CyberWire Daily

Latest Episodes:

Updates on Russia’s hybrid war. Transparent Tribe is back, with cyberespionage. A Trojanized version of Super Mario is out, and law enforcement seizes BreachForum’s domain. Jun 26, 2023

Show notes

Russian ISPs blocked Google News as tension with the Wagner Group mounted Friday. Ukrainian hacktivist auxiliaries break into Russian radio broadcasts. New EU sanctions are directed against Russian IT firms. Transparent Tribe resurfaces against Indian military and academic targets. Unauthorized access is the leading cause of data breaches for the fifth year in a row. Trojanized Super Mario Brothers game spreads SupremeBot malware. Today, guests discuss the cybersecurity skills gap. Paul Rebasti of Lockheed Martin shares what they are doing to fill cybersecurity skills gap. Jenny Brinkley joins us from AWS Re:Inforce discusses opportunities from the cybersecurity skills gap. And law enforcement agencies seize BreachForums' web domain.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/121

Selected reading.

Ukraine at D+487: After the march on Moscow. (CyberWire)

Ukraine at D+486: The march on Moscow is over. (CyberWire)

Ukraine at D+485: “We are dying for the Russian people.” (CyberWire)

U.S. spies learned in mid-June Prigozhin was planning armed action in Russia (Washington Post)

Google News Blocked in Russia as Feud With Mercenary Leader Intensifies (New York Times)

Air War: Pro-Ukraine Hackers Increasingly Breaking Into Russian Broadcasts With Anti-Kremlin Messages (RadioFreeEurope/RadioLiberty)

Fresh EU sanctions hit Russian IT firms (Computing)

Pakistan based hackers target Indian Army, education sector in new cyber attack (Telangana Today)

Pakistan-based hackers target Indian Army, education sector in new cyber attack (PGURUS)

‘Transparent Tribe’ comes out of hiding (Pune Times Mirror)

2023 ForgeRock Identity Breach Report (ForgeRock)

Trojanized Super Mario Game Installer Spreads SupremeBot Malware (Cyble)

Trojanized Super Mario game used to install Windows malware (BleepingComputer)

FBI seizes BreachForums after arresting its owner Pompompurin in March (BleepingComputer)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Slavik Markovich: Time is of the essence. [CEO] [Career Notes] Jun 25, 2023

Show notes

Slavik Markovich, CEO of Descope joins Dave to discuss his career as a serial entrepreneur. Before Descope, he co-founded and was the CEO of Demisto, a leader in the SOAR industry, which was acquired by Palo Alto Networks in 2019 for $560M, where he then served as SVP of Products. Before co-founding Demisto, Slavik was VP & CTO of database technologies at McAfee. He joined McAfee via the acquisition of Sentrigo, a database security startup he co-founded and served as CTO for. He goes into depth of his career changes throughout the years and how that has helped lead him to where he is now in his career. He shares that as a CEO and found of multiple companies he values time and hard workers. He says " I think we really stress the importance of, uh, of responsibility. So if, if you kinda take something, you, you make sure to finish it and on time, if you promise to do something, you do that. And so that's really important for us." We thank Slavik for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Unleashing the crypto gold rush. [Research Saturday] Jun 24, 2023

Show notes

Ian Ahl from Permiso's PØ Labs joins Dave to discuss their research on "Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor." First observing the group in 2021, they discovered GUI-vil is a financially motivated threat group primarily focused on unauthorized cryptocurrency mining activities.

The research states "the group has been observed exploiting Amazon Web Services (AWS) EC2 instances to facilitate their illicit crypto mining operations." This group is dangerous because unlike many groups focused on crypto mining, GUI-Vil apply a personal touch when establishing a foothold in an environment.

The research can be found here:

Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor

Learn more about your ad choices. Visit megaphone.fm/adchoices

Two sets of China-linked cyberespionage activities. Mirai’s new vectors. A Cozy Bear sighting. Anonymous Sudan gets less anonymous. Jun 23, 2023

Show notes

An update on Barracuda ESG exploitation. Camaro Dragon’s current cyberespionage tools spread through infected USB drives. The Mirai botnet is spreading through new vectors. Midnight Blizzard is out and about . Ukraine is experiencing a "wave" of cyberattacks during its counteroffensive. Karen Worstell from VMware shares her experience with technical debt. Rick Howard speaks with CJ Moses, CISO of Amazon Web Services. And Anonymous Sudan turns out to be no more anonymous or Sudanese than your Uncle Louie.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/120

Selected reading.

Barracuda ESG exploitation (Proofpoint)

Beyond the Horizon: Traveling the World on Camaro Dragon’s USB Flash Drives (Check Point Research)

Chinese malware accidentally infects networked storage (Register)

Akamai SIRT Security Advisory: CVE-2023-26801 Exploited to Spread Mirai Botnet Malware (Akamai).

Mirai botnet targets 22 flaws in D-Link, Zyxel, Netgear devices (BleepingComputer)

Neuberger: Ukraine experiencing a ‘surge’ in cyberattacks as it executes counteroffensive (Record)

Microsoft warns of rising NOBELIUM credential attacks on defense sector (HackRead).

Anonymous Sudan: neither anonymous nor Sudanese (Cybernews)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyber spies and vulnerability goodbyes. RedLine Stealer and Vidar: the cryptkeepers. Social engineering TTPs. Jun 22, 2023

Show notes

North Korea's APT37 deploys FadeStealer to steal information from its targets. Apple patches vulnerabilities under active exploitation. Access to a US satellite is being hawked in a Russophone cybercrime forum. Russian hacktivist auxiliaries say they’ve disrupted IFC.org. Unmasking pig-butchering scams. Social engineering as a method of account takeover. Fraudsters seen abusing generative AI. Sergey Medved from Quest Software describes the “Great Cloud Repatriation”. Mark Ryland of AWS speaks with Rick Howard about software defined perimeters. And embedded URLs in malware.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/119

Selected reading.

RedEyes Group Wiretapping Individuals (APT37) (Ahn Lab)

Apple fixes iPhone software flaws used in widespread hacks of Russians (The Washington Post)

Apple issues emergency patch to address alleged spyware vulnerability (Cyberscoop)

Apple patch fixes zero-day kernel hole reported by Kaspersky – update now! (Sophos)

Military Satellite Access Sold on Russian Hacker Forum for $15,000 (HackRead)

Well done. Russian hackers shut down the IMF (Dzen.ru)

Why Malware Crypting Services Deserve More Scrutiny (KrebsOnSecurity)

Unmasking Pig-Butchering Scams And Protecting Your Financial Future (Trend Micro)

Classic Account Takeover via the Direct Deposit Change (Avanan)

Q2 2023 Digital Trust & Safety Index (Sift)

Compromised Domains account for over 50% of Embedded URLs in Malware Phishing Campaigns (Cofense)

Learn more about your ad choices. Visit megaphone.fm/adchoices

A “flea” on the wall conducts cyberespionage. Cl0p update. Astrology finds its way into your computer systems. Fancy Bear sighted, again. Jun 21, 2023

Show notes

The Flea APT sets its sights on diplomatic targets. An update on the Cl0p gang’s exploitation of a MOVEit vulnerability. Unpatched TP-Link Archer routers are meeting their match in the Condi botnet. The Muddled Libra threat group compromises companies in a variety of industries. A look into passwordless authentication. Derek Manky of Fortinet describes the Global Threat Landscape. Rick Howard speaks with Rod Wallace from AWS about data lakes. And Fancy Bear noses its way into Ukrainian servers.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/118

Selected reading.

Graphican: Flea Uses New Backdoor in Attacks Targeting Foreign Ministries (Symantec)

Ke3chang (MITRE)

Third MOVEit vulnerability raises alarms as US Agriculture Department says it may be impacted (The Record)

PwC and EY impacted by MOVEit cyber attack (Cybersecurity Hub)

Norton Parent Says Employee Data Stolen in MOVEit Ransomware Attack (SecurityWeek)

MOVEit hack: Gang claims not to have BBC, BA and Boots data (BBC)

US govt offers $10 million bounty for info on Clop ransomware (BleepingComputer)

Condi DDoS Botnet Spreads via TP-Link's CVE-2023-1389 (Fortinet)

CVE-2023-1389 Detail (NIST)

Download for Archer AX21 V3 (TP-Link)

Threat Group Assessment: Muddled Libra (Unit 42)

Axiad and ESG Survey: 82% of Respondents Indicate Passwordless Authentication is a Top Five Priority (PR Newswire)

APT28 group used three Roundcube exploits (CVE-2020-35730, CVE-2021-44026, CVE-2020-12641) during another espionage campaign (CERT-UA#6805) (CERT-UA)

BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities (The Record)

CVE-2020-35730 Detail (NIST)

CVE-2023-23397 Detail (NIST)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Reddit sees bad luck as a BlackCat attack crosses their path. The C2C market is more mystical nowadays. Hacktivist auxiliaries and false flags in the hybrid war. Jun 20, 2023

Show notes

The BlackCat gang crosses Reddit’s path, threatening to leak stolen data. Mystic Stealer malware evades and creates a feedback loop in the C2C market. RDStealer is a new cyberespionage tool, seen in the wild. The United States offers a reward for information on the Cl0p ransomware gang. KillNet, REvil, and Anonymous Sudan form a "DARKNET Parliament" and “sanction” the European banking system. The British Government commits £25 million in cybersecurity aid to Ukraine. Ben Yelin explains cyber disclosure rules proposed by the SEC. Rick Howard speaks with Nancy Wang of AWS about the importance of backups and restores. And what researchers are turning up in cloud honeypots.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/117

Selected reading.

Reddit: Hackers demand $4.5 million and API policy changes (Computing)

Mystic Stealer – Evolving “stealth” Malware (Cyfirma)

Mystic Stealer: The New Kid on the Block (Zscaler)

Unpacking RDStealer: An Exfiltration Malware Targeting RDP Workloads (Bitdefender)

MOVEit Transfer and MOVEit Cloud Vulnerability (Progress Software)

CVE-2023-35708 Detail (NIST)

U.S. Energy Dept gets two ransom notices as MOVEit hack claims more victims (Reuters)

US govt offers $10 million bounty for info on Clop ransomware (BleepingComputer)

Ransomware Group Starts Naming Victims of MOVEit Zero-Day Attacks (SecurityWeek)

A bear in wolf’s clothing: Insights into the infrastructure used by Anonymous Sudan to attack Australian organisations (CyberCX)

Anonymous Sudan: Religious Hacktivists or Russian Front Group? (Trustwave)

UK to give Ukraine major boost to mount counteroffensive (UK Government)

2023 Honeypotting in the Cloud Report: Attackers Discover and Weaponize Exposed Cloud Assets and Secrets in Minutes (Orca Security)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Lorna Mahlock: Build bridges. [Combat support] [Career Notes] Jun 18, 2023

Show notes

Major General Lorna Mahlock, Deputy Director for Combat Support from the National Security Agency (NSA) sits down with Dave to discuss her long and impressive career leading up to he working for one of the most prestigious security agencies. Originally born in Kingston, Jamaica, Lorna immigrated to Brooklyn, New York and enlisted in the United States Marine Corps as a field radio operator. She shares how eye opening the military was for her, moving through ranks, and eventually landing into working at the Pentagon for the Chairman of the Joint Chiefs of staff. She moved around widening her array of paths, landing in her current role. Lorna shares some wisdom, mentioning how she likes to talk about ladders and how useful creating ladders in life can be, she says "I think about ladders in terms of horizontal component, in that you can create bridges, right? And, um, ways over obstacles, uh, for, for not only, uh, for yourself, but for others and an entire organization." We thank Lorna for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Managing machine learning risks. [Research Saturday] Jun 17, 2023

Show notes

Our guest, Johannes Ullrich from SANS Institute, joins Dave to discuss their research on "Machine Learning Risks: Attacks Against Apache NiFi." Using their honeypot network, researchers were able to collect some interesting data about a threat actor who is currently going after exposed Apache NiFi servers.

Researchers state “On May 19th, our distributed sensor network detected a notable spike in requests for ‘/nifi.’” Investigating further, they instructed a subset of their sensors to forward requests to an actual Apache NiFi instance and within a couple of hours the honeypot was completely compromised.

The research can be found here:

Machine Learning Risks: Attacks Against Apache NiFi

Learn more about your ad choices. Visit megaphone.fm/adchoices

The Cl0p gang moves its way into US government systems. It’ll take multiple showers to rinse out Shampoo malware. Hybrid war update. Arrests and indictments. Jun 16, 2023

Show notes

The US Government discloses exploitations of MOVEit vulnerabilities, and the Department of Energy is targeted by the Cl0p gang. CISA releases an updated advisory for Telerik vulnerabilities affecting Government servers. Shampoo malware emerges with multiple persistence mechanisms. How the IT Army of Ukraine can exemplify a cyber auxiliary. Russophone gamers are being targeted with ransomware. An alleged LockBit operator has been arrested. The FBI’s Deputy Assistant Director for cyber Cynthia Kaiser joins us with cybercriminal trends and recent successes. Our guest is Will Markow from Lightcast, speaking with Simone Petrella about data-driven strategic workforce decisions. And a federal grand jury indicts the alleged Discord Papers leaker.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/116