CyberWire Daily

Latest Episodes:

A creepy new geolocation payload for Smoke Loader. Speed of criminal attack, malware delivery, and the evolution of malicious AI. Ransomware at a Belgian social services agency. Aug 23, 2023

Show notes

The Smoke Loader botnet has a creepy new payload. Ransomware gets faster. How AI has evolved in malicious directions. The Snatch ransomware gang threatens to snitch. The FSB continues to use both USBs and phishing emails as attack vectors. A ransomware attack shutters Belgian social service offices. Tim Starks from the Washington Post explains a Biden administration win in a DC court. Our guest Ben Sebree of CivicPlus describes how the public sector could combat cybercrime during cloud adoption. And the deadline for comment on US cybersecurity regulations? It’s been extended.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/161

Selected reading.

Smoke Loader Drops Whiffy Recon Wi-Fi Scanning and Geolocation Malware (SecureWorks)

Time keeps on slippin’ slippin’ slippin’: The 2023 Active Adversary Report for Tech Leaders (Sophos News)

HP Wolf Security Threat Insights Report Q2 2023 | HP Wolf Security (HP Wolf Security)

Barracuda XDR Insights: How AI learns your patterns to protect you (Barracuda)

Deep Instinct Study Finds Significant Increase in Cybersecurity Attacks Fueled by Generative AI (Deep Instinct)

Cyberattack on Belgian social service centers forces them to close (Record)

Ukraine’s Military Hacked by Russian Backed USB Malware (Ophtek)

Request for Information on Cyber Regulatory Harmonization; Request for Information: Opportunities for and Obstacles To Harmonizing Cybersecurity Regulations (Federal Register)

Learn more about your ad choices. Visit megaphone.fm/adchoices

A cyberespionage operation of unclear provenance shifts its targets. Cyberattacks on voting in Ecuador. Other notes from the cyber underworld. And doxing the Duma. Aug 22, 2023

Show notes

HiatusRAT shifts its targets. Ecuador's difficulties with voting is attributed to cyberattacks. Carderbee is an APT targeting Hong Kong. auDA (OOO-duh) turns out not to have been breached. Ukrainian hacktivists claim to dox a senior member of Russia's Duma. Russian influence operations take aim at NATO's July summit. Joe Carrigan describes attacks on LinkedIn accounts. Our guest is John Hernandez from Quest to discuss why he believes the MOVEit flaw is a wakeup call for CISOs. Security, not by obscurity, but by typo.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/160

Selected reading.

HiatusRAT Malware Resurfaces: Taiwan Firms and U.S. Military Under Attack (The Hacker News)

New HiatusRAT campaign targets Taiwan and U.S. military procurement system (Security Affairs)

HiatusRAT Returns after a Hiatus in a Fresh Wave of Attacks (Cyware Labs)

No rest for the wicked: HiatusRAT takes little time off in a return to action (Lumen)

Ecuador’s national election agency says cyberattacks caused absentee voting issues (Record)

Carderbee: APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong

Resolution of cyber incident (auDA)

Ukrainian hackers claim to leak emails of Russian parliament deputy chief (Record)

Summit Old, Summit New (Graphika)

Summit Old, Summit New: Russia-Linked Actors Leverage New and Old Tactics in Influence Operations Targeting Online Conversations About NATO Summit (Graphika)

The simple typo that stopped bank robbers from stealing $1 billion (LAD Bible)

Learn more about your ad choices. Visit megaphone.fm/adchoices

DPRK tried to hit RoK-US military exercises. Australian domain administrator auDA may have been breached. WoofLocker's tech support scam. US warns of cyber threats to space systems. Aug 21, 2023

Show notes

The DPRK's Kimsuky attempts to hit joint military exercises. Australian domain administrator auDA (OW-duh) may have been breached. WoofLocker's version of a tech support scam. The US Intelligence Community warns of cyber threats to space systems. Rick Howard looks at forecasting cyber risk. Deepen Desai from Zscaler shares ransomware trends. And more wartime disinformation out of Russia.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/159

Selected reading.

Suspected N. Korean Hackers Target S. Korea-US Drills (SecurityWeek)

N. Korean Kimsuky APT targets S. Korea-US military exercises (Security Affairs)

North Korean hackers target US-South Korea military drills, police say (The Economic Times

Cyber incident update (auDA)

Australia’s .au domain administrator denies data breach after ransomware posting (Record)

Hackers claim to have breached auDA (iTnews)

Catching up with WoofLocker, the most elaborate traffic redirection scheme to tech support scams (Malwarebytes)

WoofLocker Toolkit Hides Malicious Codes in Images to Run Tech Support Scams (The Hacker News)

US warns space companies about foreign spying (Reuters)

Intelligence Agencies Warn Foreign Spies Are Targeting U.S. Space Companies (New York Times)

US Warns Space Industry of Growing Risks of Spying and Satellite Attacks (Bloomberg)

Foreign countries targeting tech from US space companies, intel agencies warn (The HIll)

Pentagon urges US space companies to stay vigilant against foreign intelligence (TechCrunch)

Safeguarding the US Space Industry: Keeping Your Intellectual Property in Orbit (DNI)

What To Do About The U.S. Intelligence Community Warning on Safeguarding The Space Industry (OODA Loop)

Countering disinformation with facts - Russian invasion of Ukraine (Government of Canada)

Sergey Lavrov: Throwing Russia off balance is ultimate aim (TASS)

Moscow says US unwillingness to end Ukraine conflict (Merh News Agency)

Russian invaders sending threats to Kherson region’s residents via social media - watchdog (Ukrinform)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Luke Vander Linden: With age comes knowledge. [VP] [Career Notes] Aug 20, 2023

Show notes

This week, our guest is Luke Vander Linden, Vice President of Membership & Marketing from RH-ISAC and host of the RH-ISAC podcast here at the CyberWire. Luke sits down to share his story all the way back to when he was a very young age where he was a child model and actor to where he is now working in the cyber industry. Luke fell into the marketing field after his time as a child actor, where he really started to find his passion. After finding his passion, he decided to branch out to different areas in the field, working in public libraries and advocacy groups, this is where he started to really enjoy the prospect of working with individuals who support organizations, which got him started in the RH-ISAC world. Luke shares that he wears many hats these days, working in the podcast business while also working on the leadership team at RH-ISAC. His advice for people getting into this industry is "I think with age comes this knowledge, but also with experiences. So, I mean, to that point, don't be afraid to go out there and fail, give it a shot." We thank Luke for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Politicians targeted by RomCom. [Research Saturday] Aug 19, 2023

Show notes

Dmitry Bestuzhev from Blackberry joins to discuss their work on "RomCom Resurfaces: Targeting Politicians in Ukraine and U.S.-Based Healthcare Providing Aid to Refugees from Ukraine." Research suggests that the RomCom threat team has been tracked carefully following the geopolitical events surrounding the war in Ukraine, and are now targeting politicians in Ukraine who are working closely with Western countries.

This group is different from others in that their focus is more on secrets or information which can be useful in geopolitics and specifically the war in Ukraine, instead of financial gain. The research says "Although it is unclear at this point what initial infection vector was used to kick off the execution chain, previous RomCom attacks used targeted phishing emails to point a victim to a cloned website hosting Trojanized versions of popular software."

The research can be found here:

RomCom Resurfaces: Targeting Politicians in Ukraine and U.S.-Based Healthcare Providing Aid to Refugees from Ukraine

Learn more about your ad choices. Visit megaphone.fm/adchoices

Phishing for Zimbra credentials. Developments in PlayCrypt and Cuba ransomware. #NoFilter exploitation. Cyber gangs (and some services) threaten security researchers. Anglo-Saxonia update. Aug 18, 2023

Show notes

Phishing for Zimbra credentials. PlayCrypt ransomware described. The Cuba ransomware group adopts new tools. #NoFilter. Cyber criminals threaten security researchers. Our guest is Kevin Paige from Uptycs with thoughts on the Blackhat conference. Eric Goldstein, Executive Assistant Director at CISA joins us discussing next steps on the Secure by Design journey. And Russian disinformation takes on "Anglo-Saxonia."

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/158

Selected reading.

Mass-spreading campaign targeting Zimbra users (We Live Security)

PlayCrypt Ransomware Group Wreaks Havoc in Campaign Against Managed Service Providers (Adlumin SaaS Security)

Cuba Ransomware Deploys New Tools: Targets Critical Infrastructure Sector in the U.S. and IT Integrator in Latin America (BlackBerry)

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security (The Hacker News)

Cyber security researchers become target of criminal hackers (Financial Times)

Britain plotting to assassinate pro-Russian leaders in Africa, says Moscow (The Telegraph)

Ukraine at D+540: Russification and disinformation. (CyberWire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

A seemingly legitimate but actually bogus host for a proxy botnet. PowerShell Gallery vulnerabilities. Cyber incident at Clorox. Scamming would be beta-testers. Cyber updates from Russia’s hybrid war. Aug 17, 2023

Show notes

Building a proxy botnet. Active flaws in PowerShell Gallery. A cyber incident disrupts Clorox. Scams lure would-be mobile beta-testers. Lessons learned from the Russian cyberattack on Viasat. An update on cyber threats to Starlink. Robert M. Lee from Dragos shares his thoughts on the waves of layoffs that have gone through the industry. Steve Leeper of Datadobi explains mitigating risks associated with illegal data on your network. And hey, world leader: it’s never too late to stop manifesting a chronic cranio-urological condition, as they more-or-less say in the Quantum Realm.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/157

Selected reading.

ProxyNation: The dark nexus between proxy apps and malware (AT&T Alien Labs)

Massive 400,000 proxy botnet built with stealthy malware infections (BleepingComputer)

PowerHell: Active Flaws in PowerShell Gallery Expose Users to Attacks (Aqua Security)

Clorox Operations Disrupted By Cyber-Attack (Infosecurity Magazine)

Cyber Criminals Targeting Victims through Mobile Beta-Testing Applications (IC3)

FBI warns about scams that lure you in as a mobile beta-tester (Naked Security)

Incident response lessons learned from the Russian attack on Viasat (CSO Online)

Recent Intel Report Reveals New Starlink Vulnerabilities, Increasing Concerns About the Future of Global Satellite Internet (Debrief)

Hacked electronic sign declares “Putin is a dickhead” as Russian ruble slumps (Graham Cluley)

Learn more about your ad choices. Visit megaphone.fm/adchoices

China accuses the US of cyberespionage. Backdoors found in NetScaler. Account hijacking campaigns. Raccoon Stealer gets an update. Cryptocurrency recovery scams. Narrative control in the hybrid war. Aug 16, 2023

Show notes

China accuses the US of installing backdoors in a Wuhan lab. NetScaler backdoors are found. A Phishing scam targets executives. LinkedIn sees a surge in account hijacking. Raccoon Stealer gets an update. Cryptocurrency recovery scams. We kick off our new Learning Layer segment with N2K’s Sam Meisenberg. And a Moscow court fines Reddit and Wikipedia, for unwelcome content about Russia's war.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/156

Selected reading.

Ministry warns of data security risks after US agencies identified behind cyberattack on Wuhan Earthquake Monitoring Center (Global Times)

China accuses U.S. intelligence agencies as source behind Wuhan cybersecurity attack (ZDNET)

China teases imminent exposé of seismic US spying scheme (Register)

2,000 Citrix NetScaler Instances Backdoored via Recent Vulnerability (SecurityWeek)

Cloud Account Takeover Campaign Leveraging EvilProxy Targets Top-Level Executives at over 100 Global Organizations (Proofpoint)

LinkedIn Accounts Under Attack (Cyberint)

LinkedIn faces surge of account hijacking (Computing)

LinkedIn accounts hacked in widespread hijacking campaign (BleepingComputer)

Raccoon Stealer malware returns with new stealthier version (BleepingComputer)

FBI warns of increasing cryptocurrency recovery scams (BleepingComputer)

Russia slaps Reddit, Wikipedia with fines (Cybernews)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Investigating China’s Storm-0558. Monti ransomware is back. Evasive phishing. Realtors’ MLS taken down in ransomware incident. News from Russia’s hybrid war. And in-game scams. Aug 15, 2023

Show notes

New targets of Chinese cyberespionage are uncovered. Monti ransomware is back. An evasive phishing campaign exposed. A Realtors' network taken down by cyberattack. A closer look at NoName057(16). Perspective on cyberwar - remember Pearl Harbor, but don’t see it everywhere. Ben Yelin on the Consumer Financial Protection Bureau’s plans to regulate surveillance tech. Microsoft’s Ann Johnson and Charlie Bell ponder the future of security. And scammers are targeting kids playing Fortnite and Roblox.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/155

Selected reading.

Chinese spies who read State Dept. email also hacked GOP congressman (Washington Post)

Binary Ballet: China’s Espionage Tango with Microsoft (SecurityHQ)

Microsoft Exchange hack to be investigated by US Cyber Safety Board (Computing)

Monti ransomware targets VMware ESXi servers with new Linux locker (BleepingComputer)

Evasive Phishing Campaign Steals Cloud Credentials Using Cloudflare R2 and Turnstile (Netskope)

Cyberattack on Bay area vendor cripples real estate industry (The Real Deal)

Intel insiders go undercover revealing fresh details into NoName hacktivist operations (Cybernews)

Why the US Military Wants You To Rethink the Idea of 'Cyber War' (The Messenger)

A Huge Scam Targeting Kids With Roblox and Fortnite 'Offers' Has Been Hiding in Plain Sight (WIRED)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Attacks on industrial systems in Europe and Africa. LolekHosted arrests. Notes from the hybrid war. The CSRB will investigate the cyberespionage campaign that exploited Microsoft Exchange. Aug 14, 2023

Show notes

An African power generator has been targeted by ransomware. The APT31 group is believed to be responsible for attacks on industrial systems in Eastern Europe. There have been arrests related to the takedown of LolekHosted. Ukraine's SBU has alleged that Russia's GRU is using specialized malware to attack Starlink. Microsoft has decided not to extend licenses for its products in Russia. Rick Howard opens his toolbox on DDOS. In our Solution Spotlight: Simone Petrella and Camille Stewart Gloster discuss the White House release of its cybersecurity workforce and education strategy. And the Cyber Safety Review Board will be investigating cases of cyberespionage against Exchange.

Watch the full video of Simone and Camille here: Solution Spotlight: Simone Petrella and Camille Stewart Gloster

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/154