Drata’s compliance automation platform was built to be customized. With 75+ deep integrations, continuous control monitoring, and custom controls and frameworks, you can achieve your unique compliance goals at any growth stage and in any security environment. Our Risk Management Solution can help you establish a security-first posture with minimal manual work. Take a look yourself and see why Drata is G2’s #1 Leader for cloud compliance.
The CyberWire is honoring Veterans Day with 15% off annual subscriptions of CyberWire Pro by using code VET2022. Veterans and service members can reach out to us directly at support@thecyberwire.com for an additional discount. Also, check out the special Veterans Day episode of CSO Perspectives along with the rest of the CyberWire Pro podcast lineup, plus exclusive briefings, articles, and events. Subscribe to CyberWire Pro here.
Zero-days' value drops quickly: once they're used they're blown, and they fall in value as organizations patch. Microsoft reported Friday that China seems to be using its vulnerability disclosure law to gain access to vulnerabilities before they're generally disclosed. This enables Chinese intelligence services, Microsoft suggests, to develop and deploy zero-day exploits during their brief window of opportunity. Beijing's interests remain focused on espionage and intellectual property theft.
Somebody once said, “if it ain’t broke, don’t fix it.” That somebody didn’t work in cybersecurity. And that somebody didn't work at Raytheon, Intelligence & Space. Here we break the definition of cyber defense: Hiring the sharpest minds, actively hunting threats, and designing one-of-a-kind-never-been-done-before solutions. That’s how we shake up the future and uncover new thinking to protect our customer's most vital infrastructure and our way of life.
The US midterm elections will conclude on Election Day tomorrow, although in most jurisdictions they've been underway in the form of mail-in and other early voting for weeks. There's been a recent surge in Russian disinformation deployed against US voters, the New York Times reports, with the Internet Research Agency's trolls and bots resurfacing. How successful the influence campaign will be is unclear, although widespread awareness that it's in progress will blunt such effect as it may have. The present campaign differs from earlier Russian efforts in the extent to which it seeks to convince as opposed to simply confuse: the positive line being pushed from St. Petersburg is that US support for Ukraine is a wasteful and losing cause. CISA, the Washington Post says, is taking a hands-off approach to specific disinformation. The agency will not, for example, flag specific false claims in social media.
US officials have recently expressed confidence that direct cyberattacks against election infrastructure (directly manipulating vote counts, for example, or interfering with reporting and tallying) are unlikely to have much if any effect. CISA's Friday communication about election security focused instead on the threat of dis- and misinformation, and in particular urged voters to remember that early counts are not official, and isolated local problems and accidents shouldn't be interpreted as evidence of systemic corruption or unreliability.
From passwords to phishing, business email compromise to social engineering, Aware Force delivers timely cybersecurity content all year long. Aware Force videos, quizzes, phishing exercises, and cyber news are branded and tailored for your organization. Your organization’s employees and senior leadership will be blown away! Plus, we deliver monthly readership metrics that can help with cyber insurance and compliance. Get 2023 Aware Force pricing here.
On Friday the US Federal Bureau of Investigation (FBI) offered an assessment of nominally hacktivist groups serving as Russian auxiliaries in the war against Ukraine. Groups like Killnet are having, the Bureau says, a minor effect at best. Their distributed denial-of-service (DDoS) attacks have not generally risen above a nuisance level. They've been "unsophisticated," and have fallen far short of achieving crippling effects on their targets. Their effect has been, the Bureau suggests, psychological as opposed to technical.
Ukraine's own auxiliaries, the directed hackers of the IT Army, have preferred website hijacking and counter-influence operations to DDoS. Kyodo News reports the organization has been responsible for some 8000 attacks against Russia targets since the start of the war. The intent hasn't been to disrupt operations, but rather to interfere with disinformation.
Elon Musk has said he intends to continue to deliver Starlink connectivity to Ukraine. Reuters reports that Ukraine trusts him on the matter, quoting digital transformation minister Mykhailo Fedorov as saying, "Elon Musk publicly spoke about this and we had a conversation with him about it, so we do not see a problem in this regard." That said, CNN reports that some 1300 Starlink terminals a British company provided to Ukrainian forces dropped offline last week. The reasons for the outage are unclear.
Other industry support for Ukraine continues uninterrupted, however. Microsoft said Thursday that it would continue to provide Ukraine with free cloud services through 2023. Vice Chair and President Brad Smith blogged that Redmond's assistance would extend beyond cloud services.
The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.
The tech sector as a whole is expecting rounds of layoffs this winter, Crunchbase reports, and some cyber companies, Varonis being the most recent, are also reducing their headcount. The most prominent recent layoffs, of course, took place at Twitter on Friday. The Verge puts the number of employees let go at around half of Twitter's pre-layoff 7500 personnel. By Sunday, however, Twitter was asking "dozens" of fired employees to return. They'd either been let go in error, Bloomberg reports, or, in other cases, Twitter belatedly realized they'd be essential to developing the new features envisioned for the platform. Crunchbase has a tracker detailing the current state of tech layoffs.
Bravo, Bitdefender, which has developed and released a decryptor for RasHassan ransomware.
Today's issue includes events affecting Australia, China, Czechia, Egypt, Germany, Greece, India, Iran, Israel, Japan, the Netherlands, Nigeria, Pakistan, Qatar, Russia, Singapore, Ukraine, the United Kingdom, and the United States.
Ukraine at D+256: Iranian drones are working (but not much else). (CyberWire) Iranian-supplied loitering weapons ("drones") are hitting Ukraine's power grid hard. Elsewhere the combat capability of Russian tactical air and ground units continues to fall short of expectations. Training remains a challenge, and Russia increasingly pins its hopes on Wagner Group mercenaries.
Russia-Ukraine war: List of key events, day 257 (Al Jazeera) As the Russia-Ukraine war enters its 257th day, we take a look at the main developments.
Ukraine Curbs Power Use as Russian Strikes Take Toll on Electric Grid (Wall Street Journal) The operator of Ukraine’s electricity-transmission system said the temporary restrictions on all consumers in seven regions were necessary to reduce pressure on the network.
Ukraine live briefing: Grid damage leaves 4.5M in Kyiv area without power, Zelensky says (Washington Post) About 4.5 million energy customers in the Kyiv region are experiencing stabilization blackouts because of Russian attacks on infrastructure, Ukrainian President Volodymyr Zelensky said Sunday. Vitali Klitschko, mayor of the city that bears the region’s name, discouraged panic and urged caution after one of his officials reported plans to evacuate should Kyiv fully lose electricity.
Iran Acknowledges Supplying Drones to Russia (Wall Street Journal) Tehran had denied until now that it had provided Moscow with the drones that Ukrainian officials say Russia has used to target civilian and energy infrastructure.
Ukraine Accuses Iran of Training Russian Drone Pilots (Wall Street Journal) Drone strikes on civilian targets across Ukraine have been so damaging that the capital’s mayor urged residents to consider temporarily leaving the city.
Ukraine war latest: Russia 'losing significantly more aircraft than it can replace' (The Telegraph) Russia has lost some 300 aircraft in Ukraine at a "significantly" higher rate than it can replace, the MoD said.
Russia Looks to Private Militia to Secure a Victory in Eastern Ukraine (New York Times) Wagner Group forces launched attacks from several directions on the city of Bakhmut, though analysts said seizing it would yield little strategic value.
Watch a lone Ukrainian paratrooper single-handedly knock out a Russian tank (Task & Purpose) The video captures why Ukraine is doing so well.
‘A car goes by with a loudspeaker telling us to leave Kherson. We stay’ (the Guardian) One of the few civilians left in the city describes his daily struggle to survive under Russian occupation and keep the dream of liberation alive
Kyiv region still struggles 6 months after Russian retreat (AP NEWS) Standing amid the wreckage of his home, Vadym Zherdetsky shows photos on his phone of how it once looked: handsome rooms, a hand-carved wooden bed and a chest of drawers he intended to leave to his grandchildren.
‘Assassination attempt’ on pro-Russia judge who sentenced British prisoners to death (The Telegraph) Alexander Nikulin is ‘stable but serious’ after being shot several times on Friday evening in the Donetsk region
Power blackouts hit Ukraine amid heavy Russian shelling (AP NEWS) Ukraine's state electricity operator on Saturday announced blackouts in Kyiv and seven other regions of the country in the aftermath of Russia's devastating strikes on energy infrastructure.
Russian missile strikes overshadow cyberattacks as Ukraine reels from blackouts (CNN) Russia has pummeled Ukrainian cities with missile and drone strikes for much of the past month, targeting civilians and large swaths of the country's critical infrastructure.
Russia-Ukraine War: Ukraine Plans Blackouts as It Braces for Extended Loss of Power (New York Times) With an electricity grid heavily damaged by Russian missiles, emergency workers in Kyiv are considering a total blackout that would require the evacuation of three million residents.
What happened in the Russia-Ukraine war this week? Catch up with the must-read news and analysis (the Guardian) Russia continues its relentless assault on Ukraine’s power grid; Putin rejoins UN grain export deal in humiliating U-turn; Kherson residents defy Russian call to evacuate city
Putin's 'barrier troops' are straight out of Stalin's playbook (The Telegraph) The Russian army is deploying armed officers behind the front line to stop soldiers deserting, the MoD has said
Wagner Group goes mainstream as infamous Russian mercenaries gain corporate logo and skyscraper HQ (The Telegraph) Move to plush new building in St Petersburg shows growing status of its leader and 'Putin's chef' Yevgeny Prigozhin
Russia Is Ramping Up Nuclear War Propaganda (WIRED) Kremlin-backed media is spreading rumors of a Ukrainian "dirty bomb" attack to rouse support for extreme retaliation.
Russian soldiers ordered to 'shoot everyone' in Bucha massacre (The Telegraph) CCTV footage reveals how civilians were rounded up, while leaked phone calls show how guilty troopers confessed to their families
Ukraine Latest: More US Aid Set; G-7 Denounces Russian ‘Crimes’ (Bloomberg) The Group of Seven said it would hold Russia accountable for “war crimes” after recent attacks on Ukrainian energy and water facilities. Foreign ministers of the leading industrial nations slammed the Kremlin’s “irresponsible nuclear rhetoric” in a statement released after a two-day foreign ministers meeting in Muenster, Germany.
Battalion of Russian mobilised men wiped out in days, survivors claim (The Telegraph) The soldiers were sent to the frontline in Luhansk and their officers ran away, according to an unverified Verstka news agency report
How a history lesson, a pro-Russian politician and dozens of cement mixers saved the key city of Kryvyi Rih (The Telegraph) Oleksandr Vilkul defended Kryvyi Rih from Russian forces by blocking off the airport - a plan his uncle, a Soviet pilot, gave him
Russia's air campaign hampered by poor ISR based strikes and target processing: NATO official (Breaking Defense) Russia's attempt to secure air dominance in Ukraine has been wildly unsuccessful with troubles prosecuting ISR supported strikes forcing plans off track.
The Russian Air War and Ukrainian Requirements for Air Defence (Royal United Services Institute) Further Western support is needed to ensure that Kyiv can counter Moscow's updated approach to the air war in Ukraine.
Has the Ukraine war killed off the ground-attack aircraft? (The Economist) Russia’s close-air support jets have been decimated
Ukraine to get ‘most advanced tanks on the battlefield’ for counter-offensive against Russia (The Telegraph) US and Netherlands join forces to supply 90 upgraded Czech T-72 tanks as part of $400m military aid package
Aid Package to Ukraine Includes T-72B Tanks (U.S. Department of Defense) The Defense Department announced approximately $400 million in additional security assistance for Ukraine under the Ukraine security assistance initiative.
Pentagon announces another $400 million in military aid to Ukraine, establishes headquarters in Germany to handle shipments and training (Stars and Stripes) An additional $400 million in U.S. aid for Ukraine will pay for more weapons and vehicles, including older Soviet-made tanks from the 1960s, to help Ukrainian troops fight off Russian forces, the Defense Department announced Friday.
US, Netherlands go Dutch to refurbish Czech tanks for Ukraine (Defense News) The U.S. and Netherlands are splitting the cost of refurbishing 90 more Czech T-72B tanks for Ukraine in Kyiv’s fight to repel Russia.
Refurbished Soviet tanks, HAWK missiles and more Phoenix Ghost drones coming soon to Ukraine (Breaking Defense) “These are tanks that the Ukrainians know how to use on the battlefield,” Pentagon Deputy Pentagon Press Secretary Sabrina Singh said of a US-Dutch-Czech effort to supply Ukraine with refurbished Soviet tanks.
$400 Million in Additional Security Assistance for Ukraine (U.S. Department of Defense) The Department of Defense announced approximately $400 million in additional security assistance for Ukraine under the Ukraine Security Assistance Initiative.
National security adviser visits Kyiv as US announces $400m in aid to Ukraine – as it happened (the Guardian) Jake Sullivan travels to Ukraine to ‘underscore the United States’ steadfast support’ as aid to include tanks and drones
Russian disinformation campaigns again targeting midterms: Report (Axios) "They recognize that political discourse is very divisive here in the U.S."
Ukraine suffered a comms outage when 1,300 SpaceX satellite units went offline over funding issues (CNN) Ukraine's fears that its troops may lose access to Elon Musk's crucial Starlink internet service deepened in the past week after 1,300 of the military's satellite units went offline, according to two sources familiar with the outage.
Ukraine trusts Musk's Starlink but looking for other providers too (Reuters) Ukraine trusts Elon Musk to continue providing internet access through his SpaceX rocket company's Starlink satellite system despite a wobble last month, but is also seeking additional providers, one of its deputy prime ministers said on Thursday.
Ukraine's "IT army" has conducted 8,000 cyberattacks against Russia (Kyodo News+) Ukraine's so-called IT army has executed cyberattacks on around 8,000 Russian resources, successfully targeting the defense industry and countering disinformation campaigns by state-sponsored outlets, according to Ukraine's deputy minister of digital transformation.
Hacktivists Use of DDoS Activity Causes Minor Impacts (FBI) The Federal Bureau of Investigation (FBI) is releasing this Private Industry Notification to highlight hacktivism activity and encourage organizations to implement the recommendations in the Mitigations section to reduce the likelihood and impact of distributed denial of service (DDoS) attacks.
FBI: Hacktivist DDoS attacks had minor impact on critical orgs (BleepingComputer) The Federal Bureau of Investigation (FBI) said on Friday that distributed denial-of-service (DDoS) attacks coordinated by hacktivist groups have little to no impact.
FBI: Beware of Cyber-Threat from Russian Hacktivists (Infosecurity Magazine) Feds claim DDoS attacks are being aimed at critical infrastructure
Extending our vital technology support for Ukraine (Microsoft On the Issues) Today, we are announcing that Microsoft will extend technology support free of charge for Ukraine throughout calendar year 2023. This commits our company to providing additional technology aid valued at roughly $100 million, which will ensure that government agencies, critical infrastructure and other sectors in Ukraine can continue to run their digital infrastructure and serve...
Microsoft gives away $400m in cloud support to Ukraine (Register) Freedom isn't free
Editor's Notes: Ukraine Called the First 'Broadband War' (National Defense) The Atlantic Future Forum is perhaps one of the more unique annual security conferences.
How to Investigate TikTok Like a Pro - Part II: Using TikTok for Ukraine Research (bellingcat) A guide for conducting research on TikTok including methods, tools and shortcuts that can be applied to the invasion of Ukraine.
WSJ News Exclusive | Senior White House Official Involved in Undisclosed Talks With Top Putin Aides (Wall Street Journal) Jake Sullivan has had confidential discussions with Russian counterparts amid concerns over escalation and nuclear threats.
Biden aide held talks with Russian officials amid nuclear tensions, the Wall Street Journal reports (Reuters) National Security Advisor Jake Sullivan has held undisclosed talks with top Russian officials in hopes of reducing the risk the war in Ukraine spills over or escalates into a nuclear conflict, the Wall Street Journal reported on Sunday.
Kremlin declines to comment on reported Ukraine talks with Biden aide (Reuters) The Kremlin declined to comment on Monday on a Wall Street Journal report that Washington had held undisclosed talks with top Russian officials about avoiding further escalation in the Ukraine war.
Olaf Scholz tells Xi Jinping to ‘use China’s influence’ on Putin to stop Ukraine war (The Telegraph) The German chancellor is the first G7 leader to visit Beijing since the start of the coronavirus pandemic
Don’t Panic About Putin (Foreign Affairs) Even desperate leaders tend to avoid catastrophe.
Putin's biggest threat could come from within Russia (Newsweek) The Russian president is facing military setbacks and growing signs of social discontent, with experts speculating that this could lead to his overthrow.
Global food security is on the line: Breaking down the stakes of the endangered Ukraine grain deal (Atlantic Council) We turned to our experts on global food security and the war in Ukraine to explain why the deal is in peril and forecast what’s coming next.
The U.N. (as We Know It) Won't Survive Russia's War in Ukraine (Foreign Policy) The institutions designed to secure global order clearly aren't up to the task. What will take their place?
Russia sends railcars of luxury horses to North Korea after 'arms help for war' (Telegraph) Delivery of thoroughbreds indicates strengthening ties between two pariah states, with wider implications for Ukraine and the Indo-Pacific
Russische Investorin vor Ausstieg bei deutscher IT-Sicherheitsfirma G Data (FinanzNachrichten) Angesichts des Ukraine-Kriegs steht die russische Investorin Natalya Kaspersky beim Bochumer Unternehmen G Data, einer führenden deutschen IT-Sicherheitsfirma, vor dem Ausstieg. Es sei vereinbart
Israel water sector not ready for Iran cyberattack - ex-IDF intel official (Jerusalem Post) Both the US and Israel are still moving too slowly to advance water sector cyber defense, warned Ariel Stern.
Fears mount that Cop27 app could be used by Egypt to surveil regime’s critics (the Guardian) Cybersecurity experts warn that official Cop27 climate app requires access to a user’s location, photos and even emails
Hackers targeted Pakistani ‘generals, politicians’ (The Express Tribune) Gang was tasked with breaking into email account of then info minister Fawad Chaudhry in Jan, investigation reveals
Misinformation and the midterm elections: What to expect (AP NEWS) Conspiracy theories about mail ballots. Anonymous text messages warning voters to stay home. Fringe social media platforms where election misinformation spreads with impunity. Misinformation about the upcoming midterm elections has been building for months, challenging election officials and tech companies while offering another reminder of how conspiracy theories and distrust are shaping America's politics .
US Security Officials Warn Lone Actors Likely the Biggest Election Threat (VOA) Officials, researchers say online influence operations – some tied to foreign adversaries – may be looking to push radicalized individuals to violence
The government says it won’t flag election disinformation on Twitter and other social platforms (Washington Post) The Cybersecurity and Infrastructure Security Agency says it’s taking a hands-off approach when it comes to false claims about the election process on Twitter.
Microsoft accuses China of abusing vulnerability disclosure requirements (The Record by Recorded Future) Microsoft accused state-backed hackers in China of abusing the country’s vulnerability disclosure requirements to develop zero-day exploits.
Threat Actors Pivot to Credential Theft in Government Mobile Phishing Attacks (Decipher) A new Lookout report highlights a tangle of government mobile device security challenges, including the use of outdated or unmanaged devices, and a rise in phishing attacks targeting credentials.
U.S. govt employees exposed to mobile attacks from outdated Android, iOS (BleepingComputer) Roughly half of all Android-based mobile phones used by state and local government employees are running outdated versions of the operating system, exposing them to hundreds of vulnerabilities threat actors can leverage to perform cyberattacks.
Android Apps With Millions of Installation Redirect Users to Weaponized Websites (Cyber Security News) It seems that the Google app store has still not been able to catch malicious applications, as they are still being listed there.
Researchers Uncover 29 Malicious PyPI Packages Targeted Developers with W4SP Stealer (The Hacker News) Researchers have discovered 29 packages in the Python Package Index (PyPI) repository that aim to infect developers' machines with a malware.
UK-Based Threat Actors Impersonate Global Law Firms in BEC Attacks (Decipher) Researchers have uncovered a new business email compromise group impersonating well-known law firms and attorneys to trick targets into paying fake invoices.
Cyber attack on Boeing subsidiary behind Sunwing outage (Pax News) Sunwing’s Nov. 2 system outage involved a different third-party provider than the one in April when a similar technical issue occurred, PAX has learned. The glitch that disrupted Sunwing flights this week is linked to Jeppesen, a Boeing company, and a cyber attack is to blame. Sunwing's operations are normalizing, but delays are expected.
Sg: Victims lose $237,000 amid resurgence in SingPost and Singtel phishing scams: Police (Data Breaches) At least 85 people here have lost about $237,000 since January 2022 after falling victim to phishing scams involving purported e-mails from Singapore Post (SingPost) and telco Singtel.
Cyber Threat To Electric Vehicle Charging Points Could Put T... (MENAFN) Cybersecurity experts at Check Point Software Technologies warn that green travel initiatives may be held back as electric vehicle charging point cy
LockBit ransomware claims attack on Continental automotive giant (BleepingComputer) The LockBit ransomware gang has claimed responsibility for a cyberattack against the German multinational automotive group Continental.
LockBit 3.0 gang claims to have stolen data from Kearney & Company (Security Affairs) The ransomware group LockBit claimed to have stolen data from consulting and IT services provider Kearney & Company. Kearney is the premier CPA firm that services across the financial management spectrum to government entities. The company provides audit, consulting and IT services to the United States government. It has helped the Federal Government improve its […]
Cyber attack temporarily shuts down Big Island radiology group (KITV Island News) Cyber attacks are on the rise on the nation's critical health-care systems. And one attack close to home has shut down a radiology company, delaying patient care.
MercyOne back online after ransomware attack (Health Exec) MercyOne Central Iowa is mostly back online in the aftermath of a ransomware attack of its parent company, CommonSpirit Health.
Cyber attack disrupts Norman school district (Norman Transcript) Norman Public Schools reported Friday its networks “are currently experiencing a malicious ransomware attack,” and warned families to discontinue using district-issued devices.
'It's a nightmare.' Expert weighs in on ransomware attack facing Norman Public Schools (KOKH) On Friday afternoon, Norman Public Schools informed parents that the district was experiencing a ransomware attack.Officials expect a "significant disruption"
Data hack at IT firm may include health records of Victorian school students (The Age) PNORS Technology Group, which has multiple government contracts, said criminals had released potentially stolen data to the company.
Medibank has revealed what personal data has been accessed, depending on what kind of customer you are (ABC) Medibank details what personal information it believes a cybercriminal has accessed from customers in the latest update on the hack of the company's data.
Medibank Private to Commission External Review of Cyber Attack (Bloomberg Law) Medibank updates what customer information it believes has been accessed and stolen in the cyber attack.
'You just can't trust a criminal': Medibank CEO on decision to not pay ransom (ABC) Medibank CEO David Koczkar explains how the private health provider reached the decision to not pay the ransom demand.
HSE cyberattack: More than 100,000 people whose personal data stolen to be contacted (The Irish Times) Move opens way to further controversy over attack and risk of litigation arising from it
Prayer rally to defeat state amendment is victim of ‘pro-choice cyber attack’ (Catholic News Agency) Organizers of the pro-life rally had asked attendees to register to help with preparations. However, phony registrations came in from IP addresses in Portland, Oregon; Boston; Chicago; and New York City.
How Qatar hacked the World Cup (The Bureau of Investigative Journalism (en-GB)) Critics who threatened to expose wrongdoing by Qatar were targeting as part of huge hacking operation
Qatar takes on 'hack-for-hire' gang to target UK firms and individuals (Computing) An undercover investigation by The Sunday Times and the Bureau of Investigative Journalism has uncovered details of a hacking group, operating from India, that has targeted a number of British businesses, officials and journalists in recent years.
BBC’s Chris Mason on list of VIPs to be hacked by Indian cyber gang (The Telegraph) The political editor was among 100 high-profile names, which included senior political figures, who were targeted
Inside the global hack-for-hire industry (The Bureau of Investigative Journalism (en-GB)) British investigators have been able to commission 'hack-for-hire' firms with little fear that they will be prosecuted for breaking the law
Robin Banks Phishing Service for Cybercriminals Returns with Russian Server (The Hacker News) Robin Banks phishing-as-a-service (PhaaS) platform is back after moving its attack infrastructure to Russian bulletproof hosting service DDoS-Guard.
November 2022 Patch Tuesday forecast: Wrapping up loose ends? (Help Net Security) October 2022 Patch Tuesday was a little unusual last month, as it ‘kind of’ repeated itself the following week. Microsoft turned around and released a
Nation-state cyberattacks become more brazen as authoritarian leaders ramp up aggression (Microsoft On the Issues) On February 23, 2022, the cybersecurity world entered a new age, the age of the hybrid war, as Russia launched both physical and digital attacks against Ukraine. This year’s Microsoft Digital Defense Report provides new detail on these attacks and on increasing cyber aggression coming from authoritarian leaders around the world.
Microsoft: Nation-state cyber attacks became increasingly destructive in 2022 (ComputerWeekly.com) The willingness of nation-state actors to conduct destructive cyber attacks is a source of grave concern, as Microsoft’s latest annual Digital Defence Report lays bare
Microsoft Digital Defense Report 2022 (Microsoft Security) Illuminating the threat landscape and empowering a digital defense.
Cyber hygiene is vital to survive today’s attacks, says Microsoft report (IT World Canada) There are no shortcuts to fighting human-directed ransomware, according to Microsoft's latest Digital Defence Report. "Combating and preventing attacks of this nature requires a shift in an organization’s mindset to focus on the comprehensive protection required to slow and stop attackers before they can move from the pre-ransomware phase to the ransomware deployment phase," says
Zero-day are exploited on a massive scale in increasingly shorter timeframes (Security Affairs) Microsoft warns of an uptick among threat actors increasingly using publicly-disclosed zero-day exploits in their attacks. According to the Digital Defense Report published by Microsoft, threat actors are increasingly leveraging publicly-disclosed zero-day vulnerabilities to target organizations worldwide. The researchers noticed a reduction in the time between the announcement of a vulnerability and the commoditization of […]
‘Cyberspace has become a battleground,’ warns Australian Cyber Security Centre (The Record by Recorded Future) The Australian Cyber Security Centre received over 76,000 cybercrime reports during the last financial year — an increase of nearly 13%.
Australia sees rise in cybercrimes on back of 'destructive' ransomware, state actors (ZDNET) Australia Cyber Security Centre says the number of reported cybercrime cases climbed almost 13% in the past year, with state actors an ongoing threat and ransomware the "most destructive".
Akamai: 49% of UK Consumers Don’t Trust Retailers to Keep Personal Details (The Fintech Times) Akamai found an alarming lack of trust for online retailers as it explored the link between cybersecurity and consumer spending.
Exclusive: 1Password acquiring ID authentication startup Passage (Axios) The deal allows 1Password to expand beyond phrase-based password managers.
OUT OF STEALTH: New SURF Zero-Trust Enterprise Browser (PR Newswire) The newly available SURF zero-trust, identity-first enterprise browser reinforces organizational security by providing the critical visibility...
Cybersecurity co Varonis lays off over 100 (Globes) Varonis has announced streamlining and cost savings measures that include laying off 5% of its workforce, including 40 employees in Israel.
Varonis lays off 110 employees, downsizes R&D staff (CTech) The Nasdaq-traded firm saw its share price plummet by more than a third last week following its disappointing results for the third quarter of the year
Big losses from Fortinet, Rapid7 drag security stocks into the red (SeekingAlpha) Network and cybersecurity companies had a rough go of it on Thursday as disappointing earnings reports and outlooks from the likes of Fortinet and Rapid7 (RPD) dragged down...
Israel’s Pegasus Spyware Maker Takes Drastic Measures to Survive Global Scandal (Bloomberg) Maker of Pegasus phone-hack tool has cut jobs and hiked prices. Firm, now blacklisted in US, is trying to pacify debt holders.
KnowBe4 Lands on The First-Ever TrustRadius Best Software List (Yahoo) KnowBe4, the provider of the world's largest security awareness training and simulated phishing platform, today announced that TrustRadius, the most trusted research and review platform, has recognized KnowBe4 with multiple Best Software List badges. The first-annual TrustRadius Best Software List enables B2B software buyers to self-serve by providing important product information for their business' market size and needs by providing market-specific awards.
CyberArk Wins CloudBees Technology Alliance Partner of the Year Award (Business Wire) CyberArk (NASDAQ: CYBR), the global leader in Identity Security, today announced it has been named Technology Alliance Partner of the Year by CloudBee
Tech Companies Are Bracing For A Winter of Layoffs (Crunchbase News) In the past week, 23 companies have laid off more than 7,000 people. That puts our tally at more than 52,700 layoffs this year.
Tech Layoffs: US Startups And Tech Companies With Job Cuts In 2022 (Crunchbase News) Tech layoffs in 2022 have included cuts at Netflix, Better, Fast and other U.S. companies. We track all the notable tech and startup layoffs of 2022.
WSJ News Exclusive | Facebook Parent Meta Is Preparing to Notify Employees of Large-Scale Layoffs This Week (Wall Street Journal) The social-media giant’s planned cuts are expected to affect many thousands of its workforce, which exceeded 87,000 as of September.
Twitter layoffs gutted election information teams days before midterms (Washington Post) With half of the company gone, political campaigns are gripped with anxiety over how to address election misinformation and potential threats
Twitter Is Said to Delay Changes to Check Mark Badges Until After Midterms (New York Times) Users and employees had raised concerns that Elon Musk’s plan to give check marks to those who paid a monthly fee could be misused to sow discord.
Twitter to delay verification check mark rollout until after US midterm elections (TechCrunch) The delay comes as Twitter attempts to avoid possible impact to the upcoming U.S. midterm elections.
Twitter Rolls Out Blue Check Marks for Paying Customers (Wall Street Journal) Twitter Inc. has begun rolling out software updates to charge users $7.99 a month to mark their accounts with a blue checkmark, part of Elon Musk’s early efforts to boost revenue a little more than a week after taking ownership of the social-media network.
Cybersecurity expert: Paid Twitter verification ‘going to create a very chaotic environment’ (The Hill) Former top cybersecurity official Chris Krebs on Sunday said the paid subscription plan for a verification mark on Twitter will “create a very chaotic environment” because it would open…
Krebs says Twitter turmoil creating "a very chaotic environment" for midterms (CBS News) Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency and a CBS News cybersecurity expert and analyst, says, "We've seen reports lately of Russia, China and Iran back at their old tricks" since Elon Musk's acquisition of Twitter.
Elon Musk Says Twitter Has Had Massive Revenue Drop as Layoffs Begin (Wall Street Journal) Elon Musk tweeted that Twitter has had a large drop in revenue due to activist groups pressuring advertisers, as the social-media company notified about half its staff that they were being let go.
Musk orders Twitter to cut infrastructure costs by $1 billion - sources (Reuters) Elon Musk has directed Twitter Inc's teams to find up to $1 billion in annual infrastructure cost savings, according to two sources familiar with the matter and an internal Slack message reviewed by Reuters, raising concerns that Twitter could go down during high-traffic events like the U.S. midterm elections.
Twitter Slashes Staff in Ad Product, Data Center Management (The Information) Several key departments at Twitter were reduced to a shadow of their former selves in mass layoffs on Friday undertaken by Elon Musk, the company’s new owner, according to employees. Among the worst hit were the teams responsible for product and engineering for ads, as well as the infrastructure ...
Elon Musk’s Twitter layoffs leave whole teams gutted (The Verge) “Shit is gonna start breaking,” said one current employee.
Twitter Now Asks Some Fired Workers to Please Come Back (Bloomberg) Twitter management trying to bring back dozens of workers. Some employees now needed or were laid off by mistake.
'I don't want to work with these clowns.' Inside the culture war that Elon Musk has unleashed at Twitter. (Business Insider) A Twitter employee worries that the old guard's culture of safeguarding the platform is giving way to Elon Musk "ass-kissing."
Lawyer Suing Twitter Over Layoffs Says Musk Trying to Comply (Bloomberg) Lawsuit comes as new boss plans to eliminate half of workforce. Musk called a similar, earlier suit by Tesla workers ‘trivial.'
Twitter’s safety boss is one of few staffers to win over Musk (Semafor) Yoel Roth is known to have the kind of technical expertise that Twitter’s new owner favors.
These are the men running Elon Musk’s Twitter (Washington Post) The billionaire has installed several members of his inner circle to enact his vision for the social media platform
Elon Musk’s response to fake verified Elon Twitter accounts: a new permanent ban policy for impersonation (The Verge) Breaking Elon’s rules risks an instant permaban.
Cesspool or civility? Elon Musk's Twitter at a crossroads (AP NEWS) The discourse was never all that civil on Twitter. The loudest voices have often drowned out softer, more nuanced takes. After all, it's much easier to rage-tweet at a perceived enemy than to seek common ground, whether the argument is about transgender kids or baseball.
Musk’s celebrity lawyer now plays key role in Twitter overhaul (Washington Post) Alex Spiro went from representing Jay-Z to participating in one of the biggest technology company overhauls in years.
Twitter's death might be the end of social media for me (Mashable) I can tell when the party's over.
China's cyberspace regulator encourages Huawei to enhance innovation and digitalization construction (Global Times) The Cyberspace Administration of China (CAC) has encouraged Huawei to make breakthrough in core technologies to accelerated the independence and innovation of top technologies under the guidelines of the 20th National Congress of Communist Party of China (CPC), according to an article published on the official website of CAC on Sunday.
Claroty names CJ Radford as Global VP of Channels and Alliances (Help Net Security) Claroty has appointed CJ Radford as global VP of channels and alliances to oversee ecosystem of channel and technology alliance partners.
Rob Dooley joins Rapid7 from VMWare (Tech Business News) Rapid7, Inc., a leader in cloud risk and threat detection, today announced the appointment of Rob Dooley as Vice President, Asia Pacific
Next DLP Announces Cybersecurity Industry Veteran, Constance Stack, as New CEO (Business Wire) Next DLP (“Next”), formerly Qush Security, today announced the appointment of Constance (“Connie”) Stack as its new chief executive officer. With Stac
Former Deputy Chief and Intelligence Officer Terry Burruss Joins LookingGlass Cyber Solutions Advisory Board (GlobeNewswire News Room) LookingGlass Cyber Solutions, the leader in actionable threat intelligence, today announced the...
Fortress Adds ICS/OT Expert Jon Taylor to Frontline Cybersecurity Team (Fortress Information Security) Fortress Information Security has added Jon Taylor to its team of cyber threat analysts as Vice President of Fortress Security Solutions.
Womble Bond Dickinson Continues Growth of DC Office (Womble Bond Dickinson) In further expansion of its Washington office, Womble Bond Dickinson announced today that Lee K. Van Voorhis has joined the firm as a partner in the Business Litigation group, and Katie Hyman has joined as a partner in the Trademarks, Copyrights, and Transactions group.
PKWARE Expands Microsoft Integration with Azure AD Authentication for Endpoint Protection (PR Newswire) PKWARE, a global leader in automated data security, today announced that it is integrating Microsoft Azure Active Directory (AD) Authentication...
Computerspiel: so leicht tappen Mitarbeiter in die Social-Engineering-Falle (B2B Cyber Security) Die G DATA academy erweitert ihr Portfolio um ein interaktives Spiel zu den Themen Social-Engineering-Falle, Ransomware und Phishing. Damit reagiert G DATA auf
LinkedIn Adds Verified Emails, Profile Creation Dates (KrebsOnSecurity) For whatever reason, the majority of the phony LinkedIn profiles reviewed by this author have involved young women with profile photos that appear to be generated by artificial intelligence (AI) tools. We’re seeing rapid advances in AI-based synthetic image generation…
Palo Alto Networks partners with UnionBank to enhance cybersecurity amid increased threats (Manila Standard) Global cybersecurity leader Palo Alto Networks (NASDAQ: PANW) partnered with the country’s leading bank in innovation, UnionBank of the Philippines
Dell announces services to protect Microsoft ecosystems (TimesTech) To help customers reduce risk and protect data, Dell Technologies is introducing new products and services focused on the Zero Trust
Suricata for Analysts - the Book (Stamus Networks) Webpage hosting information about "The Security Analyst's Guide to Suricata", a book by Eric Leblond and Peter Manev
KnowBe4's New SecurityCoach Helps to Reduce Risky Behavior With Real-Time Security Coaching (PR Newswire) KnowBe4, the provider of the world's largest security awareness training and simulated phishing platform, today announced it is introducing...
Acronis Disrupts Market with Announcement of New, Simplified MSP-class EDR Solution (GlobeNewswire News Room) Latest Acronis Cyber Protect Cloud release further democratizes advanced security solutions with effective protection for data, applications, and systems...
RanHassan Ransomware Decryptor Now Available (Bitdefender Labs) A new decryptor for the RanHassan ransomware is now available for download.
What to Expect When You are Expecting an Election (CISA) November 8th is fast approaching, and millions of voters have already cast their ballots. Although many people are just now beginning to pay attention to the election, thousands of state and local election officials have been preparing for this day all year. CISA has been working to support them, ensuring that the election officials on the frontlines of protecting and defending democracy have access to the resources, tools, capabilities, and information they need to build resilience against all threats.
2022 Midterm Election Cybersecurity: Are We Ready? (GovTech) As we head into the pivotal 2022 midterm elections this week, how prepared are states to ensure votes are properly counted and protected from cyber attacks? Here’s a roundup of recent developments.
Fourteen state National Guard cyber units activate ahead of election (StateScoop) National Guard cyber units in 14 states will be on duty Election Day protecting voting-related networks from malicious activity.
Cybersecurity considerations for federal agency buildings (Federal News Network) Discussions on cybersecurity mostly revolve around protecting digital infrastructure and various software systems. Physical infrastructure and its security is often overlooked.
NSA Celebrates 70 Years of Cryptologic Excellence (National Security Agency/Central Security Service) Today, the National Security Agency (NSA) celebrates 70 years of service to the Nation.
The obsessive millionaires who spent their fortunes codebreaking (Times) Some rich men go in for art collections, gay times on the Riviera, or extravagant living, but they all get satiated. That’s why I stick to scientific experiment
Red Cross Wants Digital Symbols to Deter Hackers From Healthcare Institutions (Wall Street Journal) The international organization proposed three options that could serve as a digital equivalent of the red cross symbol.
Boffins rekindle one-time program cryptographic concept (The Daily Swig) Authentication idea advanced but not yet fulfilled
Partners team up to fight cybercrime (University of Calgary) UCalgary brings expertise in network and software security to partnership with police and industry
The cyber strategy and operations of Hamas: Green flags and green hats (Atlantic Council) This report seeks to highlight Hamas as an emerging and capable cyber actor, and help the policy community understand how similar non-state groups may leverage the cyber domain in the future.
Japan formally joins NATO cyber cooperation center (The Record by Recorded Future) Japan formally joined NATO’s Cooperative Cyber Defence Centre of Excellence (CCDCOE) on Friday.
China's cyberspace regulator encourages Huawei to enhance innovation and digitalization construction (Global Times) The Cyberspace Administration of China (CAC) has encouraged Huawei to make breakthrough in core technologies to accelerated the independence and innovation of top technologies under the guidelines of the 20th National Congress of Communist Party of China (CPC), according to an article published on the official website of CAC on Sunday.
David or Goliath? How Thinking Like a Small Nation Can Help Counter China (The Strategy Bridge) The continued posturing of the United States as the main geopolitical power represents a grave strategic misstep against the rising power of China. This posture overcommits resources to a narrow conception of warfare that then limits the availability of options. If, however, the U.S. were to strateg
U.S. calls out Japan and Netherlands over China chip curbs (Nikkei Asia) Exports of semiconductor-making gear significant part of Japan's economy
British govt is scanning all Internet devices hosted in UK (BleepingComputer) The United Kingdom's National Cyber Security Centre (NCSC), the government agency that leads the country's cyber security mission, is now scanning all Internet-exposed devices hosted in the UK for vulnerabilities.
Press Freedom In The Age Of Digital Surveillance (Outlook India) Acting on the demands of several journalists, activists and NGOs, the Committee to Protect Journalists (CPJ) has called for an immediate moratorium on the development, export, sale and use of spyware until robust guarantees are implemented to safeguard journalists.
Closing the barn door on ‘store now, decrypt later’ attacks (The Hill) The Biden administration’s new National Security Strategy and National Defense Strategy highlight how competitors are undermining the U.S. military’s operational, logistical and information advanta…
Beyond NOFORN: Solutions for increased intelligence sharing among allies (Atlantic Council) Intelligence sharing is a perennial issue, but modern solutions exist to balance enhancing cooperation with key allies with providing decision advantage to policymakers.
Biden: U.S. chip subsidies are key for national security (Radio Free Asia) Chinese reaction to new policies may follow U.S. midterm elections and Biden-Xi meeting at G-20, experts say.
House GOP lawmaker pushes Biden to establish a cyber response plan (Axios) The administration has until Jan. 1 to submit its plan if the U.S. economy faces a destructive cyberattack.
FCC Proposes to Strengthen Cybersecurity of Emergency Alert Systems (Nextgov.com) The notice of proposed rulemaking would require emergency alert system participants to disclose cyber breaches within 72 hours of discovery.
National Guard Leaders Warn More Cyber Security Spending Needed to Help Protect Elections (Military.com) Only 14 states will mobilize Guardsmen to help oversee cyber security for the midterm elections.
Top US cyber official says state officials are 'pleased' with government support to secure the election, some election administrators say otherwise | CNN Politics (CNN) One of the nation's top cybersecurity officials said state election workers in Wisconsin and Michigan have told her they're "pleased" with the federal government's support leading up the 2022 midterm elections, while some state officials say they're not getting enough.
U.S. Attorney Announces Historic $3.36 Billion Cryptocurrency Seizure And Conviction In Connection With Silk Road Dark Web Fraud (U.S. Attorney’s Office for the Southern District of New York) In November 2021, Law Enforcement Seized Over 50,676 Bitcoin Hidden in Devices in Defendant JAMES ZHONG’s Home; ZHONG Has Now Pled Guilty to Unlawfully Obtaining that Bitcoin From the Silk Road Dark Web in 2012.
Greece’s spyware scandal expands further (POLITICO) Some 33 people have been found to have traces of the illegal spyware Predator on their devices, including several members of the Cabinet, according to a newspaper report.
Australians urged to remain vigilant as scam activity rises (Australian Federal Police) Editor’s note: Audio grabs of Commander Chris Goldsmid are available via Hightail. The AFP is urging Australians to be cautious about unsolicited text messages, phone calls and emails this Scams Awareness Week (7-11 November).
Insurance giant settles NotPetya lawsuit, signaling cyber insurance shakeup (CyberScoop) Cyber insurance have already started to find other ways to avoid covering losses related to cyberattacks linked to nation-state hackers.
The national security grounds for investigating Musk’s Twitter acquisition (Brookings) Patnaik, Litan, and Kunhardt make the case for a national security investigation of Elon Musk's acquisition of Twitter
As EFCC Ambushes Currency Hoarders, Cyber Criminals (This Day) With last week’s crackdown on the activities of some erring bureau de change operators and the smashing of a cybercrime syndicate, the Economic and Financial Crimes Commission may have commenced steps to actualise its pledge to bring economic saboteurs into its dragnet as Nigeria awaits the issuance of new naira notes by the Central Bank of Nigeria, writes Festus Akanbi
Mike Lynch rebels over executive pay amid tensions with Darktrace (Times) Mike Lynch, the technology entrepreneur battling extradition to the US on fraud charges, and his wife have launched a surprise rebellion over executive pay at Darktrace, the cybersecurity company that he helped found.Almost 21 per cent of voting shareholders opposed Darktrace’s remuneration report
Federal judge denies second attempt from DOJ to obtain interim injunction in Booz Allen-EverWatch case (FedScoop) A Maryland federal judge blocked a second attempt by the Department of Justice to stop Booz Allen Hamilton from completing its acquisition of signals intelligence company EverWatch, court documents show. According to an Oct. 31 court filing, the Department of Justice requested a second injunction to halt the deal just days after a first injunction […]
Z-Library eBook site domains seized by U.S. Dept of Justice (BleepingComputer) Internet domains for the popular Z-Library online eBook repository were seized early this morning by the U.S. Department of Justice, preventing easy access to the service.
Fugitive captured at Disney World by inspector who signed his arrest warrant (ABC News) While a distinctive "H" tattooed on his neck may not stand for happiness, a fugitive on the run for a year was captured in the "Happiest Place on Earth."
DePaul Defeats Biometric Privacy Lawsuit Over Online Proctor (Law360) An Illinois student can't pursue claims over DePaul University's use of remote test-proctoring software because the university is a financial institution that is exempt from the state's landmark biometric privacy law, a federal judge said Friday.
Wisconsin lawmaker sues to block military ballots from being counted (Axios) The Wisconsin lawmaker has been criticized by election officials for spreading false information about the system.
For a complete running list of events, please visit the Event Tracker.
Healthcare Cybersecurity Forum (Boston, Massachusetts, USA, Dec 5 - 6, 2022) The HIMSS 2022 Healthcare Cybersecurity Forum will explore how the industry is protecting itself today and how it must evolve for the future. As healthcare cybersecurity professionals adapt to new threats, you also must remain focused on safeguarding patients, defending against attackers, and delivering business value. At this year’s forum, you’ll gain actionable insights from leading organizations on how to proactively shield healthcare's expanding digital footprint and secure data inside and outside your enterprise walls.
Convene: Security Training and Awareness Conference (Clearwater, Florida, USA, Jan 10 - 11, 2023) The National Cybersecurity Alliance is gathering training and awareness professsionals together to connect, share, and convene. Connect with the training and awareness community. Convene was created for this close-knit group, which has few opportunities to connect in person at an event designed just for them. Learn best practices. Thought leaders and industry executives will share their recent successes, failures and insights from recent campaigns and programs. Build camaraderie. Immersive gatherings with like-minded professionals breed innovation, sharing and human connection.
2022 Maryland STEM Festival (Various locations, Maryland, USA, Oct 14 - Nov 13, 2022) The 2022 Maryland STEM Festival will continue its mission to encourage all students, regardless of age, background, and experience to take a greater interest in STEM with the hope that they will pursue a STEM career. The month-long Festival will take place October 14 - November 13, all across Maryland. This year's theme is Cyberscurity and Information Technology. There will be over 300 in-person and virtual STEM-focused events, bringing together thousands of STEM-curious students of all ages for STEM talks, career discussions, hands-on learning, plus comedy shows, music performances, trivia nights and other activities. The Festival is currently seeking partners to participate in events and sponsors to fund this critical mission. The Festival needs your help as it works toward ensuring a diverse, STEM workforce that is critical to Maryland's economic success.
Oktane22 (San Francisco, California, USA, Nov 8 - 10, 2022) Come to Oktane and learn why having an Identity First strategy is imperative in enabling organizations like yours to be more agile and more secure. All while building more meaningful connections with your customers and employees along the way.
IT Nation Connect 2022 (Orlando and virtual, Florida, USA, Nov 9 - 11, 2022) IT Nation Connect is the premier thought-leadership conference for TSPs designed to promote education, inspiration, and networking in the community. We create a fun environment for attendees to learn and grow through collaborative and genuine peer interaction. You're sure to leave the conference with inspiration and concrete steps for their businesses.
Converge (Austin, Texas, USA, Nov 14 - 17, 2022) Join thousands of global IT and Security professionals for four-days of engaging keynotes, informative breakout sessions and technical Hands-On Labs. Learn how Tanium is converging IT, Compliance, Security and Risk to bring teams together with a single platform and shared source of truth for complete visibility, control and trust to IT decision making. Optimize your cybersecurity readiness, develop new skills and gain new best practices for how to overcome IT and security challenges and achieve success with Tanium.
Cyber Security for Critical Assets Summit (São Paulo, Brazil, Nov 15 - 16, 2022) #CS4CA LATAM is an exclusive platform promoting in-depth cyber security knowledge and collaboration among IT and OT security leaders from Latin America’s critical industries, including Oil & Gas, Chemical, Utilities, Information & Communication Technologies, Healthcare, and Transportation. Senior cyber security professionals share first-hand insights through real-life case studies, panel debates, and keynote presentations while bringing forth urgent topics to be discussed over roundtables and networking breaks.
