CyberWire Daily

Latest Episodes:

The Port of Nagoya continues its recovery from ransomware. Charming Kitten ups its game. Spyware in the Play store. Risks to electrical infrastructure. And a quick update on hacktivist auxiliaries. Jul 06, 2023

Show notes

LockBit 3.0 claims responsibility for Nagoya ransomware attack. Charming Kitten sighting. Spyware infested apps found in Google Play. Threats and risks to electric vehicle charging stations. Solar panels and cyberattacks. Dave Bittner speaks with Eric Goldstein, Executive Assistant Director for Cybersecurity at CISA, to talk about CISA’s effort for companies to build safety into tech products.Rick Howard sits down with Clarke Rodgers of AWS to discuss the mechanics of CISO roundtables. And Hacktivist auxiliaries remain active in Russia's hybrid war.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/127

Selected reading.

Pro-Russian hackers target Port of Nagoya, disrupting loading of Toyota parts (The Japan Times)

Port of Nagoya resumes operations later than planned after Russian hack (The Japan Times)

Ransomware Halts Operations at Japan's Port of Nagoya (Dark Reading)

Nagoya Port Faces Disruption After Ransomware Attack (Infosecurity Magazine)

Welcome to New York: Exploring TA453's Foray into LNKs and Mac Malware | Proofpoint US (Proofpoint)

Two spyware tied with China found hiding on the Google Play Store (Pradeo)

EV Charger Hacking Poses a ‘Catastrophic’ Risk (WIRED)

Exploited Solar Power Product Vulnerability Could Expose Energy Organizations to Attacks (SecurityWeek)

The Continued Expansion of Cyber Incidents by Non-State Actors in the War in Europe (OODA Loop).

Russian railway site allegedly taken down by Ukrainian hackers (Record)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyberespionage, extortion, and DDoS as instruments of state policy. Ransomware continues to trouble a wide range of targets across many sectors. Jul 05, 2023

Show notes

Chinese cyberespionage campaign against European governments. The Port of Nagoya closes over ransomware attack. BlackCat and SEO poisoning. LockBit seeks to extort a semiconductor manufacturer. Professionals in the cyber underworld. CISA issued a DDoS alert for US companies and government agencies. Microsoft debunks claims of data theft by Anonymous Sudan. Matt O'Neill from the US Secret Service speaks with Dave Bittner about sextortion. Rick Howard sits down with Michael Fuller of AWS to talk about the kill chain. And Avast releases a free decryptor for Akira.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/126

Selected reading.

Chinese Threat Actors Targeting Europe in SmugX Campaign - Check Point Research (Check Point Research)

Hackers target European government entities in SmugX campaign (BleepingComputer)

Chinese hackers target European embassies with HTML smuggling technique (Record)

Japan’s largest port stops operations after ransomware attack (BleepingComputer)

BlackCat ransomware pushes Cobalt Strike via WinSCP search ads (BleepingComputer)

BlackCat Operators Distributing Ransomware Disguised as WinSCP via Malvertising (The Hacker News)

TSMC Says Supplier Hacked After Ransomware Group Claims Attack on Chip Giant (SecurityWeek)

TSMC confirms data breach after LockBit cyberattack on third-party supplier (TechCrunch)

Taiwan Semiconductor Denies LockBit's $70M Hack Claim (Bank Info Security)

Semiconductor giant says IT supplier was attacked; LockBit makes related claims (Record)

DoS and DDoS Attacks against Multiple Sectors (Cybersecurity and Infrastructure Security Agency CISA)

CISA issues DDoS warning after attacks hit multiple US orgs (BleepingComputer)

Microsoft denies data breach, theft of 30 million customer accounts (BleepingComputer)

Microsoft Denies Major 30 Million Customer-Breach (Infosecurity Magazine)

Decrypted: Akira Ransomware (Avast Threat Labs)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Two viewpoints on the National Cybersecurity Strategy. [Special Edition] Jul 04, 2023

Show notes

Earlier this month, the White House released the National Cybersecurity Strategy, the first issued since 2018. The strategy refocuses roles, responsibilities, and resource allocations in the digital ecosystem, with a five pillar approach. Those pillars are: defending critical infrastructure, disrupting threat actors, shaping market forces to drive security and resilience, investing in a resilient future, and forging international partnerships.

We wanted to delve into the strategy and its intended effects further, so Dave Bittner spoke with representatives from industry and inside government. Dave first speaks with Adam Isles, Principal and Head of Cybersecurity Practice at The Chertoff Group, sharing industry's take on the strategy. Following that conversation, Dave had a discussion with Steve Kelly, Special Assistant to the President and Senior Director for Cybersecurity and Emerging Technology at the National Security Council, for a look at the strategy from inside the White House.

Links to resources:

Learn more about your ad choices. Visit megaphone.fm/adchoices

Interview Select: Will Markow, VP of Applied Research from Lightcast, is talking with Simone Petrella about how to use data to make strategic workforce decisions. Jul 03, 2023

Show notes

This interview from June 16th, 2023 originally aired as a shortened version on the CyberWire Daily Podcast. In this extended interview, Simone Petrella sits down with Will Markow, VP of Applied Research from Lightcast, to discuss how to use data to make strategic workforce decisions.

You can also view the video of the full interview here: Simone Petrella and Will Markow discuss workforce management.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Liji Samuel: Leaping beyond the barrier. [Certification] [Career Notes] Jul 02, 2023

Show notes

Liji Samuel from NSA sits down to share her exciting career path through the years until she found a job working for as Chief of Standards and Certification at NSA's Cyber Collaboration Center. She starts by sharing that she had always wanted to work in the STEM field, explaining that growing up she was surrounded with older cousins who were choosing STEM careers and it became an interesting topic for her. She accounts working for a number of companies that helped her grow into the role she is in now. Cybersecurity became a big buzzword for her, causing her to step out of the agency into US cyber command to help take up a management position for the architecture and engineering division. From there, she continued her cybersecurity journey first as the exploration director before moving into where she is now. Liji shares that there were barriers along the way that she had to endure and hop over to get to the right path. She says "So there are challenges and barriers that come across constantly with our work. Um, one just has to pause and reflect on how we can work with it, around it, or influence like our stakeholders and jointly create a vision around it." We thank Liji for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The power behind artificial intelligence. [Research Saturday] Jul 01, 2023

Show notes

Daniel dos Santos, Forescout's Head of Security Research is sharing insights from a recent exercise his team conducted on AI-assisted attacks for OT and unmanaged devices. Using ChatGPT, Forescout’s research team converted an existing OT exploit developed in Python to run on Windows to demonstrate how easy it is to create an AI-assisted attack that converts the original exploit into alternative programming languages.

The research states "our goal was to convert an existing OT exploit developed in Python to run on Windows to the Go language using ChatGPT." This would then allow it to run faster on Windows and run easily on a variety of embedded devices.

The research can be found here:

AI-Assisted Attacks Are Coming to OT and Unmanaged Devices – the Time to Prepare Is Now

Learn more about your ad choices. Visit megaphone.fm/adchoices

CISA would like agencies to look to their management interfaces. Hacktivist auxiliaries and a role for OSINT in Russia’s hybrid war against Ukraine. Jun 30, 2023

Show notes

US Federal Government working to secure management interfaces. NoName057(16)’s DDoSia campaign grows, and targets Wagner, post-insurrection. Update: Unidentified hackers attack Russian satellite communications company, claiming to be Wagner. The role of OSINT in tracking Russia's war. Manoj Sharma of Symantec discusses trends he's hearing about generative AI. Becky Weiss from AWS talks with Rick Howard about the math behind their security. Cyber awareness over a holiday.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/125

Selected reading.

CISA Wants Exposed Government Devices Remediated In 14 Days (Dark Reading)

50 US Agencies Using Unsecured Devices, Violating Policy (Bank Info Security)

CISA working with agencies to pull exposed network tools from public internet (Record)

Following NoName057(16) DDoSia Project’s Targets (Sekoia.io Blog)

Pro-Russia DDoSia hacktivist project sees 2,400% membership increase (BleepingComputer)

Hackers attack Russian satellite telecom provider, claim affiliation with Wagner Group (CyberScoop)

Hackers claim to take down Russian satellite communications provider (Record)

Days of Chaos: How OSINT Helps Us Understand the Putin-Prigozhin Schism (Flashpoint)

Preparing for cyber threats over the Fourth of July. (CyberWire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Something new, in ransomware. Notes on cyberespionage by the Lazarus Group and Charming Kitten. Security CI/CD operations. FINRA says hold the emojis. Dispatches from the hybrid war’s cyber front. Jun 29, 2023

Show notes

8base ransomware is overlooked and spiking. GuLoader targets law firms. Akira ransomware for Linux systems targets VMs. Kaspersky tracks the Lazarus group: typos and mistakes indicating an active human operator. Charming Kitten goes spearphishing. Securing continuous integration/continuous delivery operations. No emojis for the SEC, please.Unconfirmed reports say the Wagner Group hacked a Russian satellite communications provider. Our guest is Hanan Hibshi from Carnegie Mellon's picoCTF team. Chris Novak from Verizon discusses their 2023 Data Breach Investigations Report (DBIR). And Anonymous Sudan wants you to know that they’re not just a bunch of deniable Russian crooks–where’s the love, man?

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/124

Selected reading.

8Base Ransomware: A Heavy Hitting Player (VMware Security Blog)

GuLoader Campaign Targets Law Firms in the US (Morphisec)

Akira Ransomware Extends Reach to Linux Platform (Cyble)

Andariel’s Mistakes Uncover New Malware in Lazarus Group Campaign (Infosecurity Magazine)

Charming Kitten Updates POWERSTAR with an InterPlanetary Twist (Volexity)

CISA and NSA Release Joint Guidance on Defending Continuous Integration/Continuous Delivery (CI/CD) Environments | CISA (Cybersecurity and Infrastructure Security Agency CISA)

NSA and CISA Best Practices to Secure Cloud Continuous Integration/Continuous Delivery Environments (National Security Agency/Central Security Service)

Wall Street Regulators’ New Target: Emojis (Wall Street Journal)

Russian satellite telecom Dozor allegedly hit by hackers (Cybernews)

Hacking Group Says It Attacked Microsoft for Sudan. Experts Say Russia’s Behind It (Bloomberg)

‘Hactivists’ who targeted Microsoft claim they’re working for Sudan (Fortune)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Two threats in the wild, and a third in proof-of-concept. Swiss intelligence expects an uptick in Russian cyberespionage. Privateers and auxiliaries in a hybrid war. Jun 28, 2023

Show notes

JokerSpy afflicts Macs. ThirdEye (not so blind). Mockingjay process injection as proof-of-concept. Switzerland expects Russia to increase cyberespionage as agent networks are disrupted. The fracturing of Conti, and the rise of its successors. The Washington Post’s Tim Starks explains the security of undersea cables. Our guest is Brian Johnson of Armorblox to discuss Social Security Administration impersonation scams. And the "UserSec Collective" says it's recruiting hacktivists for the Russian cause.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/123

Selected reading.

JokerSpy macOS malware used to attack Japanese crypto exchange (AppleInsider)

Prominent cryptocurrency exchange infected with previously unseen Mac malware (Ars Technica)

New Fast-Developing ThirdEye Infostealer Pries Open System Information (Fortinet Blog)

Process Mockingjay: Echoing RWX In Userland To Achieve Code Execution (Security Joes)

New Mockingjay Process Injection Technique Could Let Malware Evade Detection (The Hacker News)

New Mockingjay process injection technique evades EDR detection (BleepingComputer)

Ukraine war made Switzerland hub for Chinese, Russian spies: Swiss intelligence (South China Morning Post)

Swiss intelligence warns of fallout in cyberspace as West clamps down on spies (Record)

The rise and fall of the Conti ransomware group (Global Initiative)

The Trickbot/Conti Crypters: Where Are They Now? (Security Intelligence)

Ukraine at D+489: An influence contest, post-mutiny. (CyberWire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Anatsa Trojan's new capabilities. Third-party breach hits airlines. Gas station blues. What’s up with the Internet Research Agency? Infrastructure threats. And DDoS grows more sophisticated. Jun 27, 2023

Show notes

Anatsa Trojan reveals new capabilities. Airlines report employee data stolen in a third-party breach. Canadian energy company SUNCOR reports a cyberattack. What of the Internet Research Agency? Microsoft warns of a rising threat to infrastructure. Joe Carrigan describes an ill-advised phishing simulation. Mr. Security Answer Person John Pescatore takes on zero days. And DDoS grows more sophisticated.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/122