Updates on the crisis in Ukraine. Cyberespionage campaigns elsewhere. FIN8's new ransomware. Lessons in resilience and recovery from the Tonga disaster.

Special Section

By The CyberWire Staff

Ukraine has confirmed, according to the Washington Post, that last week's WhisperGate cyberattacks were indeed destructive, and represented neither the hacktivist defacements nor the ransomware crimes they misrepresented themselves as. Ukraine's State Service of Special Communications and Information Protection said, "Thus with a high probability it can be argued that the defacement of the websites of the attacked government agencies and the destruction of data using a wiper are components of one cyber attack aimed at as much damage as possible to the infrastructure of state electronic resources.” Ukraine is calling the campaign #BleedingBear and attributed it to Russia.

Aware of heightened tensions and with vivid memories of NotPetya and Wannacry, governments are preparing for subsequent waves of cyberattacks. Serhii Demediuk, Deputy Secretary of Ukraine’s National Security and Defense Council, described the steps Kyiv is taking to protect the country from further cyberattack in an interview with the Record. The US Cybersecurity and Infrastructure Security Agency (CISA) yesterday published advice on how organizations can protect themselves against cyberattacks of the kind Ukraine sustained last week. The advisory is designed to help organizations defend against, detect, respond to, and ride out destructive cyberattacks.

Poland has also raised its level of cyber alert, Reuters reports.

Russia has consistently represented NATO and the US as aggressors interested in using Ukraine to hold Russia at risk, but it's fair to say that this is a minority view. NATO wants further talks with Russia over the crisis, but Moscow says it won't consider renewed talks until it receives responses to the proposals it put on the table last week.

The CyberWire's current coverage of the crisis in Ukraine may be found here; a round-up of continuing coverage is here.

Summary

By the CyberWire staff

ESET offers an account of an APT (the "DoNot Team") which it regards as unsophisticated, but highly focused and tenacious. The researchers make no attribution, but the DoNot Team's focused list of targeted countries is suggestive: Pakistan, Bangladesh, Nepal, and Sri Lanka.

A post at BushidoToken Threat Intel describes what appears to be a cyberespionage campaign against industrial control system vendors, government agencies, non-governmental organizations, and university researchers in several countries. Attribution is unclear, beyond some circumstantial code similarities to tools used by Russian and North Korean intelligence services.

FIN8, a financially motivated threat actor that's been active against the retail and hospitality sectors since 2016 at least, is apparently responsible for using a new, relatively evasive ransomware strain, "White Rabbit," against a US bank last month. Trend Micro researchers, who yesterday published a description of the attack, write "[I]ts payload binary requires a specific command-line password to decrypt its internal configuration and proceed with its ransomware routine. This method of hiding malicious activity is a trick that the ransomware family Egregor uses to hide malware techniques from analysis." The malicious payload is small (about 100KB) and appears inactive and innocuous until it's activated.

Saturday's eruption of the Hunga-Tonga-Hunga-Ha'apai volcano disrupted Tonga's Internet connection (and many other modes of communication), providing an extreme test of response, resilience, and recovery. Apparently the nation's undersea cable was severed; MIT Technology Review has an account of what will need to be done to reconnect the Pacific nation with the rest of the world.

Dateline Moscow and Kyiv (also Washington, Berlin, Paris, London, and Brussels): Multidomain operations in the gray zone.

Preparing for multidomain operations in the gray zone. (The CyberWire) Last week's cyberattacks against Ukrainian targets deployed, as Microsoft said Saturday, a destructive wiper that represented itself as ransomware. Many observers view the incident as Russian battlespace preparation.

Data of several Ukrainian government agencies is wiped in cyberattack (Washington Post) Several Ukrainian government agencies had their data wiped in a cyberattack that was coordinated with another attack that defaced government agency websites in recent days, according to the Ukrainian government and other individuals familiar with the incident.

A top Ukrainian security official on defending the nation against cyber attacks (The Record by Recorded Future) In the wake of an escalating crisis between Ukraine and Russia, Serhii Demediuk agreed to a follow-up interview in which he discussed issues including the recent defacement of Ukrainian websites, the security of the country’s critical infrastructure, and Russia’s motivations.

CISA Urges Organizations to Implement Immediate Cybersecurity Measures to Protect Against Potential Threats (CISA) In response to recent malicious cyber incidents in Ukraine—including the defacement of government websites and the presence of potentially destructive malware on Ukrainian systems—CISA has published CISA Insights: Implement Cybersecurity Measures Now to Protect Against Potential Critical Threats.

Implement Cybersecurity Measures Now to Protect Against Potential Critical Threats (CISA Insights) Every organization in the United States is at risk from cyber threats that can disrupt essential services and potentially result in impacts to public safety. Over the past year, cyber incidents have impacted many companies, non-profits, and other organizations, large and small, across multiple sectors of the economy.

Federal agency urges better defenses after Russian cyber hit on Ukraine (The Washington Times) The federal government’s primary cyber security agency is urging computer network administrators for American critical infrastructure networks to immediately bolster security against electronic attacks following suspected Russian cyberstrikes against Ukraine.

Poland raises cybersecurity terror threat after Ukraine cyber attack (Reuters) Poland on Tuesday raised its nationwide cybersecurity terror threat in the wake of a cyber attack on Ukraine last week, adding that the new alert level was preventative.

PM introduces first level of cyber alert in Poland (TVP World) The decision stems from an internet attack on a number of Ukrainian government sites.

Cyberattacks on Ukrainian websites come into clearer focus as Russia tensions escalate (CyberScoop) Cybersecurity researchers shed additional light over the weekend on the cyberattacks that disabled Ukrainian government websites, as Kyiv pointed to Russia as the culprit. Microsoft and ESET both shared details on the nature of the malware that took the Ukrainian sites down.

Microsoft Details Recent Damaging Malware Attacks on Ukrainian Organizations (Dark Reading) "WhisperGate" malware was used to overwrite Master Boot Record and other files to render systems inoperable at several organizations in Ukraine, Microsoft says.

Ransomware isn’t always about gangs making money. Sometimes it’s about nations manufacturing mayhem. (CyberScoop) Ransomware is fundamentally about reaping massive profits from victims — payments were on pace to cross the billion-dollar threshold in 2021, according to the U.S. government — but there are signs foreign government-connected groups are increasingly moving into a territory dominated by criminal gangs, and for an entirely different motive: namely, causing chaos.

NATO chief invites Russia to new talks as Ukraine tensions mount (Al Jazeera) Moscow says it must have answers from the West over its security demands before more discussions can take place.

Russia insists embassy staff have not been evacuated from Ukraine amid invasion fears (Newsweek) Reports have indicated Russia thinned out embassy staff before talks about a Moscow-led military buildup.

Blinken arrives in Ukraine, says Russia could attack at short notice (Reuters) U.S. Secretary of State Antony Blinken arrived in Kyiv on Wednesday in a whistle-stop diplomatic push to defuse tensions with Moscow over Ukraine, warning that Russia could launch a new attack at "very short notice".

Blinken to meet Russian counterpart as White House warns Moscow could attack Ukraine ‘at any point’ (Washington Post) Secretary of State Antony Blinken will meet Russian Foreign Minister Sergei Lavrov in Geneva on Friday in an effort to resolve the standoff over Ukraine, with U.S. officials warning that a Russian invasion could be imminent.

Russia moves more troops westward amid Ukraine tensions (Military Times) Russia is sending troops from the country’s far east to Belarus for major war games, officials said Tuesday.

Factbox: Russian military drills in Belarus create new threats for Ukraine (Reuters) Joint military exercises between Russia and Belarus in the coming weeks will provide Russian President Vladimir Putin with new options if he decides to attack Ukraine and will further stretch that country's defences, military analysts say.

US boosts military aid to Ukraine as Russia tensions soar (Military Times) “We’re now at a stage where Russia could at any point launch an attack in Ukraine,” White House press secretary Jen Psaki said Tuesday.

US weighs more military support for Ukraine to resist Russia if it invades (CNN) The Biden administration is weighing new options, including providing more arms to Ukraine to resist a Russian occupation, to try to raise the costs for Russian President Vladimir Putin should he decide to invade the country.

Former army general on how the U.S. could back a Ukranian insurgency against Russia (NPR) NPR's Mary Louise Kelly talks with Peter Zwack, former U.S. Army Brigadier General and global fellow at the Wilson Center, about the possibility of the U.S. arming Ukraine in an insurgency.

Why the Stalemate in Eastern Ukraine Will Likely Hold (Foreign Affairs) Despite the Russian buildup, the status quo still serves both sides.

Attacks, Threats, and Vulnerabilities

Kraken the Code on Prometheus (BlackBerry) The BlackBerry Research & Intelligence Team has uncovered a cluster of nine distinct Russian threat actors who have attacked U.S. government agencies using Prometheus, a network of malicious Traffic Direction Systems.

North Korea launched cyberattack against Russia - media (RT International) The North Korean hacker group APT37 attacked the Russian Foreign Ministry and its employees in late 2021 and subsequently compromised the account of a government employee, US information security experts have reported.

ICS Vendors Targeted in Espionage Campaign Focusing on Renewable Energy (SecurityWeek) Major ICS vendors and other organizations have been targeted in an ongoing cyberespionage campaign that appears to focus on renewable energy.

Control System Cyber Incidents Are Real—and Current Prevention and Mitigation Strategies Are Not Working (IEEE) There is a disconnect between the assumptions and practices within the IT and operational technology communities. This article highlights the disparities in the context of the security and safety of industrial control systems.

DoNot Go! Do not respawn! (WeLiveSecurity) ESET researchers take a deep look into recent attacks where Donot Team targeted government and military entities in several South Asian countries.

New White Rabbit ransomware linked to FIN8 hacking group (BleepingComputer) A new ransomware family called 'White Rabbit' appeared in the wild recently, and according to recent research findings, could be a side-operation of the FIN8 hacking group.

New ‘White Rabbit’ Ransomware May Be New FIN8 Tool (Threatpost) The newcomer is simple but nasty: It uses the command-line password ‘KissMe’ to hide its bad acts and festoons its ransom note with cutesy ASCII bunny art.

New Ransomware Spotted: White Rabbit and Its Evasion Tactics (Trend Micro) We analyze the ransomware White Rabbit and bring into focus the familiar evasion tactics employed by this newcomer.

Fresh Phish: Phishers Lure Victims with Fake Invites to Bid on Nonexistent Federal Projects (INKY) During the back half of 2021, INKY began detecting phishing emails that impersonated the United States Department of Labor (DoL). Eventually, the campaign grew to hundreds of instances. INKY caught enough of these attempts to do a thorough analysis of the campaign, which is set out in this edition of Fresh Phish.

Rapid7 : Active Exploitation of VMware Horizon Servers (MarketScreener) Attackers are actively targeting VMware Horizon servers vulnerable to Apache...

Latest Updates on The Log4Shell Exploit (Nuspire) The latest updates on this critical vulnerability, including how the security world is dealing with the fallout of Log4Shell.

The Log4j Vulnerability Puts Pressure on the Security World (Threatpost) It's time to sound the alarm for Log4Shell. Saryu Nayyar, CEO at Gurucul, discusses what actions you should be taking.

Reported Comelec Data Breach Provides Attackers With Inside Information on Philippines Election Systems; Election Body Claims Nothing Happened (CPO Magazine) Manila Bulletin, the largest English-language newspaper in the Philippines, says that a serious data breach of the country’s Commission on Elections (Comelec) occurred. This breach essentially includes a roadmap of the internal workings of all of the country’s election systems, including admin credentials, as well as lists of overseas absentee voters. Comelec called it “fake news” and claimed that it never happened.

VirusTotal Hacking Offers a Supercharged Version of Google Hacking (SecurityWeek) Chronicle’s VirusTotal contains likely millions of user credentials readily available to anyone who knows where and how to look.

Researchers Explore Hacking VirusTotal to Find Stolen Credentials (Dark Reading) VirusTotal can be used to collect large amounts of credentials without infecting an organization or buying them online, researchers found.

Cobalt Strike still C2 infrastructure of choice (ComputerWeekly) Its utility and ease of use, coupled with explosive growth in ransomware actions, makes Cobalt Strike Team Servers the C2 infrastructure of choice for malicious actors.

Security flaw found in smartphone app for Olympians in Beijing (The Globe and Mail) Canada’s Olympic committee has recommended that Canadian athletes restrict the amount of personal information they store on any devices they bring to Beijing

Official Beijing 2022 Olympics Mobile App Is Marred by Security Flaws, Researchers Say (Wall Street Journal) A Chinese-built mobile app that is mandatory for all participants contains security flaws that could make it easy for a hacker to steal sensitive personal information, cybersecurity researchers in Canada have warned.

Anti-vaxxers are buying fake COVID vaccine passports on the dark web: report (Comparitech) Dark web vendors sell COVID certificates that allow EU residents and visitors to travel between member states without getting vaccinated.

Multi-Factor Authentication Bypass Led to Box Account Takeover (SecurityWeek) A vulnerability in Box's implementation of multi-factor authentication (MFA) allowed attackers to take over accounts without needing access to the target's phone.

OpenSubtitles discloses successful extortion attempt, data breach (The Record by Recorded Future) OpenSubtitles, a website that provides free subtitles for movie fans, has disclosed today that it was hacked last year and subsequently paid a ransom to silence the hacker about the attack.

Crypto.com Suffers Hack for At Least $15M in Ethereum (Decrypt) The crypto exchange has reportedly lost at least $15 million in Ethereum, and security experts believe the true losses could be much higher.

Fashion giant Moncler confirms data breach after ransomware attack (BleepingComputer) Italian luxury fashion giant Moncler confirmed that they suffered a data breach after files were stolen by the AlphV/BlackCat ransomware operation in December and published today on the dark web.

Brazilian Ministry of Health recovers systems over a month after cyberattack (ZDNet) Attackers had access credentials, according to the department; minister rules out internal sabotage

Cynerio Research Finds Critical Medical Device Risks Continue to Threa (PRWeb) After a year of unprecedented ransomware attacks on hospitals and healthcare systems – and with healthcare now the #1 target for cybercriminals – critical medica

Chinese fishermen find suspicious devices for "stealing secrets" - media (Reuters) The Chinese province of Jiangsu rewarded fishermen on Tuesday for turning over "suspicious" underwater devices found in coastal waters that posed a national security risk, media reported.

Security Patches, Mitigations, and Software Updates

Linux admins urged to patch full-disk encryption bug that allows decryption without a password (Computing) The issue affects LUKS 2.2.0 and later

SecurityBridge Exposes Supply Chain Vulnerability in SAP Transport System SAP Closed the Security Gap in October ‘21 Thanks to the Initiative of Securitybridge Sap Security Experts. (Business Wire) Supply chain attacks are a new type of threat that targets software development departments and vendors. SecurityBridge has now identified a methodolo

Trends

2022 State of Cloud Native Security Report (Palo Alto Networks) We asked leading security and DevOps experts about the current state of cloud native adoption, multi-cloud preparedness, and what keeps them up at night

WatchGuard Threat Lab Reports Endpoint Malware and Ransomware Volume Already Exceeded 2020 Totals by End of Q3 2021 (GlobeNewswire News Room) Scripting attacks on endpoints set record pace, the majority of network attacks targeted the Americas, and encrypted connections are becoming the primary...

Accidental exposure of sensitive data has been surging, Bugcrowd finds (VentureBeat) Bugcrowd's latest vulnerability report found a big increase in cases of exposure of sensitive internal data, such as open Amazon S3 buckets.

Bugcrowd’s Priority One Report (Bugcrowd) The Priority One Report provides an inside look into crowdsourced security trends in 2021, as well as a deep dive into emerging and critical vulnerabilities found over the previous year.

Cyber incidents tops the Allianz Risk Barometer for businesses, followed by business interruption (SME Advisor) Cyber incidents tops the Allianz Risk Barometer (44 percent of responses), business interruption drops to a close second (42 percent) and natural catastrophes ranks third (25 percent), up from sixth in 2021. Climate change climbs to its highest-ever ranking of sixth (17 percent, up from ninth), while pandemic outbreak drops to fourth (22 percent).

Ransomware: 2,300+ local governments, schools, healthcare providers impacted in 2021 (ZDNet) An Emsisoft report found that more than 1,000 schools alone were disrupted by ransomware incidents.

US Windows ransomware attacks in 2021 little changed from 2020 (iTWire) Ransomware attacks on Windows systems in the US during 2021 showed a small dip from the previous year, with 2323 local governments, schools and healthcare providers hit, the security firm Emsisoft reports. The break-up was 77 state and municipal governments and agencies, 1043 schools and 1203 health...

The State of Healthcare IoT Device Security 2022 (Cynerio) Cynerio’s report finds that critical medical device risks continue to leave hospitals and their patients vulnerable to cyber attacks and data security issues.

Survey Shows Lack of Confidence in Network Security (Security Boulevard) A survey of 2,045 IT leaders found that, despite technological advances, the majority of respondents still don’t have much confidence in their network

For the First Time in Five Years, External Threats Overshadow Internal Threats as the Greatest Cybersecurity Concern for the Public Sector (Business Wire) SolarWinds (NYSE:SWI), a leading provider of simple, powerful, and secure IT management software, today announced the findings of its seventh Public S

Will 2022 be the year for increased insurance claims regulation? (PropertyCasualty360) An increase in large-scale events and policyholders’ expectations to receive information in real-time could dictate wider adoption of insurtech.

KnowBe4 Finds U.S. Phishing Emails Focus on Password Alerts and Policy Changes While EMEA Focuses on Everyday Tasks (KnowBe4) KnowBe4 Finds U.S. Phishing Emails Focus on Password Alerts and Policy Changes While EMEA Focuses on Everyday Tasks

Aqua Security’s Argon Experts Find Software Supply Chain Attacks more than tripled in 2021 (Aqua) A study from Aqua's recently acquired Argon Security, found software supply chain attacks grew by more than 300% in 2021 compared to 2020

Lack of expertise drives security outsourcing (IT-Online) More than half (57%) of small and medium-sized businesses (SMBs) and enterprises across the META region listed the need for special expertise among their top reasons for engaging third-party security specialists in 2021. According to the Kaspersky annual IT Security Economics report, other commonly listed top reasons among both groups include meeting compliance requirements (SMB: […]

KnowBe4 Survey Finds a Good Portion of UK Population Fall Victim to Cybercrime Despite Overconfidence (GlobeNewswire News Room) Global survey on security attitudes, behaviours and policies reveals majority of respondents very or somewhat confident reporting a security issue to their...

China leads in hosting DDoS cyber attack weapons: Report (MENAFN) China continues to lead in hosting the highest number of potential Distributed Denial of Service (DDoS) cyber attack weapons, including both amplification weapons and botnet agents, to install modern malware on organisations globally, a new report showed on Tuesday.

Marketplace

5 Reasons Why M&A Is the Engine Driving Cybersecurity (Dark Reading) Consistent acquisition of key technologies and talent is a proven strategy for growth.

Polar Security Launches Out Of Stealth With $8.5 Million Seed Round To Automatically Protect Cloud Data As Fast As Developers Create It (PR Newswire) Polar Security, a cloud-native data security company, announced today it has raised an $8.5 million seed financing round and launched out of...

McAfee Enterprise and FireEye are now called Trellix (ZDNet) Symphony Technology Group companies gain a new name after merger.

McAfee Enterprise-FireEye relaunches as Trellix, aims to be ‘market leader’ in XDR (VentureBeat) Trellix, formerly McAfee Enterprise and FireEye, will bring a focus on extended detection and response (XDR) to address security complexity.

1Password closes $620M at $6.8B valuation to bring human-centric security to all (PR Newswire) 1Password, the leader in human-centric security, today announced it has closed a $620 million (USD) Series C that raises the company's...

Former Top Law Enforcement and Cybersecurity Experts Launch CyberCatch to Better Protect Small and Medium-Sized Businesses in North America from Cyber Threats (PR Newswire) CyberCatch today announced the publication of its inaugural Small and Medium-Sized Businesses Vulnerabilities Report (SMBVR) and launch of the...

Grey Market Labs Earns B Corp Certification (PR Newswire) Grey Market Labs, a leading cybersecurity research and development and product company, is excited to announce that it has officially become a...

Cymulate Continues Exceptional Growth Trend in 2021 as Ransomware and Supply Chain Attacks Mount (PR Newswire) Cymulate, the Extended Security Posture Management market leader, today announced it has achieved 100% revenue growth globally, and 200% growth...

Concentric Achieves 400-percent Growth in First Full Year of Shipping AI-based Data Access Governance Security Solutions in 2021 (Business Wire) Concentric Inc., a leading vendor of intelligent AI-based solutions for protecting business-critical data, today announced a record year for 2021, whi

Vanta More Than Triples Customer Base (PR Newswire) Vanta, the leader in automated security compliance, today announced the company more than tripled its customer base to more than 2,000...

U.S. Army's Applied Cyber Technologies Wins 2021 David Packard Award for Acquisition Excellence (Yahoo) ORock® Technologies, Inc., a high-performance cloud service provider focused on innovative cloud and artificial intelligence solutions, today announced that Applied Cyber Technologies (ACT), part of the U.S. Army's Defensive Cyber Operations Resource for Updates, Innovation and Development (DRUID), has won the Department of Defense's (DOD) coveted 2021 David Packard Award for Acquisition Excellence.

SCADAfence Named An OT Security Market Leader In 2021 ISG Provider Lens™ Report (PR Newswire) SCADAfence, the global leader in cybersecurity for Operational Technology (OT) and Internet of Things (IoT) environments, announced today that...

Lexmark Named 2022 Global Print Security Leader by Quocirca (Yahoo Finance) Lexmark, a global imaging technology leader, today announced it has again been named a Leader in Global Print Security by global print and market insight research firm Quocirca.

Cyber seurity firm Arctic Wolf picks Newcastle for European HQ (BusinessLive) The American firm will initially create 30 jobs in the North East but hopes to increase that number in the coming years

Bill Jennings Joins Radiance Technologies as Senior Intelligence Advisor for the Defense Sector (PR Newswire) Radiance Technologies is excited to announce the hiring of Bill Jennings as Senior Intelligence Advisor, Defense Sector. Bill reports directly...

Virsec Appoints New Chief Revenue Officer to Drive Next Stage of Growth (Virsec) In 2021, Virsec announced $100M in Series C funding from a marquee community of industry leaders and company builders. Marlier’s appointment comes following Virsec’s record-breaking 2021 growth:

vArmour Appoints Jim Ditmore to Board of Directors (GlobeNewswire News Room) Bank of London COO and Former Danske COO Joins vArmour Board Adding Financial Service Industry and Global Expansion Expertise...

Ocient Appoints Data Analytics & Technology Industry Veteran Ian Drury as Chief Technology Officer and Expands Operations Amid High Demand for Enterprise Data Analytics at Hyperscale (Business Wire) Ocient, the leading hyperscale data solutions company serving organizations that derive value from analyzing trillions of data records in interactive

Products, Services, and Solutions

SpyCloud Releases First Anti-Fraud Solution to Illuminate Fraud Risk by Applying Analytics to Underground Data (Yahoo) SpyCloud, the leader in account takeover and fraud prevention, announced today the launch of their new product, SpyCloud Identity Risk Engine, a transformative API-delivered solution that provides actionable, predictive risk assessments for e-commerce and financial service customers. The assessments consist of a risk score supported by key risk indicators and reason codes, resulting from real-time analysis of SpyCloud’s unmatched collection of recaptured data fro

Suse open sources NeuVector container security platform (InfoWorld) After acquiring NeuVector last year, Suse wasted no time in open sourcing the ‘full lifecycle’ container security platform for all Kubernetes users.

IDX Achieves Record, Managing Nearly 1,000 Data Breach Responses for Enterprises; IDX Privacy Platform Recognized in Fast Company World Changing Ideas Award (PR Newswire) Today, ID Experts Holdings, Inc. ("IDX"), the leading privacy platform and data breach services provider, released its year-in-review...

Orca Tech signs SentinelOne distie deal (CRN Australia) As vendor looks to increase enterprise partner focus.

Check Point Software introduces the world’s fastest firewall delivering 20 times better price performance to the world’s most demanding datacenters (Check Point Software) By Russ Schafer, Head of Product Marketing, Security Platforms Check Point introduces the World’s Fastest Firewall delivering 20 times Better Price

Avast launches a new firewall in latest product updates (Security Brief) Avast has announced a new firewall will be packaged with its latest free and premium product updates for Windows.

GigaOm Radar for Hybrid Cloud Data Protection for Small and Medium-Sized Businesses (GigaOm) Market Landscape for Small and Medium-Sized Businesses

Cybereason New ‘Pay As You Grow’ Program Designed to Nurture Managed S (PRWeb) Cybereason, the XDR company, today announced it has launched a ‘Pay as you Grow’ program (PAYG) for Managed Security Services Providers (MSSPs), which provides the

Distology adds Menlo Security to vendor line-up (CRN) UK deal will see Distology add entire portfolio from cloud security vendor

Juniper Networks unveils AI-driven SD-WAN solution to help IT teams identify network issues (Help Net Security) Juniper Networks announced that customers can now deploy and operate the company’s SSR technology via the Mist cloud and AI engine.

Team Cymru Announces Valuable Enhancement to its Global DDoS Mitigatio (PRWeb) Today, Team Cymru announced a valuable update to its Unwanted Traffic Removal Service (UTRS), which is a global DDoS mitigation collaborative, comprised of

LogPoint releases LogPoint 7 adding SOAR capabilities within SIEM (LogPoint) Comprehensive update provides best-in-class SIEM and SOAR integration within one unified security operations platform for accelerated detection, investigation, and response.

Blumira’s New Cloud Connectors Speeds Up Cloud Security Deployments From Months to Minutes (Blumira) Blumira announced the availability of Cloud Connectors, which enables fast and easy setup of Blumira’s platform with Microsoft 365, AWS, and Duo Security.

ZeroFox Fights Back Against External Threats with New Adversary Disruption Service (Business Wire) ZeroFox, a leading external cybersecurity provider, announces Adversary Disruption service to automate the dismantlement of malicious infrastructure,

Technologies, Techniques, and Standards

Scrutiny ratcheting up for companies' cyber insurance, practices (PropertyCasualty360) Underwriters now take a fine-toothed comb to commercial cybersecurity practices, and regulators are starting to do the same.

Six ways insurers can reduce ransomware risk (Canadian Underwriter) Cyber insurance was once seen as a bright spot for the commercial insurance industry, with lower loss ratios and higher profitability than other major areas of commercial coverage. Fast forward a few years and Fitch Ratings is reporting 2020’s direct…

Cyber Insights 2022: Supply Chain (SecurityWeek) Supply chain cyberattacks are not a new idea, but have been taken to new levels of sophistication and frequency in recent years. This growth will continue through 2022 and beyond.

Cultivating a security-first mindset for software developers (Help Net Security) What’s needed is an agile approach to security and development that brings the two disciplines together to work in conjunction.

The emotional stages of a data breach: How to deal with panic, anger, and guilt (CSO Online) Intense situations require both the security experts and stakeholders to be calm and focused, but that is easier said than done. This advice can help.

Tonga’s volcano blast cut it off from the world. Here’s what it will take to get it reconnected. (MIT Technology Review) The world is anxiously awaiting news from the island—but on top of the physical destruction, the eruption has disconnected it from the internet.

Academia

US Cyber Command will use new academic engagement network to tackle cyber challenges (C4ISRNet) The new academic engagement network will also serve as a recruiting tool for Cyber Command, especially in filling out the civilian ranks.

UMD Joins U.S. Cyber Command’s Academic Engagement Network (Maryland Today) The University of Maryland has joined 83 other academic institutions in a new initiative to bolster the nation’s cybersecurity education and workforce development.

UCCS selected to join U.S. Cyber Command Academic Engagement Network (UCCS Communique) The University of Colorado Colorado Springs (UCCS) is among 84 institutions across the country selected to join a new Academic Engagement Network facilitated by the U.S. Cyber Command, known as CYB…

DISA leans on training collaboration, academic partnerships to build future workforce (FCW) The Defense Department's IT agency says "collaborative environment" at U.S. Cyber Command's Dreamport has been key for tech workforce development.

Legislation, Policy, and Regulation

White House Meeting Puts Spotlight on OSS Sustainability (DevOps.com) A recent meeting between IT industry leaders and White House officials highlighted open source software sustainability concerns.

U.S. FAA issues impact notices on 5G wireless aviation (Military Aerospace Electronics) The FAA has been in talks with airplane makers, airlines and wireless carriers to reduce the impact of new wireless service set to begin on Jan. 19, David Shepardson reports for Reuters.

10 major airlines have signed a letter warning of massive flight disruptions and supply-chain chaos as AT&T and Verizon plan to roll out 5G services (Business Insider) The carrier said the 5G services could disrupt multiple systems in widebody aircraft. The nations's commerce "will grind to a halt," they added.

Why 5G is threatening to cause flight delays (Military Aerospace Electronics) The FAA is worried about your cellphone again, Rebecca Heilweil for Vox reports.

Airlines Cancel Some Flights Ahead of U.S. 5G Wireless Launch (Wall Street Journal) The flight suspensions occurred even as AT&T and Verizon agreed to limit signals within 2 miles of runways to address air-safety concerns.

Apple and Google oppose Senate antitrust efforts, claiming they'd hurt consumer security (Yahoo Finance) With the Senate Judiciary Committee scheduled to discuss the American Innovation and Choice Online Act and the Open App Markets Act this week, Apple and Google are stepping up their opposition to both bills.

U.S. Bills Allowing Sideloading Would Cause Consumers to Be Hit With 'Malware, Ransomware, and Scams,' Says Apple (MacRumors) U.S. bills that would require major changes to the App Store would ultimately cause consumers to be targeted with malware, ransomware, and scams,...

FCC Wants Telco Data Breach Waiting Period Eliminated (SDxCentral) The FCC proposed new rules for telecom data breaches less than six months after T-Mobile US suffered the largest carrier breach on record.

UK government latest to ramp up scrutiny of crypto ads (The Block) The move will see the regulation of adverts brought into line with other financial promotions.

Democrats unveil bill to ban online ‘surveillance advertising’ (The Verge) Most targeted advertising would be banned

Congressional cyber heavyweights Langevin, Katko won't seek reelection (CyberScoop) In the span of a few days, two House members who have concentrated much of their energy on cybersecurity — and perhaps just as importantly, on working across the aisle on the issue — have announced their plans to depart Congress. Rep. Jim Langevin, D-R.I., said on Tuesday that he would not run for reelection in 2022. Rep. John Katko, R-N.Y., made his own announcement on Friday.

FBI, US Agencies Look Beyond Indictments in Cybercrime Fight (Military.com) The evolution reflects the fact that multiple government agencies share responsibility for countering a cyber threat that has deepened over the last decade.

Navy Cryptologic Warfare Officers Cannot Do Cyber (U.S. Naval Institute) The Navy’s cryptologic warfare officer community lacks the expertise to lead the service’s cyber warfare mission. Cyber warfare engineers should be allowed to take charge.

Florida governor proposes special police agency to monitor elections (Washington Post) No state has such a force, which Gov. Ron DeSantis wants empowered to arrest voters and others who allegedly violate election laws

Deputy federal CIO Roat to retire (Federal News Network) Maria Roat is leaving federal service after 41 years, including the last year-plus as the federal deputy CIO at the Office of Management and Budget.

Privacy Is Power (Foreign Affairs) Global digital society's operating system is overdue for an upgrade.

Litigation, Investigation, and Law Enforcement

Five Key Signals From Russia's REvil Ransomware Bust (SecurityWeek) The move by Russia to conduct a very public takedown of the REvil ransomware operation has set tongues wagging about how diplomacy may hold the key to slowing big ransomware attacks

Israel police uses NSO’s Pegasus to spy on citizens (CTECH) Mayors, leaders of political protests against former Prime Minister Benjamin Netanyahu, and former governmental employees, were among those tracked by police without a search or bugging warrant authorizing the surveillance

Israeli police used spyware to hack its own citizens, an Israeli newspaper reports (NPR) According to a report in Israeli media, Israel has hacked activists, mayors and other Israeli citizens without judicial oversight using spyware from the controversial NSO Group.

Israeli police accused of using Pegasus spyware on domestic opponents of Netanyahu (Washington Post) Israeli police have used NSO Group’s Pegasus spyware to remotely access, control and extract information from cellphones belonging to Israeli citizens, including leaders of a protest movement against former prime minister Benjamin Netanyahu, according to an investigation published Tuesday in the Israeli outlet Calcalist.

Nigerian police arrest members of SilverTerrier BEC gang (The Record by Recorded Future) Interpol said today that Nigerian authorities have detained 11 internet scammers, including members of the SilverTerrier cybercrime group.

Europol Takes Down VPN Service Used by Cybercriminals (Decipher) A coordinated law enforcement operation seized 15 servers of a VPN provider that was a “popular choice for cybercriminals.”

Smartmatic Sues Mike Lindell, Accusing Him of Spreading Election Lies to Sell More Pillows (Newsweek) "Lindell could not change the outcome of the election," the lawsuit states. "He could, however, gain a bigger audience for his book and gain more purchasers for his MyPillow products."

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Data Privacy Day: A Path Forward for Federal Legislation (Virtual, Jan 27, 2022) In recognition of Data Privacy Day, join the R Street Institute January 27 for a half-day conference to discuss and debate what a data security and data privacy law should contain; existing challenges to progress on the federal level; and pragmatic solutions to data security and data privacy legislation.

Programs in Cybersecurity Risk Management Webinar (Virtual, Jan 31, 2022) Plan for, respond to, and mitigate information security threats with a Master's or Graduate Certificate in Cybersecurity Risk Management from Georgetown. Join our webinar on Jan. 31 to learn about the program formats, requirements, and application process.

Events

The 4 Qualities of Good Cyber Threat Intelligence (Virtual, Jan 21, 2022) Join Dr. Tom Winston, Director of Intelligence at Dragos, for an educational webinar about the four characteristics of good cyber threat intelligence. He’ll take you through the foundational principles and describe how to make intelligence actionable in your industrial environment.

Sharing over the Long Run: Celebrating 5 Years of Enduring Collaboration (Virtual, Jan 24, 2022) Join Cyber Threat Alliance President and CEO Michael Daniel, Broadcom Vice President of Engineering Joe Chen, Check Point Vice President of Products Dorit Dor and Sophos Chief Technology Officer Joe Levy to celebrate the Cyber Threat Alliance’s (CTA) 5th anniversary at the webinar. As cyber threats grow in their sophistication and impact, increasing collaboration within the cybersecurity industry has become essential in combating the threats we face. In this webinar, these cyber experts will discuss how CTA has helped this important shift in the industry’s approach to sharing threat intelligence and the benefits it brings to society as a whole.

MENA Cyber Security Conference (Dubai, UAE, Jan 24 - 25, 2022) CS4CA MENA summit will explore all aspects of IT & OT security with a focus on digitally transforming critical infrastructures. The summit will bring together some of the brightest minds in the industry, uniting 100+ IT & OT security leaders online for 2 days of insight building, strategy planning and expert knowledge exchange.

Insider Threat Program Development - Management Live Web Based Training Course / Certificate (Virtual, Jan 25 - 27, 2022) This affordable, comprehensive and extremely resourceful 1 day training course will ensure the Insider Threat Program (ITP) Manager, Facilities Security Officer, Insider Threat Analyst, and others who support the ITP (CSO, CIO, CISO, IT, Network Security, Human Resources, Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing or enhancing an ITP / Working Group.

NCCoE Virtual Workshop on the Cybersecurity of Genomic Data (Virtual, Jan 26, 2022) The National Institute of Standards and Technology’s (NIST) National Cybersecurity Center of Excellence (NCCoE) is seeking to identify genomic data cybersecurity and privacy concerns and develop guidance to address these challenges. To that end, the NCCoE is engaging with genomic, cybersecurity, and privacy subject matter experts in academia, industry, and government to gather their insights. The NCCoE will host a virtual workshop on January 26, 2022, from 11:00 AM – 4:30 PM (EST) to explore cybersecurity and privacy risks for genomic data. The event will feature presentations by thought leaders and opportunities for audience participation.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.