Cyber ops in Latin America. Greenwashing influence ops. Iranian threat actor exploits Log4j. Hybrid war in Southeast Europe.

Announcement

Call for entries: Creating Connections.

The CyberWire, in partnership with Maryland Art Place (MAP), is pleased to announce an open ‘Call to Artists’. As an extension of MAP’s annual IMPRINT Project, MAP is working with the CyberWire to offer a unique opportunity to female and female identifying visual artists of the greater Baltimore metropolitan area. Collectively, MAP and the CyberWire wish to acquire and possibly commission, time permitting, plus license the image of a work of art. The image of that artwork will be reproduced in a limited edition and presented to the guests of the CyberWire’s 2022 Women in Cybersecurity reception on October 20, 2022. The deadline for submissions is September 5th, 2022.

Summary

By the CyberWire staff

At a glance.

Russian and Chinese cyber activity in Latin America.
Greenwashing influence operations.
Iranian threat actor exploits Log4j vulnerabilities against Israeli targets.
Russian cyber operations reported in Southeastern Europe.
The challenge of containing the cyber phases of a hybrid war.

Russian and Chinese cyber activity in Latin America.

Dialogo Americas reports increased Russian and Chinese efforts to establish a cyber beachhead in Latin America. Those efforts have been marked by Spanish-language disinformation campaigns and, in the case of Russia, a stepped-up tempo of privateering activity, for the most part by well-known ransomware gangs. Chinese efforts have been marked by an attempt at developing influence through technology exports: ZTE has been used to induce a dependence on Chinese tech in Venezuela, where it finds a welcome audience in the Maduro regime. “'There is growing evidence that the [Venezuelan] regime is using the Carnet de la Patria to exercise control over the population. For example, numerous testimonies say that the Carnet de la Patria was used to verify citizens’ votes in the 2017 and 2018 elections,' the Organization of American States said in a report on the Venezuelan migrant and refugee crisis in the region."

Russian military cyber personnel deployed to Venezuela in May of 2019 in the overt role of helping the country recover from the collapse of its power grid. Many of those personnel have remained.

Free Whitepaper | 10 Ways Asset Visibility Builds the Foundation for OT Cybersecurity

Asset visibility is at the foundation of an effective operational technology (OT) cybersecurity strategy. Many core cybersecurity program pillars depend on having rich and complete asset visibility with intelligence-driven context. This whitepaper provides insight into 10 distinct ways that asset visibility helps inform a broader strategy for OT visibility. Download now →

Greenwashing influence operations.

Bloomberg reports that a bot-driven Chinese influence campaign has been running against Lynas Rare Earths Ltd., an Australian mining company engaged in the extraction and processing of rare earth metals in Australia and Malaysia. Bogus social media accounts circulate accusations of environmental irresponsibility on the part of Lynas with a view to influencing Australian and US public opinion. Rare earths are essential to the electronic and green energy sectors; dominance of both sectors is a key, longstanding objective of Chinese policy.

Is your company passionate about empowering women to succeed in the cyber security industry?

The CyberWire’s Women in Cybersecurity reception is returning this fall. Support the premiere networking event that highlights and celebrates the value and successes of women in the cybersecurity industry. Leaders from the private sector, academia, and government from across the region and at varying points on the career spectrum can connect with each other to strengthen relationships while building new ones. Consider sponsoring the event. Limited sponsorships are available. View our available sponsorships and benefits.

Iranian threat actor exploits Log4j vulnerabilities against Israeli targets.

Microsoft reports that the Iranian state cyber threat actor it tracks as Mercury (and which others know as MuddyWater, Seedworm, and Static Kitten) is exploiting Log4j 2 vulnerabilities in SysAid applications. All the targets have been organizations in Israel.

"In recent weeks, the Microsoft Threat Intelligence Center (MSTIC) and Microsoft 365 Defender Research Team detected Iran-based threat actor MERCURY leveraging exploitation of Log4j 2 vulnerabilities in SysAid applications against organizations all located in Israel. MSTIC assesses with high confidence that MERCURY’s observed activity was affiliated with Iran’s Ministry of Intelligence and Security (MOIS).

"While MERCURY has used Log4j 2 exploits in the past, such as on vulnerable VMware apps, we have not seen this actor using SysAid apps as a vector for initial access until now. After gaining access, MERCURY establishes persistence, dumps credentials, and moves laterally within the targeted organization using both custom and well-known hacking tools, as well as built-in operating system tools for its hands-on-keyboard attack."

The researchers at MSTIC identified five distinctive aspects of Mercury's campaign:

"Adversary-in-the-mailbox phishing: MERCURY has a long history of spear-phishing its targets. Recently, there has been an uptick in the volume of these phishing attacks. The source of the phishing comes from compromised mailboxes and initiating previous email conversations with targets. MERCURY operators include links to or directly attach commercial remote access tools, such as ScreenConnect, in these initial phishing mails.
"Use of cloud file-sharing services: MERCURY utilizes commercially available file-sharing services as well as self-hosting resources for delivering payloads.
"Use of commercial remote access applications: The initial foothold on victims emerges via commercially available remote access applications. This allows MERCURY to gain elevated privileges and be able to transfer files, primarily PowerShell scripts, easily over to the victim’s environment.
"Tooling: MERCURY’s tools of choice tend to be Venom proxy tool, Ligolo reverse tunneling, and home-grown PowerShell programs.
"Targeting: MERCURY targets a variety of Middle Eastern-geolocated organizations. Mailbox victims correlate directly with organizations that do business with the Middle Eastern victims."

The campaign is another instance in the long-running story of Log4j vulnerabilities. Experts predicted that exploits would be endemic for years until the vulnerabilities were worked out of the software supply chain, and this recent wave is entirely consistent with those expectations.

Russian cyber operations reported in Southeastern Europe.

On Friday and Saturday, respectively, Montenegrin and Bulgarian officials accused Russia of conducting cyber attacks against their countries' infrastructures. "Montenegro’s National Security Agency (ANB) said on August 26 that several Russian agencies were behind a cyberattack on key IT systems of state institutions earlier in August. Outgoing Prime Minister Dritan Abazovic said that Montenegro was at the peak of a hybrid war," BNE Intellinews reports, adding, "The following day, Bulgaria’s former ruling Gerb party said it was attacked by Russian hackers who aimed at publications on three specific topics on its social media pages." Earlier attacks, also attributed to Russian threat actors, had hit Albanian government services. All three countries have generally supported the cause of Ukraine in the present war, with Albania and Montenegro being particularly vocal in their support of extensive sanctions against Russia. Reuters describes the effects of the cyberattack against Montenegro: "'Certain services were switched off temporarily for security reasons but the security of accounts belonging to citizens and companies and their data have not been jeopardised,' Public Administration Minister Maras Dukaj said on Twitter." The state-owned power utility was among the services affected, and has switched some automated services to manual operation as a precaution.

Montenegro's attribution of the incidents to Russian cyberattack was direct and unambiguous. Metro News reports, "The Podgorica-based Agency for National Security blamed hackers based in Russia for efforts to bring down government websites, communications and transport infrastructure. Airports and border crossings could all be impacted, it warned, adding: ‘Co-ordinated Russian services are behind the cyber attack. This kind of attack was carried out for the first time in Montenegro and it has been prepared for a long period of time.'" A government spokesman said, according to an AP report cited by ABC News, "I can say with certainty that this attack that Montenegro is experiencing these days comes directly from Russia."

The challenge of containing the cyber phases of a hybrid war.

Modern Diplomacy has an essay that, while overstating the actual tactical and operational effects of cyber operations in Russia's war against Ukraine, points to the difficulty of waging cyber war in a discriminate fashion. Cyber effects easily cross borders, and the blurred lines between state and non-state actors (the essay singles out "terrorists," but might have with equal justice said "criminals") render it difficult to apply familiar principles of war involving requriements that forces operate under effective government control.

Concern about spillover isn't, however, simply a matter of academic speculation or a priori probability. Switzerland's Federal Intelligence Service (FIS) is reported to be concerned about possible Russian exploitation of Swiss servers to mount interference campaigns against Western elections. The FIS didn't comment on the report directly, saying only "Switzerland, as a European nation and as part of the western community, is a target of anti-western influence campaigns promoting the Russian narrative."

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Notes.

Today's issue includes events affecting Albania, Australia, Bulgaria, Canada, China, Costa Rica, the European Union, India, Iran, Israel, Italy, Montenegro, Peru, Russia, Ukraine, the United Arab Emirates, the United Kingdom, the United States, and Venezuela.

Dateline Moscow, Kyiv, Podgorica, Sophia, and Tirana: Hybrid war in an outside the theater of operations.

Ukraine at D+186: Cyberattacks against vulnerable targets in Southeastern Europe. (CyberWire) Russia works to fill its depleted ranks without using soldiers the important people are likely to care about. Russian cyberattacks his Southeastern European countries sympathetic to Ukraine.

Russia-Ukraine war: List of key events, day 187 (Al Jazeera) As the Russia-Ukraine war enters its 187th day, we take a look at the main developments.

Russia Moves to Reinforce Its Stalled Assault on Ukraine (Wall Street Journal) A series of volunteer battalions formed in recent weeks across Russia is preparing to deploy to Ukraine, officials and military analysts say, including a major new ground-forces formation called the 3rd Army Corps.

What is Russia's 3rd Army Corps? New unit moving to front lines: Intel (Newsweek) Members of this unit weren't required to have prior military experience, nor any high education.

Reports EU set to suspend visa travel agreement with Russia – as it happened (the Guardian) Plan to freeze 2007 deal will make it harder and more expensive for Russians to get Schengen-area documents, FT reports

Russia 'will fail to recruit 137,000 extra troops without declaring all-out war' (The Telegraph) Vladimir Putin has ordered the army to bolster numbers to replace the estimated 75,000 killed in Ukraine conflict

AP PHOTOS: Documenting Russia's invasion of Ukraine (AP NEWS) During six months of war in Ukraine, Associated Press photographers have captured images that are both succinct and eloquent. The click of a shutter is brief, but the stories they tell are deep. Sometimes they show a life that ended in a moment — the body of a Russian soldier lying face down in the snow near a ruined tank.

Ukraine risks heavy losses if counter-attack is launched before major firepower is in place (The Telegraph) Military leaders say they need more artillery before launching eagerly anticipated Kherson counter-offensive

Russian missile strike hits central Kharkiv (Euromaidan) In the night of 27 August, Russian missiles struck roads in central Kharkiv (Kyivskyi, Osnovianskyi districts), damaging buildings, Oblast Head Oleh Syniehubov reported. No casualties were reported. However, a man died from Russian shelling of a field in the Kharkiv Oblast (Bohodukhivskyi district).

Ukrainian missiles destroy building in occupied Melitopol in attempt to thwart pro-Russian referendum (The Telegraph) Vladimir Putin has finalised plans to hold referendums by mid-September in all areas of Ukraine that his armies have captured

Russia, Ukraine trade claims of nuclear plant attacks (AP NEWS) Russia and Ukraine traded claims of rocket and artillery strikes at or near Europe's largest nuclear power plant on Sunday, intensifying fears that the fighting could cause a massive radiation leak.

Cities near Ukrainian nuclear plant shelled (POLITICO) Fears persisted that fighting in the vicinity could damage the plant and cause a radiation leak.

Fears of a radiation leak mount near Ukrainian nuclear plant (AP NEWS) Authorities began distributing iodine tablets to residents near Ukraine's Zaporizhzhia nuclear power plant Friday in case of a radiation leak, amid mounting fears that the fighting around the complex could trigger a catastrophe.

UN agency to inspect Ukraine nuclear plant amid safety fears (AP NEWS) A team from the U.N. nuclear watchdog on Monday started its journey to the Zaporizhzhia atomic power plant at the heart of fighting in Ukraine, a long-awaited mission to inspect crucial safety systems that the world hopes will help avoid a catastrophe.

Satellites Show the Alarming Extent of Russian Detention Camps (WIRED) Images have identified 21 facilities that are forcibly detaining thousands of Ukrainians, as well as possible mass grave sites.

America is Gifting Ukraine a New Air Defense Network to Stop Russia's Strikes (19FortyFive) Ukraine is getting six NASAMS air defense batteries to supplement two already donated to Kyiv. An expert explains why that matters.

Ukrainian forces poised to be first to operate the L3Harris VAMPIRE (Janes) L3Harris Technologies has not yet received a contract from the US government to produce and deliver its new Vehicle-Agnostic Modular Palletized ISR Rocket Equipment...

How Britain is helping Ukraine clear Russian sea mines from Odesa (The Telegraph) Black Sea grain exports have been hampered by explosives, with devastating consequences for the world’s poorest people as food prices rise

Their Photos Were Posted Online. Then They Were Bombed (WIRED) An attack on Russian mercenaries shows how militaries are increasingly using open source data—with sometimes deadly consequences.

Cyber Element in the Russia-Ukraine War & its Global Implications (Modern Diplomacy) Cyber has become a focal point in the conduct of both civil and military operations. Given its emerging destructive potential, it was now become an independent ‘domain’ like land, sea, air, or space in the national military strategy of the United States (US). Besides being a new battle space, this domain serves as a force […]

Swiss secret service worried about Russian cyber operations (SWI swissinfo.ch) The Federal Intelligence Service (FIS) is worried that Russia could use Swiss servers in its campaigns to destabilise western democracies.

Russia blamed for wave of hacker attacks in Southeast Europe (BNE) Widespread attacks on Montenegrin state institutions and Bulgaria's opposition Gerb party follow shutdown of Albanian government services.

Montenegro declares it is in 'hybrid war' with Russia after massive cyber attack (Metro) The Balkan country, which has pressed for closer ties to the West like Ukraine, has accused the Kremlin of launching a digital assault.

Montenegro reports massive Russian cyberattack against govt (ABC News) Montenegro’s security agency has warned that Russian hackers have launched a massive and coordinated cyberattack against the small state’s government and its services

Montenegro Reports Massive Russian Cyberattack Against Govt (AP via SecurityWeek) Montenegro’s security agency warned that hackers from Russia launched a massive, coordinated cyberattack against the small nation’s government and its services.

Montenegro's state infrastructure hit by cyber attack -officials (Reuters) Government digital infrastructure in Montenegro has been hit by an "unprecedented" cyber attack and timely measures have been taken to mitigate its impact, authorities said on Friday.

How a retired MI6 boss, his Brexiteer friends and a celebrity Marxist became targets in Russia’s war on Ukraine (POLITICO) ‘We’ve seen the Russian playbook enough times to know what it looks like — and this is it.’

Odesa’s new culture war sees Ukrainians targeting Russian monuments (The Telegraph) Statues, sculptures and street names with links to the city’s Russian heritage are in the crosshairs of Ukrainian nationalists

Putin’s New Martyr for the Russian Cause (Foreign Policy) The Kremlin has turned a dead propagandist into a symbol of the war—and a call to kill more Ukrainians.

Moscow anti-war protester torches car of Russian general in charge of military censorship (The Telegraph) One of the most violent protests yet against Ukraine conflict follows an assassination in the capital, where anxiety is increasing

FBI says 'very likely' Russian official will defect and work with Western intelligence on Ukraine (The Telegraph) FBI assistant director in New York says there is 'significant conflict' in Russia over Vladimir Putin's invasion of Ukraine

‘Tavriya TV will promote happiness and love’: Russia opens station in occupied Kherson (the Guardian) As Moscow gears up to annex Kherson in a ‘referendum’, Tavriya shows Russia as liberator, saving citizens from Ukrainian Nazis

Pentagon expands use of seas to send weapons to Ukraine (Washington Post) The Pentagon has expanded its use of maritime shipping to deliver weapons for the war in Ukraine, U.S. defense officials said, after relying heavily on aircraft early in Russia’s invasion to get arms to Kyiv as quickly as possible.

Boycotting Russian Scientists Is a Hollow Victory (WIRED) Science agencies around the world halted partnerships with Russia after it invaded Ukraine. But such actions are shortsighted and do more harm than good.

Mystery over Russia burning $10m of gas a day in huge flare close to Nord Stream 1 (The Telegraph) Supplies through the pipeline have been curtailed since mid-July in what Germany says is a political move

Dell ceases all Russian operations after August offices closure (Reuters) Dell Technologies Inc. said on Saturday it had ceased all Russian operations after closing its offices in mid-August, the latest in a growing list of Western firms to exit Russia.

Pleasure Trips from Moscow: How Putin's Daughter Traveled Unnoticed to Germany (Spiegel) Over the course of several years, Katerina Tikhonova made numerous trips to Bavaria together with an entourage of bodyguards. DER SPIEGEL reporting has revealed that the German authorities knew nothing of the excursions.

Attacks, Threats, and Vulnerabilities

China and Russia Step Up Cyber Presence in Latin America (Diálogo Américas) China and Russia have stepped up their cyber presence in Latin America, while employing cyber tools, including disinformation, cybercrime, and electoral interference to pursue their goals in the region, experts said. Disinformation campaigns through state-owned Spanish-language social media platforms, cyberattacks, such as those the Russian Conti ransomware group perpetrated against Costa Rican and Peruvian government agencies in recent months, and the transfer of cybersecurity know-how and infrastructure, are some examples of their increasing cyber operations.

Dominican Republic refuses to pay ransom after attack on agrarian institute (The Record by Recorded Future) The government of the Dominican Republic has said it will not pay a ransomware group that has crippled the IT services of an agrarian institute.

China-Linked Bots Attacking Rare Earths Producer ‘Every Day’ (Bloomberg) Campaign aimed at Lynas’ environmental record in Malaysia. US push for critical minerals industry behind attacks: experts.

Vulnerable U.S. electric grid facing threats from Russia and domestic terrorists (CBS News) Bill Whitaker reports that a coordinated attack on a relatively small number of critical substations could plunge the U.S. into darkness.

Iranian Hackers Exploiting Unpatched Log4j 2 Bugs to Target Israeli Organizations (The Hacker News) Iranian state-sponsored actors are leveraging unpatched Log4j systems to target Israeli entities.

MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations (Microsoft Threat Intelligence Center) In recent weeks, the Microsoft Threat Intelligence Center (MSTIC) and Microsoft 365 Defender Research Team detected Iran-based threat actor MERCURY leveraging exploitation of Log4j 2 vulnerabilities in SysAid applications against organizations all located in Israel. MSTIC assesses with high confidence that MERCURY’s observed activity was affiliated with Iran’s Ministry of Intelligence and Security (MOIS).

Iran exploiting Log4j 2 weakness to attack Israel, says Microsoft (Israel Defense) As Israel races to prevent a nuclear agreement new report reveals that threat group MERCURY has exploited vulnerable SysAid servers

Revealing Europe's NSO (Lighthouse Reports) Confidential data and sources uncover major surveillance outfit operating from within the European Union

How 'Kimsuky' hackers ensure their malware only reach valid targets (BleepingComputer) The North Korean 'Kimsuky' threat actors are going to great lengths to ensure that their malicious payloads are only downloaded by valid targets and not on the systems of security researchers.

CSW's Threat Intelligence - August 22, 2022 - August 26, 2022 (Cyber Security Works) We bring you threats that are currently trending as well as new vulnerabilities that hackers are exploiting.

Ransomware Operator Abuses Anti-Cheat Driver to Disable Antiviruses (SecurityWeek) A vulnerable anti-cheat driver for the Genshin Impact video game has been abused in ransomware attacks to disable antivirus programs.

Hackers Are Using Anti-Cheat in 'Genshin Impact' to Ransom Victims (Vice) The game’s anti-cheat system has well-known vulnerabilities that hackers are now abusing to get access to sensitive parts of victims’ operating systems and deploy ransomware.

Fake 'Cthulhu World' P2E project used to push info-stealing malware (BleepingComputer) Hackers have created a fake 'Cthulhu World' play-to-earn community, including websites, Discord groups, social accounts, and a Medium developer site, to distribute the Raccoon Stealer, AsyncRAT, and RedLine password-stealing malware infections on unsuspecting victims.

Researchers say Cisco firewall software remains vulnerable to attack despite patch (Cybersecurity Dive) Rapid7 researchers also warn only a very small percentage of users have applied updates.

Phishing PyPI users: Attackers compromise legitimate projects to push malware (Help Net Security) PyPI is warning about a phishing campaign targeting its users; the attackers have compromised some legitimate projects to push malware.

A third of PyPi software packages contains flaw to execute code when downloaded (SC Media) The findings, discovered by Checkmarx and published Friday, underscore how open source software repositories like PyPi are increasingly being targeted and leveraged by malicious actors.

An interview with initial access broker Wazawaka: 'There is no such money anywhere as there is in ransomware' (The Record by Recorded Future) Wazawaka talked to Recorded Future analyst and product manager Dmitry Smilyanets about his interaction with other hackers, details about ransomware attacks he's been involved in, and how he settled on the name Babuk.

New Hampshire Lottery website experiences cyberattack (WMUR) New Hampshire Lottery officials warned of a cyberattack on its website on Friday.

DoorDash Discloses Data Breach Related to Attack That Hit Twilio, Others (SecurityWeek) DoorDash says hackers may have obtained customer and employee data as a result of the Twilio breach.

DoorDash hit by data breach linked to Twilio hackers (TechCrunch) Hackers accessed DoorDash customer information and some partial payment data.

N.H. lottery website returns after facing cyber attack (Boston.com) The New Hampshire lottery website is back in service after the agency faced a cyber attack this weekend. Read more on Boston.com.

Mark Zuckerberg admits to Joe Rogan that a simple hack to Meta's smart glasses could allow the user to secretly film others (Business Insider) Joe Rogan asked Meta CEO Mark Zuckerberg whether Meta's smart glasses are a concern if "some creep" can covertly take photos while wearing them.

Security Patches, Mitigations, and Software Updates

Firefox 104 is out – no critical bugs, but update anyway (Naked Security) Two trust-spoofing bugs were the main culprits this month – but neither one was a zero-day.

Apple says 95% of iCloud users already have 2FA enabled ahead of Passkeys launch (9to5Mac) With its next round of software updates coming this fall, including iOS 16 and macOS Ventura, Apple will launch integrated support for the passkeys standard. The passkey standard is described as unique digital keys designed to replace the need for passwords altogether with streamlined sign-in across your devices, websites, and apps. When Passkeys is launched […]

Trends

Gambling sites are losing significant amounts of revenue due to raising DDoS attacks (Help Net Security) This Help Net Security video uncovers how DDoS attacks on gambling sites lead to lost revenue and consumer trust.

The Rise of the Cybersavvy Corporate Treasurer (Tanium) Treasurers hold the purse strings. That makes them attractive targets for cyberthieves. Here’s how to outsmart the bad guys.

Growing Urgency for Increased Cybersecurity in Healthcare (CyberTheory) Investments toward bolstering cybersecurity of all these health-related institutions under potential cyberattack need to be considered urgent

Marketplace

Why Okta Could Soon Be the Last Man Standing in Identity (The Motley Fool) The industry leader could recover from a data breach and come out stronger.

Google to launch pan-India online safety campaign, plans to upskill 100k developers (The Indian Express) Google is launching a new pan-India online safety campaign with plans of upskilling 100,000 developers and IT professionals on the latest cybersecurity norms and safety tools.

Army Cyber & Technology Careers (Go Army) Join the ranks of skilled cyberwarriors in the U.S. Army and defend the nation with technology.

Inside ‘crypto Woodstock’ where technologists plot a utopian future (Washington Post) Founders of the online Friends With Benefits social club hope to change the way people use the blockchain

Pindrop Welcomes Marc Diouane as President and Chief Operating Officer (Business Wire) Pindrop, a global leader in voice technology, today announced the appointment of Marc Diouane to the role of President and Chief Operating Officer. Di

Products, Services, and Solutions

NAVEX Launches RiskRate® Enhancements to Further Streamline Third-Party Risk Management Experience (Business Wire) NAVEX, the leader in integrated risk and compliance management software, today announced significant updates to RiskRate, its third-party risk screeni

NHS Informatics Merseyside Selects Tanium to Boost Cyber Hygiene across Its IT Estate (Chronicle-Tribune) Tanium, the industry's only provider of converged endpoint management (XEM)...

Technologies, Techniques, and Standards

Don’t be a target: Phishing and smishing on the rise (Sixteenth Air Force (Air Forces Cyber)) JOINT BASE SAN ANTONIO-LACKLAND, Texas. You did it, you almost clicked a text, a link, or responded to an email that looked legitimate and potentially gave away personal information to scammers. You

The Crypto World Can’t Wait for ‘the Merge’ (NYTimes) A long-awaited upgrade to Ethereum, the most popular crypto platform, may make the technology more environmentally sustainable. But it comes with risks.

Critical infrastructures cannot be secure when critical equipment isn’t (Control Loop) I spoke at a podcast for Marsh’s Marc Schein July 19, 2022 on control system cyber security to be broadcast later (TBD). Because of the Marc Schein interview, I received a call from an insurance specialty insurer who had received an Operational Technology (OT) Supplemental Application from a global control system supplier to the aerospace industry, industrial operations, and the US Department of Defense.

Legislation, Policy, and Regulation

Official calls for advancing cyber civilization progress (China Daily) A senior official has called for strengthening cyber governance to ensure that cyberspace better reflects the trends of advanced culture and the spirit of the times.

Does the United States Need a Cyber Force? (The National Interest) While it might seem prudent to create a new government organization to help manage disinformation, studies demonstrate that government attempts to address disinformation backfire.

DHS looks to cyber self-assessments over CMMC model (FCW) DHS is considering how it might use self-assessments for vendors to measure their cyber hygiene—an approach that would set it apart from the Defense Department’s plans for third-party assessments.

Privacy bill triggers lobbying surge by data brokers (POLITICO) Brokers say a potential privacy bill could hamper their work with law enforcement and overly restrict their industry.

Litigation, Investigation, and Law Enforcement

Nato investigates hacker sale of missile firm data (BBC News) Hackers are selling classified documents online after obtaining data belonging to missile maker MBDA.

FCC launches investigation into mobile carriers’ geolocation data practices (The Record by Recorded Future) Documents show a variety of data practices across carriers.

Most top mobile carriers retain geolocation data for two years on average, FCC findings show (CyberScoop) Ten of the top 15 mobile carriers offer no way for consumers to opt-out of geolocation data collection, according to responses to the agency.

The Twitter Whistleblower Needs You to Trust Him (Time) Inside Peiter 'Mudge' Zatko's messy battle with Twitter

California AG looks ahead to other data privacy violations after $1.2 million Sephora fine (The Record by Recorded Future) California is already looking ahead to the next potential violations of the CCPA after issuing the state’s first fine of $1.2 million to makeup giant Sephora.

California Attorney General Announces $1.2 Million CCPA Settlement With Sephora Amid Ongoing Enforcement Sweep (cyber/data/privacy insights) On August 24, 2022, California Attorney General Rob Bonta announced a $1.2 million settlement with cosmetics retailer Sephora to resolve allegations that it violated the California Consumer Privacy Act (CCPA) and failed to cure those violations within the CCPA’s 30-day cure period. Specifical

Facebook Parent Meta Agrees to Settle Cambridge Analytica Lawsuit (Wall Street Journal) Details of the preliminary settlement with Facebook users weren’t provided; the suit was related to the handling of user data.

The Supreme Court on Pegasus: Two Short Steps Away From the Truth (The Wire) Insist on individual affidavits from the home minister, the NSA and other key officials, and allow a review by reputed organisations of the technical committee’s findings.

Malware Found In India Supreme Court Snooping Investigation (Gov Info Security) Justices Say Pegasus Not Confirmed and Government Did Not Cooperate

Femme fatale Russian spy posing as Peruvian jewellery designer 'lured Nato commanders into honeytraps' (The Telegraph) Deep-cover agent fled to Moscow in 2018 after a decade of spying in Europe for the Kremlin

Conservatives call for release of report on massive Afghan immigration data breach (CBC) The Conservative Party has written to Privacy Commissioner Philippe Dufresne asking him to speed up an investigation into a federal government data breach that exposed the identities of hundreds of Afghans seeking Canada's help to escape from the Taliban regime in October 2021.

Twitter insiders reluctantly agree with some of the revelations from whistleblower Peiter Zatko (Business Insider) "Historically, Twitter doesn't really lie, but like all companies, yes, they have skeletons," one employee told Insider.

Apple faces growing likelihood of DOJ antitrust suit (POLITICO) An antitrust lawsuit against Apple would be a dramatic escalation in the administration’s battle against the tech giants.

FBI sought national defense documents at Trump’s Mar-a-Lago, affidavit shows (the Guardian) Extensively redacted affidavit used to justify the search of the ex-president’s Florida resort was unsealed on Friday

Ex-U.S. intel operatives who worked for UAE barred from arms exports, State Dept says (Reuters) Three former U.S. intelligence operatives who worked as cyber spies for the United Arab Emirates and admitted to hacking American networks will be temporarily barred from arms export activities under a deal announced by the State Department on Friday.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Blue Team Con (Chicago, Illinois, USA, Aug 27 - 28, 2022) Blue Team Con is an annual cybersecurity conference for individuals interested in cybersecurity defense. This includes defenders of organizations but also extends to practitioners performing governance, risk, and compliance, as well as application security development and anyone else who helps safeguard organizations.

Wyoming Blockchain Stampede, WyoHackathon, and Wyoming Cybersecurity Conference (Laramie, Wyoming, USA, Sep 19 - 23, 2022) Celebrating its fifth anniversary, the 2022 Wyoming Blockchain Stampede, will be held Sept. 19-23 at the University of Wyoming Conference Center in Laramie. The Stampede, sponsored by the UW Center for Blockchain and Digital Innovation (CBDI), features speakers, panels and events exploring the next generation of digital assists, blockchain-related startups, educational programs, financial and regulatory issues, digital identity, state and federal legislation, and cybersecurity and digital identity. “Since the inception of the Stampede, industry leaders from around the world have attended the event, highlighting the opportunities, challenges and latest developments in blockchain, digital assets and cryptocurrency,” said Steve Lupien, director of the UW Center for Blockchain and Digital innovation. “This year we plan to examine more in-depth the impact of digital assets on Wyoming through legislation, economic development and education from K-12 to community colleges and UW,” Lupien added. The 2022 WyoHackathon will start ahead of the Stampede on Friday, Sept 9. Operated by Rensa Games, it will be online with winners announced at the end of the Stampede. This year’s competition length will allow for more participants from UW and around the world to be involved, and more time for them to meet challenges for rewards offered by blockchain-related businesses. This year’s event includes the annual Wyoming Cybersecurity Conference presented by the nonprofit the CyberWyoming Alliance (CWA) on Friday, Sept. 23. “It's About Identity” is the theme for this year’s conference with speakers and panels examining issues involving digital identity.

SECtember 2022 (Bellevue, Washington, USA, Sep 26 - 30, 2022) SECtember 2022 is the essential industry conference to assist organizations in elevating their cybersecurity capabilities. Cyber risk is growing quickly in a world of pervasive computing, well-funded adversaries and nation-state actors. Brought to you by Cloud Security Alliance, SECtember provides a state-of-the-art perspective on the threat vectors and solutions for cybersecurity that now have a foundation of cloud computing. Held in the heart of the cloud industry in Bellevue, Washington from September 26-30, 2022, SECtember will feature leaders from Government, Cloud, Cybersecurity and Global 2000 enterprises. The event will provide critical insights into board oversight of cybersecurity, CISO strategies, emerging threats and best practices, all against the backdrop of cloud and related leading edge technologies.

Events

13th Annual Billington Cybersecurity Summit (Washington, DC, USA, Sep 7 - 9, 2022) The world's leading government summit on cybersecurity will continue its unique educational mission of convening the who's who in cybersecurity: the senior leadership from the U.S. government, our allied partners, and their industry and academic partners. Given the fast moving strategic direction that the Biden Administration has generated over the past year, this event will take a holistic view of the cybersecurity business with a hearty dose of topics covering Zero Trust, proactive cyber defense measures, partnership building, offensive cyber, and a continued look at what the future will bring to the cybersecurity mission. Once again, Billington will play host to the Federal Government's most senior cyber and IT managers and experts, some of the most innovative cybersecurity providers in the business, and a broad range of expertise from across the public and private sectors. Like the past Billington events, we expect groundbreaking news and a content rich discussion focused on lessons learned, best practices, and things to consider as you build and enhance your own cybersecurity programs.

Hack Red Con 2022 (Louisville, Kentucky, USA, Sep 7 - 11, 2022) Hack Red Con 2022 is a Cyber Security Conference, Training and Networking 4 day event with an emphasis on Red Teaming, Pen Testing, Social Engineering, and all aspects of Off Sec. The Conference aims to connect Off Sec Professionals, Companies, Educators, Influencers, Investors, Entrepreneurs and Federal, State, Local Government Agencies together. This 4 day event will have 2 intense training days of the latest in Off Sec Education by the industries top hackers and industry experts. The following 2 conference days will include world class key note speakers, industry talks, roundtables, events including Hack the Flag, Jeopardy and Kentucky Bourbon, Lock Hack Challenges, Hack Career Meet & Great, Invest in Cyber, and of course the sickest Swag and Gear Giveaways.

WiCyS Book Club (Virtual, Sep 12, 2022) Join us on September 17 at 12pm CT for the first WiCyS Book Club meeting! The WiCyS Book Club is about creating the space in our hectic lives to connect as a community and bring diverse perspectives into a lively discussion about pre-selected books. This book club meets bi-monthly and will review various cybersecurity and privacy-related books. Meeting Date/Time: September 17 at 12pm CT Book: Cyber Privacy: Who Has Your Data and Why You Should Care by April Falcon Doss About the Book: You shouldn't have to be a privacy expert to understand what happens to your data. In Cyber Privacy, Doss demystifies the digital footprints we leave in our daily lives and reveals how our data is being used - sometimes against us - by the private sector, the government, and even our employers and schools. Attend the meeting for a discussion about the book and how these issues impact our lives! REGISTRATION IS REQUIRED. After registering, you will receive a confirmation email containing information about joining the meeting.

SASE Converge 2022 (Virtual, Sep 13 - 14, 2022) The concept of work has been completely transformed. It is no longer a location, but an activity. This new era of hybrid work means a new generation of never-before-seen threats. Is your network ready? To succeed in this new world, we need to reimagine our infrastructure to support the flexibility demanded by the modern workforce - without compromising security or user experience. ZTNA 2.0 provides you a critical first step in accomplishing a successful SASE deployment and unlocking this next phase of growth for your organization. Join us at SASE Converge 2022 to learn from industry experts about the latest trends and innovations in SASE, so you can lead the transformation of your infrastructure with confidence.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.