CyberWire Daily

Latest Episodes:

Ransomware and social engineering trends. Expired certificate addressed. Ransomware groups target schools. Cyber updates in the hybrid war. May 11, 2023

Show notes

A Ransomware report highlights targeting and classification. Phishing remains a major threat. Cisco addresses an expired certificate issue. LockBit and Medusa hit school districts with ransomware. US and Canadian cyber units wrap up a hunt-forward mission in Latvia. Ben Yelin on NYPD surveillance. Our CyberWire producer Liz Irvin interviews Damien Lewke, a graduate student at MIT. And an unknown threat actor is collecting against both Russia and Ukraine.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/91

Selected reading.

GRIT Ransomware Report: April 2023 (GuidePoint Security)

DNSFilter State of Internet Security - Q1 2023 (DNSFilter)

Identify vEdge Certificate Expired on May 9th 2023 (Cisco)

The State of Ransomware Attacks in Education 2023: Trends and Solutions (Veriti)

US Cyber Command 'Hunts Forward' in Latvia (Voice of America)

US cyber team unearths malware during ‘hunt-forward’ mission in Latvia (C4ISRNET)

Uncovering RedStinger - Undetected APT cyber operations in Eastern Europe since 2020 (Malwarebytes)

Bad magic: new APT found in the area of Russo-Ukrainian conflict (Kaspersky)

Learn more about your ad choices. Visit megaphone.fm/adchoices

CISA Alert AA23-129A – Hunting Russian intelligence “Snake” malware. May 11, 2023

Show notes

The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia’s Federal Security Service, or FSB, for long-term intelligence collection on sensitive targets.

AA23-129A Alert, Technical Details, and Mitigations

For more information on FSB and Russian state-sponsored cyber activity, please see the joint advisory Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure and CISA’s Russia Cyber Threat Overview and Advisories webpage.

No-cost cyber hygiene services: Cyber Hygiene Services and Ransomware Readiness Assessment.

See CISA Insights Mitigations and Hardening Guidance for MSPs and Small- and Mid-sized Businesses for guidance on hardening MSP and customer infrastructure.

U.S. DIB sector organizations may consider signing up for the NSA Cybersecurity Collaboration Center’s DIB Cybersecurity Service Offerings, including Protective Domain Name System services, vulnerability scanning, and threat intelligence collaboration for eligible organizations. For more information on how to enroll in these services, email dib_defense@cyber.nsa.gov

To report incidents and anomalous activity or to request incident response resources or technical assistance related to these threats, contact CISA at report@cisa.gov, or call (888) 282-0870, or report incidents to your local FBI field office.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Five Eyes disrupt FSB’s Snake malware. From DDoS to cryptojacking. Ransomware trends. Yesterday’s Patch Tuesday is in the books. May 10, 2023

Show notes

The Five Eyes disrupt Russia’s FSB Snake cyberespionage infrastructure. Shifting gears: from DDoS to cryptojacking. Trends in ransomware. Our guest is Steve Benton from Anomali with insights on potential industry headwinds. Ann Johnson from Afternoon Cyber Tea speaks with Roland Cloutier about risk and resilience in the modern era. And yesterday’s Patch Tuesday is now in the books, including a work-around for a patch from this past March.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/90

Selected reading.

Patch Tuesday notes. (The CyberWire)

U.S. Agencies and Allies Partner to Identify Russian Snake Malware Infrastructure Worldwide (US National Security Agency)

Hunting Russian Intelligence “Snake” Malware (Joint Cybersecurity Advisory)

RapperBot DDoS Botnet Expands into Cryptojacking (Fortinet)

The State of Ransomware 2023 (Sophos)

From One Vulnerability to Another: Outlook Patch Analysis Reveals Important Flaw in Windows API (Akamai)

Windows MSHTML Platform Security Feature Bypass Vulnerability (Microsoft)

Learn more about your ad choices. Visit megaphone.fm/adchoices

State-sponsored and state-promoted cyber campaigns. A look at Royal ransomware. A new wave of BEC. Man-in-the-middle attacks rising. May 09, 2023

Show notes

An analysis of Royal ransomware. PaperCut vulnerability detection methods can be bypassed. Man-in-the-middle phishing attacks are on the rise. A new wave of BEC attacks from an unexpected source. Thomas Etheridge from CrowdStrike, has the latest threat landscape trends. Our guest is Dan Amiga of Island with insights on the enterprise browser category. And a look into recent Russian cyberattacks against Ukraine.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/89

Selected reading.

Threat Assessment: Royal Ransomware (Unit 42)

PaperCut Exploitation - A Different Path to Code Execution (VulnCheck)

New PaperCut RCE exploit created that bypasses existing detections (Bleeping Computer)

Man-in-the-Middle (MitM) attacks reaching inboxes increase 35% since 2022 (Cofense)

Exploring the Rise of Israel-Based BEC Attacks (Abnormal Security)

Russians launch mass cyber attack on online service for queueing to cross border by trucks (Ukrainska Pravda)

Reverting UAC-0006: Mass distribution of SmokeLoader using the "accounts" theme (CERT-UA#6613) (CERT-UA)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Developments in the ransomware underworld: ALPHV, Akira, Cactus, and Royal. Some organizations remain vulnerable to problems with unpatched Go-Anywhere instances. May 08, 2023

Show notes

ALPHV claims responsibility for a cyberattack on Constellation Software. A new Akira ransomware campaign spreads. CACTUS is a new ransomware leveraging VPNs to infiltrate its target. Many organizations are still vulnerable to the Go-Anywhere MFT vulnerability. Russian hacktivists interfere with the French Senate's website. Keith Mularski from EY, details their "State of the Hack" report. Emily Austin from Censys discusses the State of the Internet. And ransomware gangs target local governments in Texas and California.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/88

Selected reading.

ALPHV gang claims ransomware attack on Constellation Software (BleepingComputer)

Constellation Software hit by cyber attack, some personal information stolen (IT World Canada)

Press Release of Constellation Software Inc. (GlobeNewswire News Room)

Meet Akira — A new ransomware operation targeting the enterprise (BleepingComputer)

New Cactus ransomware encrypts itself to evade antivirus (BleepingComputer)

Pro-Russian Hackers Claim Downing of French Senate Website (SecurityWeek)

Dallas cyberattack highlights ransomware’s risks to public safety, health (Washington Post)

Hacked: Dallas Ransomware Attack Disrupts City Services (Dallas Observer)

City of Dallas Continues Battling Ransomware Attack for Third Day (NBC 5 Dallas-Fort Worth)

San Bernardino County pays hackers $1.1 million ransom after cyber attack (Victorville Daily Press)

San Bernardino County pays $1.1M ransom after cyberattack disrupts Sheriff's Department systems (ABC7 Los Angeles)

Atomic Data devastated by the unexpected death of CEO and co-owner Jim Wolford (Atomic Data)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Shelley Ma: The mystery behind cybersecurity. [Response Lead] [Career Notes] May 07, 2023

Show notes

Shelley Ma, Incident Response Lead at Coalition sits down to share her story, starting all the way back when she was a kid and fell in love with playing the game "NeoPets" that ended up paving the way for her future in cybersecurity. After starting this journey, she shares how she became intrigued with crime and mystery shows, which ultimately spawned an interest in forensic science. She ended up signing up for an internship program that she was able to get into, which she says was a pivotal change for her that provided her the chance to begin her career. She shares the advice that if anyone is looking to get into this career, she highly recommends looking into the career before beginning. Following some advise given to her by a professor and mentor, she says that telling the truth helps her deal with adversity in the workplace. Shelley says "In our industry, there are so many opportunities for our opinions and testimonies to be coerced and swayed. I refuse to do that and every time I come back to what my professor said, if you don't want to spend the rest of your life looking over your shoulders, just simply tell the truth." We thank Shelley for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Phishing campaign takes the energy out of Chinese nuclear industry. [Research Saturday] May 06, 2023

Show notes

Ryan Robinson from Intezer to discuss his team's work on "Phishing Campaign Targets Chinese Nuclear Energy Industry." The research team discovered activity targeting the nuclear energy industry in China. Researchers attributed the activity to Bitter APT, a South Asian APT that is known to target the energy, manufacturing and government sectors, mainly in Pakistan, China, Bangladesh, and Saudi Arabia.

The article states "We identified seven emails pretending to be from the Embassy of Kyrgyzstan, being sent to recipients in the nuclear energy industry in China. In some emails, people and entities in academia are also targeted, also related to nuclear energy." By luring recipients in, invites them to join conferences on subjects that are relevant to them, they are then able to social engineer the victims.

The research can be found here:

Phishing Campaign Targets Chinese Nuclear Energy Industry

Learn more about your ad choices. Visit megaphone.fm/adchoices

DPRK's Kimsuki spearphishes. A standards strategy for AI. Ransomware Task Force retrospective. KillNet's new menu. Ex Uber CSO sentenced for data breach cover-up. May 05, 2023

Show notes

Kimsuki has a new reconnaissance tool. The Biden administration shares plans for AI. Reports on the ransomware taskforce report. KillNet recommits to turning a profit. Deepen Desai from Zscaler has the latest stats on Phishing. Our guest is Karen Worstell from VMware with a conversation about inclusivity. And the former CSO at Uber is sentenced.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/87

Selected reading.

Kimsuky Evolves Reconnaissance Capabilities in New Global Campaign (SentinelOne)

Ransomware Task Force Gaining Ground - May 2023 Progress Report (Ransomware Task Force)

Influential task force takes stock of progress against ransomware (Washington Post)

For Money and Attention: Killnet Apparently Reorganizes Again (Flashpoint)

Killnet Ostracizes Leader of Anonymous Russia, Adding New Chapter to Pro-Kremlin Hacktivist Drama (Flashpoint)

Former Uber CSO Joe Sullivan Avoids Prison Time Over Data Breach Cover-Up (Security Week)

Former Uber security chief Sullivan avoids prison in data breach case (Washington Post)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyberespionage, straight out of Beijing, Teheran, and Moscow. Developments in the criminal underworld. Indictment in a dark web carder case. May 04, 2023

Show notes

An APT41 subgroup uses new techniques to bypass security products. Iranian cyberespionage group MuddyWater is using Managed Service Provider tools. Wipers reappear in Ukrainian networks. Meta observes and disrupts the new NodeStealer malware campaign. The City of Dallas is moderately affected by a ransomware attack. My conversation with Karin Voodla, part of the US State Department’s Cyber fellowship program. Lesley Carhart from Dragos shares Real World Stories of Incident Response and Threat Intelligence. And there’s been an indictment and a takedown in a major dark web carder case.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/86

Selected reading.

Attack on Security Titans: Earth Longzhi Returns With New Tricks (Trend Micro)

APT groups muddying the waters for MSPs (ESET)

Russian hackers use WinRAR to wipe Ukraine state agency’s data (BleepingComputer)

WinRAR as a "cyberweapon". Destructive cyberattack UAC-0165 (probably Sandworm) on the public sector of Ukraine using RoarBat (CERT-UA#6550) (CERT-UA)

The malware threat landscape: NodeStealer, DuckTail, and more (Engineering at Meta)

Facebook disrupts new NodeStealer information-stealing malware (BleepingComputer)

NodeStealer Malware Targets Gmail, Outlook, Facebook Credentials (Decipher)

City of Dallas likely targeted in ransomware attack, city official says (Dallas News)

Cybercriminal Network Fueling the Global Stolen Credit Card Trade is Dismantled (US Department of Justice)

Secret Service, State Department Offer Up To $10 Million Dollar Reward For Information On Wanted International Fugitive (US Secret Service)

Police dismantles Try2Check credit card verifier used by dark web markets (BleepingComputer)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Iran integrates influence and cyber operations. ChatGPT use and misuse. Trends in the cyber underworld. Hybrid warfare and cyber insurance war clauses. May 03, 2023

Show notes

Iran integrates influence and cyber operations. ChatGPT use and misuse. Phishing reports increased significantly so far in 2023, while HTML attacks double. An update on the Discord Papers. Cyberstrikes against civilian targets. My conversation with our own Simone Petrella on emerging cyber workforce strategies. Tim Starks from the Washington Post joins me with reflections on the RSA conference. And, turns out, a war clause cannot be invoked in denying damage claims in the NotPetya attacks (at least not in the Garden State).

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/85