Okta describes Scatter Swine. Nobelium's MagicWeb. Wartime stress in the cyber underworld. LastPass security incident.

Summary

By the CyberWire staff

At a glance.

Okta on Scatter Swine, the threat actor that compromised Twilio.
Microsoft describes Nobelium's new approach to establishing persistence.
Russia's war against Ukraine has induced stresses in the cyber underworld.
LastPass discloses a security incident.
CISA adds ten entries to its Known Exploited Vulnerabilities Catalog.

Okta on Scatter Swine, the threat actor that compromised Twilio.

Group-IB called the campaign "Oktapus," since one of the threat actors' principal goals in compromising Twilio was to obtain credentials for Okta's identity and access management software. (Twilio, a widely used provider of programmable communications tools, detected the social engineering campaign on August 7th, and provided an update on the 24th.) Okta has since described the campaign, and they're tracking the threat actor as Scatter Swine. Okta has seen Scatter Swine before. "Scatter Swine has directly targeted Okta via phishing campaigns on several occasions, but was unable to access accounts due to the strong authentication policies that protect access to our applications."

Using logs provided by Twilio, Okta's security team "established that two categories of Okta-relevant mobile phone numbers and one-time passwords were viewable during the time in which the attacker had access to the Twilio console. A one-time passcode is valid for five minutes." They determined that there had been two categories of threat activity:

"A primary category...are those mobile phone numbers the threat actor searched for directly in the Twilio console." In these cases the threat actor was seeking to expand access using credentials stolen in earlier attacks.
"A secondary category...are mobile phone numbers that can be considered ‘incidental’ to the specific actions or objectives of the threat actor." That is, these were "phone numbers that may have been present in the Twilio portal during the threat actor's limited activity window. Okta's analysis reveals no indication that the threat actor targeted or used such mobile phone numbers."

Okta's account includes a lengthy discussion of the tactics, techniques, and procedures Scatter Swine used, and these are interesting for what they reveal about the conduct of a social engineering attack, about the way in which intelligent use of phishbait and convincing voice imposture combine with commodity phishing kits to harvest user credentials. They also include advice on how an organization can protect itself. Among the sound pieces of counsel is one worth particular attention: "Use Behavior Detection to act (via step-up authentication) or alert (via System Log) when a user’s sign in behavior deviates from a previous pattern of activity. This threat actor is almost always attempting to authenticate from a new device and new IP that has no previous association with the user."

Proactively address your attack surface risks.

The recent boom in cyber-attacks is a reminder that we face increasingly sophisticated malicious adversaries. This can make understanding the risks to your attack surface feel overwhelming. Not to worry! Read our latest e-book to learn what approaches your organization can take to manage your attack surface and better protect your organization from adversaries.

Microsoft describes Nobelium's new approach to establishing persistence.

Microsoft researchers have described how Nobelium, the Russian state threat actor more commonly known as Cozy Bear, that is, the SVR foreign intelligence service, maintains persistence in compromised environments. Nobelium is engaged in cyberespionage, "executing multiple campaigns in parallel targeting government organizations, non-governmental organizations (NGOs), intergovernmental organizations (IGOs), and think tanks across the US, Europe, and Central Asia." It's deploying a new toolkit Microsoft calls "MagicWeb" to maintain persistence in the face of attempts to evict it from compromised networks. "MagicWeb is a malicious DLL [dynamic link library] that allows manipulation of the claims passed in tokens generated by an Active Directory Federated Services (AD FS) server. It manipulates the user authentication certificates used for authentication, not the signing certificates used in attacks like Golden SAML."

As is so often the case, MagicWeb depends upon highly-privileged stolen credentials and lateral movement for its installation. Once installed, it subverts authentication by manipulating "the claims passed in tokens generated by an Active Directory Federated Services (AD FS) server. It manipulates the user authentication certificates used for authentication, not the signing certificates." Microsoft concludes its advisory with some guidelines for hunting MagicWeb infestations, and it strongly recommends that organizations accord AD FS servers appropriate protection. "It’s critical to treat your AD FS servers as a Tier 0 asset, protecting them with the same protections you would apply to a domain controller or other critical security infrastructure."

Is your company passionate about empowering women to succeed in the cyber security industry?

The CyberWire’s Women in Cybersecurity reception is returning this fall. Support the premiere networking event that highlights and celebrates the value and successes of women in the cybersecurity industry. Leaders from the private sector, academia, and government from across the region and at varying points on the career spectrum can connect with each other to strengthen relationships while building new ones. Consider sponsoring the event. Limited sponsorships are available. View our available sponsorships and benefits.

Russia's war against Ukraine has induced stresses in the cyber underworld.

An essay in the New Statesman describes the ways in which the special military operation has produced "fissures" in the criminal precincts of the dark web. The report cites observations by researchers at security firm ZeroFox, whose Adam Darrah says that the “code of criminality,” which had generally governed behavior in Russophone fora, had been stressed to the breaking point by the war. The usages of that code had effectively said, Darrah explained to the New Statesman, that “you’re not allowed to develop tools, or sell embarrassing information, that could hurt any nation in the CIS [Commonwealth of Independent States, a group made up of former Soviet republics].” The gangs had operated under a modus vivendi guaranteed by Russian official toleration and protection, but Conti's public declaration for the cause of Russia in the early days of the war fractured the consensus under which the criminal gangs had conducted business. Criminals have intensified their activities, and that activity increasingly mirrors the political conflicts in the open, above-ground world.

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

LastPass discloses a security incident.

LastPass, whose password manager is widely used by both individuals and organizations, disclosed yesterday that an unauthorized party accessed a portion of the company's development environment. The intruder gained access through a compromised developer account and was able to take "portions of source code and some proprietary LastPass technical information." LastPass says its customers' accounts remain secure, and that its services are operating normally. The company says it's contained the incident, is working on mitigation, and will keep its customers apprised of developments. Proper caution would advise enabling multifactor authentication on LastPass accounts, if you haven't already done so.

CISA adds ten entries to its Known Exploited Vulnerabilities Catalog.

The US Cybersecurity and Infrastructure Security Agency (CISA) yesterday added ten new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation in the wild. The new additions, which US Federal Civilian Executive Agencies have until September 15th to search for and remediate, are:

CVE-2022-26352. "dotCMS ContentResource API contains an unrestricted upload of files with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution."
CVE-2022-24706. "Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges."
CVE-2022-24112. "Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution."
CVE-2022-22963. "When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources."
CVE-2022-2294. "WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability which allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome."
CVE-2021-39226. "Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss."
CVE-2021-38406. "Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution.The impacted product is end-of-life and should be disconnected if still in use."
CVE-2021-31010. "In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions."
CVE-2020-36193. "PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux."
CVE-2020-28949. "PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux."

As usual, the remediation guidance is to apply the vendor's updates. It's a large number of additions, and brings the number of entries in the Catalog to more than eight hundred. Michael Assraf, CEO & Co-founder of Vicarius, wrote to comment on how the Catalog is shaping up. “What’s interesting about this batch of vulnerabilities added to the catalog is not the quantity (although ten is quite a lot) but the fact that 70% of them are in open-source projects. Perhaps alarming considering, for example, that over 10,000 clients in over 70 countries around the globe use dotCMS, one of the vendors in this new batch."

Notes.

Today's issue includes events affecting China, the Dominican Republic, the European Union, India, Kazakhstan, the Democratic Peoples Republic of Korea, the Republic of Korea, Kyrgyzstan, Pakistan, Russia, Taiwan, Tajikistan, Ukraine, the United Kingdom, the United States, and Uzbekistan.

Dateline

Ukraine at D+183: Russia seeks more troops. (CvyberWire) As Russia's Defense Minister says the special military operation's optempo has been deliberately reduced for humanitarian reasons, President Putin issues a decree calling for 137,000 more troops. A nuclear accident at Zaporizhzhia has been narrowly averted, for now, and observers see fissures in what had been (by criminal standards) a relatively collegial Russophone cyber underworld.

Russia-Ukraine war: List of key events, day 184 (Al Jazeera) As the Russia-Ukraine war enters its 184th day, we take a look at the main developments.

Russia-Ukraine war: European support for Ukraine at risk due to energy crisis, says German ambassador – live (the Guardian) Germany’s representative to the UK says public support for Ukraine could diminish due to Putin ‘using gas as a weapon’

Zelenskiy says crisis averted as Russian-held Ukraine nuclear plant regains power (Reuters) President Volodymyr Zelenskiy said the world narrowly avoided a radiation disaster on Thursday as the last regular line supplying electricity to Ukraine's Russian-held Zaporizhzhia nuclear power plant was restored hours after being cut.

Ukraine war: Europe 'one step away from nuclear disaster', warns Zelensky (The Telegraph) Volodymyr Zelensky said the world narrowly avoided a radiation disaster as electricity to the Zaporizhzhia nuclear power plant was cut for hours because of Russian shelling in the area - allegations that Moscow denied.

Putin orders Russian military to beef up forces by 137,000 (AP NEWS) Russian President Vladimir Putin on Thursday ordered the Russian military to increase the number of troops by 137,000 to a total of 1.15 million amid Moscow’s military action in Ukraine.

Putin Orders a Sharp Expansion of Russia’s Hard-Hit Armed Forces (New York Times) The decree suggests that President Vladimir V. Putin expects a prolonged war in Ukraine, but he stopped short of full mobilization, and it was not clear how the military would reach his goal.

Putin Orders Russian Army to Expand as Battlefield Failures, Corruption Roil the Military (US News and World Report) The decree does not say how the Russian military should increase recruitment at a time its military is suffering from dramatic casualty rates in Ukraine – in part of its own making.

Ukraine recaptures territory larger than Denmark from Russian invaders (The Telegraph) Moscow has lost 17,375 square miles since March 21, the date of Russia's deepest advance into Ukraine

International Army Games makes a ‘mockery’ of Russian troops in Ukraine (The Telegraph) Critics accused military leaders of wasting valuable resources on the Olympics -style event and said it was ‘a feast in a time of plague’

Restraining Russian Ransomware (Foreign Policy Research Institute) Last May, Americans up and down the East Coast waited in long lines for gas. The panic wasn’t caused by a foreign war or sanctions—it was triggered by a

How the war in Ukraine is reshaping the dark web (New Statesman) As the war drags on, cracks are forming in the digital underworld

Enemy hackers attack Ukraine more than a thousand times since Feb 24 (Interfax-Ukraine) During the active military operations, the government response team to computer emergency events of Ukraine CERT-UA, operating under the State Service of Special Communications and Information Protection, registered 1,123 cyber attacks.

Organisations changing cyber strategy in response to war in Ukraine (SecurityBrief Australia) Nearly two-thirds suspect their organisation has been either directly targeted or impacted by a nation-state cyberattack.

The Disturbing Return of the Fifth Column (Foreign Affairs) How enemies within—real and imagined—are influencing geopolitics.

‘Vampire’ to transform Ukraine pickups into deadly missile launchers (Defense News) The L3Harris-made Vampire will be included in the nearly $3 billion in aid announced Wednesday.

Is the US mission to support Ukraine getting a named operation? (Military Times) Will Ukraine support be given its own Operation XYZ?

Putin might just win his giant bet against a fractured West (The Telegraph) European leaders now face the unenviable task of persuading their voters that the economic distress they will suffer is a price worth paying

Are sanctions on Russia working? (The Economist) The lessons from a new era of economic warfare

Russia divestment promises by US states largely unfulfilled (AP NEWS) Driven by moral outrage over Russia’s invasion of Ukraine earlier this year, U.S. governors and other top state officials made it clear: They wanted to cut their financial ties with Russia. A few states quickly followed through.

Attacks, Threats, and Vulnerabilities

Cyberattack Raises Pressure on European Water Providers During Drought (Wall Street Journal) A cyberattack on a British company that supplies drinking water to 1.6 million customers has raised security concerns about the vulnerability of such utilities across drought-stricken Europe.

Hackers adopt Sliver toolkit as a Cobalt Strike alternative (BleepingComputer) Threat actors are dumping the Cobalt Strike penetration testing suite in favor of similar frameworks that are less known. After Brute Ratel, the open-source, cross-platform kit called Sliver is becoming an attractive alternative.

Automatic Execution of Code Upon Package Download on Python Package Manager (Checkmarx.com) A worrying feature in pip/PyPi allows code to automatically run when developers are merely downloading a package. Also, this feature is alarming due to the fact that a great deal of the malicious packages we are finding in the wild use this feature of code execution upon installation to achieve higher infection rates.

Threat Assessment: Black Basta Ransomware (Unit 42) Black Basta is ransomware as a service (RaaS) that first emerged in April 2022. However, evidence suggests that it has been in development since February. The Black Basta operator(s) use the double extortion technique, meaning that in addition to encrypting files on the systems of targeted organizations and demanding ransom to make decryption possible, they also maintain a dark web leak site where they threaten to post sensitive information if an organization chooses not to pay ransom.

MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone (Microsoft Threat Intelligence Center (MSTIC)) Microsoft security researchers have discovered a post-compromise capability we’re calling MagicWeb, which is used by a threat actor we track as NOBELIUM to maintain persistent access to compromised environments.

Microsoft Uncovers New Post-Compromise Malware Used by Nobelium Hackers (The Hacker News) Microsoft has uncovered "MagicWeb," a new "highly targeted" post-exploitation malware used by Nobelium APT hackers to gain persistent access.

Microsoft: Russian hackers gain powerful 'MagicWeb' authentication bypass (ZDNET) Isolate your Active Directory Federation Server, because the Kremlin's top hackers prize them for authentication after compromising a target's network.

Researchers Uncover Kimusky Infra Targeting South Korean Politicians and Diplomats (The Hacker News) Researchers uncover malware and infrastructure of North Korean Kimusky hackers targeting South Korean politicians and diplomats.

Quantum ransomware attack disrupts govt agency in Dominican Republic (BleepingComputer) The Dominican Republic's Instituto Agrario Dominicano has suffered a Quantum ransomware attack that encrypted multiple services and workstations throughout the government agency.

Notice of Recent Security Incident (The LastPass Blog) We have no evidence that this incident involved any access to customer data or encrypted password vaults. Our products and services are operating normally.

LastPass Says Source Code Stolen in Data Breach (SecurityWeek) Password management software firm LastPass has suffered a data breach that led to the theft of source code and proprietary technical information.

LastPass developer systems hacked to steal source code (BleepingComputer) Password management firm LastPass was hacked two weeks ago, enabling threat actors to steal the company's source code and proprietary technical information.

Detecting Scatter Swine: Insights into a relentless phishing campaign (Okta Security) Summary Twilio recently identified unauthorized access to information related to 163 Twilio customers, including Okta.

Twilio hackers hit over 130 orgs in massive Okta phishing attack (BleepingComputer) Threat analysts have discovered the phishing kit responsible for thousands of attacks against 136 high-profile organizations that have compromised 9,931 accounts.

Twilio says breach compromised Authy two-factor app users (TechCrunch) Hackers gained access to the accounts of 93 Authy users and registered additional devices.

How Are Ransomware Groups' Shakedown Tactics Evolving? (Bank Info Security) The latest edition of the ISMG Security Report discusses how ransomware groups continue to refine their shakedown tactics and monetization models, highlights from

LockBit ransomware accuses Entrust for DDoS attacks against leak sites and showed proof that may make you smile also (The Tech Outlook) A distributed denial-of-service (DDoS) attack that appears to have been undertaken in retaliation to the cybercriminals disclosing data they had obtained from security firm Entrust has put the leak website of the LockBit ransomware operation offline. Entrust began notifying consumers about the incident on July 6, after it was detected on June 18. The attack …

Scripting Attacks on E-Commerce Sites Hit Ally Bank Accounts (Gov Info Security) Cyber criminals are running scripting attacks on e-commerce sites that attempt to complete small payments by automatically inputting payment card numbers based on

Websites Can Identify If You’re Using iPhone’s New ‘Lockdown’ Mode (Vice) Lockdown Mode disables a series of features that can be used to hack iPhone users. But the lack of these features also makes it easier to figure out who is using Lockdown Mode.

Leaked Docs Show Spyware Firm Offering iOS, Android Hacking Services for $8 Million (SecurityWeek) Leaked documents appear to show a spyware firm offering Android and iOS exploits and other services for $8 million.

Alleged cyber attacks on MLA Leela Aheer's Facebook accounts lead to RCMP investigation (CBC) Aheer wrote on Twitter that her Facebook accounts had been hacked and were "being used for sexual exploitation."

NHS Cyber Attack, August 2022: What's the Fallout? (Axio) Hear from Axio’s Brendan Fitzpatrick, CISSP, CRISC on the fallout, and what you must know for your own cyber risk plan.

Cyber-Attack Disrupts Public Services in Fremont County, Colorado (The National Law Review) Government offices and public services in Freemont County, Colorado, have been disrupted since August 17, 2022, due to a &ldquo;cybersecurity event affecting our county computer systems.&rdquo; As

911 ring times double during JSO cyber attack, not related according to representative (Action News Jax) the average ring time jumped to 22 seconds and then 40 seconds on Sunday when the city’s network issues prompted the JSO to shut down parts of its computer system used by dispatchers

Security Patches, Mitigations, and Software Updates

Palo Alto warns of firewall vulnerability used in DDoS attack on service provider (The Record by Recorded Future) Palo Alto Networks is urging customers to patch a line of firewall products after finding that the vulnerability was used in a DDoS attack.

FATEK Automation FvDesigner (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: FATEK Automation Equipment: FvDesigner Vulnerability: Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability may allow remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of the FvDesigner software tool are affected:

Instagram sets new users under 16 to restrictive content setting (TechCrunch) Instagram is updating a critical set of features that will now default users under the age of 16 to the app's most restrictive content setting.

Trends

NCC Group Monthly Threat Pulse - July 2022 (Mynewsdesk) The ransomware threat scene continues to evolve following the disbanding of Conti, as ransomware attacks rose from 135 in June to 198 in July, representing a...

2022 Trustwave SpiderLabs Telemetry Report (Trustwave) As organizations go about their regular routine of finding and adding new technologies to help increase their overall success, each organization must keep in mind the security implications of each move, along with the fact that much of their current technology stack has to be maintained with a well-thought out and quickly implemented patching program.

As governments shun ransomware payments, cyberattacks may cost taxpayers even more (The Hill) Nearly half of the world’s government entities paid ransom in 2021.

Marketplace

Cyberstarts Closes $60M in Seed Fund III (Dark Reading) Venture firm hires former Splunk CEO to spearhead new GTM advisory board and help portfolio companies scale up.

Johnson Controls Invests in Nozomi Networks and Signs Framework Agreement for Providing Nozomi Networks Cybersecurity Services (Johnson Controls) Investment reinforces Johnson Controls' commitment to best-of-breed cybersecurity for smart buildings, facilities automation and managed services

Security company Tufin completes acquisition, makes layoffs (Boston Business Journal) An Israeli-Boston security company that was acquired by a software-focused private equity firm completed its acquisition today by Turn/River Capital in a deal valued at approximately $570 million.

Flashpoint Approved As DOD SkillBridge Provider, Will Help Service Members Transition to Civilian Work (Business Wire) Flashpoint, the globally trusted leader in actionable intelligence, today announced that it is now an authorized provider of the Department of Defense

QuintessenceLabs Chosen as Inaugural Member of the Quantum Security Alliance (PR Newswire) QuintessenceLabs, an industry leader in quantum cybersecurity, today announced it has been named the first private-sector member of the Quantum...

Huawei founder sparks alarm in China with warning of ‘painful’ next decade (the Guardian) Ren Zhengfei writes in leaked memo that ‘chill will be felt by everyone’ and company must focus on survival

Embattled spyware firm becomes ‘cautionary tale’ for industry (The Hill) The embattled Israeli spyware firm NSO Group is replacing its CEO and cutting 13 percent of its workforce as it tries to recover from being blacklisted by the U.S. government. Experts say the…

Sonatype Names Mitchell Johnson as Chief Product Development Officer (Sonatype) Sonatype bolsters its leadership team with the addition of Mitchell Johnson as Chief Product Development Officer.

AttackIQ Strengthens Leadership Team with Appointment of John Brown as Head of Global Channel (PR Newswire) AttackIQ®, the leading independent vendor of Breach and Attack Simulation (BAS) systems, today announce the appointment of John Brown as Head...

Products, Services, and Solutions

Adding the Save in 1Password button to your website just got way easier (1Password Blog) You can now add the Save in 1Password button to your website without anyone from 1Password getting involved with the process.

Coinbase, whose CEO called most politics a 'distraction', launches voter registration tool (Cointelegraph) Coinbase's voter registration tool is part of an initiative to get the crypto community engaged in policy discussions.

Kaspersky and Microsoft partner to deliver Threat Intelligence to Microsoft Sentinel users (ANI News) New Delhi [India], August 25 (ANI/Bloomingdale): Kaspersky Threat Data Feeds are now integrated with Microsoft Sentinel, a cloud-native SIEM and SOAR solution to help Microsoft Sentinel users with actionable context for attack investigation and response. With this integration, enterprise security teams can extend cyber threat detection capabilities and increase the effectiveness of initial alert triage, threat hunting or incident response.

MOXFIVE Partner Ecosystem Achieves Key Milestone Further Scaling Its P (PRWeb) MOXFIVE, a technical advisory firm specializing in cybersecurity and information technology, announced a key milestone of the MOXFIVE Partner Ecosystem eclipsin

AWS Preps ‘Bastion’ Cloud Service for Advertisers (The Information) Amazon Web Services is preparing to unveil a cloud service to help companies improve the way they target ads to potential customers without violating data privacy laws, according to three people with knowledge of the product. The move comes as advertisers try to recover from, and get ahead of, ...

Technologies, Techniques, and Standards

How U.S. Cyber Command, NSA Are Defending Midterm Elections: One Team, One Fight (U.S. Department of Defense) With 75 days until the midterm elections, the Defense Department is fully engaged to defend the U.S. electoral system from foreign interference and foreign influence alongside interagency partners.

US 'actively defending against foreign interference and influence' in midterms, Cyber Command says (CNN) US military and intelligence officials are stepping up their efforts to defend the electoral process from foreign hacking and disinformation as the November midterms approach, officials said Thursday.

Cyber Command, NSA tout election security group ahead of midterms (The Record by Recorded Future) U.S. Cyber Command and National Security Agency officials on Thursday said their joint election security task force is already engaged in keeping the upcoming midterm elections free from foreign interference by adversaries like Iran, China and Russia.

Five years to zero trust: Pentagon has 'no choice' but to sprint toward network goals (Breaking Defense) “I can tell you at DoD, we’re taking this very seriously,” DoD CIO John Sherman said. “And we are committed to implementing zero trust at scale for our four-million-person-plus enterprise that we lead.”

TEFCA promises true data interoperability, but industry must address security challenges (MedCity News) There’s no doubt that a full rollout of Trusted Exchange Framework and Common Agreement (TEFCA will save lives and improve patient care and outcomes. Challenges remain, however, centered on how to maintain data privacy and security as the number of electronic connections increases exponentially among data networks.

PCI DSS v4.0 is Coming: Here’s How to Achieve Compliance (PerimeterX) In March, the Payment Card Industry Security Standards Council published Payment Card Industry Data Security Standard (PCI DSS) Version 4.0 to address emerging threats and market changes. PCI DSS v4.0 is set to go into full effect in March 2025, replacing PCI DSS Version 3.2.1. Learn how this will impact your business and what you can do to achieve compliance.

How a threat-informed defense delivers the visibility security teams need (SC Media) Here’s how a threat-informed defense can help the team leverage its security tools.

Meta makes the case for creating a privacy red team (IT World Canada) 'Offensive security' in the form of a security red team is a capability that some IT leaders have created in their organizations to test the protection of their IT environment. But what about 'offensive privacy? Why not create a privacy red team? Scott Tenaglia, engineering manager of Meta's privacy red team thinks it's time more

What is doxing and how to protect yourself (WeLiveSecurity) Doxing can happen to anyone – here’s how you can reduce the odds that your personal information will be weaponized against you.

Design and Innovation

China's Baidu reveals its first quantum computer called Qianshi (Reuters) Chinese search engine giant Baidu Inc revealed its first quantum computer on Thursday and is ready to make it available to external users, joining the global race to apply the technology to practical uses.

Legislation, Policy, and Regulation

Taiwan Is Ground Zero for Disinformation—Here’s How It’s Fighting Back (Wall Street Journal) Chinese disinformation campaigns against Taiwan are being countered by the island’s nimble fact-checking groups, which find and debunk what they identify as disinformation before it spreads too widely.

Chemical Sector Next in Line for White House Plan to Incentivize Cybersecurity (Nextgov.com) Operators of chemical facilities will follow those of electric utilities, gas pipelines and water treatment plants in being asked to facilitate visibility into their systems.

NSTAC Urges CISA Action to Boost Security of Feds’ OT Systems (MeriTalk) The National Security Telecommunications Advisory Committee (NSTAC) voted on August 23 to approve a report recommending that the Cybersecurity and Infrastructure Security Agency (CISA) issue an order requiring all Federal civilian agencies to catalog all of their operational technology (OT) devices and systems as one of many steps to improve OT cybersecurity in government and the private sector.

FTC Proposes Change in Regulation, Enforcement of Data Collection and Security (cyber/data/privacy insights) Key Takeaways On August 11, 2022, the Federal Trade Commission announced an advance notice of proposed rulemaking (ANPR) to initiate a process that would allow it to develop and enforce rules on what the FTC has termed “commercial surveillance,” which it broadly defines as the “collection, aggreg

DHS Eyes Cybersecurity Self-Assessments for Vendor Base; Ken Bible Quoted (Executive Gov) The Department of Homeland Security is working on a rule that would allow contractors to evaluate their compliance with cybersecurity requirements through self-assessments instead of implementing a program that relies on third-party assessors, Federal News Network reported Wednesday.

Litigation, Investigation, and Law Enforcement

Nato investigates hacker sale of missile firm data (BBC News) Hackers are selling classified documents online after obtaining data belonging to missile maker MBDA.

CPJ joins letters urging U.S. government to hold NSO Group accountable on spyware (Committee to Protect Journalists) The Committee to Protect Journalists joined human rights and press freedom organizations in separate actions in August urging the United States government to hold NSO Group accountable for providing Pegasus spyware to governments that have used the tool to secretly surveil journalists around the world. In a joint letter to Acting Solicitor General Brian Fletcher...

An Instagram Sextortionist Tricked 30 Boys Into Sharing Intimate Photos, FBI Says. One Took His Own Life (Forbes) Sextortion, in which explicit imagery of victims is used to blackmail them, is spiking across America, much of it targeting teenage boys on Instagram and Snapchat.

Coinbase Security Issues Persist Despite Regulatory Intervention, Lawsuit Claims (The Recorder) A lawsuit filed in San Francisco federal court Tuesday alleges that security issues persist despite Coinbase paying “large fines” to regulators for prior vulnerabilities. Matthew Borden, of BraunHagey & Borden, said a law passed in 1978 could be the answer to address the new waves of fintech institutions.

Judge OKs Robinhood $20M data breach settlement (Compliance Week) Online stock trading platform and broker-dealer Robinhood Financial moved closer to paying $20 million as part of a class-action settlement with thousands of customers whose accounts were allegedly accessed by unauthorized users.

Scans of Students’ Homes During Tests Are Deemed Unconstitutional (WIRED) An Ohio judge ruled that such surveillance to prevent cheating could form a slippery slope to more illegal searches.

Twitter Ordered to Give Musk Additional Bot Account Data (SecurityWeek) A judge told Twitter to surrender more data to Elon Musk on fake accounts, a key issue the billionaire is using to try to cancel his buyout bid.

Pinterest is facing a civil rights investigation in California (Protocol) California’s Civil Rights Department has reached out to former Pinterest employees, including whistleblower Ifeoma Ozoma, as possible witnesses.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

WiCyS Book Club (Virtual, Sep 12, 2022) Join us on September 17 at 12pm CT for the first WiCyS Book Club meeting! The WiCyS Book Club is about creating the space in our hectic lives to connect as a community and bring diverse perspectives into a lively discussion about pre-selected books. This book club meets bi-monthly and will review various cybersecurity and privacy-related books. Meeting Date/Time: September 17 at 12pm CT Book: Cyber Privacy: Who Has Your Data and Why You Should Care by April Falcon Doss About the Book: You shouldn't have to be a privacy expert to understand what happens to your data. In Cyber Privacy, Doss demystifies the digital footprints we leave in our daily lives and reveals how our data is being used - sometimes against us - by the private sector, the government, and even our employers and schools. Attend the meeting for a discussion about the book and how these issues impact our lives! REGISTRATION IS REQUIRED. After registering, you will receive a confirmation email containing information about joining the meeting.

FAIR Conference 2022 (Washington, and virtual, DC, USA, Sep 27 - 28, 2022) The 2022 FAIR Conference (FAIRCON22), the premiere, global, quantitative risk management conference, will be held on September 27 & 28 (Tues. and Wed.) at the Mandarin Oriental Hotel in Washington, D.C. one of the city’s top hotels that is adjacent to both the Mall and the vibrant new Wharf district. The hybrid conference will also be streamed live virtually so that all members can attend. Hosted by the FAIR Institute and support by our sponsors, the FAIRCON22 brings together thought leaders in cyber and operational risk management to explore best FAIR practices that produce greater value and alignment with business goals. The premiere global risk management conference will provide ground-breaking keynote addresses, engaging C-suite panels, and expert case study sessions.

Machine Identity Management Summit 2022 (Virtual, Oct 11 - 13, 2022) The Machine Identity Management Summit is where today’s security leaders come together to talk about safeguarding tomorrow’s hyperconnected world. It’s the must-see industry event of 2022, showcasing the latest trends in machine identity management and unveiling the best ways to capitalize on zero trust security in your enterprise

CybertechNYC (New York, New York, USA, Nov 15 - 16, 2022) Cybertech has been the cyber industry’s leading networking platform for the past decade, holding inspiring and fascinating industry-related events around the globe. Cybertech conferences are the go-to place to create new business, cultivate futures, nurture connections, and learn about the latest technology innovations and solutions to challenges present in the current Cyber Era. This November 2022, Cybertech is proud to host its event in New York City at the famed Javits Center. This event, which will focus on innovation and the future of cyber, will bring together prominent cyber leaders, both from the New York City cyber ecosystem and around the globe. At the conference, attendees will hear from top executives, government officials, and leading decision-makers, from a wide array of sectors, including critical infrastructure, insurance, retail, medtech, government, defense, R&D, manufacturing, automotive, and much more.

CybertechGlobal Tel Aviv (Tel Aviv, Israel, Jan 30 - Feb 1, 2023) Cyber is all around us—it is one of the most trending topics in the tech and business arenas. It is a whole-encompassing industry that is not only about threats, but also covers the scope of digitalization and opportunities in the realm of innovation. From Tel Aviv and Rome, to Tokyo, Singapore, Panama, and more, Cybertech is the cyber industry’s foremost B2B networking platform conducting industry-related events all around the globe. Our conferences and exhibitions serve as the go-to place to make business happen and learn all about the latest technological innovations, challenges, and solutions to combating threats within the global cyber arena. Cybertech events feature top executives, government officials, leading decision-makers from a wide range of sectors including critical infrastructure, insurance, retail, health and government, defense, R&D, manufacturing, automotive, and more! Multinational corporations, startups, private and corporate investors, venture capital firms, experts, and clients—come and meet all the key players from the cyber industry and be immersed in everything there is to offer. Cyber. We live it. Breathe it. All at the forefront of global innovation.

Events

13th Annual Billington Cybersecurity Summit (Washington, DC, USA, Sep 7 - 9, 2022) The world's leading government summit on cybersecurity will continue its unique educational mission of convening the who's who in cybersecurity: the senior leadership from the U.S. government, our allied partners, and their industry and academic partners. Given the fast moving strategic direction that the Biden Administration has generated over the past year, this event will take a holistic view of the cybersecurity business with a hearty dose of topics covering Zero Trust, proactive cyber defense measures, partnership building, offensive cyber, and a continued look at what the future will bring to the cybersecurity mission. Once again, Billington will play host to the Federal Government's most senior cyber and IT managers and experts, some of the most innovative cybersecurity providers in the business, and a broad range of expertise from across the public and private sectors. Like the past Billington events, we expect groundbreaking news and a content rich discussion focused on lessons learned, best practices, and things to consider as you build and enhance your own cybersecurity programs.

Hack Red Con 2022 (Louisville, Kentucky, USA, Sep 7 - 11, 2022) Hack Red Con 2022 is a Cyber Security Conference, Training and Networking 4 day event with an emphasis on Red Teaming, Pen Testing, Social Engineering, and all aspects of Off Sec. The Conference aims to connect Off Sec Professionals, Companies, Educators, Influencers, Investors, Entrepreneurs and Federal, State, Local Government Agencies together. This 4 day event will have 2 intense training days of the latest in Off Sec Education by the industries top hackers and industry experts. The following 2 conference days will include world class key note speakers, industry talks, roundtables, events including Hack the Flag, Jeopardy and Kentucky Bourbon, Lock Hack Challenges, Hack Career Meet & Great, Invest in Cyber, and of course the sickest Swag and Gear Giveaways.

SASE Converge 2022 (Virtual, Sep 13 - 14, 2022) The concept of work has been completely transformed. It is no longer a location, but an activity. This new era of hybrid work means a new generation of never-before-seen threats. Is your network ready? To succeed in this new world, we need to reimagine our infrastructure to support the flexibility demanded by the modern workforce - without compromising security or user experience. ZTNA 2.0 provides you a critical first step in accomplishing a successful SASE deployment and unlocking this next phase of growth for your organization. Join us at SASE Converge 2022 to learn from industry experts about the latest trends and innovations in SASE, so you can lead the transformation of your infrastructure with confidence.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.