CyberWire Daily

Latest Episodes:

New targets, new tools, same threat. [Research Saturday] Oct 19, 2024

Show notes

This week we are joined by Chester Wisniewski, Global Field CTO from Sophos X-Ops team, to discuss their work on "Crimson Palace returns: New Tools, Tactics, and Targets." Sophos X-Ops has observed a resurgence in cyberespionage activity, tracked as Operation Crimson Palace, targeting Southeast Asian government organizations.

After a brief lull, Cluster Charlie resumed operations in September 2023, using new tactics such as web shells and open-source tools to bypass detection, re-establish access, and map target network infrastructure, demonstrating ongoing efforts to exfiltrate data and expand their foothold.

The research can be found here:

Crimson Palace returns: New Tools, Tactics, and Targets

Learn more about your ad choices. Visit megaphone.fm/adchoices

No more “cyber Snorlax” naps. Oct 18, 2024

Show notes

Microsoft describes a macOS vulnerability. A trio of healthcare organizations reveal data breaches affecting nearly three quarters a million patients. Group-IB infiltrates a ransomware as a service operation. Instagram rolls out new measures to combat sextortion schemes. Updates from Bitdfender address Man-in-the-Middle attacks. An Alabama man is arrested for allegedly hacking the SEC. In our Industry Voices segment, Gerry Gebel, VP of Strata Identity, describes how to ensure identity continuity during IDP disrupted, disconnected and diminished environments. CISOs want to see their role split into two positions. Game Freak’s Servers Take Critical Hit.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today, we have our Industry Voices segment with Gerry Gebel, VP of Products and Standards at Strata Identity, discussing how to ensure identity continuity during IDP disrupted, disconnected and diminished environments.

Resources to learn more:

Selected Reading

macOS Vulnerability Could Expose User Data, Microsoft Warns (Infosecurity Magazine)

Microsoft warns it lost some customer's security logs for a month (Bleeping Computer)

3 Longtime Health Centers Report Hacks Affecting 740,000 (GovInfo Security)

Cicada3301 ransomware affiliate program infiltrated by security researchers (SC Media)

Instagram Rolls Out New Sextortion Protection Measures (Infosecurity Magazine)

Bitdefender Total Security Vulnerability Exposes Users to Man-in-the-Middle Attacks (Cyber Security News)

Alabama Man Arrested in SEC Social Media Account Hack That Led the Price of Bitcoin to Spike (SecurityWeek)

CISOs Concerned Over Growing Demands of Role (Security Boulevard)

Pokémon video game developer confirms its systems were breached by hackers (The Record)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Authorities bring down another hacker. Oct 17, 2024

Show notes

Brazilian authorities arrest the alleged “USDoD” hacker. The DoJ indicts the alleged operators of Anonymous Sudan. CISA and its partners warn of Iranian brute force password attempts. A new report questions online platforms’ ability to detect election disinformation. Recent security patches address critical vulnerabilities in widely-used platforms. North Korean threat actors escalate their fake IT worker schemes. CISA seeks comment on Product Security Bad Practices. Dealing effectively with post-breach stress. Tim Starks, Senior Reporter at CyberScoop, joins us to discuss “What’s new from this year’s Counter Ransomware Initiative summit.” Redbox DVD rental machines get a reboot.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

We welcome back Tim Starks, Senior Reporter at CyberScoop, to discuss “What’s new from this year’s Counter Ransomware Initiative summit, and what’s next.”

Selected Reading

Hacker allegedly behind attacks on FBI, Airbus, National Public Data arrested in Brazil (The Record)

Two Sudanese Nationals Indicted for Alleged Role in Anonymous Sudan Cyberattacks on Hospitals, Government Facilities, and Other Critical Infrastructure in Los Angeles and Around the World (US Department of Justice)

Iranian Hackers Using Brute Force on Critical Infrastructure (GovInfo Security)

Before US election, TikTok and Facebook fail to block harmful disinformation. YouTube succeeds (Global Witness)

F5 BIG-IP Updates Patch High-Severity Elevation of Privilege Vulnerability (Security Week)

Cisco Patches High-Severity Vulnerabilities in Analog Telephone Adapters (Security Week)

GitHub patches critical vulnerability in its Enterprise Servers (CyberScoop)

North Korea Escalates Fake IT Worker Schemes to Extort Employers (Infosecurity Magazine)

CISA Seeks Feedback on Upcoming Product Security Flaws Guidance (Infosecurity Magazine)

Helping Your Team Cope With the Stress of a Cyber Incident (BankInfo Security)

Tinkerers Are Taking Old Redbox Kiosks Home and Reverse Engineering Them (404 Media)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Sri Lanka says ‘no more’ to financial fakers! Oct 16, 2024

Show notes

Authorities arrest over 200 Chinese nationals in Sri Lanka over financial scams. Officials in Finland take down an online drug market. Cisco investigates an alleged data breach. A major apparel provider suffers a data breach. Oracle’s latest patch update includes 35 critical issues. Microsoft has patched several high-severity vulnerabilities. The NCSC’s new boss calls for global collaboration to fight cybercrime. CISA warns of critical vulnerabilities affecting software from Microsoft, Mozilla, and SolarWinds.Hackers steal data from Verizon’s push-to-talk (PTT) system. On our CertByte segment, Chris Hare is joined by resident Microsoft SME George Monsalvatge to break down a question from N2K's Microsoft Azure Administrator (AZ-104) Practice Test. Robot vacuums go rogue.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CertByte Segment

Welcome to CertByte! On this bi-weekly segment hosted by Chris Hare, a content developer and project management specialist at N2K, we share practice questions from our suite of industry-leading content and a study tip to help you achieve the professional certifications you need to fast-track your career growth.

In each segment, Chris is joined by an N2K Content Developer to help illustrate the learning. This week, Chris is joined by resident Microsoft SME George Monsalvatge to break down a question from N2K's Microsoft Azure Administrator (AZ-104) Practice Test.

Candidates for the Microsoft Azure Administrator exam are Azure Administrators who manage cloud services that span storage, security, networking, and compute cloud capabilities. Candidates should be proficient in using PowerShell, the Command Line Interface, Azure Portal, ARM templates, operating systems, virtualization, cloud infrastructure, storage structures, and networking.

Have a question that you’d like to see covered? Email us at certbyte@n2k.com. If you're studying for a certification exam, check out N2K’s full exam prep library of certification practice tests, practice labs, and training courses by visiting our website at n2k.com/certify.

Please note: The questions and answers provided here and on our site are not actual current or prior questions and answers from these certification publishers or providers.

Reference:

Microsoft Azure Blog > Virtual Machines > Gain business insights using Power BI reports for Azure Backup

Selected Reading

Sri Lankan Police Arrest Over 200 Chinese Scammers (BankInfo Security)

Finnish Customs closed down the Sipulitie marketplace on the encrypted Tor network (Finnish Customs)

Cisco investigates breach after stolen data for sale on hacking forum (Bleeping Computer)

Varsity Brands Data Breach Impacts 65,000 People (SecurityWeek)

Oracle October 2024 Critical Patch Update Addresses 198 CVEs (Security Boulevard)

Microsoft Patches Vulnerabilities in Power Platform, Imagine Cup Site (SecurityWeek)

'Nationally significant' cyberattacks are surging, warns the UK's new cyber chief (The Record)

CISA Warns of Three Vulnerabilities Actively Exploited in the Wild (Cyber Security News)

Hackers Advertise Stolen Verizon Push-to-Talk ‘Call Logs’ (404 Media)

Hackers took over robovacs to chase pets and yell slurs (The Verge)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Election Propaganda: Part 3: Efforts to reduce the impact of future elections. Oct 16, 2024

Show notes

Thinking past the US 2024 Presidential Election, In part three of the series, Rick Howard, N2K CyberWire’s Chief Analyst and Senior Fellow, discusses reducing the impact of propaganda in the future elections with Perry Carpenter, Chief Human Risk Management Strategist at KnowBe4 and host of the 8th Layer Insights Podcast, Nina Jankowicz, Co-Founder and CEO of the The American Sunlight Project, and Scott Small, Director of Cyber Threat Intelligence at Tidal Cyber.

Check out Part 1 & 2!

Part 1: Election Propaganda Part 1: How Does Election Propaganda Work? In this episode, Rick Howard, N2K CyberWire’s Chief Analyst and Senior Fellow, discusses personal defensive measures that every citizen can take—regardless of political philosophy—to resist the influence of propaganda. This foundational episode is essential for understanding how to navigate the complex landscape of election messaging.

Part 2: Election Propaganda: Part 2: Modern propaganda efforts.In preparation for the US 2024 Presidential Election, Rick Howard, N2K CyberWire’s Chief Analyst and Senior Fellow, discusses recent international propaganda efforts in the form of nation state interference and influence operations as well as domestic campaigns designed to split the target country into opposing camps. Guests include Nina Jankowicz, Co-Founder and CEO of the The American Sunlight Project and Scott Small, Director of Cyber Threat Intelligence at Tidal Cyber.

References:

Rick Howard, 2024. Election Propaganda Part 1: How does election propaganda work? [3 Part Podcast Series]. The CyberWire.

Rick Howard, 2024. Election Propaganda: Part 2: Modern propaganda efforts. [3 Part Podcast Series]. The CyberWire.

Christopher Chabris, Daniel Simons, 2010. The Invisible Gorilla: And Other Ways Our Intuitions Deceive Us [Book]. Goodreads.

Chris Palmer, 2010. TFL Viral - Awareness Test (Moonwalking Bear) [Explainer]. YouTube.

David Ehl, 2024. Why Meta is now banning Russian propaganda [News]. Deutsche Welle.

Eli Pariser, 2011. The Filter Bubble: What the Internet is Hiding From You [Book]. Goodreads.

Kara Swisher, Julia Davis, Alex Stamos, Brandy Zadrozny, 2024. Useful Idiots? How Right-Wing Influencers Got $ to Spread Russian Propaganda [Podcast]. On with Kara Swisher.

Nate Silver, 2024. What’s behind Trump’s surge in prediction markets? [Analysis]. Silver Bulletin.

Niha Masih, 2024. Meta bans Russian state media outlet RT for acts of ‘foreign interference’ [News]. The Washington Post.

Nilay Patel, 2024. The AI election deepfakes have arrived [Podcast]. Decoder.

Nina Jankowicz, 2020. How to Lose the Information War: Russia, Fake News and the Future of Conflict [Book]. Goodreads.

Perry Carpenter, 2024. FAIK: A Practical Guide to Living in a World of Deepfakes, Disinformation, and AI-Generated Deceptions [Book]. Goodreads.

Perry Carpenter, 2021. Meatloaf Recipes Cookbook: Easy Recipes For Preparing Tasty Meals For Weight Loss And Healthy Lifestyle All Year Round [Book]. Goodreads.

Perry Carpenter, n.d. 8th Layer Insights [Podcast]. N2K CyberWire.

Renee DiResta, 2024. Invisible Rulers: The People Who Turn Lies into Reality [Book]. Goodreads.

Robin Stern, Marc Brackett, 2024. 5 Ways to Recognize and Avoid Political Gaslighting [Explainer]. The Washington Post.

Sarah Ellison, Amy Gardner, Clara Ence Morse, 2024. Elon Musk’s misleading election claims reach millions and alarm election officials [News]. The Washington Post.

Scott Small, 2024. Election Cyber Interference Threats & Defenses: A Data-Driven Study [White Paper]. Tidal Cyber.

Staff, n.d. Overview: Coalition for Content Provenance and Authenticity [Website]. C2PA.

Staff, 2021. Foreign Threats to the 2020 US Federal Elections [Intelligence Community Assessment]. DNI.

Staff, n.d. Project Origin [Website]. OriginProject. URL https://www.originproject.info/

Stuart A. Thompson, Tiffany Hsu, 2024. Left-Wing Misinformation Is Having a Moment [Analysis] The New York Times.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A “must patch” list in the making. Oct 15, 2024

Show notes

CISA adds a Fortinet flaw to its “must patch” list. Splunk releases fixes for 11 vulnerabilities in Splunk Enterprise. ErrorFather is a new malicious Android banking trojan. New evidence backs secure-by-design practices. CISA warns that threat actors are exploiting unencrypted persistent cookies. The FIDO Alliance standardizes passkey portability. Cybercriminals linger on Telegram. On our Industry Voices segment today, our guest is Matt Radolec, Vice President, Incident Response and Cloud Operations at Varonis, discussing how AI amplifies the need for data privacy regulation and opens doors for abuse. We mark the passing of the co creator of the BBS.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment today, our guest is Matt Radolec, Vice President, Incident Response and Cloud Operations at Varonis, discussing how AI amplifies the need for data privacy regulation and opens doors for abuse.

Selected Reading

Tens of thousands of IPs vulnerable to Fortinet flaw dubbed 'must patch' by feds (CyberScoop)

Fortinet FortiGuard Labs Observes Darknet Activity Targeting the 2024 United States Presidential Election (Fortinet)

Splunk Enterprise Update Patches Remote Code Execution Vulnerabilities (SecurityWeek)

Cerberus Android Banking Trojan Deployed in New Multi-Stage Malicious Campaign (Infosecurity Magazine)

Organizations can substantially lower vulnerabilities with secure-by-design practices, report finds (CyberScoop)

Eight Million Users Download 200+ Malicious Apps from Google Play (Infosecurity Magazine)

TrickMo malware steals Android PINs using fake lock screen (Bleeping Computer)

CISA: Hackers abuse F5 BIG-IP cookies to map internal servers (Bleeping Computer)

FIDO Alliance is Standardizing Passkey Portability (Thurrott)

So far, cybercriminals appear to be just shopping around for a Telegram alternative (The Record)

Ward Christensen, BBS inventor and architect of our online age, dies at age 78 (Ars Technica)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Solution Spotlight: A first look at ISC2's 2024 Cybersecurity Workforce Study. [Special Edition] Oct 14, 2024

Show notes

In this special edition of Solution Spotlight, join us for an exclusive conversation between ISC2's Executive Vice President of Corporate Affairs, Andy Woolnough, and N2K's Simone Petrella. Together, they take a deep dive into ISC2's 2024 Cybersecurity Workforce Study, offering a first look at the most pressing findings.

Discover insights from a survey of 15,852 cybersecurity professionals and decision-makers across the globe, including the size of the current workforce, the demand for more professionals, and alarming trends around layoffs, budget cuts, and skills shortages. Andy and Simone also explore the growing disconnect between the skills in high demand by hiring managers and those that cybersecurity pros are prioritizing. Learn why organizations must take immediate action to foster talent and bridge these skills gaps to meet the industry's evolving needs.

Plus, today marks the start of the ISC2 Security Congress 2024! Whether attending in person or virtually, this event is packed with opportunities to engage with industry experts and further your knowledge in cybersecurity.

Tune in for actionable insights and exclusive details on the state of the cybersecurity workforce and how your organization can stay ahead.

For more information on ISC2 Security Congress 2024, visit the event page here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Billy Wilson: Translating language skills to technical skills. [HPC] [Career Notes] Oct 13, 2024

Show notes

Enjoy this special encore episode, where we are joined by a High Performance Computing Systems Administrator at Brigham Young University. Billy Wilson tells his cybersecurity career story translating language skills to technical skills. According to Billy's employer, moving to a technical position at his alma mater occurred because Billy showed this potential and a thirst for learning. He is currently pursuing his master's degree from SANS Technology Institute for Information Security Engineering while working to secure BYU's data for their computationally-intensive research. Billy notes that not everyone has one overarching passion which gives him variety in his work. And, we thank Billy for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ransomware on repeat. [Research Saturday] Oct 12, 2024

Show notes

In this episode, Trevor Hilligoss, VP of SpyCloud Labs at SpyCloud, discusses the increasing threat of ransomware, emphasizing the role of infostealer malware in facilitating these attacks. He draws from SpyCloud's 2024 Malware and Ransomware Defense Report, highlighting how compromised identity data from infostealers creates opportunities for ransomware operators.

With 75% of organizations experiencing multiple ransomware attacks in the past year, Trevor explores findings from over 500 security leaders in the US and UK, discussing the challenges businesses face and how they can use insights from this research to defend against ransomware and other cybercrimes.

The research can be found here:

MALWARE AND RANSOMWARE DEFENSE REPORT

Learn more about your ad choices. Visit megaphone.fm/adchoices

Patient portals down, ransomware up. Oct 11, 2024

Show notes

A Colorado health system’s patient portal has been compromised. Malicious uploads to open-source repositories surge over the past year. Octo2 malware targets Android devices. A critical vulnerability in Veeam Backup & Replication software is being exploited. The U.S. and U.K. team up for kids online safety. The European Council adopts the Cyber Resilience Act. New York State adopts new cyber regulations for hospitals. The FBI created its own cryptocurrency to help thwart fraudsters. Our guest Dr. Bilyana Lilly joins us to talk about her new novel "Digital Mindhunters." Getting dumped via AI.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Our guest Dr. Bilyana Lilly joins us to talk about her new novel "Digital Mindhunters."

Selected Reading

Cyberattack targets healthcare nonprofit overseeing 13 Colorado facilities (The Record)

Malicious packages in open-source repositories are surging (CyberScoop)

Octo2 Malware Uses Fake NordVPN, Chrome Apps to Infect Android Devices (HackRead)

Hackers Exploiting Veeam RCE Vulnerability to Deploy Ransomware (Cybersecuritynews)

Britain, US set up working group to improve children’s online safety (Reuters)

European Council Adopts Cyber Resilience Act (BankInfoSecurity)

New York State Enacts New Cyber Requirements for Hospitals (BankInfoSecurity)

FBI created a crypto token so it could watch it being abused (The Register)

Man learns he’s being dumped via “dystopian” AI summary of texts (Ars Technica)

Share your feedback.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

Learn more about your ad choices. Visit megaphone.fm/adchoices