CyberWire Daily

Latest Episodes:

Notes from the hybrid war: nuisance-level DDoS, cyberespionage, and the possibility of financially motivated hacking. US policy on the software supply chain, and notes from the underworld. Sep 15, 2022

Show notes

Nuisance-level DDoS and cyberespionage continue to mark Russia's cyber campaign in the hybrid war. There’s a US Presidential memorandum on software supply chain security. Webworm repurposes older RATs. Trends in cyber insurance claims. OriginLogger may be the new Agent Tesla. The SparklingGoblin APT described. Mathieu Gorge of VigiTrust describes cyber vulnerabilities in the hospitality industry. Dinah Davis from Arctic Wolf explains a PayPal phishing attack. And Royal funeral phishbait.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/178

Selected reading.

Pro-Russia hackers claim to have temporarily brought down Japanese govt websites (Asia News Network)

Gamaredon APT targets Ukrainian government agencies in new campaign (Cisco Talos)

Russia-linked Gamaredon APT target Ukraine with a new info-stealer (Security Affairs)

Fears grow of Russian spies turning to industrial espionage (The Record by Recorded Future)

Enhancing the Security of the Software Supply Chain through Secure Software Development Practices (The White House)

Enhancing the Security of the Software Supply Chain to Deliver a Secure Government Experience (The White House)

White House releases post-SolarWinds federal software security requirements (Federal News Network)

Webworm: Espionage Attackers Testing and Using Older Modified RATs (Threat Hunter Team Symantec)

Coalition Releases 2022 Cyber Claims Report: Mid-year Update (GlobeNewswire News Room)

OriginLogger: A Look at Agent Tesla’s Successor (Unit 42)

You never walk alone: The SideWalk backdoor gets a Linux variant (WeLiveSecurity)

[Scam site harvests credentials] (Proofpoint)

Current, former social media execs address national security issues at Senate hearing (Fox Business)

Senators Have Stopped Embarrassing Themselves at Tech Hearings (Slate Magazine)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Patch Tuesday notes. Mr. Mudge goes to Washington. Joint warning of IRGC cyber activity. No major developments in the cyber phases of Russia’s hybrid war (but Ukraine is sounding confident). Sep 14, 2022

Show notes

Patch Tuesday notes. The US Senate Judiciary Committee hears from the Twitter whistleblower. Joint warning of IRGC cyber activity. Rob Boyce from Accenture on cybercriminals weaponizing leaked ransomware data. Chris Novak from Verizon describes his participation in the CISA Advisory Board. And Ukraine reiterates confidence in its resiliency.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/177

Selected reading.

Adobe Patches 63 Security Flaws in Patch Tuesday Bundle (SecurityWeek)

Microsoft Releases September 2022 Security Updates (CISA)

Microsoft's September Patch Tuesday fixes five critical bugs (Computing)

Microsoft Raises Alert for Under-Attack Windows Flaw (SecurityWeek)

SAP Security Patch Day September 2022 (Onapsis)

Apple Releases Security Updates for Multiple Products (CISA)

Apple fixes eighth zero-day used to hack iPhones and Macs this year (BleepingComputer)

Apple Will Let You Remove Rapid Security Response Updates in iOS 16 (Mac Rumors)

Data Security at Risk: Testimony from a Twitter Whistleblower (United States Senate Committee on the Judiciary)

Twitter Employees Have Too Much Access to Data, Whistleblower Says (Wall Street Journal)

Twitter whistleblower reveals employees concerned China agent could collect user data (Reuters)

Security failures cause ‘real harm to real people’ (Washington Post)

Twitter whistleblower testifies to Congress, calls for tech regulation reforms (The Record by Recorded Future)

The Search for Dirt on the Twitter Whistle-Blower (The New Yorker)

Whistle-Blower Says Twitter ‘Chose to Mislead’ on Security Flaws (New York Times)

Twitter whistleblower says site put growth over security (Computing)

Written Statement of Peiter (“Mudge”) Zatko United States Senate Judiciary Committee September 13, 2022 (Katz Banks Kumin)

What we learned when Twitter whistleblower Mudge testified to Congress (TechCrunch)

How China became big business for Twitter (Reuters)

Twitter whistleblower exposes limits of FTC’s power (Washington Post)

Twitter Whistle-Blower Testimony Spurs Calls for Tech Regulator (Bloomberg)

Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Operations (CISA)

Ukraine’s Cyberwar Chief Sounds Like He’s Winning (WIRED)

DDoS attacks on financial sector surge during war in Ukraine, new FCA data reveals (PR Newswire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

A conversation with members of Baltimore FBI: Special Agent in Charge, Tom Sobocinski, and Supervisory Special Agent for Cyber, Tom Breeden. [Special Editions] Sep 13, 2022

Show notes

In this extended interview, CyberWire Daily Podcast host Dave Bittner sits down with members of the FBI's Baltimore field office: Special Agent in Charge, Tom Sobocinski, and Supervisory Special Agent for Cyber, Tom Breeden. As part of the FBI's cybersecurity awareness campaign, they discuss what the FBI can do to enhance and amplify cyber efforts in ways unlike any other public or private organization. This interview from August 30, 2022 originally aired as a shortened version on the CyberWire Daily Podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Apple patches. Reviewing the cyber phase of a hybrid war. ShadowPad’s return. Phishing from the Static Expressway. Medical device threats. Security trends. Charming Kitten’s social engineering. Sep 13, 2022

Show notes

Apple patches its software. Reviewing the cyber phase of a hybrid war. The return of the (ShadowPad) alumni. Phishing from the Static Expressway. The state of cloud security. Overconfidence comes at a cost. Ann Johnson of Afternoon Cyber Tea speaks with Dr. Josephine Wolff from the Fletcher School about cyber insurance past. My conversation with FBI special agents Tom Sobocinski and Tom Breeden. And Charming Kitten and group-think in social engineering.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/176

Selected reading.

Apple security updates (Apple Support)

Ukraine Cyber War Update September 2022 (CyberCube)

New Wave of Espionage Activity Targets Asian Governments (Broadcom Software Blogs)

Chinese gov’t hackers using ‘diverse’ toolset to target Asian prime ministers, telecoms (The Record by Recorded Future)

Leveraging Facebook Ads to Send Credential Harvesting Links (Avanan)

Unpatched and Outdated Medical Devices Provide Cyber Attack Opportunities (FBI)

CFO Cyber Security Survey: Over-Confidence is Costly (Kroll)

Snyk’s State of Cloud Security Report Reveals 80% of Organizations Have Experienced a Severe Cloud Security Incident in Past Year (Snyk)

Look What You Made Me Do: TA453 Uses Multi-Persona Impersonation to Capitalize on FOMO (Proofpoint)

Iranian military using spoofed personas to target nuclear security researchers (The Record by Recorded Future)

Alleged cyber commander of Iran’s Revolutionary Guard named by opposition outlet (Times of Israel)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Albania reports more Iranian cyberattacks. RaidForums has a new successor. A look at threat actor reconnaissance in the contemporary Internet. Sep 12, 2022

Show notes

Albania reports additional cyberattacks from Iran over the weekend. RaidForums has a new successor. A look at threat actor reconnaissance in the contemporary Internet. Kinetic strikes hit Ukraine’s infrastructure. Rick Howard calculates risk with classic mathematical theorems. Tim Eades from Cyber Mentor Fund on the dynamic nature of the attack surface. And a look into the cyber phase of the hybrid war.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/175

Selected reading.

Albania blames Iran for second cyberattack since July (CNN)

Treasury Sanctions Iranian Ministry of Intelligence and Minister for Malign Cyber Activities (US Department of the Treasury)

Iran strongly condemns US sanctions over Albania hacking (Al Arabiya)

Six months into Breached: The legacy of RaidForums? (KELA)

2022 State of the Internet Report (Censys)

Ukraine hails snowballing offensive, blames Russia for blackouts (Reuters)

Ukraine says Russia is retaliating by hitting critical infrastructure, causing blackouts. (New York Times)

Last reactor at Ukraine’s Zaporizhzhia nuclear plant stopped (Associated Press)

Ukraine Warns Russian Cyber Onslaught Is Coming (Voice of America)

Montenegro wrestles with massive cyberattack, Russia blamed (ABC News)

CyberCube: Russia’s Sovereign Internet Creates Security Risks With Implications for Cyber (Re)Insurance While War in Ukraine Develops (Associated Press)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Mark Logan: March towards your goals. [CEO] [Career Notes] Sep 11, 2022

Show notes

Mark Logan, CEO of One Identity, sits down to share his story, explaining how he fit into different roles growing up in different companies. Mark has nearly two decades of C-Suite experience at an array of different organizations, finally landing on his current position as the CEO at One Identity. Sharing his different roles, he also gives a quote from Steve Jobs, saying "it's not what I say yes to, it's what I say no to." He believes that's a key area for his workers because when he is able to make up his mind, his team and his customers have someone they can rely on. Mark says that as a CEO he wants to share the advice of always marching towards your goals, and identifying that different people have different goals because they work in different fields, but that's what makes a company work best. He says "I've found that the more you can delegate, provided you've got the right folks in place the better." We thank Mark for sharing his story.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Evilnum APT returns with new targets. [Research Saturday] Sep 10, 2022

Show notes

Deepen Desai from Zscaler ThreatLabz joins Dave to discuss their work on "Return of the Evilnum APT with updated TTPs and new targets." Zscaler’s ThreatLabz team recently caught a new Evilnum APT attack campaign that uses the document template on MS Office Word to inject malicious payload to the victim's machine. There are three new instances used of the campaign, including updated tactics, techniques, and procedures.

Researchers have been closely monitoring Evilnum APT’s activity. They ssay ThreatLabz identified several domains associated with the Evilnum APT group. Which has led them to discover that the "group has been successful at flying under the radar and has remained undetected for a long time."

The research can be found here:

Return of the Evilnum APT with updated TTPs and new targets

Learn more about your ad choices. Visit megaphone.fm/adchoices

Threats to US elections. Lazarus Group targeting energy companies. Gaming-related threats. Sep 09, 2022

Show notes

Nation-states are expected to target the US midterm elections. North Korea’s Lazarus Group is targeting energy companies. The Ukraine’s Ministry of Digital Transformation on cyber lessons learned from Russia’s hybrid war against Ukraine. CISA flags twelve known exploited vulnerabilities for attention and remediation. Vulnerable anti-cheat engines used for malicious purposes. Steve Carter from Nucleus Security has thoughts on AI in cybersecurity. Roland Cloutier, former CSO of TikTok, discusses working around the changing career field, needs, and how enterprise executives are developing and finding talent. And a look at top gaming-related malware lures.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/174

Selected reading.

Mandiant ‘highly confident’ foreign cyberspies will target US midterm elections (The Register)

What to Expect When You’re Electing: Preparing for Cyber Threats to the 2022 U.S. Midterm Elections (Mandiant)

North Korea’s Lazarus hackers are exploiting Log4j flaw to hack US energy companies (TechCrunch)

Lazarus and the tale of three RATs (Cisco Talos)

How Gaming Cheats Are Cashing in Below the Operating System (Eclypsium)

Good game, well played: an overview of gaming-related cyberthreats in 2022 (Securelist)

Cybercriminals target games popular with kids to distribute malware (The Register)

CISA Adds Twelve Known Exploited Vulnerabilities to Catalog  (CISA)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Bronze President shows both enduring interests and adaptability. Iranian threat actor activity reported. Cybersecurity and small-to-medium businesses. Sep 08, 2022

Show notes

Bronze President shows both enduring interests and adaptability. Iranian threat actor activity is reported. Cybersecurity and small-to-medium businesses. An initial access broker repurposes Conti's old playbook for use against Ukraine. Johannes Ullrich from SANS on Scanning for VoIP Servers. Our guest is Ian Smith from Chronosphere on observability. And Kyivstar as a case study in telco resiliency.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/173

Selected reading.

BRONZE PRESIDENT Targets Government Officials (Secureworks)

APT42: Crooked Charms, Cons, and Compromises (Mandiant)

Profiling DEV-0270: PHOSPHORUS’ ransomware operations (Microsoft)

Albania cuts diplomatic ties with Iran over July cyberattack (The Washington Post)

Initial access broker repurposing techniques in targeted attacks against Ukraine (Google)

Unprecedented Shift: The Trickbot Group is Systematically Attacking Ukraine (IBM SecurityIntelligence)

Ransomware gang's Cobalt Strike servers DDoSed with anti-Russia messages (BleepingComputer)

Ukraine’s largest telecom stands against Russian cyberattacks (POLITICO)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Albania attributes major cyberattack to Iran. TikTok denies breach. New Linux malware. Sep 07, 2022

Show notes

The Albanian government attributes a disruptive cyber attack to Iran. TikTok says it’s found no evidence of a data breach. Researchers have discovered a new strain of Linux malware. US agencies warn of ransomware targeting the education sector. Finland prepares to increase its cybersecurity capacity. Deepen Desai from Zscaler on the latest updates to Raccoon Stealer. Our guest is Lance Spitzner from the SANS Institute with results of their recent Security Awareness Report. And a fond farewell to the father of Let’s Encrypt.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/172