CyberWire Daily

Latest Episodes:

Don’t get snatched. Trends in phishing, cyber insurance claims, and threats to academic institutions. Hacktivism in the hybrid war. Updates on the ICC attack. MGM says its casinos are back. Sep 21, 2023

Show notes

CISA and the FBI warn of Snatch ransomware. A look at phishing trends. Ransomware is increasingly cited in cyber insurance claims. Trends in cyber threats to academic institutions. A Russian hacktivist auxiliary disrupts Canadian border control and airport sites. The ICC remains tight-lipped concerning cyberattack. N2K’s Simone Petrella sits down with Chris Krebs at the mWise conference. In today’s Threat Vector segment, David Moulton from Unit 42 takes a peek into the modern threat landscape with Wendi Whitmore, SVP of Unit 42. And MGM Resorts says it’s well on the way to recovery.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/181

Threat Vector links.

To learn what is top of mind each month from the experts at Unit 42 sign up for their Threat Intel Bulletin.

Selected reading.

#StopRansomware: Snatch Ransomware (Cybersecurity and Infrastructure Security Agency CISA)

2023 .Phishing Trends (ZeroFox)

Cyber Insurance Claims Frequency and Severity Both Increased For Businesses in 1H 2023, Coalition Report Finds (Business Wire)

2023 Cyber Claims Report: Mid-year Update (Coalition)

Since 2018, ransomware attacks on the education sector have cost the world economy over $53 billion in downtime alone (Comparitech)

Canada blames border checkpoint outages on cyberattack (Record)

Cyberattack hits International Criminal Court (SC Media)

International Criminal Court hacked amid Russia probe (Register)

International Criminal Court under siege in cyberattack that could constitute world’s first cyber war crime (Yahoo News)

Our hotels and casinos are operating normally. (FAQ - MGM Resorts)

MGM Resorts computers back up after 10 days as analysts eye effects of casino cyberattacks (AP News - 09-20-2023)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hacking the ICC. ShroudedSnooper active, simple, and novel. New criminal malware used against Chinese-speakers. More on the materiality of cyberattacks. Sep 20, 2023

Show notes

The International Criminal Court reports a "cybersecurity incident." ShroudedSnooper intrusion activity is both novel and simple. Criminal malware targets Chinese-speaking victims. The costs of insider risk. More on the casino attacks (and related social engineering capers). In our Learning Layer segment, Sam Meisenberg drops into a CISSP tutoring session and offers some test-taking tips. Our guest is Aaron Brazelton, Dean of Admissions and Advancement at the Alabama School of Cyber Technology and Engineering. And the Clorox incident shows how one company navigates unfamiliar new SEC rules.

Join Sam Meisenberg as he drops into a CISSP tutoring session talking about the difference between due diligence and due care along with some test-taking tips.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/180

Learning Layer.

Learning about the CISSP certification from (ISC)²

Selected reading.

War crimes tribunal ICC says it has been hacked (Reuters)

International Criminal Court says cybersecurity incident affected its information systems last week (AP News)

Hackers breached International Criminal Court’s systems last week (BleepingComputer)

New ShroudedSnooper actor targets telecommunications firms in the Middle East with novel Implants (Cisco Talos)

ShroudedSnooper's HTTPSnoop Backdoor Targets Middle East Telecom Companies (The Hacker News)

Chinese Malware Appears in Earnest Across Cybercrime Threat Landscape (Proofpoint)

Hackers who breached casino giants MGM, Caesars also hit 3 other firms, Okta says (Reuters)

Las Vegas casino ransomware attacks: Okta in the spotlight (The Stack)

MGM losing up to $8.4M per day as cyberattack paralyzes slot machines, hotels for 8th straight day: analyst (New York Post)

Caesars reports cyberattack but did not go offline (Top Class Actions)

What Las Vegas tourists need to know about casino hacks (Washington Post)

MGM, Caesars Face Regulatory, Legal Maze After Cyber Incidents (Dark Reading)

Clorox Cyberattack Brings Early Test of New SEC Cyber Rules (Wall Street Journal)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ransomware in Colombia. An accidental data exposure. Cyberespionage hits unpatched systems. An attack on IT systems disrupts industrial production. Bots and bad actors. Sep 19, 2023

Show notes

Colombia continues its recovery from last week's cyberattacks. AI training data is accidentally published to GitHub. The cyberespionage techniques of Earth Lusca. Clorox blames product shortages on a cyber attack. Cybersecurity incidents in industrial environments. Where the wild bots are. Joe Carrigan looks at top level domain name exploitation. Our guest is Kristen Bell from GuidePoint Security with a look at vulnerability vs. exploitability. And there’s talk of potential Russia-DPRK cooperation in cyberspace.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/179

Selected reading.

More than 50 Colombian state, private entities hit by cyberattack -Petro (Reuters)

Colombia Mulls Legal Action Against US Firm Targeted In Cyber Attack (Barron's)

Microsoft mitigated exposure of internal information in a storage account due to overly-permissive SAS token (Microsoft Security Response Center)

Microsoft AI Researchers Expose 38TB of Data, Including Keys, Passwords and Internal Messages (SecurityWeek)

Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement (Trend Micro)

Chinese hackers have unleashed a never-before-seen Linux backdoor (Ars Technica)

The Clorox Company FORM 8-K (US Securities and Exchange Commission)

Clorox Warns of Product Shortages Following Cyberattack (Wall Street Journal)

Clorox warns of product shortages, profit hit from August cyberattack (The Street)

Can't find the right Clorox product? A recent cyberattack is causing some shortages (USA Today)

Clorox warns of product shortages after cyberattack (Fox Business)

As flu season looms, hackers force a shortage of Clorox products (Fortune)

New Research Finds Cyberattacks Against Critical Infrastructure on the Rise, State-affiliated Groups Responsible for Nearly 60% (Business Wire)

Death By a Billion Bots (Netacea)

Russian and North Korea artillery deal paves the way for dangerous cyberwar alliance (EconoTimes)

Learn more about your ad choices. Visit megaphone.fm/adchoices

A quick look at some threats from China and North Korea, some engaged in collection, some in theft. BlackCat and other ransomware operators. And a view of cyberwar from Ukraine’s SSU. Sep 18, 2023

Show notes

Cyber threats trending from East Asia. The Lazarus Group is suspected in the CoinEx crypto theft. Pig butchering, enabled by cryptocurrency. BlackCat is active against Azure storage. a Ukrainian view of cyber warfare. A US-Canadian water commission deals with a ransomware attack. Eric Goldstein from CISA shares insights on cyber threats from China. Neil Serebryany of Calypso explains the policies, tools and safeguards in place to enable the safe use of generative AI. And more details emerge in the Las Vegas casinos’ ransomware incidents. Danny Ocean, call your office.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/178

Selected reading.

Sophistication, scope, and scale: Digital threats from East Asia increase in breadth and effectiveness (Microsoft Security Compliance and Identity)

Evidence points to North Korea in CoinEx cryptocurrency hack, analysts say (Record)

CoinEx invites hackers to negotiate after suffering data breach (The Times of India

BlackCat ransomware hits Azure Storage with Sphynx encryptor (BleepingComputer)

MGM websites up, but reservation systems still affected by hack (Las Vegas Review-Journal)

The chaotic and cinematic MGM casino hack, explained (Vox)

Massive MGM and Caesars Hacks Epitomize a Vicious Ransomware Cycle (WIRED)

US-Canada water commission confirms 'cybersecurity incident' (Register)

Ukraine's Fusion of Cyber and Kinetic Warfare: Illia Vitiuk's Stand Against Russian Cyber Operations (AFCEA International)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Karl Mattson: Defer gratification. (CISO) [Career Notes] Sep 17, 2023

Show notes

Karl Mattson, CISO at Noname Security, joins us to share his story. Having started out as a "military brat," traveling the world as the child of a Marine, Karl later joined the Army not long after high school. In the Army, Karl was assigned the career field of intelligence analyst and started working with the NSA. He says that was a real career break. Following the Army, Karl worked in the financial services world as a CISO. At Noname, Karl began by building out internal risk and IT functions into a strong, what he calls spectacular team. Karl recommends "deferring gratification as long as possible" when building your career. He says, "People early in their career, looking at government service, those positions don't, you know, make anybody rich overnight, but they are amazing career cornerstones to build on." He closes sharing the importance of relationships. We thank Karl for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A look into the emotions and anxieties of the highest levels of decision-making. [Research Saturday] Sep 16, 2023

Show notes

Guest Manuel Hepfer from ISTARI shares his research on cyber resilience which includes discussions with 37 CEOs to gain insight into how they manage cybersecurity risk. ISTARI and Oxford University's Saïd Business School dive into the minds and experiences of CEOs on how they manage cybersecurity risk.

Ask any CEO to name the issues that keep them awake at night and cybersecurity risk is likely near the top of the list – with good reason. With the accelerating digitalisation of business models comes vulnerability to cyberattack. And while spending on cybersecurity increases every year, so does the number of serious incidents. Even the largest and most technologically advanced companies are not immune.

CEOs must formally answer to regulators, shareholders and board members for their organisation’s cybersecurity. Yet the majority (72%) of CEOs we interviewed as part of our research said they were not comfortable making cybersecurity-related decisions.

The research and associated article can be found here:

Research: The CEO Report on Cyber Resilience
Article: Make Cybersecurity a Strategic Asset

Learn more about your ad choices. Visit megaphone.fm/adchoices

Peach Sandstorm cyberespionage. Criminal attacks against a Colombian telco and two major US casino firms. A thief in the browser. And the Greater Manchester Police are on a virtual manhunt. Sep 15, 2023

Show notes

"Peach Sandstorm" is an Iranian cyberespionage campaign. A Cyberattack against a telecom provider affects government and corporate online operations in Colombia. Python NodeStealer takes browser credentials. Caesars Entertainment files its 8-K. Some MGM Entertainment systems remain down. Betsy Carmelite from Booz Allen talking about how to leverage cyber psychology. Ron Reiter of Sentra outlines the threats for connected cars. And a third-party incident exposes personal data of the Manchester police.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/177

Selected reading.

Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets (Microsoft)

Hackers Backed by Iran Caught in Apparent Global Spy Campaign (The Messenger)

BNamericas - Colombia cyberattack hits government, corpor... (BNamericas.com)

Colombia's judicial branch thrown offline in major cyber attack (Colombia Reports)

Casino giant Caesars Entertainment reports cyberattack; MGM Resorts says some systems still down (AP News)

Casino Operators Caesars and MGM Still Reeling From Cyber Attacks (Kiplinger.com)

Groups linked to Las Vegas cyber attacks are prolific criminal hacking gangs (CyberScoop)

MGM still responding to wide-ranging cyberattack as rumors run rampant (Record)

Ransomware in the casinos. (CyberWire)

MGM Resorts shuts down some systems. (CyberWire)

Manchester police officers’ data stolen following ransomware attack on supplier (Record)

Contractor Data Breach Impacts 8k Greater Manchester Police Officers (Hackread)

A Second Major British Police Force Suffers a Cyberattack in Less Than a Month (SecurityWeek)

Who is behind the latest wave of UK ransomware attacks? (the Guardian)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ransomware and materiality. MetaStealer hits businesses. Two looks at cloud risks. His Highness, the Large Language Model. Sep 14, 2023

Show notes

The MGM Resorts incident is now believed to be ransomware, and how does that inform our view of Materiality of a cyber incident? MetaStealer targets businesses. Cloud access with stolen credentials. The cloud as an expansive attack surface. Johannes Ullrich from SANS describes malware in dot-inf files. In our Industry Voices segment Dave speaks with Oliver Tavakoli, CTO at Vectra, on the complexity and challenges of cloud service security. And welcome back, or not, Your Highness the Large Language Model, Prince of Nigeria.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/176

Selected reading.

Caesars Entertainment Paid Millions to Hackers in Attack (Bloomberg)

Caesars Paid Ransom After Suffering Cyberattack (Wall Street Journal)

The Cyberattack That Sent Las Vegas Back in Time (Wall Street Journal)

Pro Take: MGM Casino Hack Shows Challenge in Defending Connected Tech (Wall Street Journal)

ALPHV Ransomware Used Vishing to Scam MGM Resorts Employee, Researchers (Hackread)

FBI probing MGM Resorts cyber incident as some casino systems still down (Reuters)

MGM Resorts says cyberattack could have material effect on company (NBC News)

MGM Resorts cybersecurity breach could cost millions, expert says (KLAS)

MGM Resorts shuts down some systems because of a “cybersecurity issue.” (Updated.) (CyberWire)

macOS Info-Stealer Malware 'MetaStealer' Targeting Businesses (SecurityWeek)

“Authorized” to break in: Adversaries use valid credentials to compromise cloud environments (Security Intelligence)

Unit 42 Attack Surface Threat Report (Palo Alto Networks)

The Nigerian Prince is Alive and Well: Cybercriminals Use Generative… (Abnormal)

Learn more about your ad choices. Visit megaphone.fm/adchoices

How one access broker gets its initial access (it’s through novel phishing). Be alert for deepfakes, US authorities say. The Pentagon’s new cyber strategy. And a reminder: yesterday was Patch Tuesday. Sep 13, 2023

Show notes

An access broker's phishing facilitates ransomware. 3AM is fallback malware. Cross-site-scripting vulnerabilities are reported in Apache services. US agencies warn organizations to be alert for deepfakes. The US Department of Defense publishes its 2023 Cyber Strategy. Ann Johnson from the Afternoon Cyber Tea podcast speaks with with Jenny Radcliffe about the rise in social engineering. Deepen Desai from Zscaler shares a technical analysis of Bandit Stealer. And a quick reminder: yesterday was Patch Tuesday.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/175

Selected reading.

Malware distributor Storm-0324 facilitates ransomware access (Microsoft Security)

3AM: New Ransomware Family Used As Fallback in Failed LockBit Attack (Symantec)

Azure HDInsight Riddled With XSS Vulnerabilities via Apache Services (Orca Security)

Contextualizing Deepfake Threats to Organizations (US Department of Defense)

Bipartisan push to ban deceptive AI-generated ads in US elections (Reuters)

DOD Releases 2023 Cyber Strategy Summary (U.S. Department of Defense)

New Pentagon cyber strategy: Building new capabilities, expanding allied info-sharing (Breaking Defense)

New DOD cyber strategy notes limits of digital deterrence (DefenseScoop)

New Pentagon cyber strategy: Building new capabilities, expanding allied info-sharing (Breaking Defense)

CISA Releases Three Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency CISA)

September 2023 Security Updates (Microsoft Security Response Center)

Microsoft Releases September 2023 Updates (Cybersecurity and Infrastructure Security Agency CISA)

Zero Day Summer: Microsoft Warns of Fresh New Software Exploits (SecurityWeek)

Microsoft Patch Tuesday: Two zero-days addressed in September update (Computing)

Adobe Releases Security Updates for Multiple Products (Cybersecurity and Infrastructure Security Agency CISA)

Microsoft, Adobe fix zero-days exploited by attackers (CVE-2023-26369, CVE-2023-36761, CVE-2023-36802) (Help Net Security)

Adobe fixed actively exploited zero-day in Acrobat and Reader (Security Affairs)

Adobe warns of critical Acrobat and Reader zero-day exploited in attacks (BleepingComputer)

Apple Releases Security Updates for iOS and macOS (Cybersecurity and Infrastructure Security Agency CISA)

SAP Security Patch Day for September 2023 (Onapsis)

Google Rushes to Patch Critical Chrome Vulnerability Exploited in the Wild - Update Now (The Hacker News)

Critical Google Chrome Zero-Day Bug Exploited in the Wild (Dark Reading)

Zero-day affecting Chrome, Firefox and Thunderbird patched (Computer)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Phishing with Facebook Messenger bots. Redfly hits a national power grid. Nice platform you got there…shame if something happened to it. MGM Resorts grapples with a “cybersecurity issue.” Sep 12, 2023

Show notes

Phishing with Facebook Messenger accounts. Redfly cyberespionage targets a national grid. The exploit trade in the C2C underground market. Phishing attack exploits Baidu link. A repojacking vulnerability. A hacktivist auxiliary looks to its own interests. Ben Yelin marks the start of the Google antitrust trial. In our Industry Voices segment, Adam Bateman from Push Security explains how identities are the new perimeter. And MGM Resorts are dealing with a “cybersecurity issue.”

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/174