CyberWire Daily

Latest Episodes:

The cyber phases of two wars show signs of intersecting. Developments in cyberespionage and cybercrime. Oct 10, 2023

Show notes

Disinformation and Hacktivism in the war between Hamas and Israel. KillNet and the IT Army of Ukraine say they'll follow ICRC guidelines. The current state of DPRK cyber operations. The Grayling cyberespionage group is active against Taiwan. A Magecart campaign abuses 404 pages. 23andMe suffers abreach. Voter records in Washington, DC, have been compromised. In our Solution Spotlight, Simone Petrella speaks with Raytheon’s Jon Check about supporting and shaping the next generation of the cyber workforce. Grady Summers from SailPoint outlines the importance of organizations managing and protecting access to critical data. And a look at CISOs willingness to pay ransom.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/193

Selected reading.

The Israel-Hamas War Is Drowning X in Disinformation (WIRED)

As false war information spreads on X, Musk promotes unvetted accounts (Washington Post)

Elon Musk’s X Cut Disinformation-Fighting Tool Ahead of Israel-Hamas Conflict (The Information)

US opinion divided amid battle for narrative over Hamas attack on Israel (the Guardian) Zelensky Compares Assault by Hamas on Israel to Moscow’s Invasion of Ukraine (New York Times)

Russia cites ‘concern’ but does not condemn Hamas attack on Israel (Washington Post)

The Israel–Hamas Conflict: Implications for the Cyber Threat Landscape (ReliaQuest)

Hackers Send Fake Rocket Alerts to Israelis via Hacked Red Alert App

Hacktivism erupts in Middle East as Israel declares war (Register)

The Israel-Hamas War Erupts in Digital Chaos (WIRED)

Hacktivists in Palestine and Israel after SCADA and other industrial control systems (Cybernews)

Hackers Join In on Israel-Hamas War With Disruptive Cyberattacks (SecurityWeek)

Israel’s government, media websites hit with cyberattacks (Cybernews)

Website of Jerusalem Post crashes after multiple cyberattacks (OpIndia)

Ukraine cyber-conflict: Hacking gangs vow to de-escalate (BBC News)

North Korea Suspected in Massive Hack of DeFi Project Mixin (OODA Loop)

Assessed Cyber Structure and Alignments of North Korea in 2023 (Mandiant)

Grayling: Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan (Symantec)

The Art of Concealment: A New Magecart Campaign That’s Abusing 404 Pages (Akamai)

Hacker Claims to Have Data of 7 Million 23andMe Users from DNA Service (Hack Read)

23andMe user data breached in credential-stuffing attack (Engadget)

‘Your DNA is for sale on the black market’: 23andMe data breach exposes customers (The Daily Dot)

23andMe User Data Stolen in Targeted Attack on Ashkenazi Jews (WIRED)

23andMe data breach affects a million users with Jewish heritage (Dataconomy)

D.C. voter records for sale in cybercrime forum (CyberScoop)

Hackers access voter information in DC Board of Elections data breach (WTOP News)

DC Board of Elections investigates voter data breach (NBC4 Washington)

The CISO Report (Splunk)

October 2023 Patch Tuesday forecast: Operating system updates and zero-days aplenty (Help Net Security)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Solution spotlight: Paths to cybersecurity. [Interview Select] Oct 09, 2023

Show notes

Solution Spotlight: Simone Petrella is talking with Diane Janosek, Executive Director of Capitol Technology University's Center for Women in Cyber, about paths to cybersecurity and ways to address cybersecurity workforce intelligence through education.

You can view the video of this interview here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Susie Squier: You're never alone. [President] [Career Notes] Oct 08, 2023

Show notes

Susie Squier, President of the Retail and Hospitality ISAC, or Information Sharing and Analysis Center, sits down to share her incredible story starting to get her into the cyber community. She first started getting into PR through an internship she did in college, then moved around a few times gaining experience everywhere she went. Susie shares some wise advice, discussing not only her managing style, but also how she handles situations, along with how she deals with adversity. She says "I also have realized over time that I'm never in this alone, whether that's your personal life or your work life and even here, uh, in addition to a great team, all great team." She hopes people will jump in to the world of cyber with an open mind, and though it may be frightening at first, she says you just need to dive in anyway and not be afraid to try new things. We thank Susie for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Targets from DuckTail. [Research Saturday] Oct 07, 2023

Show notes

Deepen Desai from Zscaler joins to take a look into their research about "DuckTail." In May of 2023, Zscaler ThreatLabz began an intelligence collection operation to decode DuckTail’s maneuvers. Through an intensive three-month period of monitoring, Zscaler was able obtain unprecedented visibility into DuckTail’s end-to-end operations, spanning the entire kill chain from reconnaissance to post-compromise.

The research states "DuckTail threat actors primarily target users working in the digital marketing and advertising space. Unfortunately, the tech layoffs occurring in 2022 and 2023 introduced more eager candidates into the digital market - meaning more prime targets for DuckTail."

The research can be found here:

A Look Into DuckTail

Learn more about your ad choices. Visit megaphone.fm/adchoices

Advice on security, from Washington, DC and Washington State. The Predator Files have bad news on privacy. Notes on the hybrid war. And LoveGPT is not your soulmate. Oct 06, 2023

Show notes

NSA and CISA release a list of the ten most common misconfigurations along with Identity and access management guidelines. The Predator Files. Cyber cooperation between Russia and North Korea. Hacktivist auxiliaries hit Australia. Hacktivists and hacktivist auxiliaries scorn the application of international humanitarian law. The direction of Russian cyber operations. Dave Bittner speaks with Andrea Little Limbago from Interos to talk about geopolitics, cyber and the C-suite. Rick Howard talks with John Hultquist, Chief Analyst at Mandiant, at the mWISE 2023 Cybersecurity Conference about cyber threat intelligence. And, finally, adventures in catphishing: “LoveGPT.”

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/192

Selected reading.

NSA and CISA Release Advisory on Top Ten Cybersecurity Misconfigurations (Cybersecurity and Infrastructure Security Agency CISA)

CISA and NSA Release New Guidance on Identity and Access Management (Cybersecurity and Infrastructure Security Agency CISA)

Microsoft Digital Defense Report 2023 (Microsoft)

Predator Files | EIC (European Investigative Collaborations)

Meet the ‘Predator Files,’ the latest investigative project looking into spyware (Washington Post)

NORTH KOREA–RUSSIA SUMMIT : A NEW ALLIANCE IN CYBERSPACE? - CYFIRMA (CYFIRMA)

Australia’s home affairs department hit by DDoS attack claimed by pro-Russia hackers (the Guardian)

Pro-Russia hacktivist group targets Australian government agencies over support for Ukraine (Cyberdaily.au)

Home Affairs, Administrative Appeals Tribunal websites hit by cyber attacks (SBS News)

‘War has no rules’: Hacktivists scorn Red Cross’ new guidelines (Record)

Espionage fuels global cyberattacks (Microsoft On the Issues)

LoveGPT: How “single ladies” looking for your data upped their game with ChatGPT (Avast Threat Labs)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Security risks in the hardware and software supply chains. Patches and proofs-of-concept. A look at recent incidents hitting major corporations. Online surveillance and social credit in Russia. Oct 05, 2023

Show notes

Apple patches actively exploited iOS 17 vulnerability. Qakbot's survival of a major takedown. BADBOX puts malware into the device supply chain. LoonyTunables and a privilege-escalation risk. Scattered Spider believed responsible for cyberattack against Clorox. Sony discloses information on its data breach. In today’s Threat Vector segment, Chris Tillett, Senior Research Engineer at Palo Alto Networks and member of the Advisory Board at Titaniam Labs, joins host David Moulton to delve inside the mind of an insider threat. Dave Bittner sits down with Eric Goldstein, Executive Assistant Director at CISA, to discuss shared progress against the ransomware threat. And the Kremlin tightens control over the Russian information space.

On this segment of Threat Vector, Chris Tillett, Senior Research Engineer at Palo Alto Networks and member of the Advisory Board at Titaniam Labs, joins host David Moulton to delve inside the mind of an insider threat.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/191

Selected reading.

Apple emergency update fixes new zero-day used to hack iPhones (BleepingComputer)

Apple releases iOS 17.0.3 to address iPhone 15 overheating issues (Computing)

Apple Warns of Newly Exploited iOS 17 Kernel Zero-Day (SecurityWeek)

Qakbot-affiliated actors distribute Ransom Knight malware despite infrastructure takedown (Cisco Talos Blog)

HUMAN Disrupts Digital Supply Chain Threat Actor Scheme Originating from China (HUMAN)

Trojans All the Way Down: BADBOX and PEACHPIT (Human)

'Looney Tunables' Bug Opens Millions of Linux Systems to Root Takeover (Dark Reading)

Looney Tunables: New Linux Flaw Enables Privilege Escalation on Major Distributions (The Hacker News)

Clorox Security Breach Linked to Group Behind Casino Hacks (Bloomberg)

Clorox Warns of a Sales Mess After Cyberattack (Wall Street Journal)

Sony confirms data breach impacting thousands in the U.S. (BleepingComputer)

Sony sent data breach notifications to about 6,800 individuals (Security Affairs)

Russian Offensive Campaign Assessment, October 4, 2023 (Institute for the Study of War)

Learn more about your ad choices. Visit megaphone.fm/adchoices

A phishnet for the C-suite. Rootkit delivered by typosquatting. Stream-jacking in YouTube. Risk management. Hybrid war, and the laws thereof. Oct 04, 2023

Show notes

EvilProxy phishes for executives. Typosquatting to deliver a rootkit. Stream-jacking on YouTube. A global look at risk management. Assistance from a diverse set of international partners. In our Solution Spotlight segment, Simone Petrella speaks with Diane Janosek, Executive Director of Capitol Technology University's Center for Women in Cyber, about paths to cybersecurity and ways to address cybersecurity workforce intelligence through education. Dave Bittner previews the 3rd annual SOC Analyst Appreciation Day with Kayla Williams of Devo. And some guidelines for hacktivists engaged in hybrid war.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/190

Selected reading.

EvilProxy Phishing Attack Strikes Indeed (Menlo Security)

Typosquatting campaign delivers r77 rootkit via npm (ReversingLabs)

A Deep Dive into Stream-Jacking Attacks on YouTube and Why They're So Popular (Bitdefender Labs)

The C-suite playbook: Putting security at the epicenter of innovation (PwC)

European Peace Foundation (EPF) opens cyber classroom for Ukrainian Armed Forces - EU NEIGHBOURS east (EU NEIGHBOURS east)

Rethinking Security When So Many Threats Are Invisible (New York Times)

8 rules for “civilian hackers” during war, and 4 obligations for states to restrain them (EJIL: Talk!)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Where ICS touches the Internet. BunnyLoader traded in C2C markets. Phantom Hacker scams. API risks. Cybersecurity attitudes and behavior. DHS IG reports on two cyber issues. Updates on the hybrid war. Oct 03, 2023

Show notes

Nearly 100,000 ICS services exposed to the Internet. BunnyLoader in the C2C market. Phantom Hacker scams. API risks. Cybersecurity attitudes and behaviors. Homeland Security IG finds flaws in TSA pipeline security programs, and privacy issues with CBP, ICE, and USSS use of commercial telemetry. Kyiv prepares for Russian attacks on Ukraine's power grid. Ben Yelin on the Department of Commerce placing guardrails on semi-conductor companies. As part of our sponsored Industry Voices segment, Dave Bittner sits down with Nick Ascoli, Founder and CTO at Foretrace, to discuss the last year in data leaks. And Russian disinformation is expected to aim at undermining US support for Ukraine.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/189

Selected reading.

Bitsight identifies nearly 100,000 exposed industrial control systems (Bitsight)

New BunnyLoader threat emerges as a feature-rich malware-as-a-service (BleepingComputer)

"Phantom Hacker" Scams Target Senior Citizens and Result in Victims Losing their Life Savings (FBI)

FBI warns of surge in 'phantom hacker' scams impacting elderly (BleepingComputer)

APIs: Unveiling the Silent Killer of Cyber Security Risk Across Industries (Hacker News)

Oh Behave! The Annual Cybersecurity Attitudes and Behaviors Report 2023 (National Cybersecurity Alliance)

Watchdog says pipeline security regulations, data collection safeguards not up to snuff at DHS (Washington Post)

Better TSA Tracking and Follow-up for the 2021 Security Directives Implementation Should Strengthen Pipeline Cybersecurity (REDACTED) (Office of Inspector General, Department of Homeland Security)

CBP, ICE, and Secret Service Did Not Adhere to Privacy Policies or Develop Sufficient Policies Before Procuring and Using Commercial Telemetry Data (REDACTED) (Office of Inspector General, Department of Homeland Security)

Ukraine prepares for winter again as Russia targets its power grid (The Economist)

Putin’s Next Target: U.S. Support for Ukraine, Officials Say (New York Times

Learn more about your ad choices. Visit megaphone.fm/adchoices

Adventures of ransomware, and other developments in cybercrime. Cyberespionage and hybrid warfare. A government shutdown averted. Cybersecurity Awareness Month is underway. Oct 02, 2023

Show notes

Double-tapping ransomware hits the same victim twice. Exim mail servers are found exposed to attack. Iran's OilRig deploys Menorah malware against Saudi targets. North Korea's Lazarus Group targets a Spanish aerospace firm. Update your ransomware scorecards: LostTrust is a rebrand of MetaEncryptor. Increased domestic surveillance in Russia, done partly so propaganda can be more effectively targeted. Killnet claims to have hit the British Royal family with a DDoS attack. Michael Denning, CEO at SecureG for Blu Ventures, shares developments in zero trust as a part of our Industry Voices segment. Rob Boyce from Accenture Security talks about Dark Web threat actors targeting macOS. And Cybersecurity Awareness Month begins this week.

Learn more about the Blu Ventures Conference here: https://www.bluventureinvestors.com/cyber-venture-forum

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/188

Selected reading.

Two or More Ransomware Variants Impacting the Same Victims and Data Destruction Trends (FBI)

FBI: Ransomware Actors Launching 'Dual' Attacks (Decipher)

A still unpatched 0-day RCE impacts more than 3.5M Exim servers (Security Affairs)

New Critical Security Flaws Expose Exim Mail Servers to Remote Attacks (The Hacker News)

APT34 deploys new Menorah malware in targeted phishing attack (Candid.Technology)

APT34 Deploys Phishing Attack With New Malware (Trend Micro)

Iranian APT Group OilRig Using New Menorah Malware for Covert Operations (The Hacker News)

Alleged Iranian hackers target victims in Saudi Arabia with new spying malware (Record)

North Korean hackers posed as Meta recruiter on LinkedIn (CyberScoop)

Lazarus APT Exploiting LinkedIn to Target Spanish Aerospace Firm (Hackread)

North Korean Lazarus targeted a Spanish aerospace company (Security Affairs)

Meet LostTrust ransomware — A likely rebrand of the MetaEncryptor gang (BleepingComputer)

Ukraine at D+585: Trench fighting in the south. (CyberWire)

Royal Family's official website targeted in cyber attack (Sky News)

Royal family website hit by cyber attack (The Independent)

The country ‘dodged a bullet’ after shutdown avoided, but the cyber threat still hovers (Washington Post)

US Federal shutdown averted (or postponed): effects on cybersecurity. (CyberWire)

Cybersecurity Awareness Month: perspectives from the cyber sector. (CyberWire)

Kicking off NIST's Cybersecurity Awareness Month Celebration & Our Cybersecurity Awareness Month 2023 Blog Series (NIST)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ted Wagner: Get that hands on experience. [CISO] [Career Notes] Oct 01, 2023

Show notes

This week, we are joined by Ted Wagner, Chief Information Security Officer at SAP National Security Services, or SAP NS2. Ted sits down to share his story on how he got introduced into the industry and why he chose this as a career path. He went straight into the Armyas a second lieutenant in the artillery field after high school, which after his time was up he decided to move on and started working for a company that allowed him to do a management training program. After that he found himself working on IT projects which got him interested in the field. Ted shares that one thing that has helped him throughout his career is teaching about very technical terms and turning it into more operational or business like terms for his students at MIT. He shares that people getting into this field should get as much hands on experience as they can, saying "I think those are all things that can really help someone who may not have all the experience, but this is a pathway to, to learn." We thank Ted for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices