CyberWire Daily

Latest Episodes:

CISA Alert AA22-249A – #StopRansomware: Vice Society.” [CISA Cybersecurity Alerts] Sep 06, 2022

Show notes

CISA, the FBI, and the Multi-State Information Sharing and Analysis Center, or MS ISAC, are releasing this advisory to disseminate indicators of compromise and TTPs associated with Vice Society actors and their ransomware campaigns. The FBI, CISA, and the MS-ISAC have recently observed Vice Society actors disproportionately targeting the education sector with ransomware attacks.

AA22-249A Alert, Technical Details, and Mitigations

Stopransomware.gov is a whole-of-government approach that gives one central location for ransomware resources and alerts.

Resource to mitigate a ransomware attack: CISA-Multi-State Information Sharing and Analysis Center (MS-ISAC) Joint Ransomware Guide.

No-cost cyber hygiene services: Cyber Hygiene Services and Ransomware Readiness Assessment.

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at central@cisa.dhs.gov or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or CyWatch@fbi.gov.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Notes on the C2C market. A new cyberespionage threat actor has surfaced. Sharkbot made a brief return to Google Play. Privateering and catphishing in the hybrid war. Sep 06, 2022

Show notes

A Phishing-as-a-service offering on the dark web bypasses MFA. The Worok cyberespionage group is active in Central Asia and the Middle East. Prynt Stealer and the evolution of commodity malware. Sharkbot malware reemerged in Google Play. BlackCat/ALPHV claims credit for attack on the Italian energy sector. Joe Carrigan shares stats on social engineering. Our guest is Angela Redmond from BARR Advisory with six cybersecurity KPIs. And the Los Angeles Unified School District was hit with ransomware.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/171

Selected reading.

EvilProxy Phishing-As-A-Service With MFA Bypass Emerged In Dark Web (Resecurity)

Worok: The big picture (WeLiveSecurity)

Dev backdoors own malware to steal data from other hackers (BleepingComputer)

The Prynt Stealer malware contains a secret backdoor. Crooks steal data from other cybercriminals (Security Affairs)

Fake Antivirus and Cleaner Apps Caught Installing SharkBot Android Banking Trojan (The Hacker News)

SharkBot malware sneaks back on Google Play to steal your logins (BleepingComputer)

BlackCat ransomware claims attack on Italian energy agency (BleepingComputer)

11.84GB of United States Military Contractor and Military Reserve data has been leaked. (vx-underground)

Hackers honeytrap Russian troops into sharing location, base bombed: Report (Newsweek)

LAUSD hit by hackers in apparent cyber attack (FOX 11 Los Angeles)

Los Angeles Unified Targeted by Ransomware Atta (Los Angeles Unified School District)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Anjali Hansen: Cross team collaboration works best. [Privacy Counsel] [Career Notes] Sep 04, 2022

Show notes

Anjali Hansen, a senior privacy counselor from Noname Security shares her story as she climbed through the ranks to get to where she is toady. When Anjali started she wanted to do international law. She started working for the International Trade Commission after law school which is where she was able to gain most of her experience and gain real world abilities. Working with online fraud and abuse, she shares, concerned her because it felt like governments could not protect organizations from threats occurring, which is how she got interested in cyber crime. From there, she moved to Noname Security and working there she found that she is working with every group in the organization, creating a cross team collaboration and how much she admires that type of model. She says "We have to help other departments protect the data because the data's throughout an organization, it's in HR, it's in sales and marketing, it's in IT, it's in finance. So you have to be able to work with all these teams." We thank Anjali for sharing her story.

Learn more about your ad choices. Visit megaphone.fm/adchoices

LockBit's contradiction on encryption speed. [Research Saturday] Sep 03, 2022

Show notes

Ryan Kovar from Splunk sits down with Dave to discuss their findings in "Truth in Malvertising?" that contradict the LockBit group's encryption speed claims. Splunk's SURGe team recently released a whitepaper, blog, and video that outlined the encryption speeds of 10 different ransomware families. During their research they cam across Lockbit doing the same thing. After completing the research, the researchers came back to test the veracity of LockBit’s findings.

The research showed three interesting finds. The first find showed that LockBit’s fastest and slowest samples were closely aligned between the tests, but the other results were very different. They also found that LockBit continues to be the fastest ransomware, but LockBit 2.0 was more efficient yet slower than its previous counterpart, LockBit 1.0. Lastly, once ransomware gets to the point of encrypting your systems, it’s too late.

The research can be found here:

Truth in Malvertising?

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ransomware groups continue to shift identities and targets. Assessments of the cyber phases of a hybrid war. Is wartime tough for criminals? Anonymous counts coup…against Moscow’s taxis. Sep 02, 2022

Show notes

REvil (or an impostor, or successor) may be back. A Paris-area medical center continues to work to recover from cyber extortion. An assessment of Russian failure (or disinclination) to mount effective cyber campaigns. Cyber criminals find wartime to be a tough time. Josh Ray from Accenture looks at cyber threats to the rail industry. Our guest is Dan Murphy of Invicti making the case that not all vulnerabilities are created equal. And Yandex Taxi’s app was hacked in a nuisance attack.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/170

Selected reading.

REvil says they breached electronics giant Midea Group (Cybernews)

Paralysed French hospital fights cyber attack as hackers lower ransom demand (RFI)

French hospital hit by $10M ransomware attack, sends patients elsewhere (BleepingComputer)

Hacks tied to Russia and Ukraine war have had minor impact, researchers say (The Record by Recorded Future)

Getting Bored of Cyberwar: Exploring the Role of the Cybercrime Underground in the Russia-Ukraine Conflict (arXiv:2208.10629v2)

Why Russia's cyber war in Ukraine hasn't played out as predicted (New Atlas)

Cyber key in Ukraine war, says spy chief (The Canberra Times)

Montenegro Sent Back to Analog by Unprecedented Cyber Attacks (Balkan Insight)

Montenegro blames criminal gang for cyber attacks on government (EU Reporter)

Ransomware Attack Sends Montenegro Reaching Out to NATO Partners (Bloomberg)

“I’m tired of living in poverty” – Russian-Speaking Cyber Criminals Feeling the Economic Pinch (Digital Shadows)

Yandex Taxi hack creates huge traffic jam in Moscow (Cybernews)

Anonymous hacked Russia's largest taxi firm and caused a massive traffic jam (Daily Star)

Learn more about your ad choices. Visit megaphone.fm/adchoices

News on three ransomware operations: BianLian, Cuba, and Ragnar Locker. How the gangs are recruiting. Mobile app supply chain blues. Happy Insider Threat Month. Sep 01, 2022

Show notes

The BianLian ransomware gang is better at coding than at the business of crime. The Attack on Montenegro seems to be ransomware. A look at Ragnar Locker's current interests. Recruiting for gangland gets allusive, but those who know, well, they know. Our guest is Dan Lanir of OPSWAT with insights on recent federal legislation supporting cyber jobs. Ben Yelin lexamines a lawsuit filed by the FTC against an online data broker. And it’s Insider Threat Month, so keep an eye on yourself.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/169

Selected reading.

BianLian Ransomware Gang Gives It a Go! ([redacted])

Montenegro blames criminal gang for cyber attacks on government (Reuters)

FBI's team to investigate massive cyberattack in Montenegro (AP NEWS)

US issues rare security alert as Montenegro battles ransomware (TechCrunch)

Cuba ransomware group claims attack on Montenegro government (IT PRO)

Cuba Ransomware Team claims credit for attack on Montenegro (Databreaches.net)

Montenegro blames Cuba ransomware for cyberattack (Cybernews)

Cybercriminals Apparently Involved in Russia-Linked Attack on Montenegro Government (SecurityWeek)

THREAT ANALYSIS REPORT: Ragnar Locker Ransomware Targeting the Energy Sector (Cybereason)

Behind the News: The Ragnar Locker Attack on Greek Natural Gas Supplier DESFA - Radiflow (Radiflow)

Mobile App Supply Chain Vulnerabilities Could Endanger Sensitive Business Information (Broadcom Software Blogs / Threat Intelligence)

“Looking for pentesters”: How Forum Life Has Conformed to the Ransomware Ban (Digital Shadows)

NCSC and Federal Partners Focus on Countering Risk in Digital Spaces during National Insider Threat Awareness Month 2022 (ODNI)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Securing multi-cloud identity with orchestration. [CyberWire-X] Sep 01, 2022

Show notes

While multi-cloud brings significant benefits, it also poses serious security risks. And identity is the reason. Each cloud platform, such as Azure, Google, and AWS, uses proprietary identity systems, and the lack of interoperability makes it unruly to manage. These disparate systems can’t talk to each other resulting in a fragmented environment full of identity silos — the perfect way for an attacker to get in and cause destruction.

In this episode of CyberWire-X, the CyberWire's CSO, Chief Analyst, and Senior Fellow, Rick Howard, is joined in the first half by Hash Table member Rick Doten, the CISO for Healthcare Enterprises and Centene. In the second half of the show, CyberWire podcast host Dave Bittner talks with our episode sponsor Strata Identity's CEO and Co-founder Eric Olden. Both sets of discussions center around the challenges to identity management caused by the rapid shift to multi-cloud.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Malicious Chrome extensions. BEC in Kentucky. Dispatches from a hybrid war, including state-directed, partisan, and criminal action. ICS advisories. “Cosplaying” hardware. Aug 31, 2022

Show notes

Chrome extensions steal browser data. A business email compromise attack is under investigation in Kentucky. Belarusian Cyber Partisans claim to have a complete Belarusian passport database. Organizing a cyber militia. CISA releases twelve ICS security advisories. Our guest is Asaf Kochan of Sentra on overemphasizing “the big one.” Carole Theriault cautions against getting ahead of yourself in the cryptocurrency supply chain. Cosplaying" hardware. And Canada welcomes a new SIGINT boss.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/168

Selected reading.

Chrome extensions with 1.4 million installs steal browsing data (BleepingComputer)

Malicious Cookie Stuffing Chrome Extensions with 1.4 Million Users (McAfee Blog)

Police investigate electronic theft of federal funds (City of Lexington)

FBI, Secret Service join Kentucky investigation into $4 million cybercrime theft (The Record by Recorded Future)

Russian hackers blamed for ongoing Montenegro cyberattack (Tech Monitor)

“For the 1st time in human history a #hacktivist collective obtained passport info of the ALL country's citizens.” (Cyber Partisans)

Inside the IT Army of Ukraine, ‘A Hub for Digital Resistance’ (The Record by Recorded Future)

Ukraine takes down cybercrime group hitting crypto fraud victims (BleepingComputer)

Hitachi Energy FACTS Control Platform (FCP) Product (CISA)

Hitachi Energy Gateway Station (GWS) Product (CISA)

Hitachi Energy MSM Product (CISA).

Hitachi Energy RTU500 series (CISA)

Fuji Electric D300win (CISA)

Honeywell ControlEdge (CISA)

Honeywell Experion LX (CISA)

Honeywell Trend Controls Inter-Controller Protocol (CISA)

Omron CX-Programmer (CISA)

PTC Kepware KEPServerEX (CISA)

Sensormatic Electronics iSTAR (CISA)

Mitsubishi Electric GT SoftGOT2000 (CISA)

Walmart Sells Fake 30TB Hard Drive That’s Actually Two Small SD Cards in a Trench Coat (Vice)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyberespionage around the South China Sea. Oktapus and the Twilio compromise. Notes from Russia’s hybrid war. And the LockBit gang looks beyond double extortion. Aug 30, 2022

Show notes

Cyberespionage around the South China Sea. Oktapus and the Twilio compromise. Montenegro works to recover from a Russian cyber offensive. A big Russian streaming platform sustains a data leak. Ann Johnson of the Afternoon Cyber Tea podcast speaks with Dave DeWalt of NightDragon and Jay Leek of both Syn Ventures and Clear Sky Security about cyber capital investment. Mr. Security Answer Person John Pescatore examines the allure of the healthcare industry for ransomware operators. And the LockBit gang looks beyond double extortion.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/167

Selected reading.

Rising Tide: Chasing the Currents of Espionage in the South China Sea (Proofpoint)

Why the Twilio Breach Cuts So Deep (WIRED)

Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms (Threatpost)

Hackers used Twilio breach to intercept Okta onetime passwords (SiliconANGLE)

Okta Impersonation Technique Could be Utilized by Attackers (SecurityWeek)

Ukraine launches counter-offensive to retake Kherson from Russia (The Telegraph)

Russia-Ukraine war: Kremlin insists invasion going to plan despite counterattacks; first grain ship docks in Africa – live (the Guardian)

Montenegro says Russian cyberattacks threaten key state functions (BleepingComputer)

Montenegro struggles to recover from cyberattack that officials blame on Russia (The Record by Recorded Future)

Leading Russian streaming platform suffers data leak allegedly impacting 44 million users (The Record by Recorded Future)

LockBit ransomware mulls triple extortion following DDoS attack (SC Media)

Learn more about your ad choices. Visit megaphone.fm/adchoices

How a hybrid war spreads its cyber effects. Russian and Chinese cyber ops in Latin America. Greenwashing influence. Iranian threat actor exploits Log4j vulnerabilities against Israeli targets. Aug 29, 2022

Show notes

Russian cyber operations in Southeastern Europe. The challenge of containing the cyber phases of a hybrid war. Russian and Chinese cyber activity in Latin America. Greenwashing influence operations. Rick Howard looks at risk probabilities. Dinah Davis from Arctic Wolf looks at ransomware payment myths. And an Iranian threat actor exploits Log4j vulnerabilities against Israeli targets.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/166