Reports of cyberespionage. Renewed LockBit threat. Risks and vulnerabilities in widely used products. Updates on a hybrid war.

Summary

By the CyberWire staff

At a glance.

Belgium accused China of cyberespionage.
LockBit ransomware spreading through compromised servers.
Vulnerabilities in popular automotive GPS tracker.
Report: password stealing and impersonation risks in identity management product.
Current Russian cyber operations.
Russia's cyber operations appear to focus on espionage.
Cyber escalation and spillover.
CISA releases ICS advisories.

Belgium accuses China of cyberespionage.

Belgium's Foreign Ministry has accused China of an extensive cyberespionage campaign against numerous Belgian targets, including the country's Ministries of Interior and Defense. The specific threat groups singled out include APT27, APT30, APT31, and Gallium, this last group also tracked as Softcell and UNSC 2814. "Belgium strongly denounces these malicious cyber activities, which are undertaken in contradiction with the norms of responsible state behaviour as endorsed by all UN member states," the Foreign Ministry's statement said in part. "We continue to urge the Chinese authorities to adhere to these norms and not allow its territory to be used for malicious cyber activities, and take all appropriate measures and reasonably available and feasible steps to detect, investigate and address the situation."

BleepingComputer reports that China says, in effect, prove it, and by the way, you can't, because China is the real victim here. The full response of the Chinese embassy in Brussels is familiar stuff: "We have taken note of the statement. It is extremely unserious and irresponsible of the Belgian side to issue a statement about the so-called "malicious cyberattacks" by Chinese hackers without any evidence. On the one hand, the Belgian side refuses to provide the factual basis and, on the other hand, it makes groundless accusations and deliberately denigrates and smears China. We express our strong dissatisfaction and our firm opposition. On the issue of cybersecurity, China is square, frank and open. China has always been a strong advocate of cybersecurity and one of the main victims of cyberattacks."

LockBit ransomware spreading through compromised servers.

Researchers at the Symantec Threat Hunter Team, part of Broadcom Software, this morning reported that threat actors are targeting servers with LockBit ransomware. Their goal is to spread the ransomware through compromised networks. One attack utilizing LockBit has been seen identifying domain-related information, creating a group policy, and executing a "gpupdate /force" command to update the group policy. The threat actors behind LockBit, which Symantec tracks as Syrphid, first appeared in September 2019 and quickly expanded its operations through a network of affiliates.

This version of LockBit delivers a double-extortion attack, both encrypting files and threatening public exposure of stolen data. LockBit is selective in its targeting, sparing Russia and a small selection of countries in the near abroad. It runs a language check, and, should it detect Azeri, Kazkh, Kyrgyz, Russian, Tajik, Turkmen, or Uzbek, the malware terminates.

LockBit is a ransomware-as-a-service operation, and it’s replaced the now-possibly defunct Conti atop the C2C market leaderboard. Its rise is thus partially opportunistic, but Symantec sees other keys to its success. “LockBit’s success is also due to its developers and affiliates continued evolution of features and tactics, which include the malware’s fast encryption speed, ability to target both Windows and Linux machines, its brash recruitment drives, and high-profile targets. In addition, as previously mentioned, the launch of a rewards program for vulnerabilities in LockBit’s code and for suggestions on improving the RaaS operation will no-doubt help the ransomware remain a serious threat to organizations.”

Proactively address your attack surface risks

The recent boom in cyber-attacks is a reminder that we face increasingly sophisticated malicious adversaries. This can make understanding the risks to your attack surface feel overwhelming. Not to worry! Read our latest e-book to learn what approaches your organization can take to manage your attack surface and better protect your organization from adversaries.

Report: password stealing and impersonation risks in identity management product.

Security firm Authomize reports that Okta identity provider tools present users with four serious security risks:

"Clear text Password extraction via SCIM [System for Cross-domain Identity Management]
"Sharing of Passwords and sensitive data over unencrypted channels (HTTP)
"Hub & spoke configuration allows sub-org admins to compromise accounts in the hub or other spokes downstream
"Mutable identity log spoofing"

Okta responded that it had looked into Authomize's report, and that it's concluded that these don't represent vulnerabilities, but rather are features of the way their product functions, and that any attendant risks can be addressed by following the best practices Okta recommends. "On July 19, 2022, a security consultancy released a blog post with claims related to the security of specific features of the Okta service. Prior to the release of their blog post, the security researcher reached out to Okta, sharing the technical details of their findings. After a thorough review, our internal product and security teams affirmed that the areas of concern highlighted are not vulnerabilities."

Micodus GPS tracker vulnerabilities.

Researchers at BitSight have issued a report on vulnerabilities in the popular Micodus MV720 automotive GPS tracker. The MV720 is designed for both fleet management and theft protection. In addition to simply tracking vehicles in which it's installed, the MV720 offers anti-theft, fuel cut off, remote control, and geofencing features. All of these are susceptible to exploitation in a variety of ways. As BitSight puts it, "The exploitation of these vulnerabilities could have disastrous and even life-threatening implications. For example, an attacker could exploit some of the vulnerabilities to cut fuel to an entire fleet of commercial or emergency vehicles. Or, the attacker could leverage GPS information to monitor and abruptly stop vehicles on dangerous highways. Attackers could choose to surreptitiously track individuals or demand ransom payments to return disabled vehicles to working condition. There are many possible scenarios which could result in loss of life, property damage, privacy intrusions, and threaten national security."

The researchers say they've been trying to get through to Micodus since September of last year, and the account of their attempts at responsible disclosure form a story of virtue under trial worthy of Samuel Richardson's Clarissa. In brief, BitSight says Micodus never replied, and eventually when BitSight turned to the US Cybersecurity and Infrastructure Security Agency (CISA), CISA had no better luck getting through. Guangdong-based Micodus says on its website that it values customer feedback, but there was no mention on their site of any of the issues BitSight uncovered. Nor are there any fixes or updates available. BitSight thinks all users should disable their MV720s at once, and stop using them until a reliable fix for the vulnerabilities is available. CISA, while noting that no public exploitation of the vulnerabilities has so far been seen, basically agrees, and thinks users should take care to isolate their networks from the vulnerable devices.

Current Russian cyber operations.

There's been some chatter in Twitter about a resurgence in operations by the FSB's Turla group. A representative post by @billyleonard, of Google's Threat Analysis Group, opened a thread on July 8th by drawing attention to, "Some recent Turla activity that @0xbadcafe1 and I looked at spoofing the Azov Regiment ... but targeting Android users."

Late yesterday Google's Threat Analysis Group (TAG) published a full report on what it's seen, recently, of Turla and other actors aligned with the Russian cause. Turla is indeed impersonating the Azov Regiment, and is offering malicious apps that misrepresent themselves as a kind of do-it-yourself kit patriotic Ukrainians can use to conduct DDoS attacks against Russian networks. The apps do nothing of the kind, but instead install malware on the devices to which they're downloaded. "Turla, a group publicly attributed to Russia’s Federal Security Service (FSB), recently hosted Android apps on a domain spoofing the Ukrainian Azov Regiment," TAG writes. "This is the first known instance of Turla distributing Android-related malware. The apps were not distributed through the Google Play Store, but hosted on a domain controlled by the actor and disseminated via links on third party messaging services. We believe there was no major impact on Android users and that the number of installs was miniscule."

Other Russian groups TAG mentions in dispatches include the GRU (APT28, Sandworm, or Fancy Bear) and a privateering spin-off of the possibly defunct Conti gang. These are exploiting the now-patched Follina remote code execution vulnerability in the Microsoft Windows Support Diagnostic Tool. TAG's observations confirm earlier reports by CERT-UA. "The Sandworm campaign used compromised government accounts to send links to Microsoft Office documents hosted on compromised domains, primarily targeting media organizations in Ukraine," the report says, adding, "TAG has also observed an increasing number of financially motivated actors targeting Ukraine. One recent campaign from a group tracked by CERT-UA as UAC-0098 delivered malicious documents with the Follina exploit in password-protected archives, impersonating the State Tax Service of Ukraine. We assess this actor is a former initial ransomware access broker who previously worked with the Conti ransomware group distributing the IcedID banking trojan based on overlaps in infrastructure, tools used in previous campaigns, and a unique cryptor."

Cyberespionage continues, with phishing as its principal mode of gaining access. Ghostwriter, operated by the intelligence services of Russia's ally Belarus, has continued to work against its customary targets, especially Poland, and the Russian threat group ColdRiver (also called "Callisto" but best known as Gamaredon or Primitive Bear) "continues to send credential phishing emails to targets including government and defense officials, politicians, NGOs and think tanks, and journalists." ColdRiver has also used Dropbox and Google Drive to host malicious pdfs.

Russia's cyber operations appear to focus on espionage.

Spectacular cyberattacks, works of sabotage with widespread kinetic effect, have not so far figured in Russia's war, and this defies the expectations that many observers had during the run-up to the February invasion. Russia had given ample evidence of its ability to disable infrastructure in earlier cyberattacks against portions of Ukraine's power grid, and there was no reason to expect restraint once Moscow's policy became one of full-scale, lethal, aggression.

Why this has been so remains a matter of debate and speculation. An essay in War on the Rocks observes that Russian cyber operations have been largely confined to cyberespionage and influence operations, leavened by some low-grade, nuisance-level distributed denial-of-service (DDoS) attacks. Among the possible explanations for the absence of serious attacks against infrastructure are 1) effective Ukrainian cyber defense (they've learned from their experience of earlier Russian attacks, and they've successfully engaged sympathetic international partners to help improve security), 2) NATO, especially US interference (the Record reports that US Cyber Command's General Nakasone yesterday repeated, without further detailed elaboration, his statement last month that his organization had actively "denied, degraded, and disrupted" Russian cyber and information capabilities, 3) such denial, disruption, and degradation may have induced a fourth D, deterrence, and, finally, 4) as War on the Rocks speculates, offensive cyber operations have simply turned out to be more difficult to pull off than many had imagined.

Cyber escalation and spillover.

While cyber operations clearly have a place in hybrid war at least as prominent as traditional espionage and electronic warfare, they seem so far to have fallen short, at least in Russian hands, of their menacing promise as combat support for a shooting war. A cold war may be a different matter. An essay in Forbes outlines the role cyber operations will play should a new cold war emerge from the war in Ukraine. The arguments in the essay, by Forbes Technology Council member Matt Georgy (CTO at [redacted], and that's the company's name, including the square brackets), are short and cogent, but we would offer one demurral: the new cold war isn't emerging. It's been in progress for the better part of a decade at least.

The European Union yesterday issued a statement deploring Russia's conduct in cyberspace and the way in which its offensive activities have spilled over to countries other than Ukraine. The statement draws particular attention to the nuisance-level DDoS attacks EU member states have recently experienced: "The latest distributed denial-of-service (DDoS) attacks against several EU Member States and partners claimed by pro-Russian hacker groups are yet another example of the heightened and tense cyber threat landscape that EU and its Member States have observed. We strongly condemn this unacceptable behaviour in cyberspace and express solidarity with all countries that have fallen victim. We remain determined to address and investigate malicious cyber activities affecting international peace, security and stability, including the security of the European Union and its Member States, their democratic institutions, citizens, businesses, and civil society." The statement made a point of reminding all that the EU had condemned Russian cyberattacks against Ukraine as early as January 14th of this year, a date that seems to mark the onset of the preparation phase of Russia's hybrid war.

The Center for European Policy Analysis (CEPA) has a recommendation on a proper Western response to Russian cyber operations: refer ops and the threat actors behind them to the International Criminal Court in the Hague.

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

CISA releases ICS advisories.

CISA released two more ICS advisories on July 19th: a new advisory for MiCODUS MV720 GPS Tracker ("mitigations for Use of Hard-coded Credentials, Improper Authentication, Cross-site Scripting, and Authorization Bypass Through User-controlled Key vulnerabilities in the MiCODUS MV720 GPS tracker") and a follow-up for Dahua ASI7213X-T1 (Update A) ("mitigations for Unrestricted Upload of File with Dangerous Type, Authentication Bypass by Capture-replay, and Generation of Error Message Containing Sensitive Information vulnerabilities in the Dahua ASI7213X-T1 facial recognition access controller").

Join 1Password security experts for Security Summer Camp - sign-up now

Notes.

Today's issue includes events affecting Australia, Azerbaijan, Belgium, Brazil, Canada, China, Denmark, the European Union, Iran, Israel, Kazakhstan, the Democratic People's Republic of Korea, Kyrgyzstan, NATO/OTAN, Russia, Tajikistan, Turkey, Turkmenistan, Ukraine, the United Kingdom, the United States, and Uzbekistan.

Dateline

Ukraine at D+146: Kinetic attrition, and cyberespionage. (The CyberWire) A stalled Russian offensive, but mass, indiscriminate fires continue unabated. Observers offer a range of possible explanations for why Russian cyber operations have remained relatively limited in scope. And, while their kinetic effect may have been negligible, Russian threat actors remain active in cyberespionage.

Russia-Ukraine war: List of key events, day 147 (Al Jazeera) As the Russia-Ukraine war enters its 147th day, we take a look at the main developments.

Russia says peace in Ukraine will be on its terms, strikes multiple targets (Reuters) A senior Russian security official said on Tuesday that peace in Ukraine when it came would be on Moscow's terms as Russian forces struck targets across the country with missiles even as their ground offensive stuttered.

Russia Following 2014 ‘Annexation Playbook’ In Eastern Ukraine, White House Says (Defense One) The White House is expected to announce another weapons shipment to Ukraine this week.

Russia hits Ukrainian homes, infrastructure as Putin visits Iran (Al Jazeera) Missiles have hit eastern and southern Ukraine as Russian president visits Iran to discuss unblocking grain exports.

Himars missiles strike key Russian-held bridge in Kherson (The Telegraph) A Ukrainian missile strike has damaged a key bridge linking the Russian-occupied city of Kherson with the heavily militarised Russia-controlled Crimea, potentially disrupting further reinforcements.

U.S. Himars Help to Hold Off Russian Advance, Ukraine Says (Wall Street Journal) Along with other heavy weapons systems from NATO members in recent weeks, Himars have enabled Ukraine to strike Russian bases far behind the front lines, including ammunition and fuel depots.

Ukraine's defense minister: With the right weapons, 'Russia can definitely be defeated' (Atlantic Council) Oleksii Reznikov laid out what the West can do to help Ukraine win back its territory from Russia.

Ukraine Faces Difficulties Getting Western Weapons to Front Lines (Wall Street Journal) Modern and effective Western weapons are now being used in the country’s war with Russia and are already making a difference. But absorbing this new equipment into the Ukrainian army is proving a serious challenge.

Weapons of a Hybrid War (Wilson Quarterly) This photo essay by photojournalist Wil Sands shows in words and pictures the complexities of Europe's disparate approach to families fleeing crisis.

Sabotage and War in Cyberspace (War on the Rocks) Russia’s invasion of Ukraine is a terrible throwback to attrition warfare. Having failed in their opening salvo against Kyiv, Russian forces have settled

Council Post: Why A Second Cold War Will Likely Be Fought In Cyberspace (Forbes) Regardless of what happens down the road, companies would be wise to assume that a second Cold War is upon us.

EU warns of Russian cyberattack spillover, escalation risks (BleepingComputer) The Council of the European Union (EU) said today that Russian hackers and hacker groups increasingly attacking "essential" organizations worldwide could lead to spillover risks and potential escalation.

Continued cyber activity in Eastern Europe observed by TAG (Google) Google’s Threat Analysis Group (TAG) continues to closely monitor the cybersecurity environment in Eastern Europe with regard to the war in Ukraine. Many Russian government cyber assets have remained focused on Ukraine and related issues since the invasion began, while Russian APT activity outside of Ukraine largely remains the same. TAG continues to disrupt campaigns from multiple sets of Russian government-backed attackers, some of which are detailed in our previous updates.

A Russian-backed malware group is spoofing pro-Ukraine apps, Google finds (The Verge) The Cyber Azov app actually contained Trojan malware.

Russian hackers behind SolarWinds breach continue to scour US and European organizations for intel, researchers say (CNN) The Russian hackers behind a sweeping 2020 breach of US government networks have in recent months continued to hack US organizations to collect intelligence while also targeting an unnamed European government that is a NATO member, cybersecurity analysts tell CNN.

State-backed threat actors use Google Drive, Dropbox to launch attacks (Cybersecurity Dive) The Russia-linked threat actor behind the SolarWinds attack used cloud storage services to deploy malicious payloads using Cobalt Strike.

Russian Cyberattacks Need an International Criminal Court Response (CEPA) International law needs to keep pace with the changing nature of warfare. The ICC is best placed to take action.

Cyber Command chief stands by comments on 'offensive' operations against Russia (The Record by Recorded Future) U.S. Cyber Command and National Security Agency chief Gen. Paul Nakasone stood by his comments last month about the U.S military conducting offensive cyber operations against Russia in its defense of Ukraine.

Direct hit! Pop song sings the praises of Himars, the rocket that has the Russians on the hop (The Telegraph) Music video lauds ‘our trusted ally from America’, which has been credited for taking out invading targets, including high-ranking officers

Putin’s New Propaganda Battle (Wilson Quarterly) From fiery speeches to movie reels to TikTok, propaganda is a critical part of war. It is used to motivate citizens, glorify soldiers, justify military action, and win support from global allies. The war in Ukraine highlights both Russia turning its long-term grievances into open conflict as well as the limits of information warfare.

Nuclear strategy and ending the war in Ukraine (The Hill) As President Putin keeps reminding us, this particular conflagration has the potential to start a nuclear war.

Fleeing Putin (Wilson Quarterly) Jill Dougherty talks with Russian journalists who have fled their home country; they share stories of their personal journeys, professional shifts, and reflect on the future of Russia.

Ukrainian boy held hostage by Russia tells of cleaning up torture rooms (the Guardian) Vladislav Buryak was kept for 90 days and describes people screaming and a room with bloodstains and soaked bandages

Putin’s Imperial Dream (Wilson Quarterly) Kennan Institute Director William Pomeranz examines the challenges Putin faces in unifying Russia while increasingly ostracized by regional and global governing bodies.

How Putin Learned to Hold Deadly Grudges (Foreign Policy) Russia’s president has been shaped by decades of bitterness and revenge.

‘Russia stole our history’: Ukraine’s bitter struggle to keep memory alive (the Guardian) Beyond the frontlines, academics are fighting to counter the fake tales of their country’s past that are peddled by the Kremlin

EU adopts Ukrainian art exhibition left stranded in Denmark (the Guardian) Unfolding Landscapes on show in Brussels before possible tour of member states and return to Kyiv

Lifting the Fog of War (Wilson Quarterly) The world has shifted dramatically since Russia invaded Ukraine on February 24, 2022. As we sit on the hinge of history, our summer 2022 issue examines the ever-widening impacts of the Russia-Ukraine war. With features covering a range of topics—from European security to world resources to mental health and more—we asked some of the nation's most experienced and respected foreign policy experts to share their thoughts on the biggest lessons and insights thus far.

A New Security Architecture (Wilson Quarterly) In this multi-media feature, Robert Litwak, senior vice president and director of international security studies at the Wilson Centers, speaks with Baroness Catherine Ashton, who served as the European Union's first High Representative for Foreign Affairs and Security Policy from 2009 to 2014. Together, they explore the cascading effects of Russia's invasion into Ukraine, with a focus on the quickly evolving geopolitical landscape.

Is Russia a Terrorist State? (Foreign Policy) Kyiv thinks it knows the answer—while Washington debates.

Russia Is Taking Advantage of the Invasion-Stirred Migration Crisis (Foreign Policy) As food problems worsen, new refugees head for Europe.

"The mouth of a bear": Ukrainian refugees sent to Russia (AP NEWS) For weeks Natalya Zadoyanova had lost contact with her younger brother Dmitriy, who was trapped in the besieged Ukrainian port city of Mariupol.

Amid flow of weapons to Ukraine, DefMin says black market smuggling is 'artificial' concern - Breaking Defense (Breaking Defense) Ukraine's defense minister says his country has been receptive to NATO, EU initiatives to monitor the influx of weapons.

Ukraine graft concerns resurface as Russia war goes on (AP NEWS) Ukrainian President Volodymyr Zelenskyy’s dismissal of senior officials is casting an inconvenient light on an issue that the Biden administration has largely ignored since the outbreak of war with Russia: Ukraine’s history of rampant corruption and shaky governance.

Ukraine’s vibrant civil society deserves key role in post-war transformation (Atlantic Council) Ukraine's vibrant civil society sector is the country's secret weapon in its civilizational struggle against Putin's Russia and should be a key focus of support efforts as the international community looks to rebuild Ukraine.

The West must take urgent steps to prevent Ukrainian economic collapse (Atlantic Council) Recent talk of a Ukrainian Marshall Plan for the post-war period is certainly welcome but Ukraine also needs action from the West without delay to avoid a potentially catastrophic economic collapse while the war continues.

Erdoğan keeps Putin waiting in awkward moment ahead of Tehran talks (the Guardian) Russian president was left standing alone as the camera shutters clicked away – a treatment he usually reserves for other world leaders

Russia-Ukraine Sanctions (Wilson Quarterly) Bruce Jentleson examines sanction's role in ending the war, the broader ripples, and future lessons.

Russia’s Energy Future (Wilson Quarterly) Russia’s invasion of Ukraine on February 24 unleashed a full-scale war with effects far outside Europe. At risk of becoming the longest warfare in the region since World War II, it has already shifted international relations and security approaches globally. With Russia an important player in global energy markets, the war may have severe and long-term repercussions for global energy relations and national energy policies. Here, are some likely scenarios.

Russia's Gazprom says it cannot guarantee natural gas deliveries to European customers - as its exports to China hit an all-time high (Markets Insider) Fears are growing that Russia will permanently slash its natural gas exports to Europe, in what could be a hammer blow to the region's economy.

Russia-Ukraine war: EU accuses Putin of blackmail and says Europe must prepare for ‘total cut-off of Russian gas’ – live (the Guardian) European Commission sets out emergency plan to reduce gas consumption among EU member states

Germany worries about gas rationing as supply from Russia halted (the Guardian) Temporary closure of Nord Stream 1 prompts fears for private consumers as well as industry

Canada accused of betraying Ukraine and helping Russia break sanctions (Atlantic Council) Canada is facing accusations of bowing to Kremlin blackmail after agreeing to lift sanctions imposed over Vladimir Putin's Ukraine invasion in order to secure Russian gas supplies to Germany.

Jill Biden meets with Ukrainian first lady Olena Zelenska at the White House (CNN) Ukrainian first lady Olena Zelenska is at the White House on Tuesday to privately meet with first lady Jill Biden and take part in a larger bilateral meeting with American officials.

Attacks, Threats, and Vulnerabilities

Belgium says Chinese hackers attacked its Ministry of Defense (BleepingComputer) The Minister for Foreign Affairs of Belgium says multiple Chinese state-backed threat groups targeted the country's defense and interior ministries.

Belgium says China-linked APT groups attacked its interior and defence ministries (Computing) APT 27, APT 30, APT 31 and Gallium are said to be the perpetrators of the attacks

China: Declaration by the Minister for Foreign Affairs on behalf of the Belgian Government urging Chinese authorities to take action against malicious cyber activities undertaken by Chinese actors (Federal Public Service Foreign Affairs) Declaration by the Minister for Foreign Affairs on behalf of the Belgian Government urging Chinese authorities to take action against malicious cyber activities undertaken by Chinese actors.

Déclaration du porte-parole de l'Ambassade de Chine en Belgique au sujet de la déclaration du gouvernement belge sur les cyberattaques (Embassy of the People's Republic of China in the Kingdom of Belgium) Le 18 juillet, le Ministre belge des Affaires étrangères a publié une déclaration au nom du gouvernement fédéral belge, accusant les hackers chinois de « cyberattaques malveillantes » contre le SPF Intérieur et la Défense belge, et exhortant les autorités chinoises à prendre des mesures contre les activités en question. Quel est votre commentaire à ce sujet ?

Albanian Government Hit by “Massive Cyber-Attack” (Infosecurity Magazine) Albanian government websites have been forced offline following the incident

Intelligence Agencies Say Russia Election Threat Persists Amid Ukraine War (New York Times) Top F.B.I. and National Security Agency officials said that Iran and China also remained potent threats, mounting their own campaigns to undermine American democracy.

Russian Threat to U.S. Elections Persists Even Amid War in Ukraine, Officials Say (Wall Street Journal) NSA and FBI chiefs warn the Kremlin can balance midterm meddling with its cyberattacks on Kyiv. ‘We’re quite confident the Russians can walk and chew gum,’ FBI head says.

Popular vehicle GPS tracker gives hackers admin privileges over SMS (BleepingComputer) Vulnerability researchers have found security issues in a GPS tracker that is advertised as being present in about 1.5 million vehicles in 169 countries.

Security flaws in GPS tracker exposing 1M vehicle locations (TechCrunch) Researchers warn that the flaws can be exploited to track vehicles and remotely cut engines

Unpatched flaws in popular GPS devices could let hackers disrupt and track vehicles (The Record by Recorded Future) CISA and BitSight warn about vulnerabilities in MiCODUS fleet management devices.

GPS trackers used for vehicle fleet management can be hijacked by hackers (CSO Online) At least one model of GPS tracking devices made by Chinese firm MiCODUS "lacks basic security protections needed to protect users from serious security issues."

Security flaws in GPS trackers put global fleets at risk (Register) About '1.5 million' folks and organizations use these gadgets

Unpatched Micodus GPS Tracker Vulnerabilities Allow Hackers to Remotely Disable Cars (SecurityWeek) Widely used Micodus vehicle GPS trackers are affected by critical vulnerabilities that can be exploited by hackers to stalk people and remotely disable cars.

LockBit: Ransomware Puts Servers in the Crosshairs (Broadcom Software Blogs | Threat Intelligence) LockBit affiliates using servers to spread ransomware throughout networks.

Authomize Discovers Password Stealing and Impersonation Risks in Okta | Authomize.com (Authomize) Inherent design risks leave the users of Okta exposed to potential theft of all employee passwords in clear text, privilege escalation by app admins, and impersonation, highlighting the need to add a security layer around IAM systems

Okta Response to Security Report (Okta) On July 19, 2022, a security consultancy released a blog post with claims related to the security of specific features of the Okta service. Prior to the rele...

Authentication Risks Discovered in Okta Platform (Threatpost) Four newly discovered attack paths could lead to PII exposure, account takeover, even organizational data destruction.

Okta Exposes Passwords in Clear Text for Possible Theft (Dark Reading) Researchers say Okta could allow attackers to easily exfiltrate passwords, impersonate other users, and alter logs to cover their tracks.

Hackers steal 50,000 credit cards from 300 U.S. restaurants (BleepingComputer) Payment card details from customers of more than 300 restaurants have been stolen in two web-skimming campaigns targeting three online ordering platforms.

Amid Rising Magecart Attacks on Online Ordering Platforms, Recent Campaigns Infect 311 Restaurants (Recorded Future) Infected ordering platforms place local restaurants at risk of Magecart e-skimmer attacks. 2 recent campaigns impact 311 restaurants and 50K+ exposed customers.

I see what you did there: A look at the CloudMensis macOS spyware (WeLiveSecurity) ESET uncovers CloudMensis, a macOS backdoor that spies on users of Mac devices and communicates with its operators via public cloud storage services.

Feelyou mental health app says emails of 78,000 users exposed in breach (The Record by Recorded Future) Popular mental health app Feelyou announced a platform vulnerability this week that exposed the email addresses of nearly 78,000 of its users.

New 'CloudMensis' macOS Spyware Used in Targeted Attacks (SecurityWeek) Researchers analyze CloudMensis, a previously undocumented macOS malware that has been used in targeted attacks to steal valuable information from compromised systems.

Blue Shield of California Promise Health Plan Announces Data Breach (JD Supra) Recently, Blue Shield of California Promise Health Plan confirmed that the company experienced a data breach related to a sub-contractor that works...

American Dental Association Reports Data Breach in the Wake of Ransomware Attacks (JD Supra) Recently, the American Dental Association (“ADA”) confirmed that the organization was the target of a ransomware attack. As a result of the attack, an...

Vulnerability Summary for the Week of July 11, 2022 (CISA) The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

UK heat wave causes Google and Oracle cloud outages (BleepingComputer) An ongoing heatwave in the United Kingdom has led to Google Cloud and Oracle Cloud outages after cooling systems failed at the companies' data centers.

Security Patches, Mitigations, and Software Updates

Microsoft Resolves Padding Oracle Vulnerability in Azure Storage SDK (SecurityWeek) Microsoft releases Azure Storage SDK update to address a padding oracle vulnerability in client-side encryption.

Dahua ASI7213X-T1 (CISA) 1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Dahua Equipment: DHI-ASI7213X-T1 Vulnerabilities: Improper Input Validation, Unrestricted Upload of File with Dangerous Type, Authentication Bypass by Capture-replay, Generation of Error Message Containing Sensitive Information 2.

CISA released Security Advisory on MiCODUS MV720 Global Positioning System (GPS) Tracker (CISA) CISA has released an Industrial Controls Systems Advisory (ICSA) detailing six vulnerabilities that were discovered in MiCODUS MV720 Global Positioning System Tracker. Successful exploitation of these vulnerabilities may allow a remote actor to exploit access and gain control the global positioning system tracker. These vulnerabilities could impact access to a vehicle fuel supply, vehicle control, or allow locational surveillance of vehicles in which the device is installed.

Trends

The DomainTools Spring 2022 Report (DomainTools) We are happy to share the release of the Spring 2022 edition of the DomainTools Report. As long time readers may know, ever since the first DomainTools Report in 2015, we have delved into our stores of domain registration, hosting, and content-related data to surface patterns and trends that might be of interest to security practitioners, researchers, and anyone else interested in the suspicious or malicious use of online infrastructure.

Technology Perspectives from Cybersecurity Professionals (ESG-ISSA) In late 2021 and early 2022, ESG in partnership with the Information Systems Security Association (ISSA) conducted a survey of 280 cybersecurity professionals focused on security processes and technologies at organizations of all sizes in industries such as technology, government, financial services, and business services, among others, spanning countries in North/Central/South America, Europe, Asia, and Africa.

LinkedIn Still Number One Brand to be Faked in Phishing Attempts while Microsoft Surges up the Rankings to Number Two Spot in Q2 Report (GlobeNewswire News Room) Check Point Research issues its Q2 Brand Phishing Report, highlighting the brands that cyber criminals most often imitate to trick people into giving up...

Q2 2022 Vulnerability Roundup | Digital Shadows (Digital Shadows) As the second quarter of 2022 closes, it's time again to report on the recent trends and highlights from a vulnerability perspective. Q2 has been dominated by the continuation of the Russia-Ukraine war, several high-profile security incidents resulting from vulnerability exploitation, and of course, a continuation of bad security practices. In this blog, we look

The Threat Report: Summer 2022 (Trellix) The Trellix Summer 2022 threat report details the evolution of Russian cybercrime, research into medical devices and access control systems.

The State of Cybersecurity and Third-Party Remote Access Risk Download (SecureLink) Thank you for downloading, you can access your content below. You'll also receive an email within 15 minutes to easily access this content at a later time,

Ransomware attacks cost the US $159.4bn in downtime alone in 2021 (Comparitech) In 2021, 576 US organizations fell victim to ransomware. This affected at least 34.1 million records and resulted in a cost of $159.4 billion in downtime alone. Entities may have faced further costs as they offered identity theft protection for affected customers, restored affected computers, and tried to improve their systems to ward off future […]

Cybercriminals targeting law enforcement agencies worldwide (Help Net Security) This Help Net Security video highlights how cyber attacks affect law enforcement agencies worldwide, based on research from Resecurity.

ForgeRock 2022 Consumer Identity Breach Report Uncovers 297% Increase in U.S. Breaches Tied to Supply Chain and Third-Party Suppliers (Business Wire) ForgeRock reveals its fourth annual Consumer Identity Breach Report.

Majority of security pros are ‘very’ or ‘extremely’ concerned about software supply chain risks (SC Magazine) The findings of a Coalfire-CyberRisk Alliance study have implications for the cloud because public cloud providers are often the first level of exposure.

Brazil surpasses US in breached users in Q2 2022 (ZDNet) The country was also the first in South America by breached users for the second consecutive quarter, according to a new study.

Marketplace

Blockchain Security Startup Raises $90 Million Despite Crypto Winter (Bloomberg) Blockchain security firm Halborn has raised $90 million, the company told Bloomberg News. The deal is an outlier in a climate where venture capital investing in crypto startups has slowed and digital currency prices have nosedived.

Push Security Banks $4 Million Seed Funding (SecurityWeek) British startup Push Security has banked $4 million in early-stage funding to help secure SaaS app deployments.

HiddenLayer Emerges From Stealth With $6 Million to Protect AI Learning Models (SecurityWeek) HiddenLayer has emerged from stealth with $6 million seed funding to protect the machine learning models: it is the first of what may become a new breed of machine learning detection and response (MLDR) platforms.

Why We Invested in HiddenLayer (TenEleven Ventures) Today we proudly announce our seed investment in ML security company HiddenLayer. As soon as we met the incredible team behind this innovative company, we knew we wanted to be a part of their pioneering effort to develop a brand new market protecting a cornerstone of the next economy, ML algorithms, and back the development of a new category of the security market, “MLDR” – machine learning detection and response.

Johnson Controls Acquires Tempered Networks (Contractor) The acquisition will bring zero trust cybersecurity to connected buildings worldwide.

Zefr acquires Israeli AI firm Adverif.ai, bolstering technology-led approach to identifying and defunding misinformation (PR Newswire) Zefr, the global leader in brand suitability across walled gardens, announced today the acquisition of Adverif.ai, an Israeli-based AI company...

Google and Mandiant deal passes important step (CRN) $5.4bn deal allowed to go ahead by US Department of Justice, filing shows

Kurt Greening joins Cerby as Head of Sales (Cerby) Collaboration can be chaos. Cerby helps teams inject order into their daily workflows without slowing teams down or opening new security gaps.

GDIT Appoints Former Judiciary Cloud Technology Chief Robert Morse as Senior Solutions Architect (GDIT) General Dynamics Information Technology (GDIT), a business unit of General Dynamics (NYSE:GD), announced today the appointment of Robert Morse as a senior solutions architect.

Cybereason appoints Chantél Hamman as channel director (ITWeb) The cyber security firm appoints the industry veteran to grow margins and revenues across Sub-Saharan Africa.

Ex-Cisco, Duo Lawyer Joins Secureframe as Cybersecurity Startup's Legal Chief (Corporate Counsel) Kyle McLaughlin now leads all legal, risk and privacy functions at Secureframe, which has raised $79 million since its 2020 launch and has been on a bit of a hiring spree.

Products, Services, and Solutions

OwnBackup Expands Its Leading SaaS Data Protection Coverage To ServiceNow® (Business Wire) ServiceNow launch press release

Cloud Detection and Response: Intercept Attacks with Continuous Monitoring (Complete Cloud Security in Minutes - Orca Security) Orca Security’s agentless Cloud Security Platform now includes Cloud Detection and Response (CDR) capabilities for continuous threat monitoring in the cloud.

Druva Unveils Industry’s First Data Posture and Observability Innovations for Cyber Attack Readiness (Druva) New Capabilities Empower Organizations to Strengthen Security Posture and Accelerate Incident Response

BNamericas - Claro and VMware partner for deployment of SASE in Colombia (BNamericas.com) Claro and VMware announce the addition of VMware Secure Access Service Edge (SASE) to Claro Colombia's Security Solutions portfolio.

BeyondTrust Remote Support Expands Integrations with Microsoft Teams (BeyondTrust) Microsoft Teams integration enables remote support sessions to be initiated from within a Teams chat, saving time and providing a more seamless user experience

Versa SASE Earns Zero Trust Security Excellence Award (Business Wire) Versa Networks, the recognized secure access service edge (SASE) leader, today announced that its industry-leading Versa SASE has won the Zero Trust S

Egnyte Announces Document Certification Service Using Blockchain Techn (PRWeb) Egnyte, the most secure platform for content collaboration and governance, today announced a new document stamping service to certify and authenticate

Paraflare Joins Microsoft Intelligent Security Association (Australian Cybersecurity Magazine) ParaFlare has been nominated as a member of the Microsoft Intelligent Security Association (MISA).

Verizon awarded over $400M modernization contract with FBI (Verizon) Verizon will help enable the FBI to support diverse applications, such as cloud computing, video and imaging transmissions, and data applications that drive demand for dynamic bandwidth capacity.

Veracode Achieves Public Sector Milestone with FedRAMP Authorization (Veracode) Software Security Pioneer Now Available on FedRAMP Marketplace

Sophos Announces Sophos X-Ops (GlobeNewswire News Room) Sophos X-Ops Links Together SophosLabs, Sophos SecOps and Sophos AI, Three Established Teams of Cybersecurity Experts at Sophos, to Help Organizations...

OODA: X-Ops Takes On Burgeoning SQL Server Attacks (Sophos News) How do the pieces of Sophos X-Ops fit together? A combined effort makes tidy work of a threat actor’s big play

Illumio Launches Zero Trust Impact Assessment to Help Organizations Maximize Cyber Investments (GlobeNewswire News Room) Security and IT Leaders Can Now Proactively Assess Cyber Resilience Posture, Better Informing Security Strategies with Data...

Technologies, Techniques, and Standards

Transparency in the Shadowy World of Cyberattacks (Google) Adapted remarks delivered by Kent Walker at the International Conference on Cyber Security 2022.

Multi-Factor Authentication Guide (Cyber Readiness Institute) Follow these guidelines to understand and implement multi-factor authentication in your organization

CISO Conversations: Netenrich, Malwarebytes CISOs Discuss Security Vendor CISOs (SecurityWeek) The big difference between security vendor CISOs and non-vendor CISOs is that the former must look in two directions simultaneously.

Why the cloud is the new rainmaker for cybersecurity (World Economic Forum) Cloud computing has become vital to the remote working boom – but its decentralised cybersecurity is causing challenges for customers used to more top-down decision-making.

Ransomware preparation and response: Develop a cyber kill chain (VentureBeat) Having a cyber kill chain emergency response in the event of a ransomware cyberattack is vital to keeping your network and systems safe.

Why SBOMs aren't the silver bullet they're portrayed as (Help Net Security) A Software Bill of Materials (SBOM), is a formal inventory of software components and dependencies, and their hierarchical relationships.

Cyber Security for IoT Devices (TÜV SÜD) TÜV SÜD announces the publication of a new white paper called “Internet of Things (IoT) for a connected world. IOT Cyber Security – Threats and Regulations”. It explains to manufacturers why cyber security is significant for devices used in the consumer Internet of Things (CIoT) and describes the challenges they are currently facing. In addition, TÜV SÜD informs about the applicable standards and shows how to ensure successful global market access.

Design and Innovation

MIT Explores How Deep Learning is Transforming Cybersecurity (Deep Instinct) Every organization and cybersecurity vendor (Deep Instinct included) is in an innovation race against ransomware groups whose attacks are becoming smarter, faster, and more damaging to business operations. Attacks are smarter as they are enhancing their evasive capabilities, using sandbox detection or even adversarial AI. An increased speed of attacks has also been noticeable, with a recent study revealing that the fastest ransomware threat LockBit can encrypt in under six seconds. And researchers have estimated ransomware attacks spiked by 105% in 2021 with threat actors increasingly targeting government organizations and supply chains.

Academia

Cyber Companies and Universities Are Building ‘Cyber Talent Hub’ (Wall Street Journal) Cybersecurity firms will make practical training on their technology available to students in an attempt to address a skills shortage. The effort comes as fears mount that global competitors like China are outpacing the West on talent.

Legislation, Policy, and Regulation

Biden administration pushes to close the growing cybersecurity workforce gap (CNN) The Biden administration is pushing to fill hundreds of thousands of cybersecurity jobs in the United States as part of a bid to close a talent shortage US officials describe as both a national security challenge and an economic opportunity.

U.S. Departments of Labor, Commerce Announce 120-Day Cybersecurity Apprentice Sprint to Promote Registered Apprenticeships (U.S. Department of Commerce) Initiative seeks to equip underrepresented populations with skills training for cybersecurity jobs

Fostering a Diverse and Inclusive Cyber Workforce (Cisco) As the U.S. faces an estimated 700,000 vacancies in cyber-enabled jobs, Cisco announced at the White House Cyber Workforce and Education Summit today our commitment to training an additional 200,000 students in the U.S. over the next three years.

New Effort to Grow the US Technology Workforce Launched by CompTIA and ConnectWise (CompTIA Press Releases) Organizations debut new training program as part of the Biden Administration’s Cybersecurity Apprenticeship Sprint

Cyber Readiness Institute Shares Multi-Factor Authentication Insights and Guidance at White House National Cyber Workforce & Education Summit (Cyber Readiness Institute) The Cyber Readiness Institute (CRI) has released a new guide to raise awareness and implementation of multi-factor authentication (MFA) among small and medium-sized businesses (SMB). At the White House National Cyber Workforce & Education Summit, the non-profit organization shared lessons learned from a global survey of small and medium-sized […]

Senate bill to require annual briefing on NSA-CYBERCOM relationship (FedScoop) A Senate committee wants annual briefings on the relationship between U.S. Cyber Command and the National Security Agency, which are currently co-located and have shared resources. The provision is found in the Senate Armed Services Committee’s version of the fiscal 2023 National Defense Authorization Act, which passed the committee June 16, but language wasn’t released […]

Senate Armed Services Committee questions Navy's future role, contribution to cyberspace operations (FedScoop) The Senate’s version of the annual defense policy bill raises the specter that the Navy should entirely get out of cyber operations for U.S. Cyber Command. While the Senate Armed Services passed its version of the National Defense Authorization Act for fiscal 2023 June 16, the full text of the bill and its provisions were […]

Pentagon steps into Senate chip debate, citing national security (The Hill) Pentagon officials are pressing lawmakers to back legislation to fund the domestic production of semiconductor chips, arguing it is essential for national security. Ahead of a crucial vote i…

Three takeaways from the Justice Department’s cyber review (Washington Post) Last year, Deputy Attorney General Lisa Monaco announced a wide-ranging, 120-day review of how the Justice Department addresses threats in cyberspace. More than a year later, a report on the review is out — and it offers praise, warnings and a sometimes dire picture of cybersecurity within the department. Here are a few key takeaways:

Litigation, Investigation, and Law Enforcement

ACCC, ASIC trials website takedowns for phishing, crypto scams (iTnews) Dozens of sites removed in first three weeks.

Romanian National Known As “Virus” Extradited For Operating “Bulletproof Hosting” Service That Facilitated The Distribution Of Destructive Malware (The United States Attorney's Office for the Southern District of New York) Damian Williams, the United States Attorney for the Southern District of New York, and Michael J. Driscoll, the Assistant Director-in-Charge of the New York Field Office of the Federal Bureau of Investigation (“FBI”), announced today that MIHAI IONUT PAUNESCU, a/k/a “Virus,” a dual Romanian and Latvian national, was extradited from Colombia for allegedly running a “bulletproof hosting” service that enabled cyber criminals to distribute the Gozi Virus, one of the most financially destructive computer viruses in history.

Twitter-Musk Trial Set for October in Lawsuit Over Stalled $44 Billion Takeover (Wall Street Journal) A Delaware Chancery Court judge granted the social-media platform’s request to fast-track the proceedings.

National Archives Reviewing Whether Jan. 6 Secret Service Texts Were ‘Improperly Deleted’ (Forbes) A trove of Secret Service texts from January 6 were deleted, according to a watchdog, and the House January 6 committee is now investigating the matter.

Secret Service use of texts on Jan. 6 "very suspicious," expert says (Newsweek) The Secret Service is expected to provide the January 6 committee with the text messages they've been seeking by Tuesday.

Israeli Spyware Producer Sued, Banned a Year After Pegasus Revelation (OCCRP) One year ago, the Pegasus Project unveiled how a program from the Israeli spyware-firm, NSO group, had become the choice tool for corrupt governments, human rights abusers and other bad actors to spy on their own journalists, activists, dissidents and political opponents.

University Health Center Pays $875,000 in HIPAA Fines after Cyber Hack (JD Supra) Oklahoma State University’s Center for Health Services recently paid $875,000 to settle potential HIPAA violations after a cyberattack resulted in the...

The FBI Forced A Suspect To Unlock Amazon’s Encrypted App Wickr With Their Face (Forbes) In November last year, an undercover agent with the FBI was monitoring a group on Amazon-owned messaging app Wickr, dubbed " Tiny Girls."

Deputy Attorney General Lisa O. Monaco Delivers Keynote Address at International Conference on Cyber Security (ICCS) 2022 (US Department of Justice) Thanks so much, Ed. It’s great to be back at Fordham and ICCS. It’s also great to be sharing the stage with another former federal prosecutor – President Tetlow. I see great colleagues and friends in

US ‘Disrupted’ North Korean Hackers Who Breached Health Sector (Bloomberg) Targets included a medical center in Kansas, DOJ’s Monaco says. Hospital faced ‘impossible choice’ to pay up or endanger care.

The Hacker Mind: G-Men in Cyberspace (ForAllSecure) Fighting organized crime online might seem like a logical extension for law enforcement, but, in fact, it is not all that straight forward. Michael McPherson is someone with 25 years in the FBI, who has transitioned out to the corporate world, and can best describe the experiences on both sides.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Digital safety snacks: Protect yourself from online abuse with short videos and workshops (Virtual, Jun 13 - Jul 28, 2022) PEN America, the Online News Association, and the International Women’s Media Foundation have teamed up to create step-by-step videos and hands-on workshops to help you defend yourself against online abuse. We’ll explain how to protect your most sensitive accounts from hackers and how to dox yourself before someone else does. We want to empower you to feel safer and more secure while maintaining the public profile you need to do your job. This series will include eight short video episodes and four virtual workshops, when you can follow along to complete your digital wellness check, ask questions, and get help if you get stuck. You can join one, two or all four sessions.

Blackpoint ReCON 2022 (Virtual, Jul 21, 2022) Join the Blackpoint team for our second annual ReCON, where you will learn from cybersecurity experts about the threats we’ve seen, anticipated tactics our Adversary Pursuit Group (APG) is watching, and ways that you can bolster your defenses. When operating proactively, you’re able to maintain operations for all you protect, as well as elevate your business growth.

Hackers On Planet Earth (HOPE) (New York, New York, USA, Jul 22 - 24, 2022) The Hackers On Planet Earth (HOPE) conference, has run continuously since 1994, and is hosted by 2600 Magazine. We define hacking broadly: hardware, software, social engineering, artwork, and much more. Recent conferences have featured over 100 speakers and drawn several thousand attendees. If a hacking-related topic is in the public mind, we want to address it directly.

STEM Pioneers Rock! Dr. L. Jean Camp, Professor, Author, Innovator (Columbia and Virtual, Maryland, United State, Jul 25, 2022) Brought to you by NSA and Dreamport/MISI, the STEM Pioneers Rock series, highlights significant accomplishments of those who are "firsts" in their field. These individuals are responsible for attaining goals that opened doors for those who come behind them. In addition, we hope the "pioneers" we have identified encourage our workforce to "stay the course", improving retention statistics. Professor L. Jean Camp is a founder of the interdiscipline of economics of security. Her core contributions are in area of the social and economic implications of technologies of security and privacy. She is a leader in the investigation of the insider threat in the networked realm. Prof. Camp began her graduate studies in electrical engineering in North Carolina before moving to the Department of Engineering and Public Policy at Carnegie Mellon to complete her PhD in Engineering and Public Policy. Upon graduation she became a Senior Member of the Technical Staff at Sandia National Laboratories. She left Sandia National Laboratories for eight years as a professor at Harvard's Kennedy School, departing to lead the security group in the newly-formed School of Informatics at Indiana University. Professor Camp is the author of "Trust and Risk in Internet Commerce" (MIT Press), "Economics of Identity Theft" (Springer) and the editor of "Economics of Information Security" (Kluwer Academic). She has authored over one additional hundred works, including ninety peer-reviewed works and two dozen book chapters. She has made scores of invited presentations on five continents. Her patents are in the area of privacy-enhancing technologies. Her professional service has included terms on the Board of Directors of Computer Professionals for Social Responsibility, the Board of Governors of the IEEE Society on Social Implications of Technology, Alumni Board for Carnegie Mellon, Senior Member of the IEEE, and longstanding member of the USACM. See http://www.ljean.com/cv.html for more detailed information.

AWS re:Inforce (Boston, Massachusetts, United States, Jul 26 - 27, 2022) Exclusively for listeners of the Cyberwire Podcasts, register for AWS re:Inforce using code ALUMLBzyE6B6 to receive $300 off your full conference registration for AWS re:Inforce while supplies last. Join us at this year’s re:Inforce to hear from AWS leaders, builders, and experts about the latest advancements in AWS security, compliance, identity, and privacy solutions—including actionable best practices your business can use immediately. Sessions are offered at all levels and for all backgrounds, from beginner to expert and business to technical.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.