CyberWire Daily

Latest Episodes:

David Nosibor: Taking calculated risks. [Product Lead] [Career Notes] Aug 28, 2022

Show notes

David Nosibor, Product Lead for SafeCyber at UL Solutions, started his career in a unique way by not letting himself be pigeonholed. Within his company, David was able to grow to the position he is in now and says that his position feels like a lot of roles tied into one. He says that on any given day he is tackling all sorts of elements, such as marketing, operations, working with the engineering team, figuring out ways to acquire customers, retain them, and also working on sales and business development capabilities. He also says that constantly learning and getting new opportunities was how he ended up being where he is today. David states that staying focused and being on the lookout for ways to accomplish the mission is the best way for him in his company to democratize product security. He quotes the famous singer Sean Carter in saying that he firmly believes in taking calculated risks to get where you need to be going. We thank David for sharing his story.

Learn more about your ad choices. Visit megaphone.fm/adchoices

How a wide scale Facebook campaign stole 1 million credentials. [Research Saturday] Aug 27, 2022

Show notes

Nick Ascoli from ForeTrace in a partnership with PIXM sits down with Dave to provide insight on their team's work on "Phishing tactics: how a threat actor stole 1 million credentials in 4 months." During routine analysis, researchers discovered the connection between the pages using PIXM’s deep html analysis feature, which enabled them to view and analyze the underlying code on the pages after they were flagged as phishing. This led to the ensuing investigation, which was led by PIXM’s threat research team with assistance from Nick Ascoli.

The research states "we uncovered a campaign whose scale has potentially impacted hundreds of millions of facebook users, and whose complexity offer insight into the evolving nature of phishing operations, especially from a technical perspective."

The research can be found here:

Phishing tactics: how a threat actor stole 1M credentials in 4 months

Learn more about your ad choices. Visit megaphone.fm/adchoices

A Black Basta update. Okta talks Scatter Swine. Nobelium's MagicWeb. Wartime stress in the cyber underworld. LastPass security incident. CISA adds to its Known Exploited Vulnerabilities Catalog. Aug 26, 2022

Show notes

Palo Alto describes the Black Basta ransomware-as-a-service operation. Okta on Scatter Swine, the threat actor that compromised Twilio. Microsoft describes Nobelium's new approach to establishing persistence. Russia's war against Ukraine has induced stresses in the cyber underworld. LastPass discloses a security incident. Josh Ray from Accenture on cyber crime and the cost-of-living crisis. Our own Dave Bittner sits down with Chris Handman from TerraTrue to discuss how he works to transform legal teams into advocates and collaborators that can ensure privacy is baked in every step of the way. And CISA adds ten entries to its Known Exploited Vulnerabilities Catalog.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/165

Selected reading.

Threat Assessment: Black Basta Ransomware (Palo Alto Networks Unit 42)

MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone (Microsoft Threat Intelligence Center)

Microsoft Uncovers New Post-Compromise Malware Used by Nobelium Hackers (The Hacker News)

Microsoft: Russian hackers gain powerful 'MagicWeb' authentication bypass (ZDNET)

Detecting Scatter Swine: Insights into a relentless phishing campaign (Okta Security)

Twilio hackers hit over 130 orgs in massive Okta phishing attack (BleepingComputer)

Twilio says breach also compromised Authy two-factor app users (TechCrunch)

How the war in Ukraine is reshaping the dark web (New Statesman)

Notice of Recent Security Incident (The LastPass Blog)

LastPass Says Source Code Stolen in Data Breach (SecurityWeek)

LastPass developer systems hacked to steal source code (BleepingComputer)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Notes from six months of hybrid war. Oktapus criminal campaign. Exotic Lily and Bumblebee Loader. Insights derived from DNS traffic. US DHS shutters its Disinformation Governance Board. Aug 25, 2022

Show notes

Ukrainian and Russian cyber operations at six months. Oktapus criminal campaign compromises 9931 accounts in more than 130 organizations. Exotic Lily and Bumblebee Loader. Insights derived from DNS traffic. Chris Novak from Verizon on DHS Cyber Safety Review Board's report on the Log4j investigation that Verizon conducted. Dave Bittner sits down with our guest Dr. Scott Crowder, CTO and VP, Quantum Computing, Technical Strategy and Transformation for IBM Systems to discuss the increasingly urgent need for industries to prepare for security threats that quantum could unleash. And the US Department of Homeland Security shutters its Disinformation Governance Board.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/164

Selected reading.

How Ukraine used Russia’s digital playbook against the Kremlin (POLITICO)

Ukraine's volunteer 'IT army' responds to Russian hackers, minister says (ABC News)

Overview of the Cyber Weapons Used in the Ukraine - Russia War (Trustwave)

How Russia-Ukraine cyberwar is impacting orgs: Two-thirds say they have been targeted (VentureBeat)

Twilio hackers breached over 130 organizations during months-long hacking spree (TechCrunch)

Roasting 0ktapus: The phishing campaign going after Okta identity credentials (Group-IB)

Bumblebee Malware Loader: Deep Instinct Prevents Attack Pre-Execution (Deep Instinct)

Akamai’s Insights on DNS in Q2 2022 (Akamai)

Following HSAC Recommendation, DHS terminates Disinformation Governance Board (US Department of Homeland Security)

Homeland Security Scraps Disinformation Board Attacked by GOP (Bloomberg)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ransomware attack hits a French hospital. Lessons for the fifth domain from six months of hybrid war. Deepfake scams have arrived. Threat actors prepare to exploit Hikvision camera vulnerability. Aug 24, 2022

Show notes

A medical center near Paris comes under ransomware attack, and refuses to pay up. Lessons for the fifth domain from six months of hybrid war. Deepfake scams appear to have arrived. Deepen Desai from Zscaler with introduction to our audience. Dave Bittner sits down with Gil Hoffer, CTO and Co-founder of Salto to discuss “Who Hacked Slack?.” And Threat actors prepare to exploit Hikvision camera vulnerability.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/163

Selected reading.

Cyber attackers disrupt services at French hospital, demand $10 million ransom (France 24)

French hospital hit by $10M ransomware attack, sends patients elsewhere (BleepingComputer)

DECLENCHEMENT DU PLAN BLANC DIMANCHE 21 AOUT 2022 (CHSF - Centre Hospitalier Sud Francilien)

Ukraine at D+181: Independence Day and six months of war. (CyberWire)

Six months, twenty-three lessons: What the world has learned from Russia’s war in Ukraine (Atlantic Council)

Hackers Used Deepfake of Binance CCO to Perform Exchange Listing Scams (Bitcoin News)

Hackers Use Deepfakes of Binance Exec to Scam Multiple Crypto Projects (Gizmodo)

Binance's CEO said thousands of people are falsely claiming to be his employees on LinkedIn. Experts warn it's an example of the platform's growing problem with fake accounts. (Business Insider)

Twitter’s Ex-Security Head Files Whistleblower Complaint (Wall Street Journal)

Twitter is vulnerable to Russian and Chinese influence, whistleblower says (CNN)

Over 80,000 exploitable Hikvision cameras exposed online (BleepingComputer)

Experts warn of widespread exploitation involving Hikvision cameras (The Record by Recorded Future)

Hikvision Surveillance Cameras Vulnerabilities (CYFIRMA)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Iranian APT data extraction tool described. LockBit gang comes under DDoS. Twitter whistleblower security claims made public. Greek natural gas supplier under cyberattack. Updates on a hybrid war. Aug 23, 2022

Show notes

Iranian APT data extraction tool described. LockBit gang comes under DDoS. Twitter whistleblower security claims made public. Poland and Ukraine conclude cybersecurity agreement. Greek national natural gas supplier under criminal cyberattack. Update to the Joint Alert on Zimbra exploitation. Addition to CISA's Known Exploited Vulnerabilities Catalog. Johannes Ullrich from SANS on Control Plane vs. Data Plane vulnerabilities. Our guest is David Nosibor, Platform Solutions Lead for UL to discuss SafeCyber Phase II. And, finally, targeting and trolling, with an excursus on Speedos. Really.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/162

Selected reading.

New Iranian APT data extraction tool (Google)

LockBit gang hit by DDoS attack after Entrust leaks (Register)

Former security chief claims Twitter buried ‘egregious deficiencies’ (Washington Post)

Ex-Twitter exec blows the whistle, alleging reckless and negligent cybersecurity policies (CNN)

Twitter’s Ex-Security Head Files Whistleblower Complaint (Wall Street Journal)

Deception, Bots, and Foreign Agents: The Twitter Whistleblower’s Biggest Allegations (Time)

The Ministry of Digital Transformation, State Service of Special Communication and Information Protection and the Council of Ministers of the Republic of Poland signed Memorandum of understanding in the cybersecurity field. (State Service of Special Communication and Information Protection)

Greek natural gas operator suffers ransomware-related data breach (BleepingComputer)

Greek gas operator refuses to negotiate with ransomware group after attack (The Record by Recorded Future)

Announcement | (DESF)

Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite (CISA)

US government really hopes you've patched your Zimbra server (Register)

CISA Adds One Known Exploited Vulnerabilities to Catalog (CISA)

Speedo-wearing Russian tourists leak defence secrets on Twitter (The Telegraph)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Bogus DDoS protection pages distribute malware. Estonia deals with DDoS attacks. Roskomnadzor's Internet panopticon.And data-tampering attacks are regarded as a growing risk. Aug 22, 2022

Show notes

Bogus DDoS protection pages distribute malware. Estonia deals with DDoS attacks. Roskomnadzor's Internet panopticon. Rick Howard on the RSA Security Breach of 2011 and the Equifax breach of 2017. Caleb Barlow on what does a recession mean for cyber security venture capital and what is the impact of this on the industry? And data-tampering attacks are regarded as a growing risk.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/161

Selected reading.

WordPress sites hacked with fake Cloudflare DDoS alerts pushing malware (BleepingComputer)

Fake DDoS Pages On WordPress Sites Lead to Drive-By-Downloads (Sucuri Blog)

Car blast kills daughter of Russian known as 'Putin's brain' (AP NEWS)

Russia blames Kyiv for killing daughter of ‘Putin’s Rasputin’, but the truth may be closer to home (The Telegraph)

Alexander Dugin's daughter killed by anti-war Russians: Former state deputy (Newsweek)

Estonia Repels Biggest Cyber-Attack Since 2007 (Infosecurity Magazine)

Estonia's Battle Against a Deluge of DDoS Attacks (Infosecurity Magazine)

Latvia Starts Removing Soviet Monument in Challenge to Russia (Bloomberg)

Data-tampering attacks are a 'nightmare' threat that's hard to detect (Protocol)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Roya Gordon: Becoming a trailblazer. [Research] [Career Notes] Aug 21, 2022

Show notes

Roya Gordon, a Security Research Evangelist at ICS cybersecurity firm Nozomi Networks, started her career as an intelligence specialist in the U.S. Navy. After her time serving, Roya spent time as a Control Systems Cybersecurity Analyst at the Idaho National Laboratory and then took the role of Cyber Threat Intelligence Manager at Accenture. She shares her story after the NSA accepted her and then quickly diverted, creating a new path for Roya to follow. She shares the jobs she went after along the way, leading up to Nozomi Networks and how she wishes to be a trailblazer for young black women everywhere. She hopes to shape young women's minds on what the cybersecurity industry is actually like, in hopes that she can be a figure people look up to. We thank Roya for sharing her story.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Clipminer: Making millions off of malware. [Research Saturday] Aug 20, 2022

Show notes

Dick O'Brien from Symantec, a part of Broadcom Software, joins Dave to discuss how the cyber-criminal operation, Clipminer Botnet, makes operators behind it at least $1.7 million. Symantec's research says "The malware being used, tracked as Trojan.Clipminer, has a number of similarities to another crypto-mining Trojan called KryptoCibule, suggesting it may be a copycat or evolution of that threat."

Symantec determined that the malware has the ability to mine for cryptocurrency using compromised computers’ resources. They also share a way to protect against the cyber-criminal operation, as well as sharing some indicators you could be compromised.

The research can be found here:

Clipminer Botnet Makes Operators at Least $1.7 Million

Learn more about your ad choices. Visit megaphone.fm/adchoices

Notes on the hybrid war. Criminal gang hits travel and hospitality sectors. Additions to CISA's Known Exploited Vulnerabilities Catalog. CISA issues five ICS security advisories. Aug 19, 2022

Show notes

Killnet claims a DDoS campaign against Estonia. The head of GCHQ calls Russian cyber operations a failure. US Cyber Command concludes its "hunt forward" mission in cooperation with Croatia. A criminal gang targets the travel and hospitality sectors. Thomas Pace of NetRise shares insights on firmware vulnerabilities. Daniel Floyd from BlackCloak on Quantifying the Business Need for Digital Executive Protection. CISA issues five ICS security advisories.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/160