Chinese and Iranian cyberespionage reported. Cybersecurity for SMBs. Conti's old playbook used against Ukraine. Telco resiliency.

Summary

By the CyberWire staff

At a glance.

Bronze President shows both enduring interests and adaptability.
Iranian threat actor activity reported.
Cybersecurity and small-to-medium businesses.
Initial access broker repurposes Conti's old playbook for use against Ukraine.
Conti remnants attract DDoS attacks.
Kyivstar as a case study in telco resiliency.

Bronze President shows both enduring interests and adaptability.

Secureworks Counter Threat Unit researchers have discovered a PlugX malware campaign targeting government officials’ computers in Europe, the Middle East, and South America. The malware is embedded in RAR archive files that require the user to click a Windows shortcut file. The decoy documents are political in nature, suggesting that the targets are all government officials. This campaign can probably be attributed to the BRONZE PRESIDENT threat group that is likely to be operated by the Chinese government. BRONZE PRESIDENT has shown an enduring interest in such Chinese neighbors as Vietnam and Myanmar, but it's also been responsive to developing crises and emergent requirements, as seen in the interest it's taken in Ukraine as Russia's invasion has developed. "BRONZE PRESIDENT has demonstrated an ability to pivot quickly for new intelligence collection opportunities. Organizations in geographic regions of interest to China should closely monitor this group's activities, especially organizations associated with or operating as government agencies."

What’s the future of cybersecurity? Join Trellix at Xpand Live to find out more.

Register for Xpand Live, taking place at the Aria Las Vegas, to hear from Trellix leaders about our vision for the future. During Xpand Live, we will explore our product roadmap as well as our approach to cybersecurity through keynotes, 60+ sessions, demos and more. It will be a week packed with keynotes, product demos, technical trainings and more. Find out more and register today.

Iranian threat actor activity reported.

Two reports, one from Mandiant, the other from Microsoft, outline Iranian cyber operations. Mandiant's report describes activity by APT42. "We estimate with moderate confidence that APT42 operates on behalf of the Islamic Revolutionary Guard Corps (IRGC)’s Intelligence Organization (IRGC-IO) based on targeting patterns that align with the organization’s operational mandates and priorities." APT42 engages in credential harvesting with a view toward establishing surveillance over its targets, principally through installation of Android mobile malware. The initial access is often achieved through closely targeted and protracted spearphishing efforts. APT42 also engages in the development of its own malware; it's not entirely dependent upon commodity tools available in the C2C markets. Mandiant summarized the group's targeting as follows:

"The targeting patterns for APT42 operations are similar to other Iranian cyber espionage actors, with a large segment of its activity focused on the Middle East region. However, unlike other suspected IRGC-affiliated cyber espionage groups that have focused on targeting the defense industrial base or conducting large-scale collection of personally identifiable information (PII), APT42 primarily targets organizations and individuals deemed opponents or enemies of the regime, specifically gaining access to their personal accounts and mobile devices. The group has consistently targeted Western think tanks, researchers, journalists, current Western government officials, former Iranian government officials, and the Iranian diaspora abroad."

There are some connections to, or at least overlap with, the Iranian Phosphorous subunit Microsoft describes in its own report. DEV-0270, or Nemesis Kitten, is interesting for the ways in which its activities don't obviously align with any Iranian strategic interests. This leads Microsoft to speculate ("with low confidence") that Nemesis Kitten is moonlighting, deploying ransomware in what amounts to either privateering or (perhaps more likely) an APT side hustle. "Judging from their geographic and sectoral targeting, which often lacked a strategic value for the regime, we assess with low confidence that some of DEV-0270’s ransomware attacks are a form of moonlighting for personal or company-specific revenue generation," Microsoft concludes.

These reports come after Albania's decision earlier this week to sever diplomatic relations with Iran over Iran's disruptive attacks against Albanian government infrastructure. Iran has denied any involvement is offensive cyberoperations against Albania or anyone else, and protested that it's the real victim here.

Don't miss the opportunity to share your company's commitment to diversity and inclusion.

The CyberWire’s Women in Cybersecurity reception returns next month. Show your support of the premiere networking event that highlights and celebrates the value and successes of women in the cybersecurity industry to leaders from the private sector, academia, and government. Limited sponsorships are available. View our prospectus for available sponsorships and benefits.

Cybersecurity and small-to-medium businesses.

Vade today released its 2022 SMB Cybersecurity Landscape Report, a survey of 500 IT decision makers. It was found that 79% of those surveyed have agreed that cyberattacks on their organizations have increased, with 87% agreeing that email threats to cybersecurity could be taken more seriously. 91% of respondents said that they are using an MSP for security, with 92% of organizations outsourcing some of their IT operations to an MSP. 94% of those surveyed have high levels of confidence in their organization’s ability to defend against cyberattacks, with 51% saying they’re completely confident, but 68% agree that their security posture could be more advanced.

Initial access broker repurposes Conti's old playbook for use against Ukraine.

Google's Threat Analysis Group (TAG) has discerned a pattern in Russia's war against Ukraine. "As the war in Ukraine continues, TAG is tracking an increasing number of financially motivated threat actors targeting Ukraine whose activities seem closely aligned with Russian government-backed attackers." Specifically, it's one threat actor, and its activities overlap with a group that CERT-UA tracks as UAC-0098. "Based on multiple indicators, TAG assesses some members of UAC-0098 are former members of the Conti cybercrime group repurposing their techniques to target Ukraine." Thus the pattern is a familiar one: Russia using criminal groups for cyber combat:

"UAC-0098 is a threat actor that historically delivered the IcedID banking trojan, leading to human-operated ransomware attacks. The attacker has recently shifted their focus to targeting Ukrainian organizations, the Ukrainian government, and European humanitarian and non-profit organizations. TAG assesses UAC-0098 acted as an initial access broker for various ransomware groups including Quantum and Conti, a Russian cybercrime gang known as FIN12 / WIZARD SPIDER."

This threat actor has engaged in at least the following campaigns since Russia's war began:

Email phishing to deliver AnchorMail, a malicious payload that delivers the Anchor backdoor. Targets varied in this campaign, which ran from April through June, but the Ukrainian hospitality industry was prominently represented among them. This effort seemed to have both a political and a financial motivation.
Emails impersonating the National Cyber Police of Ukraine, urging the recipients to download an "update." This May effort also concentrated on Ukraine's hospitality sector.
The hospitality sector was also used to pivot to targets among European non-governmental organizations (NGOs) This effort, which also ran in May, used the “Stolen Images Evidence” malware distribution service.
In the second half of May, as support by StarLink and Microsoft for Ukraine became matters of general knowledge, the tactics shifted to impersonation of those two companies.
Near the end of May Cobalt Strike was delivered by malicious documents built by EtterSilent; these targeted the Academy of Ukrainian Press (AUP)
Finally, in June, the group engaged in Follina exploitation. The phish hook was a notification of tax-filing deadline that spoofed the State Tax Service of Ukraine.

In conclusion Google TAG writes, "UAC-0098 activities are representative examples of blurring lines between financially motivated and government backed groups in Eastern Europe, illustrating a trend of threat actors changing their targeting to align with regional geopolitical interests." TAG also gives due credit to other researchers: its results are, TAG says, consistent with a report IBM published in July, and with earlier observations CERT-UA offered in April.

Conti remnants attract DDoS attacks.

Other Conti remnants have attracted counterfire, perhaps from hacktivists, or criminal rivals, or security services. Servers the gang had used to distribute Cobalt Strike payloads have been subjected to distributed denial-of-service (DDoS) attacks that displayed anti-war, anti-Russian messages, including "Be a Russian patriot," "15,000+ dead Russian soldiers," "Stop Putin!" and "Stop the war!" BleepingComputer reports that the operators behind the DDoS campaign are unknown. "It is unclear who is behind these messages (it could be anyone from a security researcher, to law enforcement agencies, to a cybercriminal with a grudge for siding with Russia) but it looks like they’re keeping the threat actor busy."

Kyivstar as a case study in telco resiliency.

Kyivstar, the Ukrainian telecommunications provider that serves some 26-million customers, has come under both cyber and kinetic attack, and has had to cope with both hacking and shelling, POLITICO reports. As much as 30% of the company's infrastructure has been damaged, yet capacity has actually increased during the war. Kyivstar credits, in part, disruption of Russian offensive operations by groups like the IT Army of Ukraine, “Part of our success is because we are forcing Russians to defense,” Kyivstar CEO Oleksandr Komarov told the press, explaining that the IT Army is “creating this hassle on [the Russian] side, and it’s making them more weak because of this.”

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Notes.

Today's issue includes events affecting Albania, Belarus, China, the European Union, Iran, Italy, the Democratic People's Republic of Korea, Myanmar, NATO/OTAN, Russia, Ukraine, the United Kingdom, the United States, and Vietnam.

Dateline Moscow, Kyiv, and Minsk: Ukraine's counteroffensive, and cybercriminals act for Russia.

Ukraine at D+196: Counteroffensives, and cyber privateering. (CyberWire) Ukraine's counteroffensive gains ground in the north, around Kharkiv, and in the south, near Kherson. Belarus holds military exercises. Conti remnants continue to operate against Ukrainian targets, and their infrastructure comes in for some virtual counterfire.

Russia-Ukraine war: Kharkiv success helps entire frontline, Zelenskiy says; US secretary of state makes surprise visit to Kyiv – live (the Guardian) Zelenskiy praises advances of Ukrainian forces; Antony Blinken arrives in Kyiv as more US aid announced

Belarus starts military exercises near border regions -defmin (Reuters) Belarus has started military exercises by the city of Brest near the Polish border, its capital Minsk and the northeast region of Vitebsk, the defence ministry said on Thursday.

Russia-Ukraine war: List of key events, day 197 (Al Jazeera) As the Russia-Ukraine war enters its 197th day, we take a look at the main developments.

Russia-Ukraine latest news: Ukraine seizes 400sq km in Kharkiv with 'opportunistic' counter-offensive (The Telegraph) Ukraine has seized around 400sq km in Kharkiv thanks to an "opportunistic" counter-offensive.

Ukraine seizes two villages in surprise Kharkiv attack (The Telegraph) Unofficial Russian and Ukrainian Telegram channels confirm significant overnight advances that have broken Moscow's frontlines

Ukraine makes gains in southern counteroffensive against Russia (CNN) One week into a new counteroffensive, Ukrainian forces are making gains in the south, with the ambitious goal of taking back most of the Russian-occupied region of Kherson by the end of the year, senior US officials and Ukrainian officials tell CNN.

Ukraine military chief claims responsibility for strikes in Crimea (Reuters) Ukraine's top military chief claimed responsibility on Wednesday for a series of strikes on Russian air bases on the annexed peninsula of Crimea, including one that caused devastation at the Saky military facility last month.

Ukraine calls for evacuation of Zaporizhzhia nuclear plant town (NBC News) The exiled mayor of Enerhodar, the main town serving the plant, said that it was under fire from Russian forces and that it had no electrical supply.

Ukraine military chief says ‘limited’ nuclear war cannot be ruled out (Washington Post) Ukraine’s top military chief warned Wednesday that a “limited” nuclear war between Russia and the West cannot be discounted, a scenario with grave global implications.

Putin, in defiant speech, threatens Western gas and grain supplies (Washington Post) Russian President Vladimir Putin on Wednesday called Western sanctions “stupid” and threatened to halt all energy sales to Russia’s critics if they move forward with a cap on oil prices proposed by the Group of Seven industrialized economic powers.

Vladimir Putin insists Russia ‘has lost nothing’ from Ukraine war (Telegraph) President threatens to walk away from key deal to release grain from Black Sea ports, as he sets up meeting with China’s Xi Jinping

Russians back war in Ukraine, but report finds notable opposition (Washington Post) Most Russians are still sure they are not the bad guys in the war against Ukraine

Russian Soldier Tells Wife Putin’s Troops Bombed Their Own People, Ukrainian Intel Says (The Daily Beast) “We talked to the bosses and they said that’s how it is.”

US: Hundreds of thousands of Ukrainians forced to Russia (AP) The U.S. said Wednesday it has evidence that “hundreds of thousands” of Ukrainian citizens have been interrogated, detained and forcibly deported to Russia in “a series of horrors” overseen by officials from Russia’s presidency

US Trained Ukrainian Missileers Who Sunk Russian Warship, Pentagon Official Says (Defense One) Bill LaPlante also praised the quick “innovation” that delivered truck-mounted Harpoon missiles to Ukraine.

Ukraine’s Supporters Aim to Create Long-Term Aid Mechanisms (Defense One) Leaders from NATO, the U.S., and others will gather to discuss ideas on Thursday.

What weapons could North Korea give to Russia? (Defense News) We have the answers to that and more, including what the North could get in return.

Decline in hacktivism, growth in cybercrime (BCS) New data compiled by Paolo Passeri, Cyber Intelligence Principle, Netskope EMEA shows the wave of cyber attacks surrounding the Russian invasion of Ukraine has tailed off.

Ukraine’s largest telecom stands against Russian cyberattacks (POLITICO) Ukrainian mobile operator Kyivstar, which provides service to almost 26 million people, is fighting a barrage of Russian cyberattacks.

Initial access broker repurposing techniques in targeted attacks against Ukraine (Google) Describing activities of a crime group attacking Ukraine.

Google says former Conti ransomware members now attack Ukraine (BleepingComputer) Google says some former Conti cybercrime gang members, now part of a threat group tracked as UAC-0098, are targeting Ukrainian organizations and European non-governmental organizations (NGOs).

Google Details Recent Ukraine Cyberattacks (SecurityWeek) Between April and August 2022, a threat actor tracked as UAC-0098 has launched at least five different campaigns targeting Ukraine.

Ukraine is under attack by hacking tools repurposed from Conti cybercrime group (Ars Technica) Researchers from Google and IBM see unprecedented blurring of lines.

Cobalt Strike servers linked to former Conti gang members attacked (SC Media) The DDoS attacks by an unknown group were riddled with anti-Russian messages, prompting security researchers to connect the incident to the Russia-Ukraine war.

Ransomware gang's Cobalt Strike servers DDoSed with anti-Russia messages (BleepingComputer) Someone is flooding Cobalt Strike servers operated by former members of the Conti ransomware gang with anti-Russian messages to disrupt their activity.

Attacks, Threats, and Vulnerabilities

Albania cuts diplomatic ties with Iran over July cyberattack (Washington Post) Albania cut diplomatic ties with Iran and expelled the country’s embassy staff over a major cyberattack nearly two months ago that was allegedly carried out by Tehran on Albanian government websites, the prime minister said Wednesday.

APT42: Crooked Charms, Cons, and Compromises (Mandiant) APT42 is an Iranian state-sponsored cyber espionage group.

Mandiant links APT42 to Iranian 'terrorist org' (Register) 'It's hard to imagine a more dangerous scenario,' Mandiant Intel VP told The Reg

Iranian Hacker Group Posed as Journalists to Hunt Dissidents (Defense One) Group spent weeks trying to fool specific targets with intricate appeals—including U.S campaign staff.

Profiling DEV-0270: PHOSPHORUS’ ransomware operations (Microsoft Security Threat Intelligence) Microsoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS.

Microsoft Warns of Ransomware Attacks by Iranian Phosphorus Hacker Group (The Hacker News) Microsoft warns of a subgroup of the Iranian threat actor Phosphorus that has been conducting ransomware attacks as a "form of moonlighting."

Ares Banking Trojan adds the departed Qakbot DGA | Zscaler (Zscaler) Zscaler ThreatLabz observed that the Ares banking trojan introduced a DGA, similar to Qakbot's. Find out more about it!

DEADBOLT ransomware rears its head again, attacks QNAP devices (Naked Security) NAS devices make it easy for anyone to add high-capacity file servers to their network. Guess why cybercrooks love NAS devices too…

Illegal sports streams riddled with threats that even the smartest users might miss (TechRadar) Streaming sports on illegal sites isn't worth it

Rachel Dillon’s fitness app Move With Us hit by data breach (New York Post) An influencer’s fitness app has been involved in a major data breach that potentially exposed customers’ personal information and revealing photos.

Holiday Inn hotels hit by cyber-attack (BBC News) The chain, run by Intercontinental Hotel Group, said its online services were facing disruptions.

InterContinental Hotels Confirms Cyber-Attack After Two-Day Outage (Infosecurity Magazine) IHG is assessing the nature, extent and impact of the incident and implementing response plans

Trends

Most IT leaders think partners, customers make their business a ransomware target (Help Net Security) Trend Micro found that 79% of global IT leaders believe their partners and customers are making their own organisation a ransomware target.

The Cost of a Data Breach for Government Agencies (Security Intelligence) Government data breaches can cost $2 million on average. See how agencies can put defenses in place before an attack actually happens.

Calling Women to Join the Cybersecurity Field (CSO Online) Cybersecurity is a necessity across every industry, including healthcare, government, transportation, banking, and retail. This offers women the opportunity to work within many industries and diversify their resumes.

Marketplace

Cybersecurity M&A Roundup: 41 Deals Announced in August 2022 (SecurityWeek) Forty-one cybersecurity-related M&A deals were announced in August 2022.

Open Raven Raises $20M in Series B from Pelion Ventures, Kleiner Perkins, and Upfront Ventures (Business Wire) Open Raven – the data security posture management company helping enterprises prevent leaks, breaches, and compliance incidents – announced it raised

Darktrace Shares Drop 33% After Takeover Talks Collapse (Bloomberg) Thoma Bravo failed to agree on final terms of the offer. Darktrace uses AI to check for hacks and suspicious data leaks.

‘Toxic’: Darktrace’s future clouded by concerns over culture and fraud case (the Guardian) Analysts have also criticised the cybersecurity firm’s business model but a US private equity fund is still pondering a takeover

Cyderes Announces First Half Growth Rate of Over 63% (PR Newswire) Robert Herjavec, CEO of Cyderes and co-star of the hit Emmy award-winning show Shark Tank, today announced half year financial performance for...

Anomali Named Leader and Outperformer in 2022 GigaOm Radar Report for Threat Intelligence Solutions (Business Wire) Anomali, the leader in intelligence-driven cybersecurity solutions, announced that the company has been recognized as a Leader in the 2022 GigaOm Rada

Illumio Joins the Cloud Security Alliance (GlobeNewswire News Room) Alliance to Help Organizations Accelerate Zero Trust Segmentation Across the Hybrid Attack Surface...

Tanium BrandVoice: How To Win The Cyber Talent Race (Forbes) Passion, problem-solving, and diverse perspectives can address the widening labor shortage in cybersecurity.

Omada Expands Global Team and Board to Support Growth (PR Newswire) Omada A/S ("Omada"), a global leader of Identity Governance and Administration (IGA), today announced four significant hires as the business...

Mandiant CEO Kevin Mandia Joins Cohesity Board of Directors and Newly Formed Cohesity Security Advisory Council (Cohesity) Cohesity Security Advisory Council Brings Together Visionaries With Deep Security Expertise from Mandiant, Netflix, and the NSA to Advise on Emerging Cyber Threats

Open Systems Hires iboss, Cylance Vet as New CMO, New Partner Program Coming (Channel Futures) The new CMO said the market opportunity for Open Systems is enormous.

Products, Services, and Solutions

Onapsis Launches Threat Intel Center to Enhance Business-Critical Application Security (Onapsis) Leading provider of business-critical application security links Onapsis Research Labs’ strategic intel with platform data to simplify threat intelligence for security teams

Code42 Instructor Uses Security Education to Scale Effective Response to Data Exfiltration Events with Incydr (Code42) Code42 Software, Inc.®, the Insider Risk Management (IRM) leader, today launched a new integration between its two leading IRM solutions – Instructor and Incydr – to accelerate and scale in-the-moment response to risky employee behaviors. The new capability allows security, compliance and education teams to immediately send corrective lessons triggered by employee actions that create […]

Financial Compliance Platform Kompliant Selects authID’s Biometric Authentication for Secure Merchant Onboarding (GlobeNewswire News Room) Adding best-in-class identity fraud and account takeover prevention, while offering a secure, frictionless onboarding experience

Delinea Server Suite Increases Privileged Security for the Largest and Newest Linux Distributions and Improves Integration with Windows Active Directory (PR Newswire) Delinea, a leading provider of privileged access management (PAM) solutions for seamless security, today announced the latest release of Server...

Datadobi's Latest StorageMAP Update Enables IT Leaders to Significantly Reduce Liability and Risk (Datadobi) Datadobi announces enhancements to StorageMAP with the introduction of capabilities to discover and remediate orphaned data.

Palo Alto Networks, Wipro Launch Managed Secure Access Service Edge (SASE), Network Defense Solutions (MSSP Alert) Palo Alto Networks, Wipro announce security solutions to help organizations "simplify, orchestrate and accelerate their cloud journey."

Shinshu University Selects TOYO Corporation’s Portable Security Solution to Enable Secured DX for the Academic Network (Business Wire) Shinshu University selects TOYO Corporation’s NetEyez Security Portable to Enable Secured DX for the Academic Network.

Australian state contracts Unisys to deploy iris and face biometrics in prisons for $12.8M (Biometric Update) The new system will replace existing touch devices with multimodal contactless scanners able to capture and process iris and face biometrics simultaneously.

Clarks Consolidates End-to-End Cybersecurity Estate with Check Point Software Technologies (GlobeNewswire News Room) Check Point’s cloud, network and endpoint solutions provide simplified management, best threat prevention and visibility, while improving cost efficiencies...

Resecurity Broadens Alliance with Cloud Seguro in Colombia (PR Newswire) Resecurity, Inc., a U.S. cybersecurity and intelligence company, announced its deepened partnership with Cloud Seguro to expand Resecurity's...

Resecurity showcased Cyber Threat Intelligence and Dark Web Monitoring at Defense & Security 2022 (PR Newswire) Resecurity, a cybersecurity and intelligence company, recently showcased its dark web monitoring and cyber threat intelligence solutions at the...

Akamai customizes Zero Trust solutions to each customer’s needs including micro-segmentation, restricting application access, securing internet access, and multi-factor authentication – PART 1 (Telecom Reseller) Zero Trust, as a required technology for enterprise, has been accelerating for the last several years based on the restructuring of corporate workplace to include remote working policies which highlighted the vulnerabilities in company networks.

Kaspersky launches Security Operations and Threat Hunting course for infosec experts (Hypertext) Education is a core aspect of cybersecurity and Kaspersky has launched a new course with the intention of helping business establish or enhance security operations centres (SOC).

Cisco partners with Radiflow for its OT security expertise (VentureBeat) Cybersecurity company Radiflow today announced a technology partnership with Cisco to provide IDS for Cisco's OT facilities.

Keeper Security Launches Upgraded MSP Platform (PR Newswire) Keeper Security, the leading provider of zero-trust, zero-knowledge and FedRAMP Authorized cybersecurity software, today released an upgraded...

Technologies, Techniques, and Standards

NSA Releases Future Quantum-Resistant (QR) Algorithm Requirements for National Security Sy (National Security Agency/Central Security Service) The National Security Agency (NSA) released the “Announcing Commercial National Security Algorithm Suite 2.0” (CNSA 2.0) Cybersecurity Advisory (CSA) today to notify National Security Systems (NSS)

NSA sets 2035 deadline for adoption of post-quantum cryptography across national security systems (FedScoop) The National Security Agency in new guidance Wednesday said it expects the owners and operators of national security systems to start using post-quantum algorithms by 2035. In an advisory note, the intelligence agency recommended that vendors start preparing for the new technology requirements but acknowledged that some quantum-resistant algorithms have yet to be approved for […]

Fighting Ransomware Takes an Army: Our Public & Private Sector Soldiers Join Forces (Dark Reading) Continued collaboration will help win the fight as cybersecurity remains a national priority. International and public-private cooperation is helping stem the damage from ransomware threats and cyberattacks.

Academia

Yeshiva University cybersecurity program rockets up in national rankings (Cleveland Jewish News) It’s also drawing applicants outside the school’s traditional base, including more women and students from outside the country.The post Yeshiva University cybersecurity program rockets up in national rankings appeared first

Legislation, Policy, and Regulation

Inglis: Hundreds of gov’t, business orgs consulted for national cyber strategy (The Record by Recorded Future) More than 300 different organizations within the U.S. government and private sector have been consulted on the new national cybersecurity strategy, according to National Cyber Director Chris Inglis.

NSA official: 'Open society' keeps US ahead on cybersecurity, technology (The Record by Recorded Future) The National Security Agency’s No. 2 official said Wednesday that the U.S. still outpaces foreign adversaries when it comes to cybersecurity and technology thanks to the country’s “open society.”

CISA Director: Tech industry should infuse security at product design stage (Cybersecurity Dive) Agency director Jen Easterly outlined a push for faster incident reporting and closer industry collaboration.

‘Treat us like adults’: CISOs air criticism of U.S. gov’t cyber outreach (The Record by Recorded Future) The CISOs for Yahoo, Netflix and Block criticized the U.S. government’s engagement efforts with the private sector, raising concerns about incident reporting and more.

Biden Cybersecurity Executive Order: Ex-US Secret Service Reflects (Trend Micro) President Biden signed Executive Order 14028, “Improving the Nation’s Cybersecurity,” on May 12, 2021 - read Ed Cabrera, former CISO of the US Secret Service, thoughts on the subject.

CISA to Hold Meetings to Flesh Out Cyber-Incident Reporting Rules (Wall Street Journal) The Cybersecurity and Infrastructure Security Agency will launch 11 consultations with critical-infrastructure operators over the coming weeks in an effort to flesh out cybersecurity reporting rules that Congress passed earlier this year.

Technical Cybersecurity Support Plan for Public Water Systems - Report to Congress (US Environmental Protection Agency) The Infrastructure Investment and Jobs Act (Public Law No. 117-58) (hereinafter, Bipartisan Infrastructure Law or BIL) requires the U.S. Environmental Protection Agency (EPA), in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), to develop a Technical Cybersecurity Support Plan (hereinafter, Support Plan).

Technical Cybersecurity Support Plan for Public Water Systems: U.S. Environmental Protection Agency Issues Report to U.S. Congress (JD Supra) The United States Environmental Protection Agency (“EPA”) issued a document related to the drinking water sector titled: Technical...

Cybersecurity Best Practices for the Safety of Modern Vehicles (NHTSA) This document from the National Highway Traffic Safety Administration (NHTSA) updates the Agency’s non-binding and voluntary guidance to the automotive industry for improving motor vehicle cybersecurity. NHTSA encourages vehicle and equipment manufacturers to review this guidance to determine whether and, if so, how to apply this guidance to their unique systems.

NHTSA Updates Vehicle Cybersecurity Guidelines (National Highway Traffic Safety Administration) Connected vehicle technology is on the rise, offering customers a wealth of new features. However, this technology also leaves users more vulnerable to cybersecurity threats, and as such, the National Highway Traffic Safety Administration, or NHTSA, has released updated cybersecurity best practices for new vehicles.

White House Cyber Director Shares Concerns That Keep Him Up at Night (ClearanceJobs) White House Cyber Director, the Honorable Chris Inglis shared key developments, initiatives, and concerns with the Billington Summit audience.

NSA Deputy Chief: Lack of US 'readiness' against adversaries worrying (Al Mayadeen English) When asked what keeps him awake at night, NSA Deputy Director George Barnes said the lack of the United States' readiness to respond to foreign adversaries' actions.

Have the Huawei Bans Achieved the US’ Intended Goals? (International Banker) The last few years have seen the US approve increasingly punitive legislation against Huawei, much of which has been based on perceiving the Chinese telecom giant as a national-security risk. But have the bans been effective? Have they influenced US-China relations? And has the US suffered more than China in the race to 5G supremacy?

Litigation, Investigation, and Law Enforcement

WT1SHOP: Authorities Seize Online Marketplace Selling Stolen Login Credentials and Other PII (Flashpoint) On Tuesday, the DOJ released notice that illicit marketplace WT1SHOP, led by Nicolai Colesnicov, has been seized by authorities.

Elon Musk Allowed to Amend Twitter Countersuit to Add Whistleblower Claims (Wall Street Journal) The judge in the lawsuit over Twitter and Elon Musk’s stalled $44 billion takeover said the billionaire can amend his countersuit to include allegations of mismanagement by the social-media platform’s former head of security.

Material on foreign nation’s nuclear capabilities seized at Trump’s Mar-a-Lago (Washington Post) Some seized documents were so closely held, only the president, a Cabinet-level or near-Cabinet level official could authorize others to know

Opinion The Trump search case judge doesn’t get the national security stakes (Washington Post) Okay, Judge Aileen Cannon, you’ve got me stumped: How can the U.S. government conduct a national-security damage assessment about possibly leaked classified documents if FBI criminal investigators can’t look at the documents or interview witnesses to figure out who might have had access to the material?

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

SOC Analyst Appreciation Day (Virtual, Oct 19, 2022) SOC analysts are too often overworked and underappreciated, leading to burnout and turnover. Devo established SOC Analyst Appreciation Day™ to pay some long-overdue kudos to YOU and to encourage organizations to improve SOC analyst job satisfaction and mental well-being. This year, the second annual SOC Analyst Appreciation Day™ will be held on October 19. Stay tuned for this year's agenda!

Dragos Industrial Security Conference (DISC) (Hanover, Maryland, USA, Nov 5, 2022) At DISC 2022, you’ll hear ICS research on threats, malware, incidents, and vulnerabilities conducted by our intelligence and threat operations teams. 100% free as a thank you to the ICS asset owner and operator community. The program is technical, research-oriented, and contains actionable advice based on lessons from the field. This event is exclusively for industrial infrastructure asset owners or operators in electric, oil & gas, chemicals, food & beverage, pharmaceutical, manufacturing, mining, and more.

Events

13th Annual Billington Cybersecurity Summit (Washington, DC, USA, Sep 7 - 9, 2022) The world's leading government summit on cybersecurity will continue its unique educational mission of convening the who's who in cybersecurity: the senior leadership from the U.S. government, our allied partners, and their industry and academic partners. Given the fast moving strategic direction that the Biden Administration has generated over the past year, this event will take a holistic view of the cybersecurity business with a hearty dose of topics covering Zero Trust, proactive cyber defense measures, partnership building, offensive cyber, and a continued look at what the future will bring to the cybersecurity mission. Once again, Billington will play host to the Federal Government's most senior cyber and IT managers and experts, some of the most innovative cybersecurity providers in the business, and a broad range of expertise from across the public and private sectors. Like the past Billington events, we expect groundbreaking news and a content rich discussion focused on lessons learned, best practices, and things to consider as you build and enhance your own cybersecurity programs.

Hack Red Con 2022 (Louisville, Kentucky, USA, Sep 7 - 11, 2022) Hack Red Con 2022 is a Cyber Security Conference, Training and Networking 4 day event with an emphasis on Red Teaming, Pen Testing, Social Engineering, and all aspects of Off Sec. The Conference aims to connect Off Sec Professionals, Companies, Educators, Influencers, Investors, Entrepreneurs and Federal, State, Local Government Agencies together. This 4 day event will have 2 intense training days of the latest in Off Sec Education by the industries top hackers and industry experts. The following 2 conference days will include world class key note speakers, industry talks, roundtables, events including Hack the Flag, Jeopardy and Kentucky Bourbon, Lock Hack Challenges, Hack Career Meet & Great, Invest in Cyber, and of course the sickest Swag and Gear Giveaways.

WiCyS Book Club (Virtual, Sep 12, 2022) Join us on September 17 at 12pm CT for the first WiCyS Book Club meeting! The WiCyS Book Club is about creating the space in our hectic lives to connect as a community and bring diverse perspectives into a lively discussion about pre-selected books. This book club meets bi-monthly and will review various cybersecurity and privacy-related books. Meeting Date/Time: September 17 at 12pm CT Book: Cyber Privacy: Who Has Your Data and Why You Should Care by April Falcon Doss About the Book: You shouldn't have to be a privacy expert to understand what happens to your data. In Cyber Privacy, Doss demystifies the digital footprints we leave in our daily lives and reveals how our data is being used - sometimes against us - by the private sector, the government, and even our employers and schools. Attend the meeting for a discussion about the book and how these issues impact our lives! REGISTRATION IS REQUIRED. After registering, you will receive a confirmation email containing information about joining the meeting.

SASE Converge 2022 (Virtual, Sep 13 - 14, 2022) The concept of work has been completely transformed. It is no longer a location, but an activity. This new era of hybrid work means a new generation of never-before-seen threats. Is your network ready? To succeed in this new world, we need to reimagine our infrastructure to support the flexibility demanded by the modern workforce - without compromising security or user experience. ZTNA 2.0 provides you a critical first step in accomplishing a successful SASE deployment and unlocking this next phase of growth for your organization. Join us at SASE Converge 2022 to learn from industry experts about the latest trends and innovations in SASE, so you can lead the transformation of your infrastructure with confidence.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.