miner (Zeroday)

Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan (Cisco Talos Blog)

DDoS threat report for 2023 Q3 (The Cloudflare Blog)

Russian artists’ Spotify accounts defaced by pro-Ukraine hackers (Record)

Elon Musk Mocked Ukraine, and Russian Trolls Went Wild (WIRED)

Ryan Gosling Tops McAfee’s 2023 Hacker Celebrity Hot List (Business Wire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

AI ain’t misbehavin’, except when it does. Also, privateers and hacktivist auxiliaries get busy. Oct 25, 2023

Show notes

Teaching AI to misbehave. Ransomware's effect on healthcare downtime. Two reports on the state of cybersecurity in the financial services sector. Possible connections between Hamas and Quds Force. Ukrainian cyber authorities report a rise in privateering Smokeloader attacks. Russian hacktivist auxiliaries strike Czech targets. My conversation with Sherrod DeGrippo, host of The Microsoft Threat Intelligence Podcast. Jay Bhalodia from Microsoft Federal shares insights on multi-cloud security. And Winter Vivern exploits a mail service 0-day.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/204

Selected reading.

AI vs. human deceit: Unravelling the new age of phishing tactics (Security Intelligence)

Ransomware attacks on US healthcare organizations cost $20.8bn in 2020 (Comparitech)

Cyberattack at 5 southwestern Ontario hospitals leaves patients awaiting care (CBC News)

State of Security for Financial Services (Swimlane)

Veracode Reveals Automation and Training Are Key Drivers of Software Security for Financial Services (Business Wire)

Hamas’ online infrastructure reveals ties to Iran APT, researchers say (CSO Online)

Hamas Application Infrastructure Reveals Possible Overlap With TAG-63 and Iranian Threat Activity | Recorded Future (Recorded Future)

Ukraine cyber officials warn of a ‘surge’ in Smokeloader attacks on financial, government entities (Record)

Bloomberg: Russia steps up cyberattacks to disrupt Ukraine’s key services (Euromaidan)

Pro-Russia group behind today’s mass cyberattack against Czech institutions (Expats.cz)

Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers (We Live Security)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Two new things to worry about: how long it takes to read the fine print, and bed bug disinformation. Oct 24, 2023

Show notes

DDoS activity during the Hamas-Israeli war. Insurance firm reports cyber incident. Recent arrests in cybercrime sweeps. Ukrainian hacktivist auxiliaries compromise customer data at Russia's Alfa Bank. How long does it take to read the fine print? Ann Johnson from Afternoon Cyber Tea talks with Noopur Davis from Comcast about building secure tech from the start. Antonio Sanchez of Fortra shares cybersecurity challenges for enterprises including why having too many tools creates too much complexity. And hey, Marianne–don’t let the bedbugs bite.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/203

Selected reading.

Cyber attacks in the Israel-Hamas war (The Cloudflare Blog)

China's crackdown on cyber scams in Southeast Asia ensnares thousands but leaves the networks intact (AP News)

12 people arrested for bank malware scam, youngest being just 17 (The Independent Singapore News)

Spain arrests 34 cybercriminals who stole data of 4 million people (BleepingComputer)

Police Disrupt Ragnar Locker Ransomware Group (Infosecurity Magazine)

Ragnar Locker Ransomware Boss Arrested in Paris (Dark Reading)

E-Root marketplace credential-selling admin extradited to US (Register)

Ukraine security services involved in hack of Russia’s largest private bank (Record)

NordVPN study: Privacy policy awareness (NordVPN)

Russia spread bedbug panic in France, intelligence services suspect (The Telegraph)

Learn more about your ad choices. Visit megaphone.fm/adchoices

How people get over on the content moderators. Oct 23, 2023

Show notes

Okta discloses a data exposure incident. Cisco works to fix a zero-day. DPRK threat actors pose as IT workers. The Five Eyes warn of AI-enabled Chinese espionage. Job posting as phishbait. The risk of first-party fraud. Hacktivists trouble humanitarian organizations with nuisance attacks. Content moderation during wartime. Malek Ben Salem of Accenture describes code models. Our guest is Joe Oregon from CISA, discussing the tabletop exercise that CISA, the NFL, and local partners conducted in preparation for the next Super BowI. And the International Criminal Court confirms that it’s sustained a cyberespionage incident.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/202

Selected reading.

Okta says hackers used stolen credentials to view customer files (Record)

Cisco discloses new IOS XE zero-day exploited to deploy malware implant (BleepingComputer)

Additional Guidance on the Democratic People's Republic of Korea Information Technology Workers (IC3)

A stern glance from all Five Eyes. (CyberWire)

DarkGate malware campaign (WithSecure)

The Fraud Next Door: First-Party Fraud Runs Rampant in America (PR Newswire)

Cyberattacks Intensify on Israeli and Palestinian Human Rights Groups (Wall Street Journal)

Israel's burial society website comes under cyberattack (Jerusalem Post)

Sheba Medical Center Hit by Cyber Attack (Jewish Press)

Health Ministry disconnects the remote connection of several hospitals following cyber attack (Jerusalem Post)

EU asks Meta, TikTok to account for their response to Israel-Hamas disinformation (Record)

Pro-Palestinian creators use secret spellings, code words to evade social media algorithms (Washington Post)

Web Summit CEO resigns after comments on Israel-Hamas conflict (Reuters)

YouTube is Autogenerating Videos for Songs Advocating the Expulsion of Muslims from India (bellingcat)

Palestinians Claim Social Media 'Censorship' Is Endangering Lives (WIRED)

International Criminal Court says cyberattack was attempted espionage (TechCrunch)

War crimes tribunal says September cyberattack was act of espionage (Record)

International Criminal Court investigating “unprecedented” cyberattack (Cybernews)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jennifer Reed: Balance the gender scales. [Principal] [Career Notes] Oct 22, 2023

Show notes

This week, we welcome Jennifer Reed, a Principal Solutions Architect at Amazon Web Services (AWS) to sit down and share her amazing story. After Jennifer graduated high school, she immediately went into Marine Corps training, which she shared was a shock to her because she was the only woman when she got out into the fleet and every single place that she went. She eventually moved on from the military after learning some programming tools, and went into the financial services industry doing systems engineering. She got called back to active duty, and then afterwards landed at AWS. She shares that being a woman in this industry can be challenging at time, but she says "I do feel, um, good about the things I've overcome, but I also don't want it to be so hard for the next person, if that makes sense. I don't want them to have to have those same struggles to kind of overcome any perceptions that someone might have due to their their gender or their background." We thank Jennifer for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

AMBERSQUID hides in the depths. [Research Saturday] Oct 21, 2023

Show notes

Sysdig's Alessandro Brucato and Michael Clark join Dave to discuss their work on "AWS's Hidden Threat: AMBERSQUID Cloud-Native Cryptojacking Operation." Attackers are targeting what are typically considered secure AWS services, like AWS Fargate and Amazon SageMaker. This means that defenders generally aren’t as concerned with their security from end-to-end.

The research states "The AMBERSQUID operation was able to exploit cloud services without triggering the AWS requirement for approval of more resources, as would be the case if they only spammed EC2 instances." This poses additional challenges targeting multiple services since it requires finding and killing all miners in each exploited service.

The research can be found here: