High-end and low-end extortion. Rolling-PWN. Social media and OSINT. Preparing for cyber combat.

Summary

By the CyberWire staff

At a glance.

High-end and low-end extortion.
Hacking Hondas (and maybe others)?
Social media and open-source intelligence.
Russian cyberattacks spread internationally.
Preparing for cyber combat.

High-end and low-end cyber extortion.

Resecurity has reported that the BlackCat gang, also known as ALPHV, is upping its ransom demands, and that it's also following what Resecurity calls a “quadruple extortion” model. It encrypts victims' files and threatens to release sensitive stolen data (the now familiar double-extortion approach), but then goes on to add two more attacks. One of these is distributed denial-of-service (DDoS); the other is "harassment," a campaign of contacting the victims' “customers, business partners, employees, and media to tell them the organization was hacked.” BleepingComputer reports that a feature of this newer, polyvalent approach is the provision of a searchable database of non-paying victims, the better to expose them to reputational damage.

BlackCat represents the high-end of the ransomware-as-a-service C2C market. There are still many other extortion scams in circulation, however, that are much simpler and require far less talent and attention to detail. Researchers at Sygnia, for example, report on the activities of LunaMoth, and these are so low-end that one hesitates to even call their operation "ransomware." LunaMoth uses commodity RATs against its victims (and it does so opportunistically, with little evidence that they're phishing for particular targets). It doesn't bother encrypting data, and relies simply on the threat of doxing to extort payment.

Hacking Hondas (and others)?

Researchers claim to have demonstrated a proof-of-concept they're calling "Rolling-PWN" that affects the remote keyless entry systems in Honda models between 2012 and 2022. They say the exploit (which has been assigned the designation CVE-2021-46145) takes advantage of the keyless entry systems' rolling code system, which uses a synchronizing counter to prevent replay attacks. The rolling code system accepts, the researchers say, "a sliding window of codes" to account for the keyfob being pressed accidentally, or when it's out of range of the vehicle. "By sending the commands in a consecutive sequence to the Honda vehicles, it will be resynchronizing the counter. Once [the] counter [is] resynced, commands from the previous cycle of the counter worked again. Therefore, those commands can be used later to unlock the car at will." The researchers worked on Hondas, but they think it likely that other makes are also vulnerable.

While there are some reports of others replicating these results, they remain controversial. Honda, for one, doesn't believe it, according to BleepingComputer. A statement Honda gave Vice dismissed the proof-of-concept as "old news." Honda added, in an email to Vice, “Thus, I’d hope that you would treat it as such and move on to something current rather than creating a new round of people thinking that this is a ‘new’ thing. We’ve looked into past similar allegations and found them to lack substance. While we don’t yet have enough information to determine if this report is credible, the key fobs in the referenced vehicles are equipped with rolling code technology that would not allow the vulnerability as represented in the report. In addition, the videos offered as evidence of the absence of rolling code do not include sufficient evidence to support the claims."

Social media and open-source intelligence.

The Telegraph cites a blogger accompanying Russian forces in Ukraine in support of its conclusion that NATO-supplied HIMARS rocket artillery systems have been "striking fear" into Russian troops: “'Yesterday I happened to witness a Himars strike on Chernobayevka in Kherson, practically in front of my eyes,' Roman Saponkov, a Russian military blogger embedded with frontline Russian forces wrote on Telegram on Monday. 'I’ve been under fire many times, but I was struck by the fact that the whole packet, five or six rockets, landed practically on a penny,' he wrote on Telegram. 'Usually MLRS lands in a wide area, and at maximum range it completely scatters like a fan. It makes an impression, I won’t dispute that. It is clear this is just the beginning,' he added. 'They are going to hammer Kherson and other border cities, Belgorod in particular. They will cover all the command posts and military installations they have gathered data on for the past four months.'” Mr. Saponkov sensibly advises his readers that a single wonder weapon is rarely a war-winner, but his comments on the effects of HIMARS fire are striking, and suggest the difficulty of moderating communication in social media, even where there's a strong motivation to do so, and a tradition of censorship to draw upon.

Open-source intelligence has played a prominent role in the special military operation from the outset. On the eve of the invasion, for example, foreign observers had a tolerably complete and realistic picture of the Russian order of battle, based on posts by Russian soldiers and, for example, by curious Belarusian civilians posting photos of Russian combat vehicles staging through their towns. (Bumper numbers of the vehicles often clearly visible.) This new opsec challenge is one all armies will henceforth face, to one degree or another. Clearance Jobs quotes security experts on the challenge. Their comments don't neglect the effect too much information can have on servicemembers' careers, but the broader opsec lessons are also clear. Domnick Eger, field chief technical officer (CTO) at Anjuna Security, said, “The advent of social media has created a whole other realm of over-sharing, tracking, and personal opinion narrative that can affect servicemembers’ careers and impact future endeavors and possible backlash around unpopular topics." Cybrary's chief impact officer Chloé Messdaghi cautioned that, “Service members must be aware of everything you post and have good device, platform and network security practice. One example of each of these might be, for example, requiring device logons that expire quickly when the device is inactive, keep your social media accounts private and be sure you know who you’re accepting and sharing content with, and don’t use public Wi-Fi without a VPN.”

Social media have largely replaced the traditional soldiers' letter home, and armies have yet to come to grips with the new media's immediacy, and the difficulty of controlling the way information transits them.

Russian cyberattacks spread internationally.

KIllnet, the threat actor that represents itself as a hacktivist tendency operating in the patriotic interest of Russia but not under the control of Moscow's security services, has extended its distributed denial-of-service (DDoS) attacks to Polish government sites, the Express reports. As was the case with earlier operations against Lithuania, the most recent DDoS attacks didn't rise above the level of a nuisance. Poland has strongly supported Ukraine both since the invasion and during the tensions that preceded Russia's war.

Margiris Abukevicius, Lithuania's vice minister of national defense, according to Delphi, while emphasizing that the effects of the DDoS attacks had a negligible effect on the country's IT infrastructure, cautioned that they're not to be dismissed, either. Cyberattacks of this kind are aimed at exerting influence quite apart from their effectiveness at disrupting networks. The audience, Mr. Abukevicius says, is at once both foreign (in Lithuania) and domestic (in Russia). The desired effect in Lithuania is erosion of confidence, leading Lithuanians to lose faith in their country's ability to protect itself in cyberspace. He also sees increased friction as a Russian goal: one aim of the cyberattacks is to "increase tension." The desired effect in Russia is the projection of an image of power, and of communicating an assurance that Russia's enemies will be punished.

Even talking about the incidents carries a cost to the victim, Mr. Abukevicius said. "We need to understand that publicity is a very important part of these attacks. If we don't talk about them, the other side will lose motivation. When we talk, when we talk about alleged victories, about alleged punishment of Lithuania, it's motivating the other side." He went on to urge that Russian cyber operations be kept in perspective. "We in Lithuania should not be so hooked on this and we often hear that the sky has been falling here for the last three weeks. It’s definitely not. Yes, we have attacks, some of them disruptive, but we don't see those incidents or those efforts that don't achieve any goal and don't affect the delivery of services at all. There are also many of those, and I think that's what we should say: that despite the effort, despite the coordination, the impact of these attacks is small."

Preparing for cyber combat.

The hybrid war Russia initiated against Ukraine has prompted considerable reflection on how one might train and organize the people who can carry out the defensive and offensive tasks the cyber phases of such a war involve. The CipherBrief describes a high-end, alliance-based approach. An essay by Rear Admiral (Retired) Mark Montgomery, a senior director at the Center on Cyber and Technology Innovation (CCTI) at the Foundation for Defense of Democracies, and his co-author Jiwon Ma (also at CCTI) commend three steps the US should consider as it seeks to build cyber operational capacity:

"First, improving the overall capacity of allies and partners to prevent, mitigate, and recover from cyberattacks can enhance U.S. economic stability and national security. For instance, to pressure Taiwan to cease resisting Beijing’s push toward unification, China could attack key supply chains, such as those for global semiconductors. Washington would then face a choice between abandoning a key partner or a global economic meltdown. But capacity building efforts such as CYBERCOM-led hunt forward operations could increase Taiwan’s cyber resilience, enabling Taipei to fend off a Chinese attack that would otherwise harm U.S. national security and the global economy.

"Second, cyber capacity building programs help the critical infrastructure of allies and partners, including electrical power grids, water systems, rail lines, ports, and airfields, to remain operational in the face of adversarial attacks — enabling U.S. armed forces to rely on this infrastructure to conduct military operations if necessary.

"Finally, a collective approach can reduce the burden on one nation by sharing information and intelligence on ongoing cyber threats. Collective action also carries more weight, particularly in enforcing cyber norms. For example, as the European Union and its member states condemned Russia’s malicious cyber activity against Ukraine, it also reaffirmed its political and financial support to Kyiv to strengthen Ukraine’s cyber resilience."

There's also a bottom-up, partisan approach to the challenge. The Record by Recorded Future describes the work of Nikita Knysh, a former employee of Ukraine’s Security Service (SBU) and founder of the cybersecurity consultancy HackControl, has been providing Ukrainians with both advice on self-protection (how to use anti-virus programs, how to use a VPN, etc.) and tips on conducting offensive cyber operations against the Russian enemy (mostly instructions on mounting distributed denial-of-service attacks). Mr. Knysh sees this as a contribution to guerrilla war against the invader. He dismisses the concerns some have raised about the risks of encouraging hacktivism, even in wartime. “Not attacking your enemy in cyberspace is stupid. In the past, soldiers destroyed logistics and production facilities, but now they also attack technology and information.”

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Broaden your reach and build partnerships with the largest B2B network that cyber leaders trust.

Notes.

Today's issue includes events affecting Belarus, China, the European Union, Finland, Germany, Iran, Japan, the Democratic People's Republic of Korea, Latvia, Lithuania, the Isle of Man, NATO/OTAN, Poland, Russia, Ukraine, the United Kingdom, and the United States.

Government Agencies Deserve A Better Way To Pentest

Synack Red Team mission data indicates that once-a-year pentests are no longer adequate to protect sensitive missions or meet most compliance requirements. Government Agencies Deserve A Better Way To Pentest, one that scales to find vulnerabilities that matter most and to meet M-22-09 zero trust requirements for dedicated application security testing. Find your Better Way to Pentest today in Synack’s FedRAMP Moderate In Process environment.

Dateline Moscow, Kyiv, Vilnius, Warsaw, and Washington: DDoS, OPSEC, and other aspects of a hybrid war.

Ukraine at D+138: OPSEC in a social media world. (The CyberWire) Russia continues the reconstitution of its army. Its maneuver forces remain relatively static while its artillery continues the reduction of those Ukrainian towns and cities within cannon and rocket range. Ukraine says it's making good use of NATO-supplied artillery, and Russian social media posts from the area of operations lend credence to those claims. Russia's mounts DDoS attacks against Polish government sites as NATO and Ukraine organize an opposing cyber capability.

Russia-Ukraine war: List of key events, day 139 (Al Jazeera) As the Russia-Ukraine war enters its 139th day, we take a look at the main developments.

Russia-Ukraine war update: what we know on day 139 of the invasion (the Guardian) The death toll from a Russian missile attack on Chasiv Yar in eastern Ukraine rises to 33; Kyiv warns Russia will step up fight in Donbas

Russia Steps Up Attacks on Civilian Areas, Even With Advance Paused (New York Times) Russian forces in eastern Ukraine are regrouping, with a new offensive expected, but they continue to rain death and destruction on cities and towns.

Russia Repeatedly Strikes Ukraine’s Civilians. There’s Always an Excuse. (New York Times) The Kremlin’s explanations have sometimes satisfied the Russian people, but they fall apart under closer scrutiny abroad.

Russia-Ukraine war: Ukraine strikes Russian military depot 'killing seven' (The Telegraph) Ukraine says it launched a barrage of rockets and missiles on Russian military targets in southern Ukraine and destroyed an arms depot, in attacks that Moscow-backed authorities said had damaged homes.

Ukrainian rockets hit Russian-controlled area as Kyiv gears up for southern counter-attack (Reuters) Ukraine said on Tuesday it had carried out a successful long-range rocket strike against Russian forces in southern Ukraine, territory it says it is planning to retake in a counter-offensive using hundreds of thousands of troops.

Ukraine reports striking Russian ammunition depot in south (AP NEWS) Ukrainian authorities said Tuesday that their forces targeted a Russian ammunition depot in southern Ukraine with overnight, resulting in a massive explosion captured on social media.

Himars rockets strike fear into Russians: ‘This is just the beginning’ (The Telegraph) Military blogger says strikes by the US-supplied High Mobility Artillery Rocket Systems are so accurate they can ‘land on a penny’

Ukraine Digs for Survivors in Rubble of Residential Attacks by Russian Missiles (Wall Street Journal) The death toll from the Russian missile strike in the Donetsk region rose to 31 people. Three are dead in an attack in Kharkiv, a regional official said.

Ukraine war: 7,200 Ukrainian service personnel missing - ombudsman (BBC News) Most of them are in Russian captivity, and "sooner or later" will be freed, Oleh Kotenko says.

Russian-occupied regions of Ukraine at risk from infections and epidemics (Atlantic Council) Russia’s ongoing invasion of Ukraine and occupation of around 20% of the country has produced a range of major public health challenges that require urgent international attention, writes Ihor Kuzin.

The West Worries Too Much About Escalation in Ukraine (Foreign Affairs) NATO can do more without provoking Moscow.

Four (updated) ways the war in Ukraine might end (Atlantic Council) Four months later, Scowcroft Center experts reexamine their forecasts and suggest how to amend them in light of recent developments.

Ukraine official says Russia strikes 'absolute terrorism' (AP NEWS) Russian missile strikes early Monday on Ukraine's second-largest city killed at least three people and injured scores, including children, the local administrator said, describing the attacks in Kharkiv as “absolute terrorism.”

Amid Ukraine war, Russian parliament to hold extraordinary session (Reuters) The lower house of the Russian parliament will gather on July 15 for an extraordinary session, its council decided on Monday, just days after President Vladimir Putin warned that he had not even started to get serious in the war in Ukraine.

Putin ally Lukashenko faces revolt from officers against Ukraine war: Report (Newsweek) Military officers allegedly wrote in an open letter to the Belarusian president that joining Russia to fight in Ukraine would be "pure suicide."

Five Space Lessons Russia’s Invasion Taught Ukraine (Defense One) Kyiv now wants its own imagery and comms satellites—and a stealthy way to launch them, a former space agency head says.

The Biggest Threat to the Military May Not Be What You Think (ClearanceJobs) During WWII, military communications were heavily monitored to make sure the enemy could get nothing. But things have changed a bit.

Iran planning to arm Russia with drones, US says (The Telegraph) Tehran could supply the Kremlin with hundreds of UAVs and the training to use them, the White House warned

Lech Walesa: Global security can be secured by "people's uprising linked to Russia". (South West Review) Former Polish President Lech Walesa advocates "an uprising of the people of this Russia and the people annexed by Russia" when "the population of Russia

Blinken Tells China: ‘It’s Pretty Hard to Be Neutral’ on Ukraine (New York Times) The secretary of state met with China’s foreign minister for five hours in Indonesia after a G20 meeting. In southern Ukraine, fighting intensified amid expectations of a possible offensive to retake occupied territory.

US’s Blinken raises China’s ‘alignment with Russia’ on Ukraine (Al Jazeera) Secretary of State Antony Blinken tells China’s Foreign Minister Wang Yi that Beijing not acting ‘neutral’ on Ukraine.

Russia launches attack on Poland as hackers declare war on 10 countries, including UK (Express) AFTER fending off attacks for months, Russian hackers launched a major cyberattack on Poland, bringing down key government websites.

Vice Minister: cyber attacks are aimed at seeking publicity and raising tensions (DELFI) Cyber attacks against Lithuanian state-owned companies and businesses are aimed at attracting publicity and raising tensions, the country's vice minister of national defense says.

How one Ukrainian ethical hacker is training 'cyber warriors' in the fight against Russia (The Record by Recorded Future) In the Ukrainian hacker community, Mykyta Knysh is a household name. The 31-year-old former employee of Ukraine’s Security Service (SBU) founded cybersecurity consulting company HackControl in 2017 and launched a YouTube channel about internet security and digital literacy. It has about 8,000 subscribers.

Equipping U.S. Partners in Cyberspace is a Must (The Cipher Brief) RADM (Ret.) Mark Montgomery and Jiwan Ma share insights on why equipping U.S. Partners in Cyberspace is a Must

Finland, in NATO and with the F-35, forms a powerful challenge to Russia (Breaking Defense) "Finland never bought into the idea of East-West peace lasting forever following the collapse of the Soviet Union," and now seems prescient in its defense investments, writes Robbin Laird.

Japan is examining its security and defense policy as Russia continues war in Ukraine (NPR) Shinzo Abe, former Japanese prime minister who was killed July 11, championed for more robust defense and security policies. With current world events, those ideas are increasingly important in Japan.

Europe’s Worst Energy Nightmare Is Becoming Reality (Foreign Policy) Russian outages and record-high prices threaten a “winter of discontent.”

Gas pipeline shutdown starts amid German suspicion of Russia (AP NEWS) A major natural gas pipeline from Russia to western Europe shut down Monday for annual maintenance as Germany prepared to give the green light for 10 coal-fired power plants to restart because of concerns that Russia may not resume the flow of gas as scheduled.

Ukraine war: Germany fears Russia gas cut may become permanent (BBC News) The crucial Nord Stream 1 pipeline is shutting down for 10 days of annual maintenance work.

Europe Jittery Over Reduced Russia Gas Supplies (NDTV) Russian gas giant Gazprom begins 10 days of routine maintenance on its Nord Stream 1 pipeline on Monday -- with Germany and other European countries watching anxiously to see if the gas comes back on.

The doomsday scenario of a winter without Russian gas (The Telegraph) Millions of jobs are at risk if Vladimir Putin chokes off supplies

Worst of Global Energy Crisis May Still Be Ahead, IEA Says (Bloomberg) Security of oil and gas supplies remains a major challenge. China has “big-footed” world on new energy supply chains: US.

U.S. Says Seven Boeing Planes Belonging To Belarus's National Airline Violate U.S. Export Controls (RadioFreeEurope/RadioLiberty) The U.S. Commerce Department has identified seven Boeing 737 Planes operated by Belarusian national carrier Belavia that are in apparent violation of U.S. export controls.

Attacks, Threats, and Vulnerabilities

‘Nobody is holding them back’ — North Korean cyber-attack threat rises (Cointelegraph) North Korea’s army of crypto hackers and operators will only get better at infiltrating crypto firms, posing a risk of a repeat of recent cyber attacks such as Axie Infinity and Harmony.

Why China’s Massive Data Leak Is So Chilling (Bloomberg) If you were only reading Chinese newspapers last week, you would have missed potentially the largest known data breach in the country’s history.

Revealed: The Smartphone App Spying on Baha'is (IranWire) In recent days, internet security experts, who are also members of the Baha’i community, have warned that hackers affiliated with the Is ...

Cloud-based Cryptocurrency Miners Targeting GitHub Actions and Azure VMs (The Hacker News) Malicious actors increasingly use GitHub actions and Azure virtual machines (VMs) for cloud-based cryptocurrency mining

Ransomware gang now lets you search their stolen data (BleepingComputer) Two ransomware gangs and a data extortion group have adopted a new strategy to force victim companies to pay threat actors to not leak stolen data.

New Phishing Attacks Shame, Scare Victims into Surrendering Twitter, Discord Credentials (Dark Reading) Scams pressure victims to "resolve an issue that could impact their status, business."

'Luna Moth' Group Ransoms Data Without the Ransomware (Dark Reading) Unsophisticated campaigns use off-the-shelf RATs and other tools to exfiltrate data and demand a ransom to keep it private.

HavanaCrypt ransomware sails in as a fake Google update (Register) Difficult to detect, hiding its window by using the ShowWindow function in Windows

New Vulnerabilities in Kubernetes NGINX Ingress Controller (Lightspin) In this blog we present a new way we discovered to exploit the Ingress Controller.

How smart homes present owners with big cybersecurity risks (Verdict) Smart homes have made people's lives more convenient, but they have also brought with them a range of cybersecurity risks.

Hackers can unlock Honda cars remotely in Rolling-PWN attacks (BleepingComputer) A team of security researchers found that several modern Honda car models have a vulnerable rolling code mechanism that allows unlocking the cars or even starting the engine remotely.

Hackers Say They Can Unlock and Start Honda Cars Remotely (Vice) They key fobs of several Honda models have a flaw that could allow hackers to unlock and start the cars.

Rolling PWN (PWN) Modern vehicles are often equipped with a remote keyless entry system. These RKE systems allow unlocking or starting the vehicle remotely.

Hacker Group Claims Elden Ring Publisher Is Its Latest Victim (Yahoo Finance) Bandai Namco, the Japanese publisher behind the Ace Combat, Dragon Ball Z, and Dark Souls games, appears to be the latest major gaming company to suffer a major hack. The ransomware group BlackCat added the Elden Ring publisher to its list of victims earlier today, though it’s not yet clear the extent of the damage or how much money the group is demanding.

Keep an eye on your Experian accounts for fraudulent access (Register) When identity thieves strike your identity theft monitor

BNamericas - CFE denies new data breach (BNamericas.com) The Mexican state-owned electric power utility said it verified its equipment and records, and found that data leaked online was from 2003 or 2004.

Associated Eye Care Discloses Impact From 2020 Netgain Ransomware Attack (SecurityWeek) The Montana-based company has started informing patients that their data was accessed without authorization during a November 2020 ransomware attack on Netgain.

Breach exposed personal data of organ donors and recipients at VCU Health since 2006 (Richmond Times-Dispatch) Virginia Commonwealth University Health System has announced a data breach may have exposed the personal information of almost 4,500 organ donors and recipients since 2006.

South Texas hospital data breach puts 15,000 patients at risk (kiiitv.com) CHRISTUS Health said the breached data could include a patient's full name, Social Security number, date of birth, home address, billing and insurance information.

Bayhealth Medical Center, Inc. Confirms More than 17,000 Patients Impacted by Professional Finance Company Data Breach (JD Supra) On July 5, 2022, Bayhealth Medical Center, Inc. posted notice of a data breach that affected the sensitive information of as many as 17,481 patients....

Charlotte Radiology Urges Patients to Watch for Healthcare Identity Theft Following Data Breach (JD Supra) Recently, Charlotte Radiology confirmed that the company experienced a data breach after an unauthorized party gained access to sensitive patient...

OrthoNebraska Hospital Reports Leaked Protected Health Information Following Email-Based Cyberattack (JD Supra) OrthoNebraska Hospital, based in Omaha, Nebraska, recently confirmed a data breach following an incident in which an unauthorized party gained access...

Going Once, Going Twice, Sold: Real Time Bidding Data Privacy Breach (JD Supra) The ongoing massive data breach in the world of advertising: real time bidding ("RTB"). You likely are, or have been, a target of RTB...

Massive Rogers outage caused by a maintenance update (BleepingComputer) Over the weekend, Rogers Communications CEO Tony Staffieri revealed the telecom company believes a maintenance update was what caused last week's massive outage.

Vulnerability Summary for the Week of July 4, 2022 (CISA) The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

Security Patches, Mitigations, and Software Updates

That didn’t last! Microsoft turns off the Office security it just turned on (Naked Security) An Office anti-malware setting that took more than 20 years to arrive… and fewer than 20 weeks to vanish again.

Microsoft Confirms Temporary Rollback of Macro Blocking Feature (SecurityWeek) Microsoft has confirmed that the recent rollback of a feature related to the blocking of internet macros in its Office suite is only temporary.

Microsoft says decision to stop blocking Office VBA macros by default is ‘temporary’ (The Record by Recorded Future) Microsoft claimed its decision to roll back a popular change that blocked Visual Basic for Applications (VBA) macros by default will be “temporary" but offered no timeline.

Trends

The Cloud Security Threat Landscape (CrowdStrike) Download the Protectors of the Cloud report now to find out which top cloud security threats to watch for and how best to address them.

The state of industrial security in 2022 (Barracuda Networks) Insecure remote access, lack of network segmentation, and insufficient automation are leaving organizations open to attacks.

Hybrid Work Expectations vs. IT Reality: New Report Shares Stark Findings (NinjaOne) Remote work went from exception to the norm almost overnight, but a new report shows how this rapid shift came with costs to IT operations.

Ransomware is still cybersecurity’s biggest challenge (VentureBeat) At CyberWeek 2022, UK SEO of NCSC, Lindy Cameron, said all hands must be on deck to root out ransomware, at government and enterprise levels.

New poll finds 7 in 10 adults want social media firms to do more to tackle harmful content (GOV.UK) Ipsos study finds over 4 in 5 adults are concerned about harmful content online

Expert warns of rising threat of cyber attacks on physical infrastructure (The Straits Times) Singapore is doing well in proactively preparing for specific scenarios, said Dragos' CEO.

What are bad actors called in cybersecurity? (Dataconomy) In this article, you can learn what are bad actors called in cybersecurity, bad actors meaning, threat actor types and attributes, detecting threat actors, bad actor vs hacker, and more.

Marketplace

The cyber insurance market has a critical infrastructure problem (CyberScoop) Rising cybersecurity risks are reviving questions about the ability of cybersecurity insurance to cover the risks of a catastrophic attack.

Cyber trust issues: How vulnerability creates cyber resilience (World Economic Forum) Organizations that will be leaders in the digital economy will encourage cyber resilience and build collaboration in the ecosystem by sharing experiences about cyber risks and challenges.

Thales further accelerates its cybersecurity development with the acquisition of OneWelcome, a leader in Customer Identity and Access Management (Thales Group) Continuing its cybersecurity expansion strategy, Thales announces the signature of an agreement to acquire OneWelcome, a European leader in the fast growing market of Customer Identity and Access Management, for a total consideration of €100 million. OneWelcome’s strong digital identity lifecycle management capabilities will complement Thales’s existing Identity services (secure credential enrollment, issuance and management, Know Your Customer etc) in order to offer the most comprehensive Identity Platform in the market.

With $3.3M in Seed Funding, Paladin Cloud Launches to Holistically Improve Cloud Security (GlobeNewswire News Room) Open source, Security-as-Code platform to help developers and security teams significantly reduce risks while improving their overall cloud security...

Kaseya says ‘false information’ was published about firm’s future (CRN Australia) Following comments from Datto co-founder Austin McChord.

Oracle mulls $1bn in cost cuts, laying off thousands of employees (Computing) Two top Oracle executives are also departing in addition to the possible job cuts

Versa Networks ACE Partner Program Wins 2022 Visionary Spotlight Award for Channel Deployments of the Year (Business Wire) Versa Networks, the recognized secure access service edge (SASE) leader, today announced that ChannelVision Magazine has named its Versa ACE (Accelera

Cybersecurity firm Polygraph reminds advertisers to apply for click fraud refunds every month (GlobeNewswire News Room) Some advertisers are wasting over 80% of their ad budgets by failing to request refunds from online advertising networks...

Iron Bow Technologies Appoints Dan Muse as Chief Financial Officer (Business Wire) Iron Bow Technologies, the leading technology solutions provider to government, commercial, and healthcare markets, today announced the appointment of

Mastermind of Broadcom’s VMware buy is out, CEO Tan to take over software (Register) Chip giant takes an add Hock approach

CRN® Names Ophelia Clarke of ConnectWise a Rising Female Star (GlobeNewswire News Room) ConnectWise, the world’s leading software company dedicated to the success of IT solution providers, today...

Incode Makes Strategic Hire to Further Accelerate Growth and Global Adoption (Business Wire) Incode, the next-generation identity verification and authentication platform for global enterprises, today announced that Dean Hickman-Smith has join

Secureworks Appoints Michael Aiello As Chief Technology Officer (Secureworks) Former Product Lead for Google Cloud Security Will Accelerate Growth as Business Transformation Continues

Products, Services, and Solutions

Deloitte Launches Zero Trust Access, a New Managed Security Service (PR Newswire) To help organizations adopt zero trust more quickly and efficiently, Deloitte is launching a new managed service – Zero Trust Access— that...

Paladin Cloud Launches New Cloud Security and Governance Platform (Dark Reading) The new open source security-as-code platform will help developers and security teams automatically detect security policy violations across the organization's cloud infrastructure.

Cellebrite Rebrands Digital Intelligence Solutions Suite (AiThority) Cellebrite, the global leader in DI solutions for public and private sectors, announced it has rebranded the industry's most comprehensive

Project slashes cost of OT cybersecurity for UK SMEs (Drives and Controls Magazine) A Welsh cybersecurity software developer has joined forces with Siemens to offer a low-cost OT (operational technology) security system for manufacturing...

Bitdefender Innovates Managed Detection and Response (MDR) with New Service Optimized for Organizations with Limited Resources (Bitdefender)

Dell’Oro Group Research Recognizes Aryaka as Delivering SASE with Unified Security and Network Connectivity (Business Wire) Aryaka®, the leader in fully managed SD-WAN and SASE solutions, today announced the company has been recognized by Dell’Oro Research Group as the newe

NeoSystems and Deltek Join Forces to Deliver Services in the Cloud (PR Newswire) NeoSystems, a full-service strategic outsourcer, IT systems integrator and managed services provider to the government contracting market, is...

FINOM Selects Resistant AI's Transaction Forensics to Strengthen its Money Laundering Defences (Resistant.AI) The Pan-European B2B Fintech Platform Can Now Prioritise In-house Alerts More Effectively While Adding Advanced Anomaly Detection

Keyfactor Launches EJBCA SaaS on Microsoft Azure (Keyfactor) The availability of EJBCA on Azure Marketplace allows customers to accelerate cloud migration.

Technologies, Techniques, and Standards

Post-quantum preparations: NIST has chosen, what should CISOs do now? (Computing) With the post-quantum cryptography landscape becoming clearer, every infrastructure decision should include considerations of quantum risk, says Post-Quantum's Andersen Cheng

Radiant Logic Participates in NIST NCCoE Zero Trust Architecture Project (Business Wire) In the Zero Trust Architecture project, RadiantOne was selected to consolidate and transform identity data into a real-time resource.

The "So What?" of the NIST Quantum Resistant Cryptographic Algorithms Announcement (OODA Loop) On 5 July 2022 NIST made a long awaited announcement of the first of four Quantum Resistant Algorithms that come from this years long process of coordination and examination. More algorithms and approaches are being evaluated and over the next two years NIST will be working on a final standard. The algorithms selected address the weaknesses proven through both Shor's and Grover's algorithms, meaning they are good algorithms for both general encryption and hashing.

GDPR Compliance in the Cloud: What You Need to Know | Enterprise Networking Planet (Enterprise Networking Planet) On May 25, 2018, the General Data Protection Regulation (GDPR) went into effect across the European Union (EU). The GDPR replaced the 1995 EU Data

The History and Evolution of Zero Trust (SecurityWeek) A brief history of the Zero Trust concept coined by Forrester’s John Kindervag in 2010, and how it has evolved over the years and is now a collective adjective.

Defending Aircraft Networks Against Cybersecurity Breaches (The State of Security) As attacks against critical infrastructure and rapidly digitizing industries rise, the aviation industry must reevaluate its standards.

How to develop successful incident response plans (Help Net Security) This video talks about the rules organizations need to think about if they way to develop successful incident response (IR) plans.

Bitcoin miners shut off rigs as Texas power grid nears brink (Seattle Times) Nearly all industrial bitcoin miners in Texas have shut off their machines as the companies brace for a heat wave that is expected to push the state’s power grid near its breaking point.

Design and Innovation

U.S. Government and QuSecure Orchestrate First-Ever Post-Quantum Encryption Communication over a Government Network (Business Wire) QuSecure™, Inc., a leader in post-quantum cybersecurity (PQC), today announced the U.S. Federal Government is currently orchestrating the world’s firs

Apple Is Offering $2M USD to Hackers Who Can Exploit Their New Lockdown Feature (HYPEBEAST) The feature will be made available in iOS 16.

Is Apple’s Lockdown Mode 100% secure? (ITWeb) With more secure modes, hacking is more difficult, but it cannot be ruled out entirely, says Kaspersky.

Academia

NSA lauds research of Mercyhurst student intelligence analysts (Mercyhurst University) Mercyhurst University is a four-year college located in Erie, Pennsylvania..

Legislation, Policy, and Regulation

How the CAC became Chinese tech’s biggest nightmare (Protocol) The Cyberspace Administration of China’s core functions have expanded from content control to data security and privacy, and it now affects the entire digital economy.

The United States Needs a New Foreign Policy for Cyberspace (Council on Foreign Relations) The internet is more fragmented, less free, and more dangerous than ever before.

Report: U.S. diplomacy must adapt to cyberspace's 'new realities' (The Record by Recorded Future) The U.S. must adopt a new foreign policy to confront a fragmented and potentially dangerous digital realm, according to the Council on Foreign Relations.

CISA Urges FCC to Prioritize National Security in Internet Routing Probe (Nextgov) CISA Director Jen Easterly said industry concerns shouldn’t preclude use of the commission’s regulatory authority to mitigate exploitation of the Border Gateway Protocol.

DHS puts the kibosh on saying ‘pilot’ as it deals with new congressional reporting requirements (Federal News Network) A provision in the omnibus spending bill for 2022 requires the Homeland Security Department to submit a report to Congress on the impact of most pilot programs.

One Year After the Colonial Pipeline Attack, Regulation Is Still a Problem (Security Intelligence) The Transportation Security Administration's directives after the Colonial Pipeline attack have proved hard to follow. What ongoing regulations may change?

New Standards Needed for Agency Cloud Computing Purchases, Says Report (FEDweek) A procurement bill (S-3099) now pending a Senate vote would require agencies to consider whether existing protections will meet their security needs

Congress could codify privacy rights with a bipartisan bill (Marketplace) The American Data Privacy and Protection Act would let consumers sue companies that violate its safeguards.

Location, health, and other sensitive information: FTC committed to fully enforcing the law against illegal use and sharing of highly sensitive data (Federal Trade Commission) Among the most sensitive categories of data collected by connected devices are a person’s precise location and information about their health.

How Much Cyber Insurance Governments Need Depends on Risk (Governing) Purchasing cyber defenses, training and insurance are budgeting decisions — and financial officers need number-driven risk models that show them how far each investment may go toward reducing risks of financial losses from cyber incidents.

Six Island businesses hit by ransomware attacks so far this year (Energy FM) The Manx Government’s Office of Cyber Security and Information Assurance (OCSIA) are urging organisations hit by ransomware attacks not to make p...

Litigation, Investigation, and Law Enforcement

OPM breach victims expected to receive about $700 each after class action settlement (The Record by Recorded Future) The nearly 26 million people who had their information leaked during two Office of Personnel Management (OPM) data breaches in 2014 and 2015 may be entitled to about $10,000.

IG Warns of Cyber Supply Chain Risks at Justice Department (FEDweek) An inspector general audit has found that both the Justice Department and its subagency the FBI are at risk because of weaknesses in its Cyber Supply

Italy warns TikTok over privacy policy switch (TechCrunch) TikTok’s attempt to switch legal basis for targeting advertising at users in Europe looks to be in trouble after Italy’s data protection watchdog stepped in and issued a warning of legal inadequacy just days ahead of the planned privacy policy change. The user-generated video sharing platform attra…

San Francisco cops want real-time access to private cameras (Register) ACLU hits back at 'unprecedented power grab'

Twitter Lawyers Call Musk’s Deal Termination ‘Wrongful’ (Bloomberg) Social network is expected to file suit against Musk this week. Billionaire seeks to scrap $44 billion deal over bot dispute.

New York Department of Financial Services Announces $5 Million Penalty in Most Recent Cybersecurity Enforcement Action (JD Supra) On June 23, 2022, the New York State Department of Financial Services (NYDFS) announced the entry of a Consent Order in connection with its most...

EDF Under Scrutiny Over Cybersecurity Record (Infosecurity Magazine) UK nuclear regulators step up monitoring of French giant EDF’s cybersecurity measures

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

STEM Pioneers Rock! Major Katie Higgins Cook, Marine Reservist, Blue Angels Pilot (Columbia and Virtual, Maryland, United States, Jul 12, 2022) Brought to you by NSA and Dreamport/MISI, the STEM Pioneers Rock series, highlights significant accomplishments of those who are "firsts" in their field. These individuals are responsible for attaining goals that opened doors for those who come behind them. In addition, we hope the "pioneers" we have identified encourage our workforce to "stay the course", improving retention statistics. Major Cook is a third-generation military aviator. Her paternal grandfather served during World War II, Korea, and Vietnam. Her father had a 26-year long career in the Navy and was an F-18 fighter pilot. Carrying on the family legacy, she joined the Marine Corps after graduating from the U.S. Naval Academy in 2008. She made the choice to go into the Marine Corps, after spending time training with Marines in Quantico, Va. During her time in the Marine Corps, she was one of the few female pilots to fly combat missions during her deployment to Afghanistan for Operation Enduring Freedom. After that, she spent time on assignment in Uganda, and had already accrued over 400 combat flight hours. It was during her time in Africa that she was approached by a Blue Angel pilot, who encouraged her to apply for the coveted flight demonstration team. Following an extensive interview process, Maj. Cook was officially the first female Blue Angel, and became the pilot of the Lockheed C–130 Hercules named "Fat Albert."

STEM Pioneers Rock! Dr. L. Jean Camp, Professor, Author, Innovator (Columbia and Virtual, Maryland, United State, Jul 25, 2022) Brought to you by NSA and Dreamport/MISI, the STEM Pioneers Rock series, highlights significant accomplishments of those who are "firsts" in their field. These individuals are responsible for attaining goals that opened doors for those who come behind them. In addition, we hope the "pioneers" we have identified encourage our workforce to "stay the course", improving retention statistics. Professor L. Jean Camp is a founder of the interdiscipline of economics of security. Her core contributions are in area of the social and economic implications of technologies of security and privacy. She is a leader in the investigation of the insider threat in the networked realm. Prof. Camp began her graduate studies in electrical engineering in North Carolina before moving to the Department of Engineering and Public Policy at Carnegie Mellon to complete her PhD in Engineering and Public Policy. Upon graduation she became a Senior Member of the Technical Staff at Sandia National Laboratories. She left Sandia National Laboratories for eight years as a professor at Harvard's Kennedy School, departing to lead the security group in the newly-formed School of Informatics at Indiana University. Professor Camp is the author of "Trust and Risk in Internet Commerce" (MIT Press), "Economics of Identity Theft" (Springer) and the editor of "Economics of Information Security" (Kluwer Academic). She has authored over one additional hundred works, including ninety peer-reviewed works and two dozen book chapters. She has made scores of invited presentations on five continents. Her patents are in the area of privacy-enhancing technologies. Her professional service has included terms on the Board of Directors of Computer Professionals for Social Responsibility, the Board of Governors of the IEEE Society on Social Implications of Technology, Alumni Board for Carnegie Mellon, Senior Member of the IEEE, and longstanding member of the USACM. See http://www.ljean.com/cv.html for more detailed information.

AWS re:Inforce (Boston, Massachusetts, United States, Jul 26 - 27, 2022) Exclusively for listeners of the Cyberwire Podcasts, register for AWS re:Inforce using code ALUMLBzyE6B6 to receive $300 off your full conference registration for AWS re:Inforce while supplies last. Join us at this year’s re:Inforce to hear from AWS leaders, builders, and experts about the latest advancements in AWS security, compliance, identity, and privacy solutions—including actionable best practices your business can use immediately. Sessions are offered at all levels and for all backgrounds, from beginner to expert and business to technical.

ICS/OT Cyber Threats, Vulnerabilities, and Incidents: Past and Present (Columbia and virtual, Maryland, USA, Jul 27, 2022) Gain an in-depth look at old case studies and new research across 2021 highlighting new ICS threat groups, vulnerabilities, and insights from the field including incident response case studies of previously unreported incidents. This session will give a ground-truth reality and primer on what is really happening in our industrial environments.

2022 Cybersecurity Conference (Indianapolis, Indiana, USA, Aug 10, 2022) Is your business utilizing the best technology available for your success? More importantly, are you using it safely? Cyberattacks are the most significant risk factor facing Indiana businesses today. The 2022 Cybersecurity Conference will address key technology information, products, strategies, protections and so much more to help you ensure your organization is operating safely for future success. This program should appeal to anyone who has a role regarding personal or confidential information – whether the information is that of a customer, employee, patient, student, job applicant or it is a trade secret or other proprietary information.

STEM Pioneers Rock! Loretta Hall, Author of biography of Wally Funk, member of the female team for Mercury 13 flight (Columbia and Virtual, Maryland, United States, Aug 15, 2022) Brought to you by NSA and Dreamport/MISI, the STEM Pioneers Rock series, highlights significant accomplishments of those who are "firsts" in their field. These individuals are responsible for attaining goals that opened doors for those who come behind them. In addition, we hope the "pioneers" we have identified encourage our workforce to "stay the course", improving retention statistics. Loretta Hall is a freelance writer and nonfiction book author. Although she has written for a variety of consumer magazines, she concentrated on civil engineering and architecture trade publications for many years. About ten years ago, her latent fascination with space exploration resurfaced, and she has since concentrated on that subject. During the past fifteen years, she has written seven books for adults and young adults, including two on architecture and three on the history and future of space travel. Her children's picture book about visiting Spaceport America was published in 2017. She is a board member of New Mexico Press Women, a Certified Space Ambassador for the National Space Society, and a member of the Historical Society of New Mexico's Speakers Bureau.

STEM Pioneers Rock! Dr. Cynthia Sutherland, First Female CISO of FEMA, Author, leader at Amazon (Columbia and Virtual, Maryland, United States, Sep 27, 2022) Brought to you by NSA and Dreamport/MISI, the STEM Pioneers Rock series, highlights significant accomplishments of those who are "firsts" in their field. These individuals are responsible for attaining goals that opened doors for those who come behind them. In addition, we hope the "pioneers" we have identified encourage our workforce to "stay the course", improving retention statistics. Dr. Cynthia Sutherland was appointed as the first Senior Executive Service (SES)-level Chief Information Security Officer (CISO) at FEMA in June 2020. As CISO, she provides executive leadership and direction for FEMAʼs cybersecurity services: Cybersecurity Policy, Planning, and Training; Identity, Credential, and Access Management (ICAM); Cyber Engineering; Cyber Assessment; Compliance; Risk Management; and Security Operations. Prior to joining FEMA, Dr. Sutherland served as the Deputy of Cyberspace Division and CISO for the Department of Defenseʼs Joint Sta as the primary advisor to Joint Sta and Combatant Commands for integrating cybersecurity into warfighter systems and military tactical networks. Her specialty areas included topics such as Data Analytics, Artificial Intelligence, Cloud, Industrial Control Systems, and Supply Chain Risk Management. She also served as the Global Chair and U.S. Representative to the Multinational Security Accreditation Board for secure interoperability between DoD and foreign partners plus the North Atlantic Treaty Organization. Before her civilian work with DoD, Dr. Sutherland served as a Telecommunications Specialist for the Army National Guard, with an active duty tour to Baghdad, Iraq in support of Operation Enduring/Iraqi Freedom. She earned numerous awards to include Army Achievement Medals, Global War on Terrorism Service Medal, and National Defense Service Medal. Dr. Sutherland holds a Doctor of Science in Cybersecurity, Master of Science in Network Security, and a Bachelor of Science in Information Systems Management. She also contributed to the cybersecurity industry through her published work, Case Study: Integration of Cybersecurity Content into Juris Doctor Curriculum – Creation of the Cybercrime Prosecutor.

Events

Digital safety snacks: Protect yourself from online abuse with short videos and workshops (Virtual, Jun 13 - Jul 28, 2022) PEN America, the Online News Association, and the International Women’s Media Foundation have teamed up to create step-by-step videos and hands-on workshops to help you defend yourself against online abuse. We’ll explain how to protect your most sensitive accounts from hackers and how to dox yourself before someone else does. We want to empower you to feel safer and more secure while maintaining the public profile you need to do your job. This series will include eight short video episodes and four virtual workshops, when you can follow along to complete your digital wellness check, ask questions, and get help if you get stuck. You can join one, two or all four sessions.

Impact 2022 (Boston and Virtual, Massachusetts, USA, Jul 12 - 14, 2022) Presented by CyberArk, Impact is the leading cybersecurity conference for forward-thinking professionals. Gain insights on privileged access management (PAM) and Identity Security to help secure your digital business from the next generation of attackers

Economics of Cyber & Risk Management (Columbia, Maryland, USA, Jul 13, 2022) Businesses, government agencies, educational institutions, healthcare entities, and nonprofits alike are all grappling with IT (Information Technology) infrastructure challenges, and the pressures will not subside anytime soon. Teleworking, telehealth, virtual learning, and e-commerce are just a few daily practices being influenced by data security, access, and management. Simultaneously, labor shortages continue to challenge technology firms in their ability to combat digital adversaries. Future business profits undoubtedly will be linked to the cyber and risk management practices business entities put in place and the ongoing training their employees receive as they protect their data assets and intellectual property.

The Diana Initiative Virtual Conference (Virtual, Jul 16, 2022) Back for the 6th year, The Diana Initiative is hosting a two-day diversity-driven conference committed to helping all underrepresented genders, sexualities, races and cultures in Information Security. The Diana Initiative features multiple speaker tracks, fully expanded villages with hands-on workshops, and a women-led Capture the Flag event.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.