CosmicStrand rootkit. Bug bounty or payoff? Brand spoofing. AV-Test's Twitter account hijacked. Cyber phases of a hybrid war.

Summary

By the CyberWire staff

At a glance.

CosmicStrand UEFI firmware rootkit.
Treating thieves like white hats?
Most-impersonated brands in phishing attacks.
AV-Test's Twitter account is hijacked.
A look at the cyber phase of Russia's hybrid war.

CosmicStrand UEFI firmware rootkit is out in a new and improved version.

Researchers at Kaspersky have identified a new UEFI (Unified Extensible Firmware Interface) firmware rootkit they're calling "CosmicStrand," an updated version of a rootkit Qihoo360, discussed in 2017. CosmicStrand appears in Gigabyte or ASUS motherboard firmware images, and, while Kaspersky hasn't been able to determine how the infection occurs, they think it likely that a common vulnerability in the H81 chipset is being exploited. The rootkit can be used to deploy a range of malicious payloads.

The victimology is interesting, and the attackers' motives are difficult to discern. "We were able to identify victims of CosmicStrand in China, Vietnam, Iran and Russia," Kaspersky wrote. "A point of interest is that all the victims in our user base appear to be private individuals (i.e., using the free version of our product) and we were unable to tie them to any organization or even industry vertical." Attribution is unclear, although signs point to Chinese, or at least Chinese-speaking, authorship. CosmicStrand offers an attacker the prospect of great persistence and extraordinary stealth. And it prompts some disturbing speculation from Kaspersky about the unknown unknowns that may still be out there: "The most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016 – long before UEFI attacks started being publicly described. This discovery begs a final question: if this is what the attackers were using back then, what are they using today?"

Free Guide | 5 Critical Controls for World-Class OT Cybersecurity

As operational technology (OT) cybersecurity becomes a top priority from boardrooms to the manufacturing floor, CISOs and their teams must implement proven strategies to protect the business. Download this free guide and discover the components to align your leadership and implement a successful operational technology (OT) security posture. Download now →

Treating thieves like white hats?

Cryptocurrency platforms who've seen their holdings looted by cyber thieves are increasingly offering the criminals who've rifled the platforms' wallets a reward if they'll return a substantial fraction of what they've stolen. According to the Wall Street Journal, legitimate vulnerability researchers, white-hat bug hunters, are unhappy about their own trade being conflated with that of the criminals. The payments are a very small fig leaf placed over a ransom payment, which isn't at all the case with legitimate bug bounties. The sort of crime the cryptocurrency platforms are dealing with isn't in the first instance extortion; it's direct theft, and it's difficult to see this particular business strategy as likely to do anything other than stoke the existing bandit economy.

Most-impersonated brands in phishing attacks.

Vade this morning released a report detailing trends in phishing scams, with particular attention to brand impersonation. The study found that Microsoft was the most impersonated brand in the first half of 2022, followed closely by Facebook. Looking at scams by sector impersonated, financial services were at the top of the leaderboard, with Crédit Agricole seeing a 203 percent increase that landed it in the #3 slot for most impersonated brand, behind Microsoft and Facebook. One interesting tidbit researchers found is that phishing is most likely to happen on weekdays, with most phishing attacks occurring between Monday and Wednesday.

AV-Test's Twitter account is hijacked.

The Magdeburg-based security testing firm AV-TEST Gmbh said yesterday that its English-language Twitter account had been hijacked. "Our English-language Twitter account "avtestorg" has been hacked and we no longer have access to the account or tweets at the moment. We are already in touch with the Twitter support to resolve this issue as soon as possible," they said in their unaffected German-language account. As we write, they don't seem to have returned their account to normal. How their account was hijacked is unknown, and, as Graham Cluley sensibly points out, it's premature to blame either AV-TEST, Twitter, or anyone else for negligence. Who hijacked the account? This is a dog-bites-man story: the hijackers appear to be some goons hawking dimwitted non-fungible tokens, "doodles."

A look at the cyber phase of Russia's hybrid war.

Many have noted that Russian cyber offensives haven't had the devastating effects that were expected during the run-up to the invasion of Ukraine, but it's important to remember that this isn't necessarily for want of trying. The CEO of the large Ukrainian utility DTEK, Maxim Timchenko, told Smart Energy that his organization had come under attack recently, and that this isn't the first such incident. "It’s not the first one: we have experienced cyber attacks of this level since November last year. But recently they intensified.” Timchenko said that DTEK defenses held (and that Microsoft's support had been "great"): “Our corporate IT systems were attacked, however, our specialists showed their professionalism. We did not suffer any serious damage nor any confidential information was taken and leaked. So it was a good test for our systems.”

CyberCube's Global Threat Briefing sees substantial cyber activity--some hacktivism, some state-run, some privateering--on both sides. "Since the start of the war in Ukraine, both sides have been amassing cyber armies and hacktivists have pooled their efforts to attack Russia. Anonymous has broken into CCTV cameras at the Kremlin. Meanwhile, Russian hacktivists are striking targets in Eastern Europe. There are currently more than 70 different cyber threat actors related to the war in Ukraine - double the number identified at the beginning of March." Strategic Risk notes CyberCube's observations about how Russian cyberespionage and ransomware activity (this now sometimes wiper-carrying pseudo ransomware) have increased and spread at higher than customary rates to target nations sympathetic to Ukraine. Target selection by ransomware privateers has shown evidence of a great deal of attention being paid to sectors that may be more vulnerable and overlooked. CyberCube told Strategic Risk that “Ransomware gangs are currently targeting lower-profile critical infrastructure operations and small and medium-sized businesses (SMBs) in healthcare, agriculture, and food supply chains. Businesses in these industries are among those who can least afford the downtime associated with ransomware and extortion attacks, and often lack resources for effective cyber security in the face of well-resourced and determined attackers.”

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Dateline Moscow and Kyiv: Targeting as intelligence and command failure; a look at the cyber phase of the hybrid war.

Ukraine at D+152: Big picture guys can't target. (The CyberWire) As Foreign Minister Lavrov says Moscow now aims at regime change in Ukraine, Russia's targeting shows signs of being too slow to be effective. (But its gunners can still hit schools.) Cyber operations retain their high but relatively ineffectual tempo.

Russia says it wants to end Ukraine's `unacceptable regime' (AP NEWS) Russia’s top diplomat said Moscow’s overarching goal in Ukraine is to free its people from its “unacceptable regime,” expressing the Kremlin’s war aims in some of the bluntest terms yet as its forces pummel the country with artillery barrages and airstrikes.

Russia-Ukraine war: List of key events, day 153 (Al Jazeera) As the Russia-Ukraine war enters its 153rd day, we take a look at the main developments.

Russia-Ukraine war: EU renews Russian sanctions until 2023; Odesa region, Kharkiv and Mykolaiv struck by missiles – live (the Guardian) Russian forces strike coastal villages, Odesa region’s military chief says; Kharkiv and Mykolaiv also hit

Russia Strikes School, Civilian Buildings as It Presses Ukraine Bombardment (Wall Street Journal) Russian strikes continued in Ukraine as the Kremlin called on Kyiv to resume shipments of grain despite a Russian missile attack over the weekend that risked derailing a key deal aimed at easing a blockade on Ukraine’s ports.

Russia's invasion "undermined by dated intelligence, poor planning"—U.K. (Newsweek) British defense officials said Russian forces are unable to land in Odessa to try to seize the Black Sea port.

Ukraine says it has destroyed 50 Russian ammunition depots using HIMARS (Reuters) Ukraine said on Monday its forces had used U.S-supplied HIMARS rocket systems to destroy 50 Russian ammunition depots since receiving the weapons last month.

Can Ukrainian forces recapture Kherson from Russia? (the Guardian) Analysis: Using greater accuracy of US-made Himars system to damage without destroying infrastructure will be a challenge

Neither Moscow nor Kyiv can control Ukraine's skies. These are the jets they're using to fight the air war. (Business Insider) As of late July, observers have identified 36 Russian aircraft and 35 Ukrainian aircraft as lost, but the totals for both sides are likely higher.

The Army Is Pushing the Limits of Bridging Ops as Ukraine’s Fight Spotlights River Crossings (Military.com) Russia suffered an embarrassing public setback in Ukraine’s Donbas region in May when its soldiers attempted to cross the Siverskyi Donets River and ended up taking a bath instead.

Guterres Has a Lot Riding on the Ukraine Deal (World Politics Review) Last week, U.N. Secretary-General Antonio Guterres was in Istanbul for the signing of an important deal that will resume agricultural shipments from Ukrainian ports. There are doubts about whether this initiative will work out, but Guterres’s role in negotiating it could be a turning point in his career.

UN to hold Security Council Meeting on Ukraine (News.az) The United Nation will hold Security Council Meeting on Ukraine, notes the program of the Security Council of the UN Security Council for the month of July, News.az reports.

Bringing Russia to Account: "We must use all possible tools" (KyivPost) There is no single court or tribunal that would resolve absolutely all issues related to bringing all war…

Russia steps up subversive activities against post-Soviet countries - Ukraine intelligence (Ukrinform) Russian special services are building up a network of agents of influence in the countries of the former USSR to run malign campaigns against the sovereignty and national interests of the targeted nations. — Ukrinform.

Cyberattacks Big Threat to Western Balkans, US Expert Says (Exit - Explaining Albania) Cyberattacks are increasingly endangering regions such as the Western Balkans, Europe and broader global areas following the Russian attack on Ukraine, according to a former American general who heads a cyber security company contracted by the Albanian government. James Jones was invited to parliament on Monday, days after a sophisticated cyber attack crippled online government

Security Service exposes referendum methods in occupied territories (Ukrainska Pravda) The Security Service of Ukraine (SSU) has documented the fact that Russia has begun an active phase of preparing a pseudo-referendum on the illegal ‘accession’ of temporarily occupied territories in the east of Ukraine.

Moldova ‘very worried’ Russia may invade, prime minister says (Washington Post) Moldova is “very worried” about a potential Russian invasion as Russian forces prepare to step up attacks in Ukraine’s east and south, close to the border with the small nation of 2.5 million.

Ukraine fall-out and new ransomware tactics elevate cyber risks (Strategic Risk Europe) The maritime sector and satellite infrastructure are sectors most likely to be targeted by cyber criminals

Ed’s note: The Ukrainian-Russian cyber war no one speaks about (Smart Energy) The boss of Ukrainian energy company DTEK has confirmed that three weeks ago the utility had been the target of a substantial cyber attack – and revealed it was the latest in a series of attacks in the Ukrainian-Russian cyber war.

GUEST ESSAY: How amplified DDoS attacks on Ukraine leverage Apple’s Remote Desktop protocol (The Last Watchdog) Cyber-attacks continue to make headlines, and wreak havoc for organizations, with no sign of abating. Having spiked during the COVID-19 pandemic, threats such as malware, ransomware, and DDoS attacks continue to accelerate. Related: Apple tools abuse widespread A10’s security research team recorded a significant spike in the number of potential DDoS weapons available for exploitation […]

Cyber armies continue to amass to attack Russia: report (Insurance Insider) There are now more than 70 different cyber actors carrying out attacks related to the Ukraine war, double the number identified at the beginning of March, according to a report from CyberCube

European natural gas prices soar 17% after Russia says it will slash supplies to the continent, driving fears of a deep recession (Markets Insider) Russia said it will cut supplies through the Nord Stream 1 pipeline to 20% of capacity, further battering Europe's fragile economy.

Attacks, Threats, and Vulnerabilities

LockBit Ransomware Group Augments Its Latest Variant, LockBit 3.0, With BlackMatter Capabilities (Trend Micro) In June 2022, LockBit revealed version 3.0 of its ransomware. In this blog entry, we discuss the findings from our own technical analysis of this variant and its behaviors, many of which are similar to those of the BlackMatter ransomware.

Cyber-mercenaries represent shifting criminal business model (Register) Emerging threat group offers a broad range of attack services

CosmicStrand: the discovery of a sophisticated UEFI firmware rootkit (Securelist) In this report, we present a UEFI firmware rootkit that we called CosmicStrand and attribute to an unknown Chinese-speaking threat actor.

Experts Uncover New 'CosmicStrand' UEFI Firmware Rootkit Used by Chinese Hackers (The Hacker News) Researchers have discovered a new UEFI firmware rootkit malware, dubbed "CosmicStrand," that Chinese hackers have been using for at least two years.

CosmicStrand UEFI rootkit found on ASUS and Gigabyte motherboards (Computing) Malware found in the firmware images of Gigabyte or ASUS motherboards with the Intel H81 chipset

CosmicStrand UEFI malware found in Gigabyte, ASUS motherboards (BleepingComputer) Chinese-speaking hackers have been using since at least 2016 malware that lies virtually undetected in the firmware images for some motherboards, one of the most persistent threats commonly known as a UEFI rootkit.

PrestaShop Confirms Zero Day Attacks Hitting eCommerce Servers (SecurityWeek) A major security vulnerability in the open source PrestaShop software is being exploited in the wild and approximately 300,000 merchant shops are at risk.

Hackers exploited PrestaShop zero-day to breach online stores (BleepingComputer) Hackers are targeting websites using the PrestaShop platform, leveraging a previously unknown vulnerability chain to perform code execution and potentially steal customers' payment information.

1,000 Organizations Exposed to Remote Attacks by FileWave MDM Vulnerabilities (SecurityWeek) Researchers discovered critical vulnerabilities in the FileWave MDM product that could have been exploited to hack over 1,000 organizations.

QBot phishing uses Windows Calculator sideloading to infect devices (BleepingComputer) The operators of the QBot malware have been using the Windows Calculator to side-load the malicious payload on infected computers.

Has a ransomware attack compromised your Entrust SSL certificate? (https.in Blog) According to a source about two weeks ago, Entrust SSL Certificate was breached and hackers stole corporate data during the cyberattack.

LockBit ransomware gang: We breached Italy’s tax agency (Register) Miscreants boast of 78GB haul, officials say everything's fine

LockBit claims ransomware attack on Italian tax agency (BleepingComputer) Italian authorities are investigating claims made by the LockBit ransomware gang that they breached the network of the Italian Internal Revenue Service (L'Agenzia delle Entrate).

Italy investigating ransomware attack on tax agency (The Record by Recorded Future) Italian authorities are investigating an alleged ransomware attack on the country’s tax agency.

Probe into possible cyber attack on Italy's tax agency (ANSA) 78 giga of data reportedly stolen © ANSA

Testing times for AV-Test as Twitter account hijacked by NFT spammers (Graham Cluley) An unauthorised party has seized control of the @avtestorg Twitter account, nuked its profile picture and banner, replaced its name and description with a full-stop, and set about retweeting numerous…

Opposition Seeking Update on Health Care Cyber Attack (VOCM) The opposition is looking for an update from the Minister of Digital Government and Service NL on the cyber at...

Under Attack (Bella Caledonia) For months now this site has been under a Denial of Service attack (DoS)*.

Tenet Healthcare cyberattack had $100M unfavorable impact in Q2 (Health Leaders Media) A cyberattack and data breach cost Tenet Healthcare $100 million in lost revenue and mitigation costs in Q2, 2022.

Maryland families report $286,000 in food stamps and cash stolen by thieves (WMAR) In the last six months, Maryland families have lost an estimated $286,000 in food stamps and cash assistance benefits, more than triple the amount stolen in all of 2021.

Staff data compromised in Cedar Rapids School District security breach (KCRG) The security threat caused some employees to go unpaid and the majority of district activities to close over the week.

Toronto Symphony Orchestra customer names and emails potentially compromised in ransomware attack (MobileSyrup) The Toronto Symphony Orchestra is warning its patrons that their information might have been compromised in a recent ransomware attack.

Trends

Palo Alto Networks Unit 42 Incident Response Report Reveals that Phishing and Software Vulnerabilities Cause Nearly 70% of Cyber Incidents (PR Newswire) According to a new report from Palo Alto Networks (NASDAQ: PANW), the global cybersecurity leader, the heavy use of software vulnerabilities...

Netskope Threat Research: Data Sprawl Creating Risk for Organizations Worldwide as Personal App Use in Business Continues to Rise (PR Newswire) Netskope, the leader in Security Service Edge (SSE) and Zero Trust, today released new research detailing the proliferation of cloud apps used...

Tessian | 1 in 3 Employees Do Not Understand the Importance of Cybersecurity at Work, According to New Report (RealWire) Data from Tessian reveals the disconnect between security leaders and employees when it comes to security cultures July 26 2022 - New research from email security company Tessian reveals that a significant percentage of employees are not engaged in their organizations’ cybersecurity efforts and don’t understand their role in keeping their company secure

Phishers’ Favorites Top 25, H1 2022: Microsoft Is the Most Impersonated Brand in Phishing Attacks (Vade Secure) Phishing attacks in H1 2022 used Microsoft and Facebook to lure users into clicking.

Latest SonicWall Threat Report Uncovers Seismic Shift in Cyber Arms Race Due to Geopolitical Unrest as Cyberattacks Climb (PR Newswire) 2.8 billion malware attacks (+11%) recorded in the first half of 2022 — first escalation of global malware volume in more than three years While ransomware...

Cybersecurity Firm Mutare Reveals That Nearly Half Of All Organizations Have Been Targeted By Voice-Acted Phishing Attacks (Digital Information World) Research by Mutare revealed that approximately 47% of all organizations were at the receiving end of voice-oriented phishing attacks.

Is Australia finally coming to grips with cybersecurity? (Technology Decisions) The appointment of Australia's first dedicated minister for cybersecurity highlights a trend that dates back to the beginning of this decade.

Marketplace

DoJ okays Google's acquisition of Mandiant (Register) Plus: Ukrainian fake news and Uber admits covering up data breach

Resecurity(R) Expands VAPT Capabilities with Acquisition of Cybit Sec in UAE (PR Newswire) Resecurity®, a Los Angeles-based cybersecurity company protecting Fortune 500, has acquired Cybit Sec, an innovative vulnerability assessment...

Island Raises $115 Million in Series B Funding to Enable Massive Innovation on Enterprise Browser (Business Wire) Island, creator of the Enterprise Browser, today announced that it has raised $115 million in its Series B financing round at a $1.3 billion valuation

Incode Expands Executive Team Amid Rapid Global Growth (Business Wire) Incode Expands Executive Team Amid Rapid Global Growth

Products, Services, and Solutions

CISO of Aviatrix joins the CyberWire’s Hash Table panel of distinguished cybersecurity experts. (The CyberWire) The CyberWire today announced the appointment of Jennifer Reed to the CyberWire Pro Hash Table. Reed, the Chief Information Security Officer at Aviatrix, joins CyberWire's influential panel of industry leaders with distinguished security engineering and cloud expertise that spans four decades of service.

SpyBuster for iOS helps spot apps that may threaten the privacy of your data (MacPaw) MacPaw team brings you the iOS version of its anti-spying tool SpyBuster. Designed to spot apps that originate from or connect to servers in Russia or Belarus, SpyBuster helps identify and remove unwanted connections on your iPhone.

Snyk Unveils Snyk Cloud, the Industry's First Developer-Centric Cloud Security Solution (Snyk) New Product Secures the Cloud from Code Through Runtime, Facilitating DevSecOps Collaboration

Kyndryl Offers On-Demand Experts for Cyber Attack Recovery (SDXCentral) Kyndryl is aiming to complement incident response retainers currently available on the market by helping organizations recover from cyber incidents such as ransomware attacks.

Runecast announces new capabilities to simplify Kubernetes security and speed up operations (Help Net Security) Runecast announced that its patented enterprise platform Runecast has expanded its current KSPM capabilities with advanced image scanning.

Fortress Information Security Annouces Strategic Partnership with NetRise to Extend XIoT Offering (PR Newswire) NetRise, the company providing visibility into the world's XIoT security problem, and Fortress Information Security, the nation's leading...

Stairwell Announces MSSP Partnership with Cyderes (PR Newswire) Stairwell, a company that empowers security teams to outsmart any attacker, today announced a strategic partnership with Cyderes, a powerhouse...

Aqua Advantage: Aqua's Global Partner Ecosystem Program (Aqua) Aqua's partner program is designed to support all partners and their customers through engagement, enablement & execution of Aqua’s CNAPP

KICKS CREW Selects Forter to Scale its Global Digital Commerce Operations (Business Wire) KICKS CREW increases its approval rate to over 97% with Forter

Portnox CLEAR (Portnox) Portnox CLEAR Cloud-Native Network Access Control Enterprise-grade network & endpoint security essentials for companies of all sizes. Portnox CLEAR is the first and only cloud-native NAC-as-a-Service purpose-built for today’s lean, overworked IT teams combatting today’s toughest network threats. Request a Demo Cloud-native NAC-as-a-Service. Built for today’s lean IT teams. See & understand Gain real-time visibility…

Technologies, Techniques, and Standards

NCUA cyber breach rule would give credit unions longer reporting window than banks (Banking Dive) The time frame falls in line with the Critical Infrastructure Act that President Joe Biden signed in March, but is twice as long as the reporting window banks have had to comply with since May.

Crypto Firms Make Thieving Hackers an Offer: Keep a Little, Give Back the Rest (Wall Street Journal) The payouts occasionally recover most of the loot and are then labelled ‘bug bounties.’ But that designation has incensed white-hat hackers, who say it conflates them with their criminal counterparts.

Why Physical Security Maintenance Should Never Be an Afterthought (Threatpost) SecuriThings' CEO Roy Dagan tackles the sometimes overlooked security step of physical security maintenance and breaks down why it is important.

What Every CEO Needs To Know About The Shanghai Data Breach (Forbes) Many data breaches are not the result of sophisticated cybercriminals, but rather carelessness.

Research and Development

Researchers develop technique to bypass AI intrusion detection (Computing) Researchers managed to trick deep learning model trained to recognise malicious packets that DDoS traffic was legitimate

Academia

Craig Newmark gives UC Berkeley $2 million for university cybersecurity clinics (Berkeley News) These clinics provide students with hands-on experience as they work to strengthen the digital defenses of under-resourced organizations

FHSU earns redesignation as a Center for Excellence in Cyber Defense (Hays Post) Dr. Melissa Hunsicker Walburn and Jason Zeller receiving the CAE redesignation certificate

Legislation, Policy, and Regulation

Are Indian organizations prepared for the new CERT-In cyber policies (The Times of India) With the announcement of the CERT-In’s new directions, this is the first time India is proposing to implement vigorous mandates to fight cyber inciden

Nations continue to lose faith in Chinese tech giant Huawei (ThePrint) Hong Kong, July 26 (ANI): The Chinese telecommunications giant, Huawei, has taken center stage in recent times as the world runs towards the shiny new technology of 5G, however, nations across the world are losing faith due to security threats. Huawei has faced a fair amount of heat over incidents involving information breaches, data leaks, […]

Tech Antitrust Bill Threatens to Break Apple, Google’s Grip on the Internet (Bloomberg) US lawmakers are eyeing votes before November’s midterm elections on legislation that marks the first major effort by Congress to regulate big tech since the inception of the internet.

Senate Bill to Boost Chip Production, Advanced Technology Set to Move Ahead (Wall Street Journal) Supporters say the measures are needed for the U.S. to maintain a competitive edge, while foes say semiconductor companies should pay their own way.

Dusting Off Our Dusty Old Industrial Policy* (Reason.com) Episode 418 of the Cyberlaw Podcast

DHS convenes first meeting of cyber incident reporting council, tasked with harmonizing regulations (Inside Cybersecurity) A new council tasked with harmonizing federal cyber incident reporting requirements is taking shape, according to a Department of Homeland Security announcement providing details on the first meeting and upcoming plans.

Senate Armed Services Committee concerned about DOD's cyber mission force (FedScoop) The Senate Armed Services Committee is looking to help the Department of Defense address and correct issues associated with the readiness of its cyber forces, according to new legislation and congressional aides. Committee aides told reporters on Monday that in discussions with cyber commanders, readiness problems — including recruiting and retention — became more apparent. […]

CISA Plans RFI Soon To Help With Draft Rule For Cyber Incident Reporting - Defense Daily (Defense Daily) As the Cybersecurity and Infrastructure Security Agency (CISA) begins to craft a proposed rule to require certain critical infrastructure entities to

TSA Updates Security Requirements For Pipeline Operators (Decipher) The revised Security Directive aims to give natural gas and oil pipeline operators more flexibility in how they implement security measures.

Ransomware: To Pay or Not to Pay? It Just Got More Complicated (The National Law Review) When an organization experiences a ransomware attack, it must address significant&mdash;and sometimes competing&mdash;challenges under pressing deadlines. These challenges include the following: evi

Office of the National Cyber Director Announces Camille Stewart Gloster as Deputy National Cyber Director for Technology and Ecosystem Security (The White House) Today, the Office of the National Cyber Director (ONCD) announced the upcoming appointment of Camille Stewart Gloster as Deputy National Cyber Director

Jen Easterly wants to cut the nerdspeak (Washington Post) More than words: CISA’s director makes her case to workers, consumers

Litigation, Investigation, and Law Enforcement

Twitter Spy Trial Exposes Betrayal of Saudi Arabia Dissidents (Bloomberg) Ex-staffer allegedly traded user data for Hulbot watch, cash. Abouammo faces 20 years in prison if convicted of charges.

Reality Winner says she leaked file on Russia election hacking because ‘public was being lied to’ (the Guardian) Former NSA contractor says in interview ‘I knew it was secret … but I also knew that I had pledged service to the American people’

T-Mobile Settles to Pay $350M to Customers in Data Breach (SecurityWeek) T- Mobile has agreed to pay $350 million to customers affected by a class action lawsuit filed after the company disclosed in August 2021

Uber admits covering up massive 2016 data breach in settlement with US prosecutors (The Verge) Uber won’t be criminally charged in the cover-up.

How a sex worker became a defense contractor employee -- and an insider threat (CSO Online) An accomplished research scientist manipulated a defense contractor CEO into hiring a prostitute for a technical role. Here's how this insider threat could have been avoided.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Digital safety snacks: Protect yourself from online abuse with short videos and workshops (Virtual, Jun 13 - Jul 28, 2022) PEN America, the Online News Association, and the International Women’s Media Foundation have teamed up to create step-by-step videos and hands-on workshops to help you defend yourself against online abuse. We’ll explain how to protect your most sensitive accounts from hackers and how to dox yourself before someone else does. We want to empower you to feel safer and more secure while maintaining the public profile you need to do your job. This series will include eight short video episodes and four virtual workshops, when you can follow along to complete your digital wellness check, ask questions, and get help if you get stuck. You can join one, two or all four sessions.

AWS re:Inforce (Boston, Massachusetts, United States, Jul 26 - 27, 2022) Exclusively for listeners of the Cyberwire Podcasts, register for AWS re:Inforce using code ALUMLBzyE6B6 to receive $300 off your full conference registration for AWS re:Inforce while supplies last. Join us at this year’s re:Inforce to hear from AWS leaders, builders, and experts about the latest advancements in AWS security, compliance, identity, and privacy solutions—including actionable best practices your business can use immediately. Sessions are offered at all levels and for all backgrounds, from beginner to expert and business to technical.

Cyber Risk Summit 2022 (Virtual, Jul 27, 2022) The CyberRisk Summit showcases the leading minds, best practices, and tech in cyber risk management. Join us to learn how innovators own risk across all cyber surfaces.

ICS/OT Cyber Threats, Vulnerabilities, and Incidents: Past and Present (Columbia and virtual, Maryland, USA, Jul 27, 2022) Gain an in-depth look at old case studies and new research across 2021 highlighting new ICS threat groups, vulnerabilities, and insights from the field including incident response case studies of previously unreported incidents. This session will give a ground-truth reality and primer on what is really happening in our industrial environments.

Black Hat USA 2022 (Las Vegas (and virtual), Nevada, USA, Aug 6 - 11, 2022) Black Hat USA 2022 will be a hybrid conference, offering both a virtual (online) event and a live, in-person event at Mandalay Bay in Las Vegas, August 6-11. You’ll find the same high-quality content and networking opportunities that you’ve come to expect at our Black Hat events, in whichever format you choose.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.