CyberWire Daily

Latest Episodes:

Dispatches from a hybrid war. CISA releases its election cybersecurity toolkit. Post-incident disruption at NHS is expected to last at least three weeks. Cisco discloses a security incident. Aug 11, 2022

Show notes

KillMilk says his crew downed Lockheed Martin's website. Industroyer2, and what became of it. CISA releases its election cybersecurity toolkit. Post-incident disruption at Britain’s NHS. Carl Wright of AttackIQ shares strategies for CISOs to successfully prepare for the next attack. Dr. Christopher Pierson from Blackcloak joins us from Black Hat. And Cisco seems to have thwarted a security incident.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/154

Selected reading.

Russian hacking group claims attack on Lockheed Martin (SiliconANGLE

HIMARS-Maker Lockheed Martin "confident" against Russian hackers (Newsweek)

Industroyer2: How Ukraine avoided another blackout attack (SearchSecurity)

Researchers Look Inside Russian Malware Targeting Ukrainian Power Grid (PCMAG)

CISA Releases Toolkit of Free Cybersecurity Resources for Election Community (CISA)

Cybersecurity Toolkit to Protect Elections (CISA)

NHS staff told to plan for three weeks of disruption following cyberattack (Computing)

Major NHS IT outage to last for three weeks (The Independent)

Exclusive: NHS chiefs fear cyber attackers have accessed patient data (Health Service Journal)

Cisco Event Response: Corporate Network Security Incident (Cisco)

Cisco Talos shares insights related to recent cyber attack on Cisco (Cisco Talos)

Cisco confirms May attack by Yanluowang ransomware group (The Record by Recorded Future)

Cisco Hit by Cyberattack From Hacker Linked to Lapsus$ Gang (Bloomberg)

Cisco's own network compromised by gang with Lapsus$ links (Register)

Cisco hacked by Yanluowang ransomware gang, 2.8GB allegedly stolen (BleepingComputer)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Patches, and some incentive to apply them. Hacktivism, privateering, and patriotic banditry in Russia’s hybrid war. Aug 10, 2022

Show notes

Patch notes, and the risks associated with failure to patch. Finland's parliament comes under cyberattack. Killnet says there will be blood, but they may just be grandstanding for the home crowd. Cyberattacks against a UK firm that's criticized Russia's war. We’re joined by FBI Cyber Division AD Bryan Vorndran and Adam Hickey, deputy assistant attorney general for the National Security Division with an introduction to Watchguard. Our guest is Matthew Warner from Blumira with tips on avoiding burnout. And not all criminal organizations are working for Russia.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/153

Selected reading.

Already Exploited Zero-Day Headlines Microsoft Patch Tuesday (SecurityWeek)

Microsoft August 2022 Patch Tuesday fixes exploited zero-day, 121 flaws (BleepingComputer).

IBM Patches High-Severity Vulnerabilities in Cloud, Voice, Security Products (SecurityWeek)

Adobe Patch Tuesday: Code Execution Flaws in Acrobat, Reader (SecurityWeek)

ICS Patch Tuesday: Siemens, Schneider Electric Fix Only 11 Vulnerabilities (SecurityWeek)

VMSA-2022-0022 (VMware)

Emerson OpenBSI (CISA)

Emerson ControlWave (CISA)

Mitsubishi Electric GT SoftGOT2000 (CISA)

Multiple attackers increase pressure on victims, complicate incident response (Sophos News)

Life After Death—SmokeLoader Continues to Haunt Using Old Vulnerabilities (Fortinet Blog)

NBI launches probe into attack on Finnish Parliament site (Yle)

Russian hacker warns cyberwarfare will turn deadly (Newsweek)

Suspected Russian cyber attack on British soil as firm subjected to ‘daily’ hacks (The Telegraph)

Meet DUMPS Forum: A pro-Ukraine, anti-Russia cybercriminal forum | Digital Shadows (Digital Shadows)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyberespionage against belligerents' industry. Tornado Cash sanctions. Data breaches at Twilio and Klayvio. Intercept tools and policies in Canada. Aug 09, 2022

Show notes

Tracking apparent Chinese industrial cyberespionage. Tornado Cash sanctions. Twilio discloses a breach. Social engineering exposes data at Klaviyo. Microsoft’s Ann Johnson previews the latest season of Afternoon Cyber Tea. Joe Carrigan tracks the growth in cryptojacking. And what might the Mounties be monitoring?

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/152

Selected reading.

Cyberspying Aimed at Industrial Enterprises in Russia and Ukraine Linked to China (SecurityWeek)

China-linked spies used six backdoors to steal defense info (Register)

U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (U.S. Department of the Treasury)

Twilio hacked by phishing campaign (TechCrunch)

Twilio, a texting platform popular with political campaigns, reports breach (CyberScoop)

Incident Report: Employee and Customer Account Compromise - August 4, 2022 (Twilio Blog)

Email marketing firm hacked to steal crypto-focused mailing lists (BleepingComputer)

RCMP has used spyware to access targets’ communications as far back as 2002: Senior Mountie (Global News)

RCMP says it has not used Pegasus spyware (POLITICO)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cybersecurity is a team sport. [CyberWire-X] Aug 09, 2022

Show notes

In order to run a successful SOC, security leaders rely on tools with different strengths to create layers of defense. This has led to a highly siloed industry with over 2,000 vendors, each with their own specific function and who very seldom work together. To gain an advantage on attackers, we need to start seeing cybersecurity as a team sport–united for a shared mission.

In this episode of CyberWire-X, the CyberWire's CSO, Chief Analyst, and Senior Fellow, Rick Howard, is joined in the first half by two Hash Table members, Ted Wagner, CISO at SAP National Security Services, and Jenn Reed, CISO at Aviatrix. In the second half of the show, CyberWire podcast host Dave Bittner talks with our episode sponsor ExtraHop's Senior Product Marketing Manager, Chase Snyder, and CrowdStrike's Head of Product Marketing, Janani Nagarajan .They discuss why and how vendors should work together to enable better integrated security for their customers. They’ll answer questions like “what is XDR?” and “how do I get my vendors to work together?”.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Wipers, tak; grid takedown, nyet. Twitter 0-day exploited before patching. NHS 111 recovering from cyberattack. Notes on the C2C underworld. Aug 08, 2022

Show notes

Shifting cyber threats during Russia's war against Ukraine. A Twitter exploit may have compromised more than 5 million accounts. A Cyberattack disrupts NHS 111. Developments in the C2C market. An alleged Russian cryptocurrency exchange operator is extradited to the US. Rick Howard looks at FinTech. Andrea Little Limbago from Interos on Industrial policy and the tech divide. And a Crypto mixing service has been sanctioned by the US Treasury Department.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/151

Selected reading.

ESET Threat Report T 1 2022 (WeLiveSecurity)

Twitter confirms zero-day used to expose data of 5.4 million accounts (BleepingComputer)

NHS 111 software outage confirmed as cyber-attack (BBC News)

Ministers coordinate response after cyber-attack hits NHS 111 (the Guardian)

Thousands of hackers flock to 'Dark Utilities' C2-as-a-Service (BleepingComputer)

Attackers leveraging Dark Utilities "C2aaS" platform in malware campaigns (Cisco Talos)

Genesis Brings Polish to Stolen-Credential Marketplaces (Sophos)

Cyber-related Designation (U.S. Department of the Treasury)

U.S. imposes sanctions on virtual currency mixer Tornado Cash (Reuters)

Crypto Mixing Service Tornado Cash Blacklisted by US Treasury (CoinDesk)

Alleged Russian Cryptocurrency Money Launderer Extradited to United States (US Department of Justice)

Russian accused of money laundering and running $4B bitcoin exchange extradited to US | CNN Politics (CNN)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Anna Belak: Acquiring skills to make you into a unicorn. [Thought Leadership] [Career Notes] Aug 07, 2022

Show notes

Anna Belak, Director of Thought Leadership at Sysdig, shares her story from physics to cyber. Anna explains how she went into college with the thinking of getting a physics degree and then for her PhD decided to switch to material science and engineering. Both were not something she enjoyed and ultimately decided to go into cyber. She shares some advice on how you should never limit yourself to your degree, as well as always learning new skills and honing in on skills you already have. She say's by doing these things it will make you into a unicorn, meaning if you are good at one thing and teach yourself to be good at something else, you will become that much more valuable. Anna hopes she makes an impact with the people she works with, she hopes they will want to work with her even long after she leaves a company. We thank Anna for sharing her story.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Iran-linked Lyceum Group adds a new weapon to its arsenal. [Research Saturday] Aug 06, 2022

Show notes

Deepen Desai from Zscaler's ThreatLabz joins Dave to discuss how APTs, like Lyceum Group, create tactics and malware to carry out attacks against their targets. The Lyceum group has been active since 2017 and is a state-sponsored Iranian APT group. This group targets Middle Eastern organizations most notably in the energy and telecommunication sectors, and they rely heavily on .NET based malwares.

Zscaler said in their research they "recently observed a new campaign where the Lyceum Group was utilizing a newly developed and customized .NET based malware targeting the Middle East by copying the underlying code from an open source tool." They go on to give an analysis explaining why the .NET based DNS backdoor is causing problems.

The research can be found here:

Lyceum .NET DNS Backdoor

Learn more about your ad choices. Visit megaphone.fm/adchoices

CyberFront Z's failed influence operation. Iranian operators target Albanian government networks. CISA issues two ICS security advisories. CISA and ACSC issue a joint advisory on top malware strains. Aug 05, 2022

Show notes

CyberFront Z's failed influence operation. Iranian operators target Albanian government networks. CISA issues two ICS security advisories. Andy Robbins of SpecterOps to discuss Attack Paths in Azure. Denis O'Shea of Mobile Mentor talking on the intersection of endpoint security and employee experience. CISA and ACSC issue a joint advisory on top malware strains.

for links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/150

Selected reading.

Quarterly Adversarial Threat Report (Meta)

Meta took down Russian troll farm that supported country’s invasion of Ukraine (The Hill)

Russia's Infamous Troll Farm Is Back -- and Sh*tting the Bed (Rolling Stone)

Meta’s threat report highlights clumsy attempt to manipulate Ukraine discourse (TechCrunch)

Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations (Mandiant)

CISA Alert AA22-216A – 2021 top malware strains. (The CyberWire)

2021 Top Malware Strains (CISA)

Digi ConnectPort X2D (CISA)

Cisco Releases Security Updates for RV Series Routers (CISA)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ukraine claims to have taken down a massive Russian bot farm. Were Russian cyber operations premature? Report: Emergency Alert System vulnerable to hijacking. And more crypto looting. Aug 04, 2022

Show notes

Ukraine claims to have taken down a massive Russian bot farm. Russian cyber operations may have been premature. A report says Emergency Alert Systems might be vulnerable to hijacking. The Mirai botnet may have a descendant. Adam Flatley from Redacted with a look back at NotPetya. Ryan Windham from Imperva takes on Bad Bots. Attacks on a cryptocurrency exchange attempt to bypass 2FA. Solana cryptocurrency wallets looted.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/149

Selected reading.

Ukraine takes down 1,000,000 bots used for disinformation (BleepingComputer)

Did Russia mess up its cyberwar with Ukraine before it even invaded? (Washington Post)

So RapperBot, What Ya Bruting For? (Fortinet Blog)

Gaming Respawned (Akamai)

Coinbase Attacks Bypass 2FA (Pixm Anti-Phishing)

Thousands of Solana wallets drained in multimillion-dollar exploit (TechCrunch)

Thousands of Solana Wallets Hacked in Crypto Cyberattack (Wall Street Journal)

Solana, USDC Drained From Wallets in Attack (Decrypt)

Ongoing solana attack targets thousands of crypto wallets, costing users more than $5 million so far (CNBC)

Solana and Slope Confirm Wallet Security Breach (Crypto Briefing)

How Hackers Target Bridges Between Blockchains for Crypto Heists (Wall Street Journal)

Learn more about your ad choices. Visit megaphone.fm/adchoices

CISA Alert AA22-216A – 2021 top malware strains. [CISA Cybersecurity Alerts] Aug 04, 2022

Show notes

This joint Cybersecurity Advisory was coauthored by CISA and the Australian Cyber Security Centre, or ACSC. This advisory provides details on the top malware strains observed in 2021.

AA22-216A Alert, Technical Details, and Mitigations

For alerts on malicious and criminal cyber activity, see the FBI Internet Crime Complaint Center webpage.

For more information and resources on protecting against and responding to ransomware, refer to StopRansomware.gov, a centralized, U.S. Government webpage providing ransomware resources and alerts.

The ACSC recommends organizations implement eight essential mitigation strategies from the ACSC’s Strategies to Mitigate Cyber Security Incidents as a cybersecurity baseline. These strategies, known as the “Essential Eight,” make it much harder for adversaries to compromise systems.

Refer to the ACSC’s practical guides on how to protect yourself against ransomware attacks and what to do if you are held at ransom at cyber.gov.au.

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at central@cisa.dhs.gov or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or CyWatch@fbi.gov.

Learn more about your ad choices. Visit megaphone.fm/adchoices