Twitter account data stolen. NHS 111 hit by cyberattack. Notes on the C2C market. Update on the hybrid war against Ukraine.

Summary

By the CyberWire staff

At a glance.

Twitter exploit may have compromised more than 5 million accounts.
Cyberattack disrupts NHS 111.
Developments in the C2C market.
Alleged Russian cryptocurrency exchange operator extradited to the US.
Crypto mixing service sanctioned by US Treasury Department.
A review of how cyber threats have shifted during Russia's war against Ukraine.

Twitter exploit may have compromised more than 5 million accounts.

On Friday Twitter disclosed a cyberattack that compromised some users' personal information. "In January 2022, we received a report through our bug bounty program of a vulnerability in Twitter's systems. As a result of the vulnerability, if someone submitted an email address or phone number to Twitter’s systems, Twitter's systems would tell the person what Twitter account the submitted email addresses or phone number was associated with, if any. This bug resulted from an update to our code in June 2021. When we learned about this, we immediately investigated and fixed it. At that time, we had no evidence to suggest someone had taken advantage of the vulnerability." But it turned out that a threat actor had exploited the vulnerability to collect personal information before Twitter applied the patch, and was now offering the stolen data for sale. Twitter is in the process of notifying affected users. BleepingComputer reports that some 5.4 million accounts were scraped for personal data before the vulnerability was fixed.

Sponsors make the Daily Briefing possible.

Having the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, means companies trust us to get their messages out. Feature your brand and message with the source that top security leaders read every day. Learn more.

Cyberattack disrupts NHS 111.

A cyberattack against a third-party provider has disrupted Britain's National Health Service's NHS 111 online service, an advice and scheduling platform designed "to make it easier and quicker for patients to get the right advice or treatment they need." Advanced, a digital services provider for NHS 111, detected the attack on Thursday. The BBC says the target of the attack was the system "used to refer patients for care, including ambulances being dispatched, out-of-hours appointment bookings and emergency prescriptions." The Guardian reported on Saturday that the Government was organizing a "coordinated resilience response," and that recovery might well take into this week. There's so far been no public attribution of the attack, but the Telegraph says that an unnamed nation-state is suspected.

Check out our exclusive interview w/ CISA Director Jen Easterly.

Did you catch Dave Bittner's interview with CISA Director Jen Easterly? Hear Director Easterly discuss her time at CISA, the work of her team, and her take on the current cyber threat landscape in this special edition extended interview. Listen now!

Developments in the C2C market.

There are two noteworthy developments in the criminal-to-criminal marketplace. First, as BleepingComputer reported on Thursday, a service that calls itself "Dark Utilities" offers command-and-control as a service for criminal clients. Researchers at Cisco Talos described the service as "a platform that provides full-featured C2 capabilities to adversaries." It's marketed to the underworld as offering affordable "remote access, command execution, distributed denial-of-service (DDoS) attacks and cryptocurrency mining operations on infected systems." Subscribers can get command-and-control-as-a-service (C2aaS) for an initial fee of €9.99. Dark Utilities has some 3000 active subscribers.

In another C2C subsector, the initial access broker marketplace where stolen credentials are hawked, the Genesis Marketplace is said to deliver its wares with sophistication and "polish." Researchers at Sophos describe the service (active since 2017) as follows: "Genesis – called Genesis Marketplace, or Genesis Store, or Genesis Market; the site refers to itself inconsistently – is an invitation-only marketplace. It sells stolen credentials, cookies, and digital fingerprints that are gathered from compromised systems, providing not just the data itself but well-maintained tools to facilitate its use."

Alleged Russian cryptocurrency exchange operator extradited to the US.

On Thursday Alexander Vinnik finally arrived in the US, extradited from Greece. Mr. Vinnik, the US Department of Justice announced Friday, faces money laundering charges in connection with BTC-e, an exchange that allegedly catered to the criminal-to-criminal market. “'After more than five years of litigation, Russian national Alexander Vinnik was extradited to the United States yesterday to be held accountable for operating BTC-e, a criminal cryptocurrency exchange, which laundered more than $4 billion of criminal proceeds,' said Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division."

Crypto mixing service sanctioned by US Treasury Department.

In a "cyber related designation," the US Department of the Treasury this morning added Tornado Cash to the Department's Specially Designated Nationals List. Tornado Cash is a virtual currency mixer, and the Treasury Department has concluded that this particular mixer is implicated in laundering the proceeds of cybercrime. In particular, Reuters reports, the Department is concerned about the uses North Korea's Lazarus Group has made of Tornado Cash. The immediate effect of the sanction, CoinDesk notes, is that US persons will no longer be able to use the mixer. This is the second virtual currency mixing service Treasury has sanctioned for connections with North Korea: Blender.io came under sanction early this May.

A review of how cyber threats have shifted during Russia's war against Ukraine.

The opening phase of Russia's hybrid war was marked by a series of wiper attacks that at the time seemed to foreshadow a more extensive cyber campaign to come. That expected campaign has for the most part failed to materialize, but ESET's Threat Report T1 2002 offers some perspective on the early attacks and some of their sequelae and successor operations.

"On the eve of the Russian invasion of Ukraine, ESET researchers discovered new data-wiper malware deployed in Ukraine on that day, which was installed on hundreds of machines in at least five organizations in that country. The attack came just hours after a series of distributed denial-of-service (DDoS) onslaughts knocked several important Ukrainian websites offline. The data wiper was first spotted just before 17:00 local time (15:00 UTC), February 23.... ESET researchers assess with high confidence that the affected organizations were compromised well in advance of the wiper’s deployment based on these three findings:

"The attackers used a genuine code-signing certificate issued to a company called Hermetica Digital Ltd., issued on April 13, 2021. That is also the reason why ESET decided to name the malware HermeticWiper, as was suggested in a reply to ESET Research’s tweet.
"Initial access vectors varied from one organization to another, but the deployment of HermeticWiper through Group Policy Object (GPO) in at least one instance suggests the attackers had prior access to one of that victim’s Active Directory servers.
"Its compilation timestamp shows it was compiled on December 28, 2021. HermeticWiper overwrites several locations (such as master boot record and master file table) on compromised systems with random bytes; symbolic links and large files in My Documents and Desktop folders are overwritten with random bytes too. It recursively wipes folders and files in Windows, Program Files, Program Files(x86), PerfLogs, Boot, System Volume Information, and AppData folders. The wiper even wipes itself from the disk by overwriting its own file with random bytes. This anti-forensic measure is likely intended to prevent post-incident analysis. The machine is restarted; however, it will fail to boot because most files were wiped. ESET researchers believe that without backups, it is not possible to recover the impacted machines."

The early access and staging are significant insofar as they indicate Russian preparation for hybrid combat.

Another familiar attack failed, even with the malware in question being deployed in a new version. The Sandworm threat actor, also known as Voodoo Bear and for some time identified as Unit 74455 of the GRU, had been active with some success against sections of the Ukrainian power grid as early as 2015. It attempted to hit high-voltage electrical substations again in early April of this year, but without success.

"For over five years, ESET researchers have wondered why Industroyer, as sophisticated as it was, was never deployed again. This April, the wait was over, when we collaborated with CERT-UA to respond to a cyber-incident affecting an energy provider in Ukraine and helped to remediate and protect this critical infrastructure. This collaboration resulted not only in the disruption of the attack but also in the discovery of a new Industroyer variant, which we, together with CERT-UA, named Industroyer2. In this case, the Sandworm attackers made an attempt to deploy Industroyer2 against high-voltage electrical substations in Ukraine. In addition to Industroyer2, Sandworm used several destructive malware families including CaddyWiper, ORCSHRED, SOLOSHRED and AWFULSHRED. ESET researchers don’t know how attackers compromised the initial victim, nor how they moved from the IT network to the Industrial Control System (ICS) network. If successful, this attack could have left two million people without electricity, claimed Farid Safarov, Ukraine’s Deputy Minister of Energy."

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Notes.

Today's issue includes events affecting Albania, Algeria, Belarus, China, Greece, India, Iran, Israel, the Democratic People's Republic of Korea, the Republic of Korea, Morocco, Russia, Taiwan, Ukraine, the United Kingdom, and the United States.

Dateline

Ukraine at D+165: Command failure, cyberattacks, and espionage. (CyberWire) Russia now appears to be reacting to Ukrainian battlefield moves as the initiative in the war appears to be shifting away from Moscow. The effectiveness of Ukraine's new rocket and cannon artillery seems to have be central to the reversal of Russian fortunes, as high casualty rates and widespread command failure in the Russian army continue during Russia's prolonged operational pause. ESET reviews Russian cyber operations during the war. Russia's FSB and Ukraine's SBU make arrests for espionage (and at least some of the espionage the FSB is charging was reportedly committed on behalf of China.

Russia-Ukraine war: List of key events, day 166 (Al Jazeera) As the Russia-Ukraine war enters its 166th day, we take a look at the main developments.

Russia-Ukraine war: what we know on day 166 of the invasion (the Guardian) UN warns of possible ‘nuclear disaster’ after plant hit by shelling; ships carrying foodstuffs sail from Ukrainian ports

Russia-Ukraine war: what we know on day 165 of the invasion (the Guardian) UN nuclear watchdog warns of disaster risk as Zaporizhzhia power plant shelled; war about to enter a new phase, UK intelligence predicts

Russia begins new assault on 2 cities in Ukraine's Donetsk region (CBS News) Bakhmut and Avdiivka have been considered key targets of Russia's ongoing offensive across Ukraine's east.

Ukraine war: Russia 'using landmines that maim children who mistake them for toys' (The Telegraph) Russia is highly likely to be deploying anti-personnel mines along its defensive lines in the Donbas region of Ukraine, the Ministry of Defence has said.

Russian Offensive Campaign Assessment, August 7 (Institute for the Study of War) Russian occupation officials may be accelerating their preparations for illegitimate pseudo-referenda on the Russian annexation of occupied Ukrainian territory. The Ukrainian Mayor of Melitopol, Zaporizhia Oblast, Ivan Fedorov, reported on August 7 that

Russians "no longer able to resist HIMARS": Front-line Ukrainian mayor (Newsweek) Ivan Fedorov, mayor of Melitopol, said a recent attack by Ukraine's soldiers will help ahead of a counterattack against Russian forces

Russia in "tremendous" military difficulty in Ukraine war: Lange (Newsweek) German lawmaker Nico Lange said Saturday that significant aid from overseas has changed the power dynamic in the ongoing conflict.

Russia-Ukraine war ‘about to enter new phase’ as Russian forces gather in the south, UK intelligence warns – live (the Guardian) UK’s Ministry of Defence says troop build-up could be in anticipation of Ukrainian counter-offensive or for a new assault

Ukrainian unit digs in for Russian assault on eastern city (AP NEWS) Ukrainian military personnel are fortifying their positions around the eastern city of Sloviansk in expectation of a fresh Russian attempt to seize the strategic point in the fiercely fought-over Donetsk region.

Attack on Ukraine nuclear plant ‘suicidal’, says UN chief as he urges access to site (the Guardian) Atomic watchdog seeking access to Zaporizhzhia, Europe’s largest atomic energy plant, after shelling damages radiation sensors and injures worker

Is Lukashenko preparing to help Russia reopen Ukraine’s northern front? (BNE) Recent Russian and Belarusian military activity on Belarusian territory could be laying the groundwork for Russia to reopen the northern front in its invasion of Ukraine.

Lukashenko doesn't have final say on Russian troops using Belarus: Expert (Newsweek) Russian strikes fired at Ukraine from Belarus prove Putin's forces "can pass through Belarus quite freely," said Estonian official Marti Magnus.

Russians shell nuclear power plant twice within hours: Energoatom official (Newsweek) Russia says Ukraine is the one attacking the plant, but Ukraine's Western allies say that Russia is using the plant as a shield.

Ukraine and Russia Trade Blame After Rockets Hit Near Nuclear Site (New York Times) A strike landed near spent-fuel storage at the Zaporizhzhia power plant, which Russian forces have held since March. Moscow blamed Ukraine, while Ukrainian intelligence says it was a Russian move to destroy power infrastructure.

Ukraine HIMARS strike Russian bases during major counter-attack (Newsweek) Ukrainian forces are laying the groundwork for an operation to liberate Kherson, occupied by Russian troops in February.

Ukraine lists this week's HIMARS, MLRS conquests against Russia (Newsweek) All this comes as the British Ministry of Defense has raised concerns about the security of the Zaporizhzhia nuclear plant, which is under Russian control.

Russia says forces have destroyed platoon of U.S. HIMARS and Alder systems (Newsweek) Moscow has made a number of recent claims about striking the U.S.-supplied systems, although the reports have been contested.

Russia claims it "destroyed" HIMARS—what we do know, what we don't (Newsweek) The U.S.-sourced weapons system is touted as a "game-changer" in the conflict, but has Russia taken down any of them? Newsweek Fact Check looked at the claims.

Russia blows up its ammunition while trying to hide from HIMARS: Report (Newsweek) Russian forces created a smoke screen to protect themselves from HIMARS while unloading ammunition from a train in Ukraine's Kherson region, Ukraine said.

Russian-appointed Kherson mayor ‘was poisoned by chef’ (The Telegraph) Vladimir Saldo’s ‘mind began to cloud and his fingertips went numb’ after he ate food prepared by newly-arrived staff member

Wagner Group recruiting convicts to join militia – with promise of a free coffin (The Telegraph) Man known as ‘Putin’s chef’ touring jails looking for physically fit murderers and thieves, offering presidential pardons and a salary

Russia's invasion of Ukraine has been an utter failure. But you wouldn't know it (The Telegraph) Russian propaganda works because it exploits a weakness in the West: we still tend to believe that language has something to do with truth

Oksana Bashuk Hepburn: Russia knows it is loosing and Ukraine needs to be careful (Kyiv Independent) A wounded wild animal is very dangerous. So is Russia’s dictator Vladimir Putin. He is losing his bloody war in Ukraine. He’s humiliated now and historically. He must be livid. Before Ukraine declares victory it — with friends and allies — needs to ensure the wounded criminal in the Kremlin won’t pounce.

Russian spy network supplying intel about military movements in Donbas shut down by SBU (NV) Ukraine’s SBU Security Service terminated the activities of a Russian intelligence network that provided information about the deployment and movement of units of the Armed Forces of Ukraine in Slovyansk, Kramatorsk and Pokrovsky districts of Donetsk Oblast, the SBU reported on Aug. 6.

Russian hypersonic missile scientist arrested, charged with treason (Newsweek) Alexander Shiplyuk is the third prominent Novosibirsk-based scientist to be taken into custody over the past few months.

Russia-Ukraine war: Head of Russian hypersonic missile lab arrested for treason (The Telegraph) One of Russia’s top hypersonic missile scientists has been arrested for treason in Siberia.

Top Ukraine Amnesty International official resigns after report finds military operated in residential areas (The Hill) The top official at Amnesty International’s office in Ukraine announced on Friday she would step down after the organization issued a report alleging that some of Kyiv’s military based itself in po…

What we know about the blast that killed Ukrainian POWs in Olenivka (Washington Post) Early on July 29, on the outskirts of Olenivka village in eastern Ukraine, a mysterious explosion tore through a separatist-controlled prison housing hundreds of Ukrainian detainees. The blast killed at least 50 people, according to Russian officials, including fighters who surrendered to Russia in May at the Azovstal steel plant in Mariupol.

Footage appears to show fresh atrocity against Ukrainian PoW (the Guardian) Russians accused of barbaric behaviour apparently seen in videos and photos from captured city of Popasna

Tracking the Faceless Killers who Mutilated and Executed a Ukrainian POW (bellingcat) In a series of gruesome videos, a man wearing a cowboy hat mutilates a Ukrainian prisoner of war before murdering him. Open source evidence suggests the involvement of a Chechen-led paramilitary group.

ESET Details How War in Ukraine has Changed the Threat Landscape (TechEconomy.ng) ESET Threat Report details how war in Ukraine has changed the threat landscape, writes Roman Kováč, Chief Research Officer at ESET

ESET Threat Report T 1 2022 (WeLiveSecurity) A view of the T 1 2022 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts

Why Can’t Cyber Scholars Move Beyond the Basics? (The National Interest) Instead of pushing knowledge forward, the field of cybersecurity in geopolitics has mostly become about explaining why something didn’t happen rather than why it did.

How Putin’s digital Iron Curtain is struggling to suppress dissent over war (The Telegraph) RuTube and RossGram fail to stop Russians bypassing Kremlin censorship

Russian men, dying in war, leave many families sad, angry and silent (Washington Post) When Yevgeny Chubarin told his mother he was joining the Russian army to fight against Ukraine, she cried and begged him not to go. But his exhilaration shone through. By May 15, he had an AK-47 and was on his way. The 24-year-old stone-factory worker was killed the next day.

U.S. Security Official Vindman Testifies Ukraine Offered Defense Minister Post (RadioFreeEurope/RadioLiberty) The U.S. National Security Council's (NSC) expert for Ukraine has told the Democratic-led House of Representatives impeachment hearing he was offered the position of Ukraine's defense minister three times, a new revelation that came out as Republicans tried to undermine his key testimony.

When Politics Returns to Kyiv (Foreign Affairs) Ukrainian democracy will be tested after the war.

Exclusive: U.S. readies new $1 billion Ukraine weapons package (Reuters) The Biden administration's next security assistance package for Ukraine is expected to be $1 billion, one of the largest so far, and include munitions for long-range weapons and armored medical transport vehicles, three sources briefed on the matter told Reuters on Friday.

HIMARS’ Hidden Superpower and Other Acquisition Lessons from Ukraine (Defense One) With no U.S. troops on the ground, acquisition professionals are the operators making the difference.

Can Russia Divide Europe? (Foreign Affairs) Why a false peace could be worse than a long war.

Siemens Energy warns of deeper net loss over Russia restructuring (Nasdaq) Siemens Energy ENR1n.DE, which supplies equipment to the power industry, on Monday warned of a deeper than previously expected net loss in 2022, on a charge of around 200 million euros ($204 million) due to the restructuring of its business in Russia.

Attacks, Threats, and Vulnerabilities

New Woody RAT used in attacks aimed at Russian entities (Security Affairs) An unknown threat actor is targeting Russian organizations with a new remote access trojan called Woody RAT. Malwarebytes researchers observed an unknown threat actor targeting Russian organizations with a new remote access trojan called Woody RAT. The attackers were delivering the malware using archive files and Microsoft Office documents exploiting the Follina Windows flaw (CVE-2022-30190). The assumption […]

North Korean hackers target crypto experts with fake Coinbase job offers (BleepingComputer) A new social engineering campaign by the notorious North Korean Lazarus hacking group has been discovered, with the hackers impersonating Coinbase to target employees in the fintech industry.

NHS 111 software outage confirmed as cyber-attack (BBC News) The problems are reported to have impacted referrals from the NHS 111 helpline to out-of-hours GPs.

Cloud MSP Suffers Cyberattack; Outages Impact UK's NHS 111 Emergency Healthcare System - MSSP Alert (MSSP Alert) Advanced, a cloud MSP that hosts & manages healthcare applications for NHS 111 & UK businesses, confirms cyberattack.

NHS 111 suffers major cyber attack as staff resort to ‘pens and paper’ (The Telegraph) Security services investigate as hackers feared to be linked to hostile state shut down crucial system, with widespread disruption predicted

NHS 111 expects delays after cyber-attack causes system outage (the Guardian) Services still available but will run at reduced capacity over the weekend

Ministers coordinate response after cyber-attack hits NHS 111 (the Guardian) Outage that affected services across system may not be fully resolved until next week, says IT provider

Thousands of hackers flock to 'Dark Utilities' C2-as-a-Service (BleepingComputer) Security researchers found a new service called Dark Utilities that provides an easy and inexpensive way for cybercriminals to set up a command and control (C2) center for their malicious operations.

Genesis IAB Market Brings Polish to the Dark Web (Dark Reading) As the market for initial access brokers matures, services like Genesis — which offers elite access to compromised systems and slick, professional services — are raising the bar in the underground economy.

Cyber-weapons on the Dark Web (Express Tribune) State-developed cyber-weapons will be available on the darknet in a few of years, the chief of Interpol has warned

GwisinLocker ransomware exclusively targets South Korea (Security Affairs) Researchers spotted a new family of ransomware, named GwisinLocker, that encrypts Windows and Linux ESXi servers. Researchers warn of a new ransomware called GwisinLocker which is able to encrypt Windows and Linux ESXi servers. The ransomware targets South Korean healthcare, industrial, and pharmaceutical companies, its name comes from the name of the author ‘Gwisin’ (ghost […]

New GwisinLocker ransomware encrypts Windows and Linux ESXi servers (BleepingComputer) A new ransomware family called 'GwisinLocker' targets South Korean healthcare, industrial, and pharmaceutical companies with Windows and Linux encryptors, including support for encrypting VMware ESXi servers and virtual machines.

Actors linked to Iran likely behind cyber attack on Albanian government, American company says (Tirana Times) A major cyberattack on Albania’s government and its online services for citizens was likely conducted by an Iranian threat actor, according to a report by Mandaint, a large U.S. cyber security company.

An Attack on Albanian Government Suggests New Iranian Aggression (Wired) A Tehran-linked hack of a NATO member marks a significant escalation against the backdrop of US-Iran nuclear talks.

Anonymous Source Leaks 4TB of Cellebrite Data Online After Cyberattack (HackRead) Cellebrite is an Israel-based smartphone hacking (or cracking) firm that previously made headlines for unlocking iPhone devices for law enforcement and security agencies in the United States.

Zimbra Credential Theft Vulnerability Exploited in Attacks (SecurityWeek) CISA has urged organizations to patch a recent Zimbra credential theft vulnerability after reports of exploitation in the wild.

CISA adds Zimbra email bug to Known Exploited Vulnerabilities Catalog (Security Affairs) US Critical Infrastructure Security Agency (CISA) adds a recently disclosed flaw in the Zimbra email suite to its Known Exploited Vulnerabilities Catalog. The Cybersecurity & Infrastructure Security Agency (CISA) has added a recently disclosed flaw in the Zimbra email suite, tracked as CVE-2022-27924, to its Known Exploited Vulnerabilities Catalog. In middle June, researchers from Sonarsource discovered […]

Serious cyberattack hits German Chambers of Industry and Commerce (DIHK) (Security Affairs) A massive cyberattack hit the website of the German Chambers of Industry and Commerce (DIHK) this week. A massive attack hit the website of the German Chambers of Industry and Commerce (DIHK) forcing the organization to shut down its IT systems as a precautionary measure for security reasons. “Due to a possible cyber attack, the […]

Slack Forces Password Resets After Discovering Software Flaw (SecurityWeek) Slack has started forcing password resets for some workspace owners after the discovery of a security flaw that exposed credentials.

Snapchat, Amex sites abused in Microsoft 365 phishing attacks (BleepingComputer) Attackers abused open redirects on the websites of Snapchat and American Express in a series of phishing attacks to steal Microsoft 365 credentials.

Twitter: Someone Exploited a Zero-Day to Access User Data (PCMAG) As many as 5.4 million Twitter accounts may have been affected.

Twitter fixes bug that exposed at least 5.4M accounts (TechCrunch) Twitter fixed the bug in January, but not before it was exploited.

Twitter confirms zero-day used to expose data of 5.4 million accounts (BleepingComputer) Twitter has confirmed a recent data breach was caused by a now-patched zero-day vulnerability used to link email addresses and phone numbers to users' accounts, allowing a threat actor to compile a list of 5.4 million user account profiles.

Cisco warns of critical vulnerabilities in routers (The Record by Recorded Future) Cisco urged customers to patch three vulnerabilities discovered in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers.

Algerian Hacker Attacks Website of Science University in Fez, Morocco (Morocco World News) The official website of Dhar El Mahraz Science University in Fez (FSDM) was subject to a cyberattack by an Algerian hacker on Friday.

Security Patches, Mitigations, and Software Updates

F5 Fixes 21 Vulnerabilities With Quarterly Security Patches (SecurityWeek) F5 has fixed a total of 21 vulnerabilities, including 12 high-severity issues, with its latest quarterly security patches.

Microsoft Edge gets better security defaults on less popular sites (BleepingComputer) Microsoft is rolling out a new update to the Microsoft Edge Stable Channel over the coming days to improve the web browser's security defaults when visiting less popular websites.

DuckDuckGo says no to those Microsoft trackers after revolt (Register) Plus: That Twitter privacy leak, scammers send Ubers for victims, critical flaw in Cisco gear, and more

Trends

Interoperability: Is the glass half full or half empty? (Medical Economics) New ONC report highlights progress, challenges in promoting interoperability

Marketplace

Third Annual DT Challenge - DataTribe (DataTribe) What could your company do with $2 million? The DataTribe Challenge is a unique annual competition where startups have a chance at receiving up to $2 million in seed capital. The Challenge brings together the best entrepreneurs in the world to looking to disrupt cybersecurity and data science. DataTribe selects three finalists that split $20,000 ... Read more Third Annual DT Challenge

QinetiQ US to Add Cyber, Software Capabilities With Avantus Federal Acquisition; Shawn Purvis Quoted (Executive Gov) The U.S.-based subsidiary of defense contractor QinetiQ Group plc has agreed to purchase cyber- and data analytics-focused company Avantus Federal for a reported sum of $590 million.

Peraton Lands $850M DOD Intelligence Systems Contract (WashingtonExec) Peraton has been awarded a contract by the Defense Department to provide agile analytic platforms and data management solutions. The contract is worth

Gartner® Hype Cycle™ for Application Security Report - July 2022 (ThreatX) ThreatX has been named a Sample Vendor in the July 2022 Gartner Hype Cycle™ for Application Security in the API Threat Protection and Cloud WAAP categories. We’re thrilled with this recognition, and look forward to continuing to help organizations tackle the significant challenge of application and API security. Gartner notes in the report, “Because APIs […]

Here's why Sanjay Poonen, VMware's ex-COO, just took job as Cohesity's new CEO (Silicon Valley Business Journal) Sanjay Poonen is taking the reins at San Jose-based Cohesity from founder Mohit Aron, who will remain on the board and lead R&D as chief technology officer.

Justin DePalmo Named GDIT Chief Information Security Officer (GovCon Wire) Looking for the latest GovCon News? Check out our story: Justin DePalmo Named GDIT Chief Information Security Officer. Click to read more!

Fastly hires Todd Nightingale as CEO (Help Net Security) Fastly announced that the Board of Directors has appointed Todd Nightingale as the company’s next Chief Executive Officer.

Jarrett Booz Joins Accenture Federal Services (WashingtonExec) Accenture Federal Services has hired Jarrett Booz as a senior manager and program and project management lead, where he'll be responsible for organizing,

Bugcrowd Expands Executive Team with Addition of Dave Gerry as Chief Operating Officer (PR Newswire) Bugcrowd, the leader in crowdsourced cybersecurity, today announced the appointment of Dave Gerry to Chief Operating Officer (COO). Gerry...

Products, Services, and Solutions

New infosec products of the week: August 5, 2022 (Help Net Security) The featured infosec products this week are from: Claroty, Fortinet, Qualys, Scrut Automation, Sony, and VIPRE Security.

Claroty launches new cloud-based industrial cybersecurity platform (SecurityBrief Asia) The company says Claroty xDome is the industry's first solution to deliver the ease and scalability of SaaS without compromising on visibility, protection, and monitoring controls.

VMware Unveils Cloud Workload Protection for AWS - EnterpriseTalk (EnterpriseTalk) VMware has announced the release of advanced workload protection for AWS to help give AWS customers better visibility over on-premises

AvePoint rebrands SaaS learning product to MaivenPoint (IT Brief Australia) Our mission with MaivenPoint is to make your learning experience limitless and inspire everyone to achieve their aspirations.

Technologies, Techniques, and Standards

If cryptocurrencies are unhackable, how do they keep getting stolen? (New Scientist) News of a $190 million cryptocurrency theft emerged this week, despite cryptocurrencies being designed to be unhackable. Here's the low-down on what is going on and how safe bitcoin or other cryptocurrencies are

An interview with a professional ransomware negotiator (Register) What it's like bargaining with criminals ... and advising clients suffering their worst day yet

Israel Police's Pegasus Spyware Prototype Revealed (Haaretz) Israel Police planned to present NSO's Pegasus to security officials eight years ago, demonstrating how an infected phone becomes a listening device with its camera secretly turned on

Rare Pegasus screenshots depict NSO Group's spyware capabilities (AppleInsider) A new investigation has revealed rare screenshots of NSO Group's Pegasus iPhone spyware in action, showing off its user interface, capabilities, and more.

XDR Alliance Celebrates First Anniversary, Releases Open Source Common Information Model (CIM) (Business Wire) XDR Alliance Celebrates First Anniversary

Angry Kitten electronic attack pod bares its claws during Air Force tests (Breaking Defense) During a series of flight tests in April, the Air Force added new electronic attack techniques to the Angry Kitten Combat Pod on a daily basis.

Report: Some of DOD's GPS Alternatives Lack Complete Business Cases (Air Force Magazine) A new report from the Government Accountability Office looked into how the Pentagon’s work on GPS alternatives is progressing.

Data breaches: How startups can win back customer trust (YourStory.com) Recent data breaches reported by Cleartrip and PB Fintech once again brought forth the need for Indian startups to put cybersecurity on their priority list.

Is Your Government Organization Cyber Resilient? (GovTech) What does it mean to be prepared for technology and business disruptions in the 2020s? How can your organization recover fast?

Operation Cyber Dragon turning US Navy reservists into digital defenders (Defense News) “The interesting thing in the IT world or the network world is what’s patched and 100% compliant today might not be patched tomorrow, because vulnerabilities ebb and flow.”

Research and Development

NSF Invests in New Research Projects to Advance Cybersecurity, Privacy (Executive Gov) The National Science Foundation is investing $25.4 million in a research program aimed at advancing cybersecurity and privacy in areas including supply chain and cloud computing.

Legislation, Policy, and Regulation

India cannot afford to lack a robust data protection law for too long (India Today) The Union government withdrew the Personal Data Protection Bill after a parliamentary panel suggested 81 changes to it. Here's why India cannot afford to lack a robust data protection law for too long.

Safety Net: Editorial on the need of data protection laws to counter cybercrime (Telegraph Online) With traditional methods of fighting internet crimes proving to be less effective there is an urgent need to overhaul the securitisation of cyberspace

Greece’s intelligence boss quits amid phone surveillance scandal (Al Jazeera) Panagiotis Kontoleon quits ‘following mistaken actions found during lawful wiretapping procedures’, PM’s office says.

Greek Intel Chief and Top PM Aide Quit Over Israeli Spyware Scandal (Haaretz) Greece's intel service was accused of hacking cellphones of opposition party leader and investigative reporter with predator spyware made by ex-top Israeli intel officer

Why banning Huawei is proving easier said than done (Times) Shortly before Russia invaded Ukraine in February, Huawei’s two remaining UK directors attended a strategy meeting at its new office near Victoria in London.Oth

Could Cyber Defense Deter a War Over Taiwan? (The National Interest) The United States should let China know that the free world’s semiconductor coalition has collaborated on a mutual digital defense pact to deny access to the one supply chain they need the most.

US strategic advantage depends upon addressing cybersecurity vulnerabilities of weapon systems (The Hill) Known digital vulnerabilities in Joint Force weapon systems introduce unintended and unrealized risk.

Could criminalizing ransomware payments put a stop to the current crime wave? (Help Net Security) In this video, Charl van der Walt from Orange Cyberdefense, discusses whether criminalizing ransomware payments could quell the crime wave.

CISA official highlights agency’s cyber tools at hearing on threats to elections, workers (Inside Cybersecurity) CISA is emphasizing “field-based assistance” and customized tools to help state and local officials secure election systems, a senior official testified before the Senate Judiciary Committee, while pointing to significant progress since 2016 on information sharing, situational awareness and building resilience into the system.

Finance Sector Deals Latest Blow to Cyber Solarium Construct Teetering in NDAA (Nextgov.com) Congress will return from the August recess faced once again with the challenge of building cybersecurity policy for private providers of critical infrastructure faster than industry can tear it down.

Opinion | It Was a Mistake to Let Kids Onto Social Media Sites. Here’s What to Do Now. (New York Times) Changing a law to raise the age requirement for social media use could empower parents.

Litigation, Investigation, and Law Enforcement

Cyber-related Designation (U.S. Department of the Treasury) The following entity has been added to OFAC's SDN List: TORNADO CASH (a.k.a. TORNADO CASH CLASSIC; a.k.a. TORNADO CASH NOVA)

U.S. imposes sanctions on virtual currency mixer Tornado Cash (Reuters) The United States on Monday imposed sanctions on virtual currency mixer Tornado Cash, accusing it of helping hackers, including from North Korea, to launder proceeds from their cyber crimes.

Crypto Mixing Service Tornado Cash Blacklisted by US Treasury (CoinDesk) The U.S. Treasury Department barred all U.S. persons from using Tornado Cash, alleging its use in laundering stolen crypto funds by North Korean hackers poses a national security threat.

Alleged Russian Cryptocurrency Money Launderer Extradited to United States (US Department of Justice) The alleged operator of the illicit cryptocurrency exchange BTC-e was extradited yesterday from Greece to the United States to face charges in the Northern District of California.

Russian accused of money laundering and running $4B bitcoin exchange extradited to US | CNN Politics (CNN) A Russian national accused of running a multibillion-dollar cryptocurrency exchange that allegedly profited from various hacking and extortion schemes has been extradited from Greece and is on his way to the US, according to the suspect's lawyer.

Former health adviser found guilty of illegally accessing patient records (ICO) A former health adviser has been found guilty of accessing medical records of patients without a valid legal reason. Christopher O’Brien, 36, was working at the South Warwickshire NHS Foundation Trust when he unlawfully accessed the records of 14 patients, who were known personally to him, between June and December 2019.

Public Citizen Advises US Decision-Makers Investigate Amazon-One Medical Merger (Managed Healthcare Executive) Public Citizen advised Amazon's acquisition of One Medical should be rejected if Amazon does not commit to robust, legally binding safeguards in a letter sent today to authorized U.S decision-makers.

iMessage and the Secret Service (Six Colors) I was struck by this section of a report by Politico’s Eric Geller involving the deletion of Secret Service messages related to the January 6 insurrection at the U.S. Capitol: The phone reset…

Exclusive: Trump-backed Michigan attorney general candidate involved in voting-system breach, documents show (Reuters) The Republican nominee for Michigan attorney general led a team that gained unauthorized access to voting equipment while hunting for evidence to support former President Donald Trump’s false election-fraud claims, according to a Reuters analysis of court filings and public records.

House GOP leader McCarthy: Hunter Biden probe will expand to what US intel chiefs knew (New York Post) “They should come in and talk to us,” McCarthy said in an exclusive sitdown with The Post. “You’d want to ask these individuals what did they know and when.”

McCarthy Says House Investigation of Hunter Biden Will Include U.S. Intel Chiefs | National Review (National Review) After initially dismissing the Hunter Biden laptop story, many in the mainstream media have recently confirmed it.

Fearing Arrest By Maha Police, Tele Phishing Suspects Return Cash | Aurangabad News (The Times of India) Fearing arrest in a cheating case registered with the Parbhani district police four years ago, tele phishing suspects from Jharkhand returned Rs 65,0

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

SANS 2022 Cloud Security Exchange (Virtual, Aug 25, 2022) SANS Institute, the global leader in cybersecurity training and certifications, today announced it would be hosting its first SANS 2022 Cloud Security Exchange live online event, which will take place on August 25, 2022 at 11:00am EDT. The Cloud Security Exchange brings technical security leaders from Google Cloud Platform (GCP) and Microsoft Azure together in one forum to share their perspectives on building cloud security programs and best practices on crucial security pillars. As more organizations embrace digital transformation, security operations and architecture teams are facing new challenges.

Texas Cyber Summit (Austin, Texas, USA, Sep 22 - 24, 2022) The Texas Cyber Summit annual conference is a gathering of over 1300 Cybersecurity Professionals and enthusiasts, we are hosting beginner to expert level briefings, labs, workshops and challenges. Cybersecurity Awareness, intro to hacking and defense, Mobile developers, application developers, Security Analysts Engineers, DevSecOps, offensive and defensive, to power gen, industrial controls, financial, medical and government systems, even the famous "Car Hacking Village." The Texas Cyber Summit is a three-day conference held annually in Austin Texas.

Events

Black Hat USA 2022 (Las Vegas (and virtual), Nevada, USA, Aug 6 - 11, 2022) Black Hat USA 2022 will be a hybrid conference, offering both a virtual (online) event and a live, in-person event at Mandalay Bay in Las Vegas, August 6-11. You’ll find the same high-quality content and networking opportunities that you’ve come to expect at our Black Hat events, in whichever format you choose.

2022 Cybersecurity Conference (Indianapolis, Indiana, USA, Aug 10, 2022) Is your business utilizing the best technology available for your success? More importantly, are you using it safely? Cyberattacks are the most significant risk factor facing Indiana businesses today. The 2022 Cybersecurity Conference will address key technology information, products, strategies, protections and so much more to help you ensure your organization is operating safely for future success. This program should appeal to anyone who has a role regarding personal or confidential information – whether the information is that of a customer, employee, patient, student, job applicant or it is a trade secret or other proprietary information.

The Diana Initiative Las Vegas Conference (Las Vegas, Nevada, USA, Aug 10 - 11, 2022) Back for the 6th year, The Diana Initiative is hosting a two-day diversity-driven conference committed to helping all underrepresented genders, sexualities, races and cultures in Information Security. The Diana Initiative features multiple speaker tracks, fully expanded villages with hands-on workshops, and a women-led Capture the Flag event.

STEM Pioneers Rock! Loretta Hall, Author of biography of Wally Funk, member of the female team for Mercury 13 flight (Columbia and Virtual, Maryland, United States, Aug 15, 2022) Brought to you by NSA and Dreamport/MISI, the STEM Pioneers Rock series, highlights significant accomplishments of those who are "firsts" in their field. These individuals are responsible for attaining goals that opened doors for those who come behind them. In addition, we hope the "pioneers" we have identified encourage our workforce to "stay the course", improving retention statistics. Loretta Hall is a freelance writer and nonfiction book author. Although she has written for a variety of consumer magazines, she concentrated on civil engineering and architecture trade publications for many years. About ten years ago, her latent fascination with space exploration resurfaced, and she has since concentrated on that subject. During the past fifteen years, she has written seven books for adults and young adults, including two on architecture and three on the history and future of space travel. Her children's picture book about visiting Spaceport America was published in 2017. She is a board member of New Mexico Press Women, a Certified Space Ambassador for the National Space Society, and a member of the Historical Society of New Mexico's Speakers Bureau.

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Aug 15 - 19, 2022) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.