Cyberattacks and sanctions. Underworld notes. Update on the hybrid war.

Summary

By the CyberWire staff

At a glance.

Albania reports more Iranian cyberattacks.
RaidForums' successor.
A look at threat actor reconnaissance in the contemporary Internet.
Attacks on infrastructure (but these are kinetic strikes, not cyberattacks).
Update on the cyber phase of the hybrid war.

Albania reports more Iranian cyberattacks.

Albania reports that it sustained additional cyberattacks from Iran over the weekend, evidently in response to Tirana severing of relations with Tehran over earlier cyber incidents. In the most recent attacks, CNN reports that the Total Information Management System (TIMS) used for border control was taken offline.

As the outlines of Iranian attacks against Albania's government networks become clearer, the US Treasury Department announced sanctions against Iran's Ministry of Intelligence and Security (MOIS) and its Minister of Intelligence, Esmail Khatib, in response to their involvement in cyberattacks on the NATO country. Mr. Khatib is singled out for his role in directing "several networks of cyber threat actors involved in cyber espionage and ransomware attacks in support of Iran’s political goals." Iran condemned the US action, Al Arabiya reports, with the Foreign Ministry saying, “America’s immediate support for the false accusation of the Albanian government... shows that the designer of this scenario is not the latter, but the American government.”

Microsoft described Iran's campaign against Albania in a report published last Thursday: "Microsoft assessed with high confidence that on July 15, 2022, actors sponsored by the Iranian government conducted a destructive cyberattack against the Albanian government, disrupting government websites and public services. At the same time, and in addition to the destructive cyberattack, MSTIC assesses that a separate Iranian state-sponsored actor leaked sensitive information that had been exfiltrated months earlier. Various websites and social media outlets were used to leak this information."

Do you ask yourself these questions?

“What does my organization look like from an attacker’s point of view, and how should it find and prioritize the issues attackers will see first?” – then this Gartner research can help you. According to Gartner, “security and risk management leaders who are aware of their attack surface can improve their risk posture by prioritizing security hygiene and increasing its visibility.” LookingGlass is excited to offer you this complimentary Gartner research, Innovation Insight for Attack Surface Management.

RaidForums' successor.

KELA released a report today describing BreachForums (also known as Breached), a cybercrime forum that’s risen in response to the closure and seizure of RaidForums. The site, launched by the threat actor whose nom-de-hack is “pompompurin,” offers database leaks, login credentials, adult content, and hacking tools. Breached launched only a few weeks after RaidForums was closed, and has quickly risen to become the new platform for database exchange, with 82,000 registered users, which continues to increase. Besides that, the forum is active with monthly posts, and with participation by known actors from RaidForums. "Breached is not only the successor of RaidForums, but in a very short timeframe has become a promising data leak marketplace. The increasing number of users, monthly posts on the forum, and the fact that known actors from RaidForums have chosen to join the platform shows pompompurin’s popularity and influence," KELA concludes. "It also seems that ransomware operators are allowed to post, which expands the possibilities for a wide range of cybercriminals. KELA believes that the forum will continue gaining popularity in the next months and could become bigger and even more sophisticated than RaidForums."

Attend Mandiant Worldwide Information Security Exchange (mWISE) Oct 18-20

Hear insights, gather intel, and learn about best practices from security practitioners to CISOs at Mandiant Worldwide Information Security Exchange (mWISE). A new event from security leader Mandiant for an evolving cybersecurity industry, focused on gathering bright minds from across the globe. Curated by a program committee of experts without vendor influence. Attend October 18-20 online or in-person in Washington, DC. Learn more or register now.

A look at threat actor reconnaissance in the contemporary Internet.

Censys has published a report on the state of the Internet, finding that 88% of Internet-connected risks are caused by misconfigurations or accidental exposures: “[I]dentification of misconfigurations and exposures can be among the first observations a threat actor makes when performing initial reconnaissance on an organization. Good security hygiene that addresses misconfigurations and exposures may not be as exciting as a zero day, but it’s a critical piece of defense in depth for any security program.”

One of the questions the report asks is, how are organizations responding to vulnerability disclosures? It suggests that there have in general been three kinds of response:

"Near-immediate upgrading: Systems vulnerable to Log4j acted quickly based on the widespread coverage of the vulnerability. By March 2022, Censys observed only 36% of potential vulnerable services were left unpatched.
"Upgrading only after the vulnerability is being actively and widely exploited: While the GitLab vulnerability was being exploited, the remediation process acted slower than others until researchers discovered a botnet composed of thousands of compromised GitLab servers participating in DDoS campaigns.
"Near-immediate response by taking the vulnerable instance off the Internet entirely: Rather than upgrading, users chose to remove assets entirely from the Internet after Confluence's vulnerability became public between June 2021 and March 2022."

Attacks on infrastructure (but these are kinetic strikes, not cyberattacks).

As Russian forces retreat from the vicinity of Kharkiv, Reuters reports, they have retaliated with attacks against Ukrainian electrical and water utilities in the area. Those attacks were kinetic, conducted by repurposed air defense and anti-shipping missiles as the Russian army runs short on cannon artillery, and they're not the long-feared Russian cyberattacks. Ukrainian authorities denounced the attacks, the New York Times says, as "deliberate" and "cynical."

Elsewhere in critical infrastructure, external power having been restored to the Zaporizhzhia nuclear plant, the Ukrainian operators are performing a cold shutdown on the last operating reactor in the complex, according to the AP. That doesn't entirely remove the danger of a nuclear incident, but it does reduce the possible effects of any damage, whether accidental or deliberate.

Update on the cyber phase of the hybrid war.

While cyber operations in Russia's war have been eclipsed by kinetic operations, Ukrainian authorities warn that they expect an increase in the tempo of Russian cyberattacks. The Voice of America quotes Deputy Minister of Digital Transformation Georgii Dubynskyi, who told reporters at the Billington Cybersecurity Summit this past Friday, "We saw this scenario before. They are trying to find a way how to undermine, how to defeat our energy system and how to make circumstances even more severe for Ukrainians. We are preparing.” An increase in cyber operations may represent a form of escalation intended to compensate for widespread battlefield failure. "We cannot compare it with nuclear weapons, but the effectiveness of that is enough," Dubinskyi said, which of course is correct: cyber weapons aren't to be compared with nuclear weapons in terms of their effects. Ukraine also faces an insider threat, and this threat is a familiar one. "[The Russians] are developing classical operations, using not only cyber, not only software, also using some human resources," Dubinskyi said. "Using some traitors."

The effects of Russian cyberattacks continue to be felt in NATO countries that have supported Ukraine. ABC News reports that Macedonia is still recovering from a large cyber campaign Russia mounted as a punitive action for that country's pro-Ukrainian sympathies.

A report this morning by CyberCube sees one possible enduring effect of the hybrid war: Russian use of criminal cyber gangs as privateers, coupled with the growing isolation of an increasingly autarkic Russian Internet, may give the gangs a long-term safe harbor from which they operate with even greater impunity than that already afforded them by Russian toleration. This expectation is already beginning to appear in the calculations insurers are applying to cyber risk:

"Russia is using ransomware gangs to undermine the US economy while avoiding direct war with the US. European energy companies that are being targeted for strategic value.
"Russian actors are targeting governments outside of Ukraine. This is intended to gather intelligence on Western allies assisting Ukraine’s war effort.
"Ransomware threat actors are today focussing their efforts more on Russia than on other parts of the world.
"Forward-looking (re)insurers are starting to adopt a threat-modeling approach to portfolio risk management. Reinsurers should look across their portfolios for indications that certain companies may be susceptible to different threat actors."

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Notes.

Today's issue includes events affecting Albania, Australia, Cameroon, China, Côte d'Ivoire, the European Union, Germany, Greece, Iran, Ireland, Israel, Montenegro, Morocco, NATO/OTAN, Russia, Senegal, Togo, Ukraine, the United Kingdom, and the United States.

Dateline Moscow and Kyiv: Ukraine's counteroffensive progresses.

Ukraine at D+200: Ukraine retakes ground. (CyberWire) Ukrainian forces see success along all three axes of advance in its counteroffensive. The prospect of Russian cyberattacks remains a concern, and Ukraine says it's preparing for a wave of them, but so far they have yet to materialize.

Latest Developments in Ukraine: Sept. 12 (VOA) The latest developments in Russia’s war on Ukraine. All times EDT. 5:15 a.m.: The Ukrainian Agrarian Council said Monday that Ukrainian farmers are likely to cut the winter grain sowing area by at least 30% because of a...

Exclusive: Russian soldiers 'literally running' for their lives as chain of command collapses (The Telegraph) Ukraine intelligence unit fighters tell The Telegraph they are struggling to deal with the mountains of equipment left behind after rout

Russia's front line collapses as Ukrainians recapture an area the size of Lancashire (The Telegraph) Volodymyr Zelensky: 'These last few days the Russian army has shown us its best side, its back. It's a good choice for them to flee'

Russia confirms big retreat near Kharkiv as Ukraine offensive advances (Washington Post) Russia’s defense ministry on Saturday admitted its forces had retreated from key towns in northeastern Ukraine after a stunning advance by Ukrainian troops.

Russia-Ukraine war live: Kharkiv mayor accuses Russian forces of targeting ‘densely populated residential area’ as they shell city (the Guardian) Area under attack does not contain military infrastructure, Kharkiv’s mayor says

Ukraine seizes the initiative in the east (The Economist) A lightning offensive near Kharkiv could mark a turning-point in the war

Exclusive: Russian soldiers 'literally running' for their lives as chain of command collapses (The Telegraph) Ukraine intelligence unit tells The Telegraph they are struggling to deal with the mountains of equipment left behind after rout

Russian frontline in Kharkiv collapses in major victory for Ukraine (The Telegraph) Kyiv’s forces are now believed to have freed the strategically significant cities of Izium and Kupyansk in a surprise lightning offensive

Ukraine-Russia war: residents of Russian-controlled Kharkiv told to evacuate as Ukrainian counter-offensive advances – as it happened (the Guardian) Russian-installed administrator makes announcement after occupying forces pull out of two key towns in face of Ukrainian offensive

Ukraine takes ‘substantial’ victory over Russians in Kharkiv offensive (The Telegraph) Thousands of Kremlin soldiers could be trapped by Kyiv forces as Moscow braced for worst battlefield defeat since Second World War

Ukraine claws back some territory; nuclear plant in peril (AP NEWS) Ukrainian forces on Friday claimed new success in their counteroffensive against Russian forces in the country's east, taking control of a sizeable village and pushing toward an important transport junction.

Last reactor at Ukraine's Zaporizhzhia nuclear plant stopped (AP NEWS) Europe's largest nuclear plant has been reconnected to Ukraine's electricity grid, allowing engineers to shut down its last operational reactor in an attempt to avoid a radiation disaster as fighting rages in the area.

Russia Strikes Power Plants as Ukrainian Forces Extend Gains (Bloomberg) Blackouts experienced across northeast Ukraine overnight. Russian losses could mark a turning point in the conflict.

Ukraine hails snowballing offensive, blames Russia for blackouts (Reuters) President Volodymyr Zelenskiy hailed Ukraine's offensive in the northeast Kharkiv province as a potential breakthrough in the war, saying this winter could bring more rapid gains of territory if Kyiv can get more powerful weapons.

Ukraine region of Kharkiv reports blackouts, water cuts after Russian attacks, governor says (Reuters) Power blackouts and cuts in water supply hit several areas of Ukraine's northeastern region of Kharkiv on Sunday as Russian attacks hit infrastructure sites, the region's governor said.

Ukraine says Russia is retaliating by hitting critical infrastructure, causing blackouts. (New York Times) Kyiv condemned the strikes as an act of revenge as Russian forces retreat in the northeast.

Ukraine’s southern offensive ‘was designed to trick Russia’ (the Guardian) Exclusive: Russian forces wrong-footed by attack in Kharkiv region after preparing for offensive in the south

As Ukraine counterattacks, Russia’s military facing steep artillery, resupply challenges (Breaking Defense) Even before this weeks' gains by Ukraine, there were signs that Russia's artillery is wearing down, and that it is running low on munitions - potentially limiting Moscow's options.

Russia’s Retreat in Ukraine Pokes Holes in Putin’s Projection of Force (New York Times) Russia’s military setbacks may be weakening President Vladimir V. Putin’s reputation at home as a savvy geopolitical strategist.

Putin is finished. The Ukrainians have him on the ropes with a stunning victory in their sights (The Telegraph) In 72 hours, the Ukrainian Armed Forces have retaken over 2,500 sq km of Russian-occupied Ukraine

Putin's imperial dream is collapsing before our eyes (The Telegraph) The scale of disaster is forcing even pro-Russian officials to acknowledge that the Ukrainians are gaining ground

One young Ukrainian soldier’s death felt by family, friends and country (Washington Post) The last time Svitlana Povalyaeva saw her son alive was at a funeral.

Excalibur is no longer a myth as Pentagon confirms supplying Ukraine with 'most accurate' shell (The Telegraph) Devastating satellite-guided weapons have been sent into the war against Vladimir Putin’s invaders, US defence documents reveal

Ukrainian gunners salute Queen Elizabeth II with tributes on shells (The Telegraph) Kyiv's politicians, front-line soldiers and civilians offer their condolences to the late Queen amid appreciation for Britain’s war aid

Ukraine is fighting both a physical and cyber war against Russia (NPR.org) NPR's Michel Martin speaks with Dina Temple-Raston, host of the podcast Click Here, about Ukraine's volunteer IT Army.

Ukraine Warns Russian Cyber Onslaught Is Coming (VOA) A top Ukrainian cyber official visiting US says Moscow is looking to target Ukraine’s energy, financial sectors with precision cyber strikes, bolstered by military attacks

Cyber trends in the wake of Russia-Ukraine war undergoing evolution – report (Insurance Business) US companies have been targeted

Russia’s sovereign internet could see cyber insurance implications – CyberCube (Insurance Times) There could be potential future 'collaboration' between Russian, North Korean and Chinese internets that could increase the likelihood of cyber attacks, says CyberCube consultant

CyberCube: Russia’s Sovereign Internet Creates Security Risks With Implications for Cyber (Re)Insurance While War in Ukraine Develops (AP NEWS) Press release content from Business Wire. The AP news staff was not involved in its creation. A sovereign Russian internet could lead to cyber criminal safe havens, greater confidence that large-scale attacks can be carried out without consequences, and intelligence blindspots, according to a new report published today by cyber risk analytics expert CyberCube.

Weaponized cybercrime: Learning from the conflict in Ukraine (Business Leader) Sergey Shykevich explores how the conflict in Ukraine has impacted cyber security and what businesses can learn from this.

Montenegro wrestles with massive cyberattack, Russia blamed (ABC News) At the government headquarters in NATO-member Montenegro, the computers are unplugged, the internet is switched off and the state’s main websites are down

Kyiv officials lay out vision for security, digital future at DC event (Defense News) Ukraine's leaders have in recent months advocated for international spending to reinvigorate industries and rebuild its economy, both ravaged by Russia.

Putin Is Trying to Turn Ukraine Into a Culture War (Foreign Policy) A conservative message isn’t selling well on the Russian homefront.

A ‘New’ Gorbachev Won’t Rescue U.S.-Russia Relations After Putin (World Politics Review) After Mikhail Gorbachev’s death, many wondered if another Gorbachev-like figure could repair US-Russia relations. But that’s unlikely.

Time for the West to seize Russian state assets (The Hill) To win the war against Russia, monetary support will be as important to Ukraine as will be the delivery of weapons.

The EU Is Playing a Pretty Strong Hand on Europe’s Energy Crisis (World Politics Review) An emergency meeting of the EU’s energy ministers will attempt to resolve Europe's energy crisis, but several unanswered questions remain.

Attacks, Threats, and Vulnerabilities

Albania blames Iran for second cyberattack since July (CNN) Albania blamed the Iranian government Saturday for a cyberattack against computer systems used by Albanian state police — just days after the White House condemned Tehran for a hack that disrupted Albanian government services in July.

Albania targeted by Iranian cyberattack shortly after cutting relations (Jerusalem Post) Albania's prime minister said that no data leaks were caused by the latest cyberattack.

Albania was hit by a new cyberattack and blames Iran (Security Affairs) Albania blamed Iran for a new cyberattack that hit computer systems used by the state police on Friday. Albania blamed the government of Teheran for a new cyberattack that hit computer systems used by the state police on Saturday. “The national police’s computer systems were hit Friday by a cyberattack which, according to initial information, […]

Albania reports 2nd cyberattack by Iran, on border systems (Alton Telegraph) TIRANA, Albania (AP) — Albania’s Interior Ministry said Saturday that one of its...

Iranian Actors Targeted SharePoint Flaw in Attack on Albania (Decipher) The Iranian state-backed actors who attacked the Albanian government targeted an old SharePOint vulnerability for initial access.

Microsoft investigates Iranian attacks against the Albanian government (Microsoft Security Threat Intelligence) Shortly after the destructive cyberattacks against the Albanian government in mid-July, the Microsoft Detection and Response Team (DART) was engaged by the Albanian government to lead an investigation into the attacks.

Microsoft: Iranian hackers breached Albanian government more than a year before main hack (IT PRO) Investigation reveals how long Iran spent inside government systems and how little damage it actually did

Microsoft: Multiple Iranian Groups Conducted Cyberattack on Albanian Government (SecurityWeek) Microsoft has identified four Iranian hacking groups that participated in a July 2022 cyberattack targeting the Albanian government.

Iranian APT42 Launched Over 30 Espionage Attacks Against Activists and Dissidents (The Hacker News) Iranian state-linked APT42 hacker group carried out more than 30 confirmed cyber espionage attacks against activists and dissidents.

Iran-linked APT42 is behind over 30 espionage attacks (Security Affairs) Iran-linked APT42 (formerly UNC788) is suspected to be the actor behind over 30 cyber espionage attacks against activists and dissidents. Experts attribute over 30 cyber espionage attacks against activists and dissidents to the Iran-linked APT42 (formerly UNC788). The campaigns have been conducted since 2015 and are aimed at conducting information collection and surveillance operations against […]

Threat From Iranian Regime’s Cyber Army Is Real but Over-sold - NCRI (NCRI) Hossein Salami, the commander of Iran’s Islamic Revolutionary Guard Corps (IRGC), delivered a boastful speech on Tuesday in which he claimed that the

US midterms likely to be targeted by foreign cyberespionage efforts (SC Media) Numerous state-sponsored threat groups are expected with high confidence by Mandiant to launch cyberespionage efforts against U.S. election infrastructure as the midterm polls near, according to The Register.

How Simple Claims of Election Interference Can be Enough to Prompt Real-World Threats (Nextgov.com) Federal officials remain on guard against foreign meddling in U.S. elections, as CISA and other agencies work to strengthen partnerships and intelligence sharing efforts with state and local election administrators.

Hackers Repeatedly Targeting Financial Services in French-Speaking African Countries (The Hacker News) Multiple major financial services companies in French-speaking Africa have been repeatedly attacked by hackers as part of the DangerousSavanna.

Shape-shifting cryptominer savaging Linux endpoints and IoT (Register) Also, Authorities seize WT1SHOP selling 5.8m sets of PII, The North Face users face tough security hike

New Linux malware combines unusual stealth with a full suite of capabilities (Ars Technica) With polymorphic encoding and a multistage infection chain, Shikitega is hard to detect.

Ransomware gangs switching to new intermittent encryption tactic (BleepingComputer) A growing number of ransomware groups are adopting a new tactic that helps them encrypt their victims' systems faster while reducing the chances of being detected and stopped.

Israeli-made Spyware Was Used to Hack Phone of Greek Ex-minister (Haaretz) The scandal over use of the malicious software in Greece grows as a former minister from a left-wing party became the third person said to have been targeted with the Israeli Predator spyware

Fake Minecraft updates pose threat to users | The Express Tribune (The Express Tribune) Updates are infecting thousands of PCs with viruses

Philippine Airlines Suffers Cyberattack With Frequent Flyer Program (Simple Flying) The incident affected thousands of travelers who became members from 2015 to 2017.

Everything we know so far about the ransomware attack on Los Angeles schools (Yahoo Finance) Los Angeles Unified School District, or LAUSD — the second largest district in the U.S. with more than 1,000 schools and 6,000 students — confirmed this week that it was hit by a cyberattack over the weekend, disrupting access to its IT systems. Details about the incident, described as "criminal in nature" and later confirmed to be ransomware, remain vague. It’s not yet known whether data was stolen, and while LAUSD resumed classes as planned on Tuesday following the long Labor Day weekend, the impact on schools is currently unclear.

LA school district was warned of ransomware threat before recent shutdown (The Verge) Researchers found TrickBot malware on a device in the school network

Cybersecurity expert recommends schools stay on alert for cyber hacks as new year starts (WSTM) School safety goes beyond security guards, mental health awareness, and counseling.Schools are on high alert for potential cyber hacks, and it’s becoming more i

Ransomware attack knocked a Kentucky city-operated ISP offline before holiday (The Record by Recorded Future) The “Bourbon Capital of the World” is still investigating alleged ransomware attack.

OakBend Medical Center hit by ransomware; Daixin Team claims responsibility (Databreaches.net) While many were looking forward to the Labor Day holiday weekend, the IT department at OakBend Medical Center learned they had been hit with a ransomware attack. The center is still trying to recover.

Security Patches, Mitigations, and Software Updates

Cisco Releases Security Updates for Multiple Products (CISA) Cisco has released security updates to address vulnerabilities in multiple Cisco products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA encourages users and administrators to review the following advisories and apply the necessary updates:

The users most at risk from Microsoft’s mass security step-up (SecurityBrief Australia) A technology change three years in the making is finally about to start taking effect: the phasing out of ‘Basic Authentication’ for Outlook, Exchange Online and related services, replaced with a decidedly more modern approach to logging into email.

Trends

Censys Launches Inaugural State of the Internet Report (PR Newswire) Today, Censys, the leader in Attack Surface Management (ASM), launched its inaugural State of the Internet Report, a holistic view into...

State of the Internet Report (Censys) Gain vital cybersecurity insights from our analysis of over 23,000 incidents and 5,200 confirmed breaches from around the world—to help minimize risk and keep your business safe.

IronNet's September Threat Intelligence Brief 2022 (IronNet) IronNet September threat intelligence brief with threat intel rules (TIR) and update on IOCs.

Marketplace

Open Raven raises $20M to expand support for their portfolio of large enterprises (Help Net Security) Open Raven raises $20M to accelerate their roadmap and expand support for their increasing portfolio of large enterprises.

Normalyze Announces $22.2M in Series A Funding to Solve the Biggest Issue in Modern Cloud Security: Data (Normalyze) Security Industry Veterans from Netskope, Qualys, and Symantec Team Up With Backing from Battery Ventures and Lightspeed Venture Partners

Celerium Announces Acquisition of Dark Cubed (PR Newswire) Celerium Inc., a leader in innovative cyber defense solutions, today announced it has acquired Dark Cubed, the company providing automated...

Google Completes Acquisition of Mandiant (Google Cloud Press Corner) Google LLC today announced the completion of its acquisition of Mandiant, Inc. (NASDAQ: MNDT), a recognized leader in dynamic cyber...

Google + Mandiant: Transforming Security Operations and Incident Response (Google Cloud Blog) Google announced the completion of its acquisition of Mandiant, Inc. (NASDAQ: MNDT). Mandiant will join Google Cloud and retain the Mandiant brand.

Moving the Mission Forward: Mandiant Joins Google Cloud (Mandiant) Google's acquisition of Mandiant is now complete.

Darktrace ends buyout discussions with Thoma Bravo (CRN Australia) After both sides couldn’t reach agreement on a sale price.

Rising cyber insurance premiums haven’t scared away most companies (Axios) Since 2019, U.S. cyber insurance premiums more than doubled from $1.6 billion to $3.2 billion.

Patreon confirms security team layoffs (TechCrunch) A former Patreon security engineer says she, and the rest of Patreon's security team, were laid off.

Patreon security team layoffs cause backlash in creator community (CyberScoop) A former Patreon employee told CyberScoop that after the layoffs "there are no qualified security personnel" at the company.

Cerberus Sentinel Adds David Bronner as M&A Legal Counsel (Cerberus Sentinel) Cerberus Sentinel Adds David Bronner as M&A Legal Counsel. He will lead all legal matters regarding the company’s mergers and acquisitions

Ex-Deloitte CIO joins Silverfort as Strategic Advisor - Silverfort (Silverfort) Tim Fleming brings over 40 years’ risk management and innovation experience at large organizations to fast-scaling Unified Identity Security platform 12 September, Gartner IT Symposium/Xpo, Australia: Unified Identity Protection company Silverfort today announced the appointment of ex-Deloitte Australia and APAC CIO and Partner, Tim Fleming, as Strategic Advisor. Responsible for all commercial and operational technology...

Swimlane Appoints Frans Xavier as CTO and SVP of Engineering (Swimlane) Swimlane , the low-code security automation company, today announced the appointment of Frans Xavier as Chief Technology Officer and Senior Vice President of Engineering. Xavier will spearhead the company’s technical roadmap, implementing strategies to advance…

Products, Services, and Solutions

Lightspin Democratizes Cloud Security with Launch of Free Product Tier (PR Newswire) Lightspin, the #1 cloud security solution for SaaS companies of all sizes, today announced free access to its Cloud Native Application...

Technologies, Techniques, and Standards

Bayes Rule: A different way to think about cybersecurity risk. (CyberWire) In the last essay, I talked about superforecasters from Dr Tetlock’s book of the same name. He makes the case, and I agree with him, that it’s possible to forecast answers to highly complex questions, queries that seemingly no one could possibly answer because there are no prior data or history of occurence, with enough accuracy to make meaningful decisions in the real world. Specifically, I believe we can use his superforecasting techniques to estimate the probability of material impact to our own organizations due to a cyber attack.

CISA Welcomes Input on New Cyber Incident Reporting Requirements (CISA) Today, the Cybersecurity and Infrastructure Security Agency (CISA) announced their plans to issue a Request for Information (RFI) soliciting public input on approaches to implementing the cyber incident reporting requirements, pursuant to the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), which President Biden signed into law in March 2022. The RFI will publish in the Federal Register on Monday, September 12 and provide the public with 60 days to provide their written submissions.

Cyber Incident Reporting for Critical Infrastructure Act of 2022 Listening Sessions (Federal Register) The Cybersecurity and Infrastructure Security Agency (CISA) is announcing a series of public listening sessions to receive input as CISA develops proposed regulations required by the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). CISA is interested in receiving public...

CISA goes on tour to get feedback on cyber incident reporting rules (Federal News Network) The agency is seeking public input on the development of landmark cyber incident reporting regulations.

CISA preps solicitation for public feedback on incident reporting rule (The Record by Recorded Future) The Cybersecurity and Infrastructure Security Agency (CISA) on Friday announced its intent to issue a request for public feedback on the organization’s forthcoming cyber incident reporting rules.

DIA director sees room for improvement in cyber intelligence and support (FedScoop) The Department of Defense’s main intelligence arm is working to improve how it provides cyber intel to combatant commands around the world. “We think that there’s room for discussion about what’s the future of cyber intelligence really is in partnership with Cyber Command, NSA and others across the community to really define where we need […]

What Is White-Box Penetration Testing? (MUO) Are you looking to nip security problems in the bud? White-box pentesting could be the key.

Design and Innovation

Inside the World's First No-Coiner Conference - Decrypt (Decrypt) “Usually crypto events try to sell you something. We wanted this event to be free, rather than bribe people to be here.”

Solving the Unredacter Challenge (Bishop Fox) Learn how one of our Unredacter Challenge winners solved how to unredact a blurred image.

Unredacter Challenge - John L. Showcase Solution (Bishop Fox) We asked the security community to take Unredacter to the next level by decoding our secret blurred message. Watch as John L. showcases his solution.

Interview of Alejandro, one of the winners of the Unredacter Challenge (Bishop Fox) We asked the security community to take Unredacter to the next level by decoding our secret blurred message. Watch as Alejandro showcases his solution.

Research and Development

Can the Air Force Shield Its New ICBM from Cyberattacks? (The National Interest) As part of the development process for the Sentinel missile, the Air Force has been working with Northrop Grumman to engineer new command and control systems, computing infrastructure, and networking capabilities.

Legislation, Policy, and Regulation

‘Future of cyberspace’ on the line as US, Russia square off (The Sydney Morning Herald) A Russian and an American are in competition to run a little-known United Nations agency that experts warn authoritarian countries want to use to govern the internet.

Cyber Chief: Ireland's position in the world does not protect it from attacks by other countries (TheJournal.ie) Dr Richard Browne gave an interview to The Journal this week on the work of Ireland’s National Cyber Security Centre.

Treasury Sanctions Iranian Ministry of Intelligence and Minister for Malign Cyber Activities (U.S. Department of the Treasury) Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) is designating Iran’s Ministry of Intelligence and Security (MOIS) and its Minister of Intelligence for engaging in cyber-enabled activities against the United States and its allies.

Iran strongly condemns US sanctions over Albania hacking (Al Arabiya English) Iran on Saturday strongly condemned a US decision to impose sanctions on its intelligence ministry, blamed for a major cyber-attack on NATO ally

US Announces New Iran Sanctions Over Albania Cyber Attack (Barron's) The US announced sanctions Friday on Iran's Ministry of Intelligence and Security and its minister Esmail Khatib, after Tehran was identified as being behind an unprecedented cyberattack against NATO ally Albania.

U.S. Sanctions Iranian Intelligence Ministry and Its Leader, Citing Alleged Hacks (Wall Street Journal) The U.S. has imposed sanctions against Iran’s intelligence ministry and its chief, alleging they took part in malicious cyberattacks against the U.S. and its allies, the Treasury Department said.

US sanctions Iran’s Ministry of Intelligence over Albania cyberattack (BleepingComputer) The U.S. Treasury Department announced sanctions today against Iran's Ministry of Intelligence and Security (MOIS) and its Minister of Intelligence for their role in the July cyberattack against the government of Albania, a U.S. ally and a NATO member state.

US sanctions Iran intelligence agency over Albania cyberattack (The Record by Recorded Future) The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) on Friday imposed sanctions on Iran's primary intelligence agency and its top official less than two days after Albania cut diplomatic ties with Tehran over an attack on the country's government websites.

G-7 Privacy Regulators Aim To Ease Turbulent International Data Flows (Wall Street Journal) Privacy regulators from the Group of Seven countries met in Bonn, Germany, this week to discuss ways to allow data to move more smoothly between the world’s wealthy countries.

Exclusive: Biden to hit China with broader curbs on U.S. chip and tool exports - sources (Yahoo Finance) The Biden administration plans next month to broaden curbs on U.S shipments to China of semiconductors used for artificial intelligence and chipmaking tools, several people familiar with the matter said. The Commerce Department intends to publish new regulations based on restrictions communicated in letters earlier this year to three U.S. companies -- KLA Corp, Lam Research Corp and Applied Materials Inc, the people said, speaking on the condition of anonymity. The letters, which the companies publicly acknowledged, forbade them from exporting chipmaking equipment to Chinese factories that produce advanced semiconductors with sub-14 nanometer processes unless the sellers obtain Commerce Department licenses.

CIA Director Details Actions Taken to Deter Foreign Adversaries in Cybersecurity (Meritalk) William J. Burns, Director, Central Intelligence Agency (CIA) detailed some of the most important actions that they are undertaking to deter foreign adversaries in the realm of cybersecurity at the Billington Cybersecurity Summit on September 8.

Berlin sets up hotline for cyber-security attacks (TheMayor.EU) Authorities in Berlin set up a cyber-security hotline which will deal with cyber-attacks aimed at businesses. The hotline is part of the city’s Digitlagentur, which deals with the German capital’s dig..

An increase in cyber attack fines highlights firms’ need to tighten security (Open Access Government) One in five companies that has been the victim of a cyber attack has felt the increased financial impact of a substantial cyber attack fine

U.S. SEC to set up new office for crypto filings (Reuters) The U.S. securities regulator will set up two new offices to deal with filings related to crypto assets and the life sciences sector, the agency said on Friday.

Litigation, Investigation, and Law Enforcement

More than $30 million seized from North Korean hackers involved in Axie crypto-theft (The Record by Recorded Future) More than $30 million worth of cryptocurrency allegedly stolen by hackers connected to the North Korean government has been seized by law enforcement agencies.

FBI: Americans lost nearly $7 billion to cybercrime last year (CBS News) Ransomware kits are sold on the dark web, they cost as little as six dollars

Samsung is facing a class action suit over a recent data breach (Android Central) The company is accused of failing to fulfill its obligations as a data collector.

Google Pays ‘Enormous’ Sums to Maintain Search-Engine Dominance, DOJ Says (Bloomberg) DOJ suit alleges Google’s exclusive deals lock out rivals. Company says phone makers, browsers want its search engine.

Uber exec accused of disguising data-breach extortion as “bug bounty” (Ars Technica) Security experts: Uber exec "did nothing wrong" by disguising data breach.

Histadrut election candidate’s campaign manager arrested for cyber fraud (Times of Israel) Police say the accused sent 'hundreds of thousands' of fraudulent text messages to labor federation members with aim of overwhelming opponent's phone lines

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

WiCyS Book Club (Virtual, Sep 12, 2022) Join us on September 17 at 12pm CT for the first WiCyS Book Club meeting! The WiCyS Book Club is about creating the space in our hectic lives to connect as a community and bring diverse perspectives into a lively discussion about pre-selected books. This book club meets bi-monthly and will review various cybersecurity and privacy-related books. Meeting Date/Time: September 17 at 12pm CT Book: Cyber Privacy: Who Has Your Data and Why You Should Care by April Falcon Doss About the Book: You shouldn't have to be a privacy expert to understand what happens to your data. In Cyber Privacy, Doss demystifies the digital footprints we leave in our daily lives and reveals how our data is being used - sometimes against us - by the private sector, the government, and even our employers and schools. Attend the meeting for a discussion about the book and how these issues impact our lives! REGISTRATION IS REQUIRED. After registering, you will receive a confirmation email containing information about joining the meeting.

SASE Converge 2022 (Virtual, Sep 13 - 14, 2022) The concept of work has been completely transformed. It is no longer a location, but an activity. This new era of hybrid work means a new generation of never-before-seen threats. Is your network ready? To succeed in this new world, we need to reimagine our infrastructure to support the flexibility demanded by the modern workforce - without compromising security or user experience. ZTNA 2.0 provides you a critical first step in accomplishing a successful SASE deployment and unlocking this next phase of growth for your organization. Join us at SASE Converge 2022 to learn from industry experts about the latest trends and innovations in SASE, so you can lead the transformation of your infrastructure with confidence.

RhythmWorld Security Conference (Denver, Colorado, USA, Sep 13 - 15, 2022) RhythmWorld is the premier cybersecurity conference for the latest security insights, perspectives on emerging threats, and support in achieving your security goals. This year, we are happy to announce that we will return to the Mile High City for two full days of interactive peer-to-peer learning, networking, and an unforgettable experience. RhythmWorld attendees gain access to best practices, comprehensive training sessions featuring cybersecurity leaders from across the industry, connections to technical LogRhythm experts, and the chance to compete in a LogWars Capture the Flag (CTF) event.

2022 PCI SSC North America Community Meeting (Toronto, Ontario, Canada, Sep 13 - 15, 2022) The 2022 Community Meetings continue to be an opportunity to bring the PCI Security Standards Council community together and this year we especially look forward to reconnecting in person once again! Gather together with your community for important Council updates, insights on industry trends, strategies on best practices, engaging keynotes and industry expert speakers. Plus multiple opportunities for face to face networking and connecting!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.