Iranian cyber ops against Israel. Wipers and cyberespionage at war. Cyber war clauses becoming mandatory. BlackByte 2.0.

Summary

By the CyberWire staff

At a glance.

Iran suspected of cyber operations against four Israeli sectors.
Wipers as a tool in hybrid war.
A scorecard for Russian cyber ops during the special military operation.
Cyber war clauses coming to cyber insurance policies.
BlackByte is back, and calling itself BlackByte 2.0.

Iran suspected of cyber operations against four Israeli sectors.

Mandiant reports that UNC3890, "a cluster of activity targeting Israeli shipping, government, energy and healthcare organizations via social engineering lures and a potential watering hole," is playing a role in the low-level naval conflict currently observed between Iran and Israel. The attribution of UNC3890 to Iran is in part circumstantial, but Mandiant advances that attribution with "moderate confidence." The evidence falls into four categories:

Linguistic. UNC3890 developers use Farsi words in their strings.
Targeting. A focus on Israeli targets is consistent with Iranian interests.
Program database (PDB) path. This is the same as has been observed in activity by UNC2448, attributed to the Islamic Revolutionary Guard Corps (IRGC), which itself is linked to APT35 (Charming Kitten).
C2 framework. UNC3890 uses the NorthStar C2 Framework, which has been an Iranian favorite.

The threat actor's initial approach has typically been via social engineering. Its interests seem so far to have involved intelligence collection, but this could be used in subsequent operations that go beyond espionage. "While we believe this actor is focused on intelligence collection," Mandiant says, "the collected data may be leveraged to support various activities, from hack-and-leak, to enabling kinetic warfare attacks like those that have plagued the shipping industry in recent years."

Free Guide | 5 Critical Controls for World-Class OT Cybersecurity

As operational technology (OT) cybersecurity becomes a top priority from boardrooms to the manufacturing floor, CISOs and their teams must implement proven strategies to protect the business. Download this free guide and discover the components to align your leadership and implement a successful operational technology (OT) security posture. Download now →.

Wipers as a tool in hybrid war.

VentureBeat yesterday summarized expert opinion on the way in which wipers in particular have emerged as a disturbing class of malware during Russia's war against Ukraine. One of their sources, Fortinet's Global Threat Landscape Report for the first half of 2022 explained how this had come to be so, describing wiper attacks as a distinctive feature of Russian hybrid warfare. "Security researchers believe—but have not always been able to attribute with confidence—that groups aligned with Russian military goals were behind many of the wiper attacks in Ukraine during the first half of 2022," the researchers write, and then go on to inventory some of the malware used in the attacks:

"One example is CaddyWiper, a variant used to wipe data and partition information from drives on systems belonging to a limited number of Ukrainian organizations soon after the war began. Other examples include WhisperGate, a wiper that Microsoft discovered being used in attacks against Ukrainian entities in January 2022; HermeticWiper, a tool for triggering boot failures that SentinelLabs found being used in similar attacks; and IsaacWiper, a malware tool for overwriting data in disk drives as well as attached storage to make them inoperable. The three other wipers we observed in the first half of 2022 targeting Ukrainian companies and infrastructure were WhisperKill, DoubleZero, and AcidRain."

The wiper attacks were not as discriminating as one would wish a proper weapon to be, their effects spilling over into countries other than Ukraine, the intended target. AcidRain was particularly unconstrained. Wipers have been seen before, and Fortinet says that security teams can expect to see them again. "The attacks in Ukraine have shown how this malware can be used to degrade and disrupt critical infrastructure capabilities and services to support broader kinetic warfare goals. But that is not the only threat. Shamoon showed how wipers can be used as weapons of cyber sabotage, and other variants, such as NotPetya and GermanWiper from 2017, showed how adversaries can use wipers as fake ransomware to try and extort money from victims."

Become a sponsor for this year’s Women in Cybersecurity Reception!

The Women in Cybersecurity Reception is an annual networking event that highlights and celebrates the value and successes of women in the cybersecurity industry. This event brings together a group of women with diverse backgrounds to strengthen relationships, and build new ones. Contact us if your company is interested in sponsoring an event made for women that are passionate about cybersecurity. Learn More.

A scorecard for Russian cyber ops during the special military operation.

Trustwave's SpiderLabs this morning offered an overview of Russian offensive cyber operations so far in the war against Ukraine. They associate distinct threat actors with the three principal Russian security and intelligence organs: the SVR foreign intelligence service and the FSB security service (both daughter organizations of the old Soviet KGB) and the GRU military intelligence service. The associations the researchers track are as follows:

"APT28, also known as Cozy Bear or The Dukes, has ties to the Russian Foreign Intelligence Service (SVR).
"APT29, also known as Fancy Bear or Sofacy, was traced to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (Former GRU) Unit 26165.
"SANDWORM, also known as Black Energy, was tied to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (Former GRU) Unit 74455.
"DRAGONFLY, also known as Energetic Bear or Crouching Yeti, was identified as the Russian Federal Security Service (FSB) Unit 71330.
"GAMAREDON, also known as Primitive Bear or Armageddon, traced to the Russian Federal Security Service (FSB) in November 2021. The Security Service of Ukraine (SSU) successfully identified individuals behind Gamaredon confirming their ties with FSB."

The study divides Russian cyber operations into two broad categories, distinguished by their objectives. Some aim at destruction (in the present war usually destruction of data and IT capabilities) while others aim at collection, espionage. The destructive attacks began as hostilities opened on February 24th, 2022, and continued into early April. They've since abated: "Destructive attacks are meant to destroy the data and render targeted systems inoperable. According to Viasat, on February 24, the day the war started, cyberattacks against Viasat’s KA-SAT network impacted several thousand customers in Ukraine and tens of thousands across Europe. Reuters reported over 5,800 Enercon wind turbines in Germany were affected by this attack. As published by SSSCIP, on April 8, the Sandworm group attacked a Ukrainian energy provider. Fortunately, due to a timely response, only part of the IT infrastructure was affected, and significant power outages were prevented."

Cyberespionage began to intensify about a week into the war and has continued through the present. Interestingly, some of the cyberespionage has been conducted by privateers, criminal gangs operating in the interest of the Russian state: "Espionage attacks are designed to establish a foothold and exfiltrate data from targeted systems. Malware used in the attacks usually provides attackers backdoor access with webcam and microphone captures, keylogging, and the possibility to download and install additional components. Exfiltrated data includes operating system information, documents, pictures and stored passwords from web browsers and other software."

For many reasons--the inherent difficulties of offensive cyber, the need to integrate cyber into effective combined arms operations (and Russian forces have shown surprisingly little aptitude for combined arms operations), victory disease (overconfidence inspired by years of consequence-free privateering and espionage)--cyber operations haven't proven to be the war-winner for Russia that many feared they would. But that said, there are many reasons to expect cyber to remain a principal military tool in future conflicts. SpiderLabs outlines them. "Without a doubt, sophisticated cyber weapons are key tools in the arsenal of a modern military, and the amount of global cyberwarfare will likely increase in the future.

"First, with the constantly growing number of devices connected to the network, the attack surface is becoming massive, increasing the potential use cases for cyberwarfare.
"Second, cyberwarfare is not bound by the territorial constraints of conventional warfare, offering the chance to infiltrate and damage targets far behind the frontlines.
"Finally, compared to traditional warfare, cyberwarfare is invisible to the naked eye, does not risk lives on the side of the aggressor, and is cost effective."

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Cyber war clauses coming to cyber insurance policies.

Insurance Day reports that Lloyd's Marketing Association has mandated that all cyber insurance policies must, by March 31st of next year, contain an explicit clause "excluding liability for losses arising from state-backed cyber attacks." That clause would be in addition to the typical war clauses that have long excluded coverage of losses caused by action in a conventional war. The requirement for an explicit exclusion of liability for state cyber action seems to recognize the growing risk of gray zone conflict. Insurance Day quotes Lloyds as explaining, "It is important that Lloyd’s can have confidence that syndicates are managing their exposures to liabilities arising from war and state backed cyber-attacks. Robust wordings also provide the parties with clarity of cover, means that risks can be properly priced and reduces the risk of dispute. The ability of hostile actors to easily disseminate an attack, the ability for harmful code to spread, and the critical dependency that societies have on their IT infrastructure, including to operate physical assets, means that losses have the potential to greatly exceed what the insurance market is able to absorb.”

BlackByte is back, and calling itself BlackByte 2.0.

BlackByte ransomware has reappeared, BleepingComputer reports, and represents an enhanced, double-extortion threat to personal data. The gang has launched a new data dump site with a focus on individual victims. "The data leak site only includes one victim at this time but now has new extortion strategies that allow victims to pay to extend the publishing of their data by 24 hours ($5,000), download the data ($200,000), or destroy all the data ($300,000)," BleepingComputer writes. "These prices will likely change depending on the size/revenue of the victim."

BlackByte hasn't been without problems of its own. In its earlier version the gang's cryptor had flaws that permitted white hat researchers to develop and distribute a free decryptor. BlackByte closed that particular hole, and it's unknown whether they're using that improved cryptor in BlackByte 2.0. Payment seems to be a problem with the current version of the site. The Bitcoin and Monero addresses offered for victims (whom BlackByte cynically refers to as "customers") to submit payment aren't correctly embedded, which for now at least will impede collection of ransom.

Notes.

Today's issue includes events affecting Iran, Israel, NATO/OTAN, Russia, Ukraine, the United Kingdom, and the United States.

Dateline Moscow and Kyiv: Rear area combat operations, and a history of Russia's cyber campaign.

Ukraine at D+175: Rear-area threats, and an overview of Russian cyber ops. (CyberWire) Ukraine continues to demonstrate the ability to strike Russian rear areas, and Russia resumes the shelling of civilian residential areas. Wiper malware and cyberespionage as defining aspects of Russia's cyber campaign.

Russia-Ukraine war: List of key events, day 176 (Al Jazeera) As the Russia-Ukraine war enters its 176th day, we take a look at the main developments.

Ukraine war: Russia kills seven in fresh strikes on Kharkiv (The Telegraph) One person has died and 18 were wounded in pre-dawn shelling of a residential area in the eastern city of Kharkiv, Oleh Synehubov, the regional governor said.

Russia-Ukraine war latest: what we know on day 176 of the invasion (the Guardian) Russia replaces commander of Crimea-based Black Sea fleet; at least seven dead and 16 wounded in strike on Kharkiv, Ukrainian officials say

Behind Enemy Lines, Ukrainians Tell Russians ‘You Are Never Safe’ (New York Times) Clandestine resistance cells are spotting targets, sabotaging rail lines and killing those deemed collaborators as they seek to unnerve Russian forces.

Russia-Ukraine war: Zelenskiy adviser says war in deadlock; fatalities reported in attacks on Kharkiv and Mykolaiv – live (the Guardian) Russian forces have made only minimal advances, Oleksiy Arestovych claims; at least one person killed in Kharkiv and another in Mykolaiv

Russian shakes up Black Sea fleet command after series of blows in Crimea - state agency (Reuters) Russia's Black Sea fleet based in annexed Crimea has installed a new commander, RIA news agency cited sources as saying on Wednesday, after Russian military bases on the peninsula were rocked by explosions in the past nine days.

Did Putin fire Black Sea commander after massive losses? What we know (Newsweek) The Russian state-owned news agency Ria Novosti reported the news of the new commander, citing unnamed sources in the Black Sea Fleet.

‘I don’t see justice in this war’: Russian soldier exposes rot at core of Ukraine invasion (the Guardian) Exclusive: Pavel Filatyev has fled his homeland after publishing a 141-page account detailing his experiences on the frontline

‘They turned us into savages’: Russian soldier describes start of Ukraine invasion (the Guardian) In this extract from former paratrooper Pavel Filatyev’s memoir, he recalls wild looting after soldiers entered Kherson

Stop ‘cancelling’ Russians and get them on our side instead, says top Zelensky advisor (The Telegraph) Oleksiy Arestovych blames Russophobia for losing Ukraine ‘hundreds of thousands of supporters’ among disaffected citizens

Overview of the Cyber Weapons Used in the Ukraine - Russia War (Trustwave SpiderLabs) Observing the ongoing conflict between Russia and Ukraine, we can clearly see that cyberattacks leveraging malware are an important part of modern hybrid war strategy.

Russia-Ukraine cyberwar creates new malware threats (VentureBeat) Fortinet research reveals that the Russia-Ukraine cyberwar has created new wiper malware and ransomware threats.

Fortinet: Use of wipers expanding beyond Ukraine to 24 countries (The Record by Recorded Future) The use of wiper malware has expanded beyond the Ukraine conflict to 24 countries, according to research from Fortinet.

How Unmoderated Platforms Became the Frontline for Russian Propaganda (Lawfare) An overfocus on covert networks on Facebook and Twitter misses the full expanse of the propaganda strategies that often reach more users through different communication media.

Ukraine ‘testing ground’ shaping US network, electronic warfare effort (C4ISRNet) Oleksii Reznikov described Ukraine as “a testing ground,” where “many weapons are now getting tested in the field, in the real conditions of battle.”

Will They Fight? Washington Wants to Know. (Foreign Policy) The United States thought Afghans would fight and Ukrainians would fold. Reality is forcing a reassessment.

Attacks, Threats, and Vulnerabilities

Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors | Mandiant (Mandiant) New research on a suspected Iranian threat actor that's targeting Israeli shipping, government, energy, and healthcare organizations.

Iran-linked hacking group is targeting Israeli shipping, US cybersecurity firm says (Times of Israel) Attackers began threatening maritime commerce in 2020 as the Israel-Iran shadow war increasingly spilled into the sea, according to leading security company Mandiant

Iranian Group Targeting Israeli Shipping and Other Key Sectors (SecurityWeek) Mandiant has been tracking an activity cluster that it believes to be from a single Iranian threat group that has been targeting Israeli interests, especially the shipping industry.

BlackByte ransomware gang is back with new extortion tactics (BleepingComputer) The BlackByte ransomware is back with version 2.0 of their operation, including a new data leak site utilizing new extortion techniques borrowed from LockBit.

Overlooked DarkTortilla crypter is a long-term cyberthreat (Register) .NET-based malware can push wide range of malicious payloads, and evades detection, Secureworks says

'DarkTortilla' Malware Wraps in Sophistication for High-Volume RAT Infections (Dark Reading) The stealthy crypter, active since 2015, has been used to deliver a wide range of information stealers and RATs at a rapid, widespread clip.

Hackers Build Phishing Pages Using AWS Apps (Avanan) Hackers are building phishing pages by using AWS apps.

How a Third-Party SMS Service Was Used to Take Over Signal Accounts (Vice) Unknown attackers targeted Signal users after they broke into the systems of communications services company Twilio.

Worldwide crypto & NFT rug pulls and scams tracker (Comparitech) The crypto world is reported to be worth over $3 trillion with over 300 million people worldwide owning some form of crypto.

Period and pregnancy tracking apps have bad privacy protections, report finds (The Verge) Wearables have better policies.

Investigation continues in library data breach (Cascadia Daily) The Whatcom County Library System (WCLS) continues to investigate a data-security breach that compromised the personal information of an undisclosed number of library users. Some form of malware was initially suspected in a June 27 security breach of the county libraries’ computers. The county library system informed the Bellingham Public Library on July 11 that some patrons’ personal data had been downloaded from county library computers. The names, birthdates, library card numbers and PINs of 735 Bellingham library cardholders were exposed in the breach, the city said.

Medical billing vendor data breach affects more than 942,000 patients (Becker's Hospital Review) More than 942,000 patients from 28 hospitals and physician offices were affected by a data breach involving medical billing vendor Practice Resources, according to an Aug. 4 submission to the HHS Office of Civil Rights.

Security Patches, Mitigations, and Software Updates

Chrome browser gets 11 security fixes with 1 zero-day – update now! (Naked Security) Don’t delay – patch today.

Amazon quietly fixes Ring Android app bug that exposed data, camera recordings (The Record by Recorded Future) Amazon resolved a vulnerability in May that exposed the data and camera recordings of Ring app users on Android devices.

Amazon Quickly Fixed a Vulnerability in Ring Android App That Could Expose Users’ Camera Recordings (Checkmarx.com) Researchers at Checkmarx found that the Ring Android app could have allowed a malicious application installed on the user’s phone to expose their personal data, geolocation, and camera recordings.

Trends

Global Threat Landscape Report: A Semiannual Report by FortiGuard Labs (Fortinet) Another half-year through unprecedented times has passed. But as unique as these times may feel, we continue to see familiar exploits, names, and attacks taking up space. To help you and your business feel confident in your ability to protect yourself against the threats that continue to come our way, this report looks back on the cyber threat landscape of the first half of 2022 using our global array of sensors monitored by FortiGuard Labs.

Healthcare Breaches Costliest for 12 Years Running, Hit New $10.1M Record High (Security Intelligence) The 2022 Cost of a Data Breach Report revealed the healthcare industry as the sector experiencing the costliest data breaches — more than $10 million in average breach costs.

Sifting Through Digital Exhaust - Cyber Physical Threats (Constella Intelligence) How Your Life Events Invite Cyber & Physical Threats

Sifting Through Digital Exhaust Part 2: Remove Exposed Data (Constella Intelligence) Part 2: How to remove much of your exposed data from the web, opt-out of tracking, keep tabs on your PII, and how this data can be used against you.

2022 State of the API Report (Postman) The 2022 State of the API report covers the largest and most comprehensive survey on APIs, ever. More than 37,000 developers and API professionals shared their thoughts.

The UK Regions Most And Least Impacted By Cybercrime In 2022 |… (Hicomply) Hicomply is a software platform that gives you the tools to build your information security management system as well as protect your business data.

Marketplace

Wavenet Acquires Cyber Security Vendor OGL (UC Today) UC Today reports on the latest technology news from around the globe. Read similar Unified Communications news to 'Wavenet Acquires Cyber Security Vendor OGL' here

Malwarebytes Cuts 125 Employees as per Strategic Reorganization Plan (TechDator) Malwarebytes, 0ne of the well-known device security makers, confirmed laying off about 14% of its global workforce, about 125 employees.

Santa Clara-based cybersecurity startup Malwarebytes is cutting 125 jobs (Silicon Valley Business Journal) Malwarebytes Inc. has reportedly cut 125 employees, or about 14% of its global workforce, as it shifts its business strategy.

KKR acquires cybersecurity firm Barracuda for $4bn (Totaltelecom) The deal represents a key indicator of private equity’s growing interest in cybersecurity firms,

KKR snaps up cybersecurity specialist for $4B (Mobile World Live) KKR continued to expand its portfolio of cybersecurity and fibre network assets through acquisition of Barracuda Networks.

Investing in Innovation: 9 Startups That Recently Secured $50M+ (Acceleration Economy) Snapshots of 9 startups that have recently secured $50 million or more in funding to fuel innovation in security, supply chains, and more.

Lloyd’s sets requirements for state-backed cyber attack exclusions (Insurance Day) From March 31 next year, all standalone cyber attack policies must exclude liability for losses arising from any state-backed cyber attack

Privacy protection could be the key to retention in 2023 (HR Morning) There’s a new benefit employers may want to consider offering in 2023 – privacy protection. The reason: Eighty-two percent of breaches have a human element involved, according to Verizon’s 2022 Data Breach Investigations Report. Keeping employees’ privacy safe, means keeping the company’s privacy safe. Dimitri Shelest, founder and CEO at OneRep, a privacy protection company, believes the […]

KnowBe4 Honored as Gold Stevie® Award Winner In 2022 Stevie Awards for Talent Acquisition Team of the Year (GlobeNewswire News Room) KnowBe4 has been named the winner of a Gold Stevie® Award in the Talent Acquisition Team of the Year category in the seventh annual Stevie Awards for Great...

Radiant Logic Named Winner of 1st Annual Cybersecurity Impact Award (Business Wire) Radiant Logic selected as inaugural winner of the Cybersecurity Impact Award by the Aite Novarica Group.

1Password Welcomes Security Innovator as Chief Product Officer (PR Newswire) 1Password, the human-centric security leader, today announced Steve Won as Chief Product Officer. Steve brings a wealth of experience from...

Claroty Appoints Joshua Corman as VP Cyber Safety Strategy (Claroty) Former Chief Strategist of CISA’s COVID Task Force and Founder of I Am The Cavalry to lead company’s efforts to protect public safety, human life, and national security

Products, Services, and Solutions

Introducing curated detections in Chronicle SecOps Suite (Google Cloud Blog) Curated detections for Chronicle enables security teams to use Google’s intelligence and expertise in responding to threats and cyberattacks.

Wesfarmers to stand up offensive cyber security capabilities (iTnews) Through new "Cyber Fusion Centre".

Kyndryl, EY team up for digital transformation offering (CRN Australia) Combining cloud, infrastructure expertise with consulting experience.

AttackIQ Becomes First Breach and Attack Simulation Provider to Secure Authority to Operate from the United States Army (Business Wire) AttackIQ®, the leading independent vendor of Breach and Attack Simulation (BAS) systems, today announced it has been granted a three-year Assess Only

Fujifilm Group deploys Verizon Business Group’s Advanced Security Operations Center (Verizon) Verizon Business is supporting Japan’s FUJIFILM Holdings and its subsidiaries strengthen its global cybersecurity monitoring and cyber intelligence capabilities.

Why The DIG Chose Swimlane to Transform Its Phishing Defense (Swimlane) The Digital Investigative Group (DIG) is a Managed Security Services Provider (MSSP) startup that serves local government entities and Managed Service Providers (MSPs) in Montana. As the tech bubble continues to grow there, the DIG helps these smaller businesses enhance their cybersecurity posture…

Contrast Security Adds API Support to Security Platform (DevOps.com) Contrast Security has fully extended its vulnerability scanning and runtime application self-protection (RASP) platform to now include APIs.

ManageEngine Integrates with Sectigo® to Automate Certificate Lifecycle Management (Business Wire) ManageEngine announced the integration between its key and certificate lifecycle management solution, Key Manager Plus, and Sectigo.

Technologies, Techniques, and Standards

Analysis | Mandatory password updates are passe (Washington Post) Regular password changes don't improve security, the latest thinking goes.

Council Post: To Pay Or Not To Pay: Ransomware Negotiation Tactics (Forbes) As ransomware attacks multiply, most organizations tend to respond in either of two ways—by paying the ransom, which can amount to millions of dollars, or not paying and diverting resources to recovery efforts.

New Army intel unit having big impact on recently established 'triad' (FedScoop) Army Cyber Command’s new intelligence unit blending historical military intelligence activities with commercial data and public information is providing critical insights in a rapid manner to a newly established “triad” between the service’s cyber, missile defense and special operations organizations. Last week, the Army announced this new triad between Army Cyber Command, […]

Army adding more cyber teams (FedScoop) The Army will be building two more cyber mission force teams for U.S. Cyber Command this year, according to a top official. Lt. Gen. Maria Barrett, commander of Army Cyber Command, told an audience at the TechNet Augusta conference Wednesday that the service is dedicated to beefing up the force in support […]

National Cryptologic Museum Rediscovering Artifacts Hidden Away in NSA Warehouse (National Security Agency/Central Security Service) The machine is strikingly taller and wider than nearly all of the other National Cryptologic Museum (NCM) artifacts stored inside NSA’s 281,000-square-foot storage facility, which is located just a

Academia

In Tennessee, Possible Solution to the Cyber Talent Shortage (Wall Street Journal) A partnership between East Tennessee State University and BlueCross BlueShield of Tennessee plans to graduate cyber pros in two years

Legislation, Policy, and Regulation

A high-level guide to UK prosecutorial and enforcement agencies (Lexology) It is now widely accepted that financial crime is not ‘victimless’, but rather is wrongdoing which has a pervasive detrimental effect on legitimate…

Whatever Happens Between China and Taiwan, the U.S. Needs Its Own Chips (The Information) The intentions of the People’s Republic of China toward Taiwan are clear—it intends to take possession of the island and thereby “reunify” China. U.S. House Speaker Nancy Pelosi’s visit to the island, during which she met with political leaders as well as the chair of Taiwan Semiconductor ...

DOE invests $45 million in cyber technology that protects power sector (The Hill) The Department of Energy announced on Wednesday that it is investing $45 million in cyber technology that will protect the power grid sector from cyberattacks. The investment will fund up…

FTC Kicks Off Wide-Ranging Privacy Rulemaking | JD Supra (JD Supra) The Federal Trade Commission (FTC) released an advance notice of proposed rulemaking (ANPRM) on “Commercial Surveillance and Data Security” on August...

US Army forming ‘offensively oriented’ curriculum to spur cyber skills (Defense News) The program is six months to a year from being fully operational, according to U.S. Army Maj. Gen. Paul Stanton.

How a new Army cyber general got George Patton’s stars (Army Times) The new commander of the Cyber Center of Excellence at Fort Gordon received the artifact the night before his promotion.

Litigation, Investigation, and Law Enforcement

Alleged Russian Money Launderer Extradited from the Netherlands to U.S. (U.S. Department of Justice) An alleged cryptocurrency money launderer was extradited this week from the Netherlands to the United States to face charges in the District of Oregon.

Company changes name after SEC charges 18 over pump-and-dump hacking scheme (The Record by Recorded Future) Lotus Bio-Technology Development Corp. announced on Tuesday that it is initiating a name change, following revelations that its stock was manipulated as part of a pump-and-dump scheme that involved the hack of more than 30 brokerage accounts.

Israeli Firm Cellebrite Sold Phone-hacking Tools to Uganda's Brutal Dictatorship (Haaretz) Ruling Uganda since 1986, Museveni's regime is responsible for kidnapping, torturing and murdering rights activists, opposition figures and LGBTQ people. Cellebrite: Strict oversight ensures proper use of our technology.

Rights groups ask Defense Ministry to stop sales of phone hacking tool to Uganda (Times of Israel) Human rights activists urge that Cellebrite be barred from providing its equipment to Kampala regime, claiming it is used to suppress dissidents and LGBT community

Google wins defamation battle as Australia’s high court finds tech giant not a publisher (the Guardian) Judgment rules ‘a hyperlink is merely a tool’ in case between search engine and Melbourne lawyer George Defteros

Complaint (Attorney) – #1 in HADNAGY v. MOSS (E.D. Pa., 2:22-cv-03060) (CourtListener) COMPLAINT against DEF CON COMMUNICATIONS, INC., JEFF MOSS ( Filing fee $ 402 receipt number APAEDC-16086367.), filed by J. HADNAGY CHRISTOPHER. (Attachments: # 1 Civil Cover Sheet, # 2 Case Management Track Form)(ZINGARETTI, ASHLEY) (Entered: 08/03/2022)

FTC threatens to sue firm allegedly revealing abortion clinic visits (Washington Post) A lawsuit against the agency shows how it might defend health data after the Supreme Court left states free to outlaw abortion

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

SASE Converge 2022 (Virtual, Sep 13 - 14, 2022) The concept of work has been completely transformed. It is no longer a location, but an activity. This new era of hybrid work means a new generation of never-before-seen threats. Is your network ready? To succeed in this new world, we need to reimagine our infrastructure to support the flexibility demanded by the modern workforce - without compromising security or user experience. ZTNA 2.0 provides you a critical first step in accomplishing a successful SASE deployment and unlocking this next phase of growth for your organization. Join us at SASE Converge 2022 to learn from industry experts about the latest trends and innovations in SASE, so you can lead the transformation of your infrastructure with confidence.

Techno Security & Digital Forensics Conference (La Jolla, California, USA, Oct 10 - 12, 2022) Techno Security & Digital Forensics Conference provides a unique education experience that blends the digital forensics and cybersecurity industries for collaboration between government and private sectors. The 2022 California edition of Techno Security & Digital Forensics Conference will feature educational sessions, industry-leading speakers, and sponsors/exhibits over three days of networking among cybersecurity and digital forensics industry professionals. Learn about new tools and techniques, discuss important case studies, and share insight on future trends and the current state of the industry. Educational sessions cover a wide range of topics within the following primary tracks from which CPE credits can be earned: Audit/Risk Management, eDiscovery (New!), Forensics, Information Security, Investigations, and Sponsor Demos. In addition to educational sessions, sponsoring/exhibiting companies will be on hand to introduce and demonstrate the latest products and services in the industry. Learn from industry experts, connect with leading suppliers, explore the latest tools, and network with cybersecurity and digital forensics professionals.

Techno Security & Digital Forensics Conference (Wilmington, North Carolina, USA, Jun 5 - 8, 2023) Techno Security & Digital Forensics Conference provides a unique education experience that blends the digital forensics and cybersecurity industries for collaboration between government and private sectors. The 2023 East edition of Techno Security & Digital Forensics Conference will feature educational sessions, industry-leading speakers, and sponsors/exhibits over four days of networking among cybersecurity and digital forensics industry professionals. Learn about new tools and techniques, discuss important case studies, and share insight on future trends and the current state of the industry. Educational sessions cover a wide range of topics within the following primary tracks from which CPE credits can be earned: Audit/Risk Management, eDiscovery (New!), Forensics, Information Security, Investigations, Magnet Forensics Lab, Cellebrite Lab, and Sponsor Demos. In addition to educational sessions, sponsoring/exhibiting companies will be on hand to introduce and demonstrate the latest products and services in the industry. Learn from industry experts, connect with leading suppliers, explore the latest tools, and network with cybersecurity and digital forensics professionals.

Events

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Aug 15 - 19, 2022) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps.

Insider Threat Program Development - Management Training Course (Sterling, Virginia, USA, Aug 22 - 23, 2022) This affordable, comprehensive and extremely resourceful 2 day training course will ensure the Insider Threat Program (ITP) Manager, Facilities Security Officer, Insider Threat Analyst, and others who support the ITP (CSO, CIO, CISO, IT, Network Security, Human Resources, Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing or enhancing an ITP / Working Group. Our student satisfaction levels are in the exceptional range. Over 875+ individuals have attended this training course and received ITP Manager Certificates. The class has 2 additional instructors who are the former ITP Managers for CIA and NSA.

Insider Threat Program Development - Management (Virtual, Aug 22 - 23, 2022) This affordable, comprehensive and extremely resourceful 1 day WEB BASED training course will ensure the Insider Threat Program (ITP) Manager, Senior Official, Facilities Security Officer, Insider Threat Analyst, and others who support the ITP (CSO, CIO, CISO, IT, Network Security, Human Resources, Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing or enhancing an ITP / Working Group. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended this training course and received ITP Manager Certificates. CLASS DATES: August 22 & 23 (Training Taught In 2 / 4 Hour Sessions On Different Dates).

SANS 2022 Cloud Security Exchange (Virtual, Aug 25, 2022) SANS Institute, the global leader in cybersecurity training and certifications, today announced it would be hosting its first SANS 2022 Cloud Security Exchange live online event, which will take place on August 25, 2022 at 11:00am EDT. The Cloud Security Exchange brings technical security leaders from Google Cloud Platform (GCP) and Microsoft Azure together in one forum to share their perspectives on building cloud security programs and best practices on crucial security pillars. As more organizations embrace digital transformation, security operations and architecture teams are facing new challenges.

13th Annual Billington Cybersecurity Summit (Washington, DC, USA, Sep 7 - 9, 2022) The world's leading government summit on cybersecurity will continue its unique educational mission of convening the who's who in cybersecurity: the senior leadership from the U.S. government, our allied partners, and their industry and academic partners. Given the fast moving strategic direction that the Biden Administration has generated over the past year, this event will take a holistic view of the cybersecurity business with a hearty dose of topics covering Zero Trust, proactive cyber defense measures, partnership building, offensive cyber, and a continued look at what the future will bring to the cybersecurity mission. Once again, Billington will play host to the Federal Government's most senior cyber and IT managers and experts, some of the most innovative cybersecurity providers in the business, and a broad range of expertise from across the public and private sectors. Like the past Billington events, we expect groundbreaking news and a content rich discussion focused on lessons learned, best practices, and things to consider as you build and enhance your own cybersecurity programs.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Iran suspected of cyber ops against Israel. Wipers and cyberespionage during Russia's hybrid war. Cyber war clauses becoming mandatory. BlackByte 2.0.