Stay ahead of the game with CrowdSec, an open-source security suite that offers crowdsourced protection against malicious IPs. With its simple integration into your existing security infrastructure, you gain behavioral detection and automated remediation. Plus, you will benefit from highly actionable cyber threat intelligence with zero-false positives and a reduced volume of alerts built from a network of 170k+ machines spread over 180+ countries. Don’t fight alone, let the crowd support you. Get started with CrowdSec for free!
We’re very pleased to announce that the Retail & Hospitality ISAC Podcast has joined the CyberWire Podcast Network. Join host Luke Vander Linden for chats with members of the InfoSec community to discuss the latest challenges, opportunities, and best practices unique to cybersecurity in the retail and hospitality industry. Tune in and subscribe.
The Director of the US Cybersecurity and Infrastructure Security Agency (CISA) spoke yesterday at Carnegie Mellon University and outlined steps she urged vendors to take in order to introduce more inherent security into their products. One of her conclusions was that the burden of security shouldn't fall on the consumer.
Why are you struggling with interpreting threat intel by yourself? Engage Nisos to achieve better risk insights and outcomes. Rely on the experts with a managed service that gives you the people, process, and technology to control costs while improving your defenses. Nisos leverages automation efficiency and analyst expertise that eliminates noise, identifies risks, and prioritizes your company-specific threats. We help you respond to threats faster and more effectively through assessments, monitoring, and investigations.
A data breach that could be ransomware-related has been reported at the US Marshals Service (USMS). Witness Protection Program data are said to be safe, but some data of those under investigation, as well as data pertaining to USMS employees, are believed to have been compromised, NBC News Correspondent Tom Winter shared in a tweet thread yesterday evening. NBC News yesterday evening broke the news of the breach. “The affected system contains law enforcement sensitive information, including returns from legal process, administrative information, and personally identifiable information pertaining to subjects of USMS investigations, third parties, and certain USMS employees,” said Drew Wade, a Marshals Service spokesperson. The February 17 discovery of what Wade calls “a ransomware and data exfiltration event affecting a stand-alone USMS system,” led to the disconnect of the affected system from the network. The USMS is actively investigating the attack as a “major incident,” Bleeping Computer writes. Justice Department officials were briefed last Wednesday. The breach is said to have left the Witness Security Program, better known as the Witness Protection Program, untouched, USA Today reported in an update this morning. For more on the breach at the US Marshals Service, see CyberWire Pro.
Other CISSP certification training providers don't have a way to determine exam readiness until a practitioner passes (or fails) their certification exam. CyberVista's online CISSP course includes predictive analytics to show who is ready, who needs more time, and where to focus training. Through diagnostic exams, custom quizzes, a mock Computer Adaptive Test (CAT) Exam, and more, employers and practitioners alike feel confident in passing their CISSP the first time with CyberVista.
BlackBerry has published a report on a threat actor, Blind Eagle, also known as APT-C-36. It's a South American cyberespionage operation that's been operating against targets in Ecuador, Chile, Spain, and Colombia since at least 2019. Its most recent activity has been directed primarily at organizations in Colombia, including "health, financial, law enforcement, immigration, and an agency in charge of peace negotiation in the country.”
The come-on in Blind Eagle’s phishing emails depends upon fear and urgency. Recipients of the email are told they have “obligaciones pendientes," that is, “outstanding obligations,” with some of the communications telling the recipients that their tax payments are forty-five days in arrears. The emails’ phish hooks are usually malicious links. “The URL shown on the bait document masquerades as the actual domain of DIAN. However, when clicked, the hyperlink leads to another domain created entirely by the threat actor using the public service website[.]org. The link redirects the target to dian.server[.]tl. This crafty technique is known as URL phishing.” The phishing is conceptually simple; Blind Eagle has persisted with it simply because it works.
Dish continues to grapple with what it characterizes as an "internal system error." The Record notes that no specific information has so far come to light that would support early speculation that the incident arose from a cyberattack. TechCrunch has been in touch with the company, who said that Dish TV, Sling TV, and wireless service were all back up. Investigation and remediation are in progress. “However," a spokesman said, "some of our corporate communications systems, customer care functions and websites were affected,” said Wietecha. “Our teams are working hard to restore affected systems as quickly as possible and are making steady progress.” Dish's website this morning was still displaying the notice it's had up since the weekend: "We are experiencing a system issue that our teams are working hard to resolve."
Armorblox describes a phishing campaign that’s using OneNote file attachments to distribute the Qakbot banking Trojan. The phishing emails purport to come from a trusted vendor, and ask the recipient to open a OneNote attachment that appears to be an invoice: “Upon opening the email, victims are presented with a simple-bodied email designed to look like a follow-up to a previous discussion. As victims read this language-based email, they are prompted to open the attachment to review the details of the order to which it seems has already been completed.” The file will then execute VB Script code, which will result in the installation of Qakbot.
SpyCast has an interview with the Washington Post's Shane Harris, who encapsulates how the conventional wisdom went astray. "At the outset, I believed that what we were looking at was probably a pretty swift Russian victory," he said. "They would come in, they would decapitate the central government in Kiev in the first 72 hours, and it would be bloody, and it would be violent, but that Russia would prevail because they were deemed to have the superior military in terms of technology experience numbers. Turns out, all those things were spectacularly wrong.”
The CyberWire's continuing coverage of Russia's war against Ukraine may be found here.
Today's issue includes events affecting Belarus, Canada, Chile, China, Colombia, Ecuador, Montenegro, Poland, Russia, Spain, Ukraine, the United Kingdom, and the United States.
Ukraine at D+369: Russia goes constitutional. (CyberWire) Moscow outlines its preconditions for peace negotiations.
Russia-Ukraine war live: Russia will ‘never compromise’ on annexed Ukrainian regions, says Kremlin (the Guardian) Dmitry Peskov insists Moscow unwilling to compromise on what he described as new ‘territorial realities’
Ukraine's northeastern front could decide new battle lines (AP NEWS) A tank carrying Ukrainian infantry speeds toward a target position marked with a metal sheet. The soldiers climb down, hurl grenades and unleash a crackle of machine-gun fire.
‘If you don’t burrow in you die pretty quickly’: the relentless battle for Bakhmut (the Guardian) Ukrainian soldiers who have been holding off a Russian offensive around the city describe intense fighting
Putin's £274m spy plane blown up by Belarusian partisans (The Telegraph) Operation that involved drones dropping explosives hailed by opposition in country unhappy at its close collaboration with Russian president
Anti-war partisans in Belarus claim to have damaged Russian plane (the Guardian) Group says it used drones to hit early warning aircraft at Machulishchy airfield 12km from Minsk
Ukraine & Intelligence: One Year on – with Shane Harris (CyberWire) Shane Harris (Twitter, LinkedIn) joins Andrew (Twitter; LinkedIn) to discuss the role of intelligence in the Ukraine conflict one year after it began. Shane reports on intelligence for the Washington Post and is the author of two books.
The Evolution of Pro-Russian Hacktivism in One Year of War Report (GroupSense) A look at the changing cybersecurity landscape throughout the Russian invasion of Ukraine.
No One Knows If Decades-Old Nukes Would Actually Work (WIRED) Atomic weapons are highly complex, surprisingly sensitive, and often pretty old. With testing banned, countries have to rely on good maintenance and simulations to trust their weapons work.
Russia Turns to China’s Yuan in Effort to Ditch the Dollar (Wall Street Journal) Moscow has jettisoned longstanding concerns about giving China too much leverage over its economy.
Take Note: Armorblox Stops OneNote Malware Campaign (Armorblox) Over the course of the month, Armorblox has seen a re-emergent of the Qakbot malware campaign. These email attacks contain malicious software disguised as a OneNote file attachment. This blog dives into this malicious malware attack campaign that Armorblox accurately identified and stopped, protecting more than 15,000 end users.
Blind Eagle Deploys Fake UUE Files and Fsociety to Target Colombia's Judiciary, Financial, Public, and Law Enforcement Entities (BlackBerry) The threat group APT-C-36, also known as Blind Eagle, has been actively targeting organizations in Colombia and Ecuador, including health, financial, law enforcement, immigration, and an agency in charge of peace negotiation in the country.
APT-C-36 Strikes Again: Blind Eagle Hackers Target Key Industries in Colombia (The Hacker News) Blind Eagle, a notorious hacker group, has launched a new campaign targeting key industries in Colombia, Ecuador, Chile, and Spain.
More trouble from an APT with Colombia and Ecuador on its mind (The Record from Recorded Future News) The advanced persistent threat (APT) group known as Blind Eagle or APT-C-36 continues to phish with official-looking PDFs, researchers say.
PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks (The Hacker News) PlugX remote access trojan has been caught disguising itself as a legitimate open source Windows debugger tool called x64dbg to gain control of target
Dish hit by multiday outage after reported cyberattack (TechCrunch) Dish customers say they have been unable to access television streams or pay their bills online after a widespread outage.
DISH says ‘system issue’ affecting internal servers, phone systems (The Record from Recorded Future News) DISH said a “systems issue” with its network was affecting several services but would not confirm if it was a cyberattack.
Beware rogue 2FA apps in App Store and Google Play – don’t get hacked! (Naked Security) Even in Apple’s and Google’s “walled gardens”, there are plenty of 2FA apps that are either dangerously incompetent, or unrepentantly malicious. (Or perhaps both.)
U.S. Marshals Service suffers 'major' security breach that compromises sensitive information, senior law enforcement officials say (NBC News) The incident did not involve the database involving the Witness Security Program, commonly known as the witness protection program, a source told NBC News.
'Major' data breach reported by U.S. Marshals Service; sensitive information potentially compromised (USA Today) Sensitive law enforcement information put at potential risk
U.S. Marshals Service investigating ransomware attack, data theft (BleepingComputer) The U.S. Marshals Service (USMS) is investigating the theft of sensitive law enforcement information following a ransomware attack that has impacted what it describes as "a stand-alone USMS system."
US Marshals says prisoners’ personal information taken in data breach (TechCrunch) Current and former prisoners were notified of the breach on May 1.
Hackers exploit Namecheap email system in phishing campaign (IT World Canada - Information Technology news on products, services and issues for CIOs, IT managers and network admins) Hackers gained access to the Namecheap email system and used it to send MetaMask and DHL phishing emails aimed at customers’ personal and crypto wallet information.
As MedusaLocker ransomware targets RDP, HHS urges brute force defense (SC Media) A new HHS alert warns the Russian-backed MedusaLocker ransomware group has ramped up its tactics, adding brute-force attacks to its phishing and spam email arsenal.
Victims lose $8.8k to phishing scams linked to reservations on Booking.com since start of 2023 (Stomp) Victims have lost at least $8,800 to hotel-related phishing scams since the start of 2023. Read more at stomp.straitstimes.com
LastPass: DevOps engineer hacked to steal password vault data in 2022 breach (BleepingComputer) LastPass revealed more information on a "coordinated second attack," where a threat actor accessed and stole data from the Amazon AWS cloud storage servers for over two months.
LastPass hacked - attackers accessed data vault (Computing) A DevOps engineer at password management firm LastPass had their home computer compromised and infected with keylogging malware during last year's cyberattack, leading to the exfiltration of corporate data.
Cyberattack on Boston Union Results in $6.4M Loss (SecurityWeek) A cyberattack on the Boston-based Pipefitters Local 537 union’s health fund resulted in the loss of $6.4 million.
Encino Energy claims 'no impact' from ALPHV ransomware attack (SC Media) Major U.S. private natural gas and oil producer Encino Energy has disclosed that its operations were not impacted by a cyberattack, which it has already remediated, days after it was added by the ALPHV ransomware operation, also known as BlackCat, to its data leak site, reports The Record, a news site by cybersecurity firm Recorded Future.
Hacker leaks alleged Activision employee data on cybercrime forum (BleepingComputer) A threat actor has posted data the alleged data stolen from American game publisher Activision in December 2022 on a hacking forum, highlighting the data's value for phishing operations.
Minneapolis Public Schools still investigating what caused ‘encryption event’ (The Record from Recorded Future News) Thousands of students in Minneapolis returned to school on Monday after a ransomware attack crippled the school’s systems all of last week.
ChatGPT is down worldwide - OpenAI working on issues (BleepingComputer) ChatGPT is down, according to OpenAI and users reports. Users are currently experiencing issues worldwide, with many unable to access the AI.
CISA Adds One Known Exploited Vulnerability to Catalog (CISA) CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2022-36537 ZK Framework AuUploader Unspecified Vulnerability
NCC Group Monthly Threat Pulse – January 2023 (Mynewsdesk) January’s Threat Pulse sees a decrease in ransomware attacks – 38%, compared to December but still a high number recorded for January, the highest in 3 years.
Phone Attacks and MFA Bypass Drive Phishing to New Heights (Infosecurity Magazine) Proofpoint reveals surge in direct financial losses from attacks
New Survey Shows Increase in 2023 Security Budgets Following Spike in Breach Incidents - Pentera (Pentera) New industry survey conducted by Pentera finds that 88% of organizations report a breach incident in the past 2 years Boston and Tel Aviv, February 28,
The state of pentesting 2023 - Survey Report (Pentera) Pentera, the leaders in Automated Security Validation, undertook this research to understand the current state of security validation in organizations of different sizes across Europe and the USA.
2023 CrowdStrike Global Threat Report Reveals Sophisticated Adversaries Re-exploiting and Re-weaponizing Patched Vulnerabilities and Moving Beyond Ransomware (CrowdStrike) CrowdStrike today announced the release of 2023 CrowdStrike Global Threat Report – the ninth annual edition of the cybersecurity leader’s seminal report on the evolving behaviors, trends and tactics
Cisco to acquire startup Valtix to beef up its multicloud network security (TechCrunch) Cisco announced its intent to acquire multicloud security startup Valtix over the weekend, adding another element to its security unit.
Securonix Appoints Sanjay Singh as Chief Growth Officer (Securonix) Cloud-Native Security Analytics Leader Taps Proven Enterprise Software and Security Executive to Lead Global Go-to-Market Organization
Ballistic Ventures Appoints Expert Cybersecurity GTM Advisors (PR Newswire) Ballistic Ventures, the venture capital firm dedicated exclusively to funding and incubating entrepreneurs and innovations in cybersecurity,...
NRECA’s New Commercial Cybersecurity Solution Protects OT and IT Systems in Real Time - America's Electric Cooperatives (America's Electric Cooperatives) The National Rural Electric Cooperative Association (NRECA) today announced the commercial launch of Essence, a next generation Operations Technology (OT) and cybersecurity monitoring solution. Purpose-built to protect America’s critical infrastructure, Essence continuously monitors the operation of electric grids and other operational networks to give real-time situational awareness to owners and operators of […]
'Take It Down:' a tool for teens to remove explicit images (AP NEWS) “Once you send that photo, you can't take it back,” goes the warning to teenagers, often ignoring the reality that many teens send explicit images of themselves under duress, or without understanding the consequences.
Tanla Platforms unveils phishing protection platform Wisely ATP™ at Mobile World Congress, Barcelona 2023 (CXOToday.com) Dr. P. D. Vaghela, Chairman, TRAI, launches Wisely ATP at Mobile World Congress 2023 Wisely ATP is an end-to-end solution aimed to combat the global challeng
Palo Alto Networks Makes AI-Powered OT Security Easy to Adopt for Its 61,000+ Network Security Customers IT Voice | Online IT Media | IT Magazine (IT Voice | Online IT Media | IT Magazine) The usage and connectivity of operational technology (OT) is rapidly growing as are the number of cyberattacks on OT environments. These attacks can disrupt operations, causing damage that can reac…
U.S. cyber official praises Apple security and suggests Microsoft, Twitter need to step it up (CNBC) CISA Director Jen Easterly held up Apple as a positive example of accountability and transparency for its security practices during a speech on Monday.
U.S. cyber chief warns tech companies to curb unsafe practices (CBS News) CISA Director Jen Easterly says companies like Microsoft and Twitter should face liability if they fail to protect customers from Chinese hacking.
Tech manufacturers are leaving the door open for Chinese hacking, Easterly warns (The Record from Recorded Future News) CISA Director Jen Easterly warned Monday of potentially dire consequences if technology manufacturers don't bolster security.
CISA Director Calls Out Industry Using Consumers as Cyber 'Crash Test Dummies' (Nextgov.com) The head of the Cybersecurity and Infrastructure Security Agency said technology companies need to be more proactive when it comes to promoting safety and security.
The Designed-in Dangers of Technology and What We Can Do About It (Cybersecurity and Infrastructure Security Agency) REMARKS AS PREPARED FOR DELIVERY: CISA Director Jen Easterly's Address at Carnegie Mellon University. Good morning. Thank you to President Jahanian for that warm introduction and to everyone for joining me today on this Monday morning. It’s wonderful to start the week off with this incredible community.
Threat intelligence: Why Attributing Cyber-Attacks Matters (Infosecurity Magazine) While cyber attribution has become much more challenging with the emergence of cybercrime-as-a-service, threat intelligence analysts argue it is still valuable to anticipate future attacks
Mind these five mistakes when responding to infosec threats (SC Media) Here are five common mistakes security teams make that prevent them from having the right tools and talent on staff.
Business email compromise: What you can do to prevent fraud and recover funds (Lexology) Business Email Compromise is one of the greatest cyber threats to businesses of all sizes and industries, particularly those involved in regular wire…
How ChatGPT Can Help Cyber Security Pros Beat Attacks (Security Intelligence) ChatGPT has already been proven to enable threat actors to accelerate attacks. But can it also help prevent cyber attacks?
Fighting ‘Woke AI,’ Musk Recruits Team to Develop OpenAI Rival (The Information) Elon Musk has approached artificial intelligence researchers in recent weeks about forming a new research lab to develop an alternative to ChatGPT, the high-profile chatbot made by the startup OpenAI, according to two people with direct knowledge of the effort and a third person briefed on the ...
Voice Cloning: A Blessing or a Curse for the Voice Banking Industry? (Finextra Research) Imagine being able to talk to your bank account and conduct transactions without the need for a phon...
How to avoid falling victim to an online scam: Research says slow down (Techexplore) Keeping up with the latest digital cons is exhausting. Fraudsters always seem to be one step ahead. But our study found there is one simple thing you can do to drastically reduce your chances of losing money to web scams: slow down.
'Unacceptable level of risk': Canada bans TikTok from federal government devices (National Post) Directive comes as federal government is embroiled in questions about foreign interference by China in the 2019 and 2021 federal elections.
White House gives agencies 30 days to impose federal device TikTok ban (CNBC) The White House on Monday gave government agencies 30 days to ensure they do not have Chinese-owned app TikTok on federal devices and systems.
President Biden Signs Presidential Waiver of Statutory Requirements for Supply Chain Resil (U.S. Department of Defense) President Joe Biden signed a presidential waiver of some statutory requirements authorizing the use of the Defense Production Act to allow the Department of Defense to more aggressively build the
US National Cyber Strategy Pushes Regulation, Aggressive Hack-Back Operations (SecurityWeek) The U.S. government is set to green-light a more aggressive ‘hack-back’ approach to dealing with foreign adversaries.
Los Angeles fugitive in sprawling COVID relief scam is extradited from Montenegro (Los Angeles Times) Tamara Dadyan, who fled to a resort in Montenegro to dodge more than 10 years in prison for a pandemic relief swindle, is extradited to the U.S.
"Ethical hacker" amongst those arrested in Dutch ransomware investigation (Hot for Security) Three men have been arrested by Dutch police [https://www.
Biometric-Privacy Rulings in Illinois Expand Potential Liability for Companies (Wall Street Journal) Decisions from the state’s highest court could boost claims by workers and consumers.
For a complete running list of events, please visit the Event Tracker.
HBS and MIT Technology and National Security Conference (Cambridge, Massachusetts, USA, Apr 15, 2023) The HBS and MIT Technology and National Security Conference brings together practitioners and thinkers from the public and private sectors to discuss the challenges, opportunities, and emerging dynamics confronting the global defense establishment. The 2023 conference will focus on the technological developments and innovation gleaned from the ongoing Russian invasion of Ukraine and their implications for a future China-Taiwan contingency. Russia’s invasion of Ukraine has highlighted multiple strengths and weaknesses in U.S., allied, and partner defense industrial base’s ability to respond rapidly to the crisis and adapt current practices for future conflicts. The U.S. Intelligence Community accurately predicted and publicized President Vladimir Putin’s invasion playbook to limit his options. Ukraine has employed information warfare and unmanned aerial systems (UAS) to massively disrupt Russian operations. Allied weapons’ manufacturers have faced long production and delivery timelines as governments deplete domestic stockpiles to surge weapons to the conflict zone. These innovations and problems are just a few examples of the “lessons learned” for the national security establishment. Beyond Russia and Ukraine, these insights are particularly relevant to U.S., allied, and partner defense and industrial policy as senior decision-makers respond to Chinese aggression against Taiwan. As the cross-strait balance of power tilts further in Beijing’s favor and the risk of conflict increases, the U.S., alongside allies and partners, must shape emerging technology today to deter Chinese designs on the island and avoid great power war in the near future.
3rd Annual Nunn School Symposium: Lessons from Russia’s War in Ukraine for the West (Atlanta, Georgia, USA, Feb 28, 2023) This half-day program explores what lessons the West should draw a year after Russia’s invasion of Ukraine. It will consider both what can be learned about warfighting and about the broader role of statecraft. While what has happened and what might happen are clearly relevant, the focus will be on what lessons can be drawn from what has happened thus far.
SecureWorld Charlotte (Charlotte, North Carolina, USA, Mar 2, 2023) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational elements learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.
Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Mar 13 - 17, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps. Learn more and register now.
Security & Policing (Farnborough, England, UK, Mar 14 - 16, 2023) Security & Policing, the official Government global security event, returns to the Farnborough International Exhibition and Conference Centre between 14-16 March 2023. Hosted by the Home Office’s Joint Security & Resilience Centre (JSaRC), Security & Policing offers a world‐class opportunity to meet and discuss the latest advances in delivering national security and resilience with leading UK suppliers, UK and overseas Government officials and senior decision makers across the law enforcement and security sectors. There is no general admittance to Security & Policing and all visitors and exhibitors are subject to Home Office approval.
GISEC Global (Dubai, UAE, Mar 14 - 16, 2023) With the ever-changing global landscape, it is increasingly essential to strengthen cybersecurity across industries. GISEC Global offers a platform for key industry leaders and names to come together in order to stay ahead of potential threats, discover innovative strategies and remain secure from major disruptions.
