DPRK phishing. New Babuk variant hits manufacturer. Tunneling past an air gap. Update on the hybrid war.

Announcement

Join the Q4 Cybersecurity Analyst Call.

As 2022 comes to a close, join the CyberWire on Thursday, December 15th at 2PM EST, to take a look at exactly which developments and topics were the most important this year. Join Rick Howard, the CyberWire's Chief Analyst, and our VP Editor, John Petrik for an insightful discussion about the events from this year that materially impacted your career, the organizations you're responsible for, and the daily lives of people all over the world. This live event is typically a CyberWire Pro exclusive, but will be open to all readers and listeners. Be sure to submit questions and/or topics with your registration. Register now.

Summary

By the CyberWire staff

At a glance.

North Korea exploits Internet Explorer vulnerability.
New variant of Babuk ransomware reported.
Blind spots in air-gapped networks.
IT Army of Ukraine claims responsibility for DDoS against Russian bank.

North Korea exploits Internet Explorer vulnerability.

Researchers at Google's Threat Analysis Group report that North Korean threat actor APT37 exploited a zero-day vulnerability in Microsoft Internet Explorer in a phishing campaign against South Korean targets. "On October 31, 2022, multiple submitters from South Korea reported new malware to us by uploading a Microsoft Office document to VirusTotal," Google writes. "The document, titled “221031 Seoul Yongsan Itaewon accident response situation (06:00).docx”, references the tragic incident in the neighborhood of Itaewon, in Seoul, South Korea during Halloween celebrations on October 29, 2022. This incident was widely reported on, and the lure takes advantage of widespread public interest in the accident."

Microsoft was quick to patch the issue after Google reported it. It's noteworthy that Internet Explorer continues to be a target for exploitation by threat actors, even after Explorer's replacement by Microsoft Edge.

MITRE points out that researchers commonly cover APT37, like other DPRK cyber units, under the umbrella name "Lazarus Group." Some of the operations associated with APT37 have been "Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018."

At Raytheon, Intelligence & Space, if it’s not broken, we break it.

Somebody once said, “if it ain’t broke, don’t fix it.” That somebody didn’t work in cybersecurity. And that somebody didn't work at Raytheon, Intelligence & Space. Here we break the definition of cyber defense: Hiring the sharpest minds, actively hunting threats, and designing one-of-a-kind-never-been-done-before solutions. That’s how we shake up the future and uncover new thinking to protect our customer's most vital infrastructure and our way of life.

New variant of Babuk ransomware reported.

Morphisec announced today that it has observed a new version of Babuk ransomware in the wild. An infestation was detected at a large manufacturing company.

How did the internet respond to recent celebrity vulnerabilities?

When your business accelerates faster than your cybersecurity capabilities, responding to major vulnerabilities can be difficult. In the 2022 State of Risk & Remediation Report, the Censys Research Team examined recent celebrity vulnerabilities and observed how organizations reacted to each. What did we learn, and how can you apply these insights to your own organization?

Blind spots in air-gapped networks.

Pentera has published a report showing how attackers can use DNS tunneling to communicate with air-gapped networks. Organizations often use air-gapped networks to isolate their sensitive assets. Theoretically, these networks should be entirely cut off from the outside Internet. Pentera explains, however, “While air-gapped networks may not have direct access to the Internet, they still often require DNS services in order to resolve a company’s internal DNS records.... [M]any organizations often make the mistake of thinking that by routing communication over an internal DNS server they are preventing a potential breach. However, they are still susceptible as the internal DNS server can still connect with a public DNS server.”

If an attacker gains the owner rights to a root record within the organization, they can create a Name Server that can communicate with the air-gapped network over DNS. This isn’t trivial, since DNS traffic is usually sent over UDP and the attacker has “no control over the flow or sequence of data transmission.” These obstacles can be overcome, however. For example, if the payload is compressed before sending and decompressed after it’s received, the attacker can verify whether the data has been corrupted. For more on Pentera's report, see CyberWire Pro.

IT Army of Ukraine claims responsibility for DDoS against Russian bank.

HackRead reports that the IT Army of Ukraine, Kyiv's hacktivist auxiliary, has claimed credit for the distributed denial-of-service (DDoS) attack against the state-owned Russian bank VTB. The IT Army tweeted, "VTB could not handle with our attack the whole week long so they have to admit it. However, the problem is not we took them down so long but something went wrong newly, and they cannot settle paychecks, remittances, fine and tax payments." DDoS attacks in the current war, whether conducted by Russian or Ukrainian operators, have rarely risen above a nuisance-level of severity.

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Selected Reading

Dateline Moscow and Kyiv: Blackouts and war crimes.

Ukraine at D+287: UN war crimes report. (CyberWire) Russian strikes against civilian targets continue as the UN reports evidence of widespread Russian war crimes in Ukrainian territory it occupied early in the war.

Russia-Ukraine war: List of key events, day 288 (Al Jazeera) As the Russia-Ukraine war enters its 288th day, we take a look at the main developments.

Russia-Ukraine war at a glance: what we know on day 288 of the invasion (the Guardian) Putin says war could turn into ‘long-term process’; more ‘suspicious packages’ sent to Ukrainian missions

Putin says Ukraine fight is taking longer than expected (Military Times) Russian troops invaded Ukraine more than nine months ago.

Russian ally Belarus sparks fears it could join Ukraine war as it moves troops (New York Post) Belarus, a loyal Russian ally on Ukraine’s northern border, announced Wednesday that it would be moving troops inside the country in a counter-terror exercise that some feared could be a mobi…

Ukraine-Russia war latest: Russia forced to fill elite Kremlin guard with conscripts (The Telegraph) Russia has been forced to patch up its elite tank unit formed to defend Moscow with newly mobilised troops after suffering heavy casualties in Ukraine, according to the British Ministry of Defence.

Volodymyr Zelensky Is TIME's 2022 Person of the Year (Time) Volodymyr Zelensky’s success as a wartime leader has relied on the fact that courage is contagious

Putin rules out second mobilisation but admits war in Ukraine could be 'long process' (The Telegraph) Vladimir Putin has warned that the risk of nuclear war is "rising" and that Russia has the most "advanced weapons".

Putin Calls Russian Nukes Deterrent Factor, Says War Risk Rising (Bloomberg) President Vladimir Putin called Russia’s nuclear arsenal a “deterrent factor” in conflicts, stopping short of pledging not to be the first to use them.

'We haven’t gone mad': Putin backpedals on his nuclear threats (The Telegraph) The Russian president said nuclear deterrent was intended only for retaliation and appeared to rule out using them in a battlefield role

Lies and Vladimir Putin's political culture: "Intelligence Matters" (CBS News) Host Michael Morell sits down with Russia expert Andrew Weiss, who has just published his new graphic novel biography Accidental Czar: The Life and Lies of Vladimir Putin.

U.S. did not encourage or enable Kyiv to strike within Russia, Blinken says (Washington Post) The United States has not encouraged or enabled Ukraine to carry out attacks inside Russia, Secretary of State Antony Blinken said, after drone strikes targeted Russian military airfields this week.

No Peace on Putin’s Terms (Foreign Affairs) Why Russia must be pushed out of Ukraine.

Ukraine Is on the Edge of a Complete Blackout (Foreign Policy) As winter deepens, half of the country’s energy system is already destroyed—and the other half is under threat.

Live Updates: Brittney Griner Is Freed in Prisoner Swap With Russia (New York Times) Griner, an American basketball star who had been imprisoned on drugs charges, was traded for Viktor Bout, a Russian arms dealer. President Biden is giving a statement on the exchange.

As Ukraine and Russia step up prisoner exchanges, scarred POWs tell of abuse (Washington Post) The 60 prisoners of war arrived on Ukrainian soil Tuesday afternoon — free after the latest trade between Moscow and Kyiv, but still under strict rationing.

Killings of Civilians: Summary Executions and Attacks on Individual Civilians in Kyiv, Chernihiv, and Sumy Regions in the Context of the Russian Federation’s Armed Attack Against Ukraine (United Nations Officer of the High Commissioner for Human Rights) This report by the Office of the United Nations High Commissioner for Human Rights (OHCHR) addresses killings of civilians, encompassing both summary executions and attacks on individual civilians, committed in parts of Kyiv, Chernihiv and Sumy regions of Ukraine between 24 February and 6 April 2022, while under military control of the Russian Federation. The report documents certain killings and, in so doing, aims to contribute to victims’ right to truth and accountability, as well as to deter future violations of international human rights, humanitarian and criminal law in the context of the continuing international armed conflict in Ukraine. It also advocates for enhanced efforts to bring the perpetrators to justice and to provide victims with remedy and reparations.

Russia killed 441 civilians extrajudicially in Kyiv area early in war, U.N. finds (Washington Post) Russian forces killed extrajudicially at least 441 civilians outside of Kyiv, in what likely amounted to war crimes, in the first weeks of the invasion of Ukraine, according to a U.N. report released Thursday. The actual number of civilians summarily killed is likely to be “considerably higher,” the report found.

Putin must immediately cease attacks on Ukraine’s civilians: UK statement to the OSCE (GOV.UK) Ambassador Neil Bush says that Russia is trying to break Ukrainian resolve through its brutal attacks on civilians, hospitals and energy infrastructure.

Remarks by Vice President Harris and Prime Minister Šimonytė of Lithuania Before Bilateral Meeting (The White House) Vice President's Ceremonial OfficeEisenhower Executive Office Building 1:48 P.M. EST VICE PRESIDENT HARRIS: Madam Prime Minister, welcome to Washington.

As Finland and Sweden wait to join NATO, Turkey extracts concessions (Washington Post) Ankara is holding up expansion of the Western alliance, and the Biden administration may have to step in to get the deal done

IT Army of Ukraine Hit Russian Banking Giant with Crippling DDoS Attack (HackRead) The bank confirmed that it had “experienced an unprecedented cyber attack from abroad.”

Russian state-owned bank VTB hit by largest DDoS attack in its history (Reuters) Russia's No. 2 bank VTB was hit by the largest cyber attack in its history, it said on Tuesday, warning of temporary difficulties in accessing its mobile app and website, but assuring customers that their data remained safe.

How Estonia is helping Ukraine take on Russian cyber threats (POLITICO) Estonia is playing a leading role in providing cybersecurity and digital support for Ukraine, areas the Baltic nation dominates in.

Disentangling The Digital Battlefield: How the Internet Has Changed War (War on the Rocks) Journalists have described the invasion of Ukraine as the world’s “first TikTok war,” the most “internet-accessible war in history,” and history’s “most

West urged to seize Russia’s frozen $350bn to fund war in Ukraine (The Telegraph) Bill Browder, the British financier and arch-critic of Vladimir Putin, says the commitment to support Kyiv with money and weapons is waning

Attacks, Threats, and Vulnerabilities

Fake Invoice Attack with Malware Bypasses Office 365 (Armorblox) This blog examines a Vendor Invoice Fraud attack that included Malware within an attachment, and impersonated a trusted vendor. The email attack bypassed Microsoft Office 365 email security with the potential to compromise more than 100,000 users if not for Armorblox stopping the attack.

Leaked: The Altrnativ world of cybersurveillance (POLITICO) Leaked: The Altrnativ world of cybersurveillance About this series: As co-founder of the French search engine Qwant, Eric Leandri was heralded as a champion of digital privacy and an example of Eur…

A Twitter data tracker inhabits tens of thousands of websites (Washington Post) A 202 exclusive: Twitter can track other websites’ visitor information, with few check

Morphisec Discovers Brand New Babuk Ransomware Variant in Major Attack (PRWeb) Morphisec discovered a brand-new variant of Babuk ransomware during a major attack at the end of November. The attack targeted a Morphisec

Bypassing air-gapped networks via DNS (Pentera) In order to protect an organization’s critical assets from Internet access, IT teams often create isolated or ‘air-gapped’ networks. These networks are

How Secure are WhatsApp voice calls? (Salt | Secure Communications) One of the most well-known messaging apps in the world is WhatsApp, a system which is owned by Meta. The software is used by over two billion individuals, sending over 55 billion messages daily. Therefore, it is not surprising that spam, malware threats, and security issues are starting to be more widely reported in regards […]

Internet Explorer 0-day exploited by North Korean actor APT37 (Google) Google’s Threat Analysis Group describes a new 0-day vulnerability attributed to North Korean government-backed actors known as APT37.

North Korea used Internet Explorer vulnerability to target South Koreans (The Verge) Malicious documents referenced the recent tragedy in Itaewon, Seoul.

Internet Explorer is still a viable zero-day attack vector (Cybersecurity Dive) North Korea-linked threat actors are using a technique that has been widely used to exploit Internet Explorer via Office files since 2017, Google researchers found.

₿uyer ₿eware: Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware (Volexity) Over the last few months, Volexity has observed new activity tied to a North Korean threat actor it tracks that is widely referred to as the Lazarus Group.

Iranian hackers accused of targeting diamond industry with wiper malware (The Record by Recorded Future) Iranian government hackers have been accused of targeting diamond companies in South Africa, Israel and Hong Kong with wiper malware.

Fantasy – a new Agrius wiper deployed through a supply‑chain attack (WeLiveSecurity) ESET researchers analyzed a supply-chain attack abusing an Israeli software developer to deploy Fantasy, Agrius’s new wiper.

SafeBreach Labs Discovers New Zero-Day Vulnerabilities | New Research (SafeBreach) See how the vulnerabilities were used to develop an undetectable, next-generation wiper with the potential to impact hundreds of millions of endpoints.

How will Cyber Attackers use AI? | ChatGPT & Phishing (YouTube) In this video, you'll learn how an attacker could use ChatGPT to create better phishing attacks and why it's going to require AI and ML to catch these attack...

ChatGPT shows promise of using AI to write malware (CyberScoop) Large language models pose a major cybersecurity risk, both from the vulnerabilities they risk introducing and the malware they could produce.

Law, Order and Mayhem: Cybercriminals Scam Each Other Out of Millions of Dollars and Take Their Complaints About the Scams to Arbitration Rooms, Sophos Reports (GlobeNewswire News Room) Attackers Use Classic Techniques – Typosquatting, Phishing, Backdoored Malware, Fake Marketplaces, and Much More – to Scam Each Other; Sub-Economy in Just...

The scammers who scam scammers on cybercrime forums: Part 1 (Sophos News) A shadowy sub-economy is more than just a curiosity – it’s booming business, and also an opportunity for defenders. In the first of a four-part series, we look at the forums involved, and how they …

Metropolitan Opera Suffers Cyber Attack (OperaWire) The Metropolitan Opera has suffered a cyber attack.

Colombian healthcare giant Keralty targeted by RansomHouse gang; forced to suspend operations (teiss) Colombian healthcare provider Keralty suffered a ransomware attack that affected IT operations, websites, scheduling of medical appointments, and other daily operations.

Antwerp Goes Offline Following Ransomware Attack (Heimdal Security Blog) The Antwerp public prosecutor's office has initiated an investigation to find out more information about the unprecedented cyberattack.

Month-long cyber-attack, some counties still offline (KAIT8) A recent cyber-attack left at least 30 Arkansas counties without access to online files. Now, a month later, some counties are still offline.

Ransom for data approved by Little Rock School Board (Arkansas Online) The Little Rock School Board on Monday authorized Superintendent Jermall Wright to enter into a settlement to end, as favorably as possible for the district, a cyberattack on the 21,000-student school system's data networks.

Justice Hacked: When Cyber Criminals Come for the Courts (GovTech) Cyber incidents have hit state courts in Alaska, Georgia and Texas in recent years. Court leaders and CIOs at the NCSC eCourts conference this week shared what happened and what they learned from the experiences.

What to Know About an Unlikely Vector for Cyber Threats: Household Pets (Insurance Journal) Pets can make a great addition to the family, bringing positivity and warmth to a household, but the digital devices associated with them could be a

Trends

Zscaler Study Finds 90% of Global Enterprises are Adopting Zero Trust, Yet Have Not Unlocked the Full Business Potential (GlobeNewswire News Room) More than 90% of organizations migrating to the cloud have implemented, are implementing, or are in the process to implement a zero trust architecture Only...

US Executives Turn to Cyber Programs for Business Enablement and Future Readiness (PR Newswire) According to Deloitte's "2023 Future of Cyber" survey, many U.S. executives turn to cybersecurity programs to enable business strategy. The...

Policy Violation and Fraud on Food Delivery Apps Uncovered by Incognia Trust & Safety Report (GlobeNewswire News Room) Data indicates a direct relationship between policy violation and fraud on food delivery mobile applications...

Cybercrime outlook 2023: It’s all about the economy (Norton) Norton Labs released their 2023 cybersecurity predictions. See how the economy is expected to have an impact on cybercrime next year.

Metaverse and Space May Be Cybercriminals’ Playgrounds in 2023 (Business Wire) Experian releases its 10th annual Data Breach Industry Forecast that includes six predictions for 2023 and beyond.

Identity Fraud Report (Onfido) Get the latest identity fraud trends and threats, and get best practice advice for fraud prevention in this report.

4 cybersecurity predictions for 2023 — SANS analysts look ahead (VentureBeat) SANS Institute analysts share 4 cybersecurity predictions for 2023 with VentureBeat to help security leaders confront emerging threats.

US Executives Turn to Cyber Programs for Business Enablement and Future Readiness (PR Newswire) According to Deloitte's "2023 Future of Cyber" survey, many U.S. executives turn to cybersecurity programs to enable business strategy. The...

Marketplace

How the Global Spyware Industry Spiraled Out of Control (New York Times) The market for commercial spyware — which allows governments to invade mobile phones and vacuum up data — is booming. Even the U.S. government is using it.

Vaultree Raises $12.8 Million for Data-in-Use Encryption Solution | SecurityWeek.Com (SecurityWeek) Vaultree has raised $12.8 million in Series A funding for its data-in-use encryption technology.

Second Front Systems Raises Oversubscribed $32 Million Series A to Scale its DevSecOps Platform (PR Newswire) Second Front Systems (2F), the public-benefit software company focused on accelerating the delivery of mission-critical software-as-a-service...

IBM to Acquire Octo (PR Newswire) IBM (NYSE: IBM) today announced an agreement to acquire Octo, a U.S.-based IT modernization and digital transformation services provider...

We’re joining Dropbox! (Boxcryptor) Almost 12 years ago, we set out to make complex security solutions easy to use. Now we are excited to share that we are set to begin a new chapter with Dropbox, Inc.

Deloitte joins forces with Makros to bolster its cybersecurity practice (Intelligent CIO LATAM) With the goal of solidifying its strategic leadership and to continue supporting its clients in critical areas such as cybersecurity, Deloitte has joined forces with Makros, a Chilean cybersecurity business with 18 years of proven experience in the domestic market. With nearly 100 professionals and more than 200 clients, Makros provides a host of services […]

We want to be a profitable company by FY25, says SentinelOne CEO (CNBC) Tomer Weingarten, SentinelOne CEO, joins 'TechCheck' to discuss how long the company's strong growth can continue, how quickly it can grow on the top line and how he would characterize the way the customer thinks right now.

Corelight Achieves 75% Year-over-Year Growth in IDS Subscriptions Fueled by Customer Requirements to Consolidate Legacy Toolsets and Boost Efficiency (Corelight) Corelight Achieves 75% Year-over-Year Growth in IDS Subscriptions Fueled by Customer Requirements to Consolidate Legacy Toolsets and Boost Efficiency

NSO Group welcomes Netanyahu's return, views contracts in Saudi Arabia (I24news) Heavily indebted firm hopes Netanyahu will ease restrictions on its exports - Click the link for more details.

Shift5 Expands Arlington Office, Further Fueling Growing Tech Community in DC Metro Area (GlobeNewswire News Room) OT data and cybersecurity company plants roots in DC and invests in hybrid-by-design model...

Securonix appoints Nayaki Nayyar as chief executive officer (People Matters) Founder and former CEO Sachin Nayyar appointed as executive chairman of the board of directors.

Products, Services, and Solutions

Rezilion Unveils New Updates to MI-X, An Open Source Tool That Determines Vulnerability Risk, at Black Hat Europe (Rezilion) Today Rezilion announced updates to MI-X, its highly-rated open-source tool developed by Rezilion’s vulnerability research team.

Open Line Selects and Deploys Salt Security API Protection Platform to Enhance Their Managed Services Portfolio (PR Newswire) Salt Security, the leading API security company, today announced that Open Line NL, a supplier of managed cloud services and applications, has...

SecurityScorecard Empowers Customers to Maximize their Security Investments by Providing a One-Stop Shop with Dramatically Expanded Partner Marketplace (Business Wire) SecurityScorecard, the global leader in cybersecurity ratings, today announced significant momentum for the SecurityScorecard Marketplace, the one-sto

1Password's New Tools Secure Entire Software Development Lifecycle (PR Newswire) 1Password, the leader in human-centric security and privacy, today launched a solution to help streamline how companies manage and secure...

Kali Linux 2022.4 Release (Azure, Social & Kali NetHunter Pro) | Kali Linux Blog (Kali Linux) Before the year is over, we thought it was best to get the final 2022 release out. Today we are publishing Kali Linux 2022.4. This is ready for immediate download or updating existing installations. A summary of the changelog since August’s 2022.3 release:

French Biggest Auto Club Roole Unveils the Innovation Behind Its GPS Antitheft Tracking Solution Wetrak (Actility) An unjammable GPS tracking protection for cars is now widely available in France, powered by LoRaWAN® and Abeeway

Palo Alto Networks Medical IoT Security protects connected medical devices (Help Net Security) Palo Alto Networks has released Medical IoT Security — the zero trust security solution for medical devices.

SimSpace expands globally with cyber force platform used by US cyber command elite forces (TahawulTech.com) SimSpace Expands Globally with Commercial Release of Cyber Force Platform used by US Cyber Command Elite Forces.

Congress sticks with Twitter, not flocking to other social media — for now (Roll Call) Whatever happens to Twitter under Elon Musk, communications directors on Capitol Hill are hanging around to find out.

Microsoft taps security demand to drive M365 amid fragmented market (Cybersecurity Dive) A top company executive said a key driver is to bundle its cybersecurity capabilities with office productivity applications, as customers look to consolidate vendors.

Mosaic Partners With Safe Security on Real-Time Cyber Risk Evaluation (Business Wire) Safe Security and Mosaic Insurance announce partnership to connect cybersecurity controls to insurance coverage.

Opaque Systems, Pioneer in Confidential Computing, Unveils the First Multi-Party Confidential AI and Analytics Platform (PR Newswire) Opaque Systems, the pioneers of secure multi-party analytics and AI for Confidential Computing, today announced the latest advancements in...

Technologies, Techniques, and Standards

What does it take to be good at cybersecurity? (Cybersecurity Dive) Few large enterprises meet Deloitte’s standards for high cyber maturity. The 21% that do recognize benefits not typically associated with security.

Surveillance won’t curb insider threats — but workplace culture can (Security Magazine) By establishing a data protection program based in trust and transparency, security teams promote collaboration and innovation among all levels of the business, while still having the visibility needed to monitor for risks.

Unraveling The Clues: Delivering On The Promise Of High-Fidelity, Actionable Alerts (Netography) Netography Fusion shows the who, what, and where as important data points for enrichment to create true, high-fidelity, actionable alerts worthy of an outcome.

Limiting Gen Z Marines’ phone use hard but necessary, top Marine says (Marine Corps Times) “Now we have to completely undo 18 years of communicating all day long and tell them, ‘That’s bad, that will get you killed.’”

Design and Innovation

WSJ News Exclusive | Apple Plans New Encryption System to Ward Off Hackers and Protect iCloud Data (Wall Street Journal) The optional feature would keep most data secure that’s stored in iCloud, a service used to back up iPhones or save specific device data such as Messages. The data would be protected in the event Apple is hacked, and it also wouldn’t be accessible to law enforcement, even with a warrant.

Apple says it will allow iCloud backups to be fully encrypted (Washington Post) The FBI said it was 'deeply concerned with the threat end-to-end and user-only-access encryption pose’

Apple Kills Its Plan to Scan Your Photos for CSAM. Here’s What’s Next (WIRED) The company plans to expand its Communication Safety features, which aim to disrupt the sharing of child sexual abuse material at the source.

ESET launches psychometric test to uncover visionary thinkers across the world (Technuter) ESET announces the launch of the Progress Personas psychometric test, developed in partnership with The Myers-Briggs Company, a pioneer in personality and profe

ESET Launches Psychometric Test to Uncover Visionary Thinkers Across the World (IndianWeb2.com) ESET, a global leader in cybersecurity, today announces the launch of the Progress Personas psychometric test, developed in partnership with The Myers

Legislation, Policy, and Regulation

Reconciling International Breach Reporting Rules Could Prove Challenging (Wall Street Journal) Privacy and security chiefs say different countries must sync up rules around cybersecurity incident reporting, but contrasting views between governments on how to implement rules could complicate those efforts.

Australia’s cyber security is a ‘long tale of areas’ needing improvement (skynews) Cyber Security Minister Clare O’Neil says there are “patches” of world-leading brilliance but also “long tale of areas where” Australia needs to improve on cyber security, this is why new cyber strategies are being introduced.

$858 billion defense bill focuses heavily on cyber. These are some highlights. (CyberScoop) The National Defense Authorization Act omits some efforts such as one to compel federal contractors to provide software bills of material.

Final defense policy bill chock full of cybersecurity provisions (The Record by Recorded Future) Lawmakers filed a compromise version of their annual defense policy bill on Tuesday that includes several major provisions for U.S. Cyber Command.

Congress drops media bargaining bill amid Facebook, industry blowback (Washington Post) Facebook threatened to block news in the U.S. over the measure, which was under consideration as part of a defense package

U.S. to spend $1.5 billion to jumpstart alternatives to Huawei (Axios) The federal government will invest in alternative methods to build cell-network equipment.

Inside the FCC decision to ban sales of Chinese-made telecom gear | Federal News Network (Federal News Network) A normally divided Federal Communications Commission recently voted unanimously to ban sales of Chinese-made telecommunications equipment in the United States. Specifically, gear made by the Huawai…

The White House’s new deputy cyber director: Tech’s challenges are society’s challenges (Atlantic Council) Camille Stewart Gloster, the inaugural deputy national cyber director for technology and ecosystem security, spoke at the DFRLab's 360/StratCom about her newly created office's ambitious agenda to address a wide scope of cyber challenges.

CISA's 2023 priorities include election security, corporate cyber risk (CyberScoop) Director Jen Easterly said the agency's focus will include working with the C-suite, local officials and educators on key cyber issues.

Department of Defense Announces Joint Warfighting Cloud Capability Procurement (U.S. Department of Defense) The Defense Department announced the awarding of the Joint Warfighting Cloud Capability contracts to Amazon Web Services Inc. , Google Support Services LLC, Microsoft Corporation and Oracle.

Pentagon awards $9B cloud contract formerly known as JEDI to AWS, Google, Microsoft and Oracle (Washington Business Journal) The Department of Defense on Wednesday awarded a $9 billion hybrid cloud computing contract to the world's largest tech companies, all of whom had bid, protested, lobbied and bid again for the lucrative deal formerly known as JEDI.

DoD ends cloud contracting saga with four awards (Federal News Network) Microsoft, Amazon Web Services, Google and Oracle won spots on DoD’s Joint Warfighting Cloud Capability (JWCC) vehicle.

US military’s National Media Exploitation Center to refocus on China (Defense News) “We are reducing the size of NMEC,” the chief of staff said, “and we want what’s left of it to be really hyper-focused on strategic competition.”

Texas is latest state banning TikTok on government devices amid national security concerns (Axios) The FBI has warned of possible threats posed by the Chinese-owned social media platform.

Litigation, Investigation, and Law Enforcement

Exclusive: Govt pushes Meta for 1 hour turnaround time on content takedown orders, says Google better on compliance (Moneycontrol) Union IT minister Ashwini Vaishnaw also told Meta that it needs more fact-checkers in India in proportion to the country's population and the user base it commands for its social media platforms.

TikTok Is Sued by State of Indiana, Accused of Targeting Young Teens With Adult Content (Wall Street Journal) Indiana filed two lawsuits against TikTok, alleging it deceives consumers about content and data security—the latest move by state officials to push back against the platform and its China connections.

As States Take Action Against TikTok, Major Privacy Legislation Seems Unlikely (Broadband Breakfast) Californians' opposition to the ADPPA's preemption provision may be the end of the comprehensive bipartisan privacy bill.

FTX Founder Sam Bankman-Fried Is Said to Face Market Manipulation Inquiry (New York Times) Federal prosecutors are investigating whether Sam Bankman-Fried and his hedge fund orchestrated trades in a way that led to the collapse of two cryptocurrencies in May.

Musk Says Twitter Executive Was ‘Exited’ From Company (Bloomberg) Move linked to Jim Baker’s involvement in ‘Twitter Files. Company is facing increased scrutiny from regulators.

4 Arrested for Filing Fake Tax Returns With Stolen Data (Dark Reading) Cybercrooks allegedly stole personal data, used it to file IRS tax documents, and routed refunds to bank accounts under their control.

NSO Group faces lawsuit over spyware activity (SC Media) Israeli spyware company NSO Group has been sued by at least 22 journalists and staff.

School board members applaud coordinated response to BHS threat (Yahoo) Members of the local school board praised the strong and swift response Glynn County law enforcement officials and school resource officers had to the recent fake shooting threat at Brunswick High School. Brunswick High was one of more than 400 public schools in Georgia and across the country that received a false report of an active shooter situation on Nov. 30. The Federal Bureau of ...

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

CYBERUK (Belfast, Northern Ireland, UK, Apr 19 - 20, 2023) Welcome to CYBERUK 2023, the UK’s flagship cyber security event run by the National Cyber Security Centre (NCSC). The theme for 2023 is securing an open and resilient digital future. We face an unprecedented growth in digital and technological development. This will bring huge benefits to society, but it also has the potential to threaten the national and economic security interests of the UK and other free and open societies.

Events

ISSA Central MD Holiday / Social Celebration (Columbia, Maryland, USA, Dec 8, 2022) Join Corelight and Exabeam at Stumpy’s Hatchet House and experience the thrill of ax throwing. Corelight has partnered with Exabeam, the Smarter SIEMTM company, to combine Corelight’s proven network security monitoring (NSM) capabilities with Exabeam’s advanced user and entity behavior analytics (UEBA) and automated incident response capabilities. This integrated solution streams Corelight’s rich logs directly to Exabeam so security teams can obtain faster, more actionable network insights, and use the rich data as a building block for advanced security analyses via the Exabeam platform. We hope to see you there!

Open Source Security Summit (Virtual, Dec 8, 2022) Explore advancements in open source security and how using open source tools can build trust with customers and consumers. For the third annual Open Source Security Summit, we will bring together users, business leaders, and industry visionaries to chart a path forward and highlight the future of open source security solutions at this free virtual event.

How the Peel Regional Police Found the Right Authentication Solution for Them (Virtual, Dec 8, 2022) The two people responsible for this implementation, Tony Ventura, Director, Information Tech Services at Peel Police, and Marco Novielli, Supervisor, Systems & Information Security at Peel Police, will discuss: the authentication challenges they faced migrating to a cloud-based PKI solution—and how yours might compare, the tipping point that meant they needed to transition, their selection criteria and best practices for finding a new approach, why they selected Axiad as their vendor of choice, and the challenges they foresee for the future. The Peel Regional Police (PRP) team is the third largest municipal police service in Canada with 2,100 uniformed members and close to 875 support staff. Composed of five major divisions supported by community police stations, the team is responsible for a broad range of policing duties from airport security and traffic to community-related services and improving community safety and well-being. With such a broad range of environments and systems, the stakes are high when it comes to authentication.

Ignite '22 (Las Vegas, Nevada, USA, Dec 12 - 15, 2022) Securing our digital future against cyberthreats has never been more critical. Collectively, we have a huge opportunity to do it right. At Palo Alto Networks, our mission is to make sure each day is safer than the one before. But we can’t do that on our own. We’re committed to partnering with the world’s cybersecurity leaders, practitioners and strategists to build the right security architectures of the future. At Ignite ’22 we’ll share our innovation, insights, strategies, and training. We invite you to join us there so that, together, we can build what’s next.

ISSA Monthly Meeting: Supply Chain Security: Supplier/Contractor Relationships In Negotiated Contracts (Columbia (and virtual), Maryland, USA, Dec 14, 2022) During the December 14th 2022 presentation to ISSA-Md, the Information Systems Security discussion will center on Standard Cyber Security Contract Provisions which have been dictated by Risk Analysis Tenets and overlapping Cyber Security Frameworks (such as NIST, ISO, Cobit, etc.) as well as legal requirements in the FAR, the DFARS, and CMMC 2.0, which will affect U.S. Government contractors and private sector stakeholders. The discussion will be led by Todd Hinson, a Cybersecurity Contracts Principal with Constellation Energy in Baltimore, Maryland.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.