Cyber threats in Ukraine. Iranian actors exploit Log4j bugs. Attack on Iranian TV used a wiper. Kraken continues to develop.

Announcement

Check out our new First Principles Guide to Cybersecurity.

Our First Principles Guide to Cybersecurity goes through key CSO Perspectives podcast episodes, discussions, and essays that help you understand the challenges that security teams are faced with every day. This guide lays out the fundamentals of topics that are universally and continually relevant to ensure that you are situationally aware and prepared for potential cyber events. Let us help you along your path of professional development and continuing education on cybersecurity. Find it here.

Special Section

By The CyberWire staff.

False flags, information operations, and cyberattacks continue to mark Russia's hybrid war against Ukraine. Whether Moscow will escalate the conflict with a large conventional campaign remains to be seen but both the US and UK have continued to warn that a large-scale invasion could be imminent, perhaps days away.

"False flags" and disinformation.

Reports of shelling in Eastern Ukraine continue. Russian media has accused Ukrainian forces of hitting a kindergarten and blaming it on Russian-led separatists in an attempt at provocation. (Tymofiy Mylovanov observed during last night's session in Chicago that artillery fire in the Donbas isn't new; that it's been going on at a low level since Russia's 2014 incursion into Ukraine.) Separatist leaders in Donetsk, however, acknowledge that their guns were the ones that hit the school, but say it's Ukraine's fault anyway, since Ukrainian forces used "mortars and grenades" against them first. Most observers see the ongoing artillery fire as part of a Russian attempt to frame Ukraine as an aggressor against ethnic Russians in Donetsk and Luhansk.

Russia continues to disclaim any intention of preparing a further invasion of Ukraine, Bloomberg reports. The US continues to say that the risk of intensified ground combat remains high. “We have reason to believe they are engaged in a false-flag operation to have an excuse to go in,” President Biden said yesterday. "False flag" operations are provocations staged as outrages that can be more-or-less plausibly attributed to an adversary. According to the Washington Post, US Secretary of State Blinken, speaking yesterday at the United Nations, enumerated three possible false-flag provocations: “'fabricated so-called terrorist bombing inside Russia,' a fake mass grave, a staged drone attack on civilians, or a 'fake, even a real, attack using chemical weapons.'”

Recent cyberattacks against Ukraine.

Bloomberg quotes Ukrainian authorities as calling the distributed denial-of-service attack that began Tuesday and extended into Wednesday the largest the country had seen. This may be an exaggerated local perspective. Reuters cites Netscout to the contrary. The security firm said that what Ukraine faced was relatively standard and not unusually large. “It’s possible that it was the largest they’d seen against targets,” Netscout's Richard Hummel said. “It is definitely not the largest we’ve seen.” At the Chicago session last night Mylovanov said that, contrary to most reports, the effects of the attack had not been confined to just two banks, but had affected the banking sector as a whole. He assessed the level of interference as comparable to that Estonia sustained when it came under Russian cyberattack. Tha Ukraine escaped a crippling shutdown he ascribed to the country's improved resiliency.

Warnings that Russian cyber operations could affect countries beyond Ukraine continue. The Voice of America reports US concerns about the possibility of cyberattack, and it cites the often-mentioned case of NotPetya, which spread beyond its Ukrainian targets to affect commerce globally. Media in the UK are retailing similar warnings, although they focus on the possibility of a direct cyberattack against British assets. Online shopping, paycard transactions, and healthcare information are regarded as especially at risk.

Speaking at the Munich Cybersecurity Conference, US Deputy Attorney General Lisa Monaco said, "Given the very high tensions that we are experiencing, companies of any size and of all sizes would be foolish not to be preparing right now as we speak -- to increase their defenses, to do things like patching, to heighten their alert systems, to be monitoring in real-time their cybersecurity. They need to be as we say, 'shields up' and to be really on the most heightened level of alert that they can be and taking all necessary precautions."

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Summary

By the CyberWire staff

While the general push to address the risk posed by Log4j vulnerabilities seems to have limited the damage organizations might otherwise have sustained, exploitation of vulnerable systems continues. SentinelLabs researchers describe the activities of an Iranian-aligned threat actor they're calling "TunnelVision," and which is hitting vulnerable instances of VMware Horizon. SentinelLabs notes overlap between TunnelVision activity and the operations Microsoft ascribes to Phosphorus and CrowdStrike to Charming Kitten or Nemesis Kitten. Whether these represent activities of the same unit or distinct groups remains unclear.

Iran itself has been the target of cyberattacks. Check Point looks into recent incidents affecting Iranian state television. Their surface motivation seemed straightforwardly hacktivist, designed to denigrate the regime and urge assassination of Tehran's supreme leader. But an examination of the malicious files finds that the unknown threat actors also deployed wiper malware against their targets.

ZeroFox this week has published an update to its research on the Golang-based botnet its researchers described last October. It's called "Kraken," but it's not to be confused with the botnet that appeared in 2008 and had the same name; the two are unrelated. The current Kraken spreads via SmokeLoader, and, while it's still under development, it "already features the ability to download and execute secondary payloads, run shell commands, and take screenshots of the victim’s system." While it's still maturing, Kraken nets its operators a small but interesting sum of ~$3000 a month. Its most recent infestations show signs of deploying an information-stealer, but to what end is unknown.

Selected Reading

Dateline

Sanctions, support, and prospects for diplomacy. (The CyberWire) Cyber operations seem likely to form an enduring part of Russia's hybrid campaign against Ukraine as Moscow continues a campaign of disinformation and provocation.

Ukraine Says It Suffered Worst DDoS Attack in Standoff (Bloomberg) Attackers targeted government websites and banks: officials. Government sees no damage to Ukraine infrastructure, finances.

Recent Ukraine outage caused by modest cyberattack, data shows (Reuters) The blast of rogue traffic that briefly overwhelmed Ukrainian servers earlier this week was modest compared to digital onslaughts recorded elsewhere, U.S. company Netscout Systems Inc said Thursday.

As Russia amasses troops, Ukraine battles another threat: Digital warfare (NBC News) A new wave of cyber operations began in earnest Jan. 13, when computers in Ukraine started showing signs of the first serious hacking campaign since Russia’s troop buildup.

What would a world war look like as Ukrainian official warns of 'information warfare' (inews.co.uk) Critical infrastructure from banking services to the energy sector can be targeted by hackers to disrupt millions of people's lives

Constant Russian attacks on Ukraine in cyberspace (GZERO Media) What is cyber's role in the Russia-Ukraine crisis? Marietje Schaake, International Policy Director at Stanford's Cyber Policy Center, Eurasia Group senior advisor and former MEP, discusses trends in big tech, privacy protection and cyberspace.

Ukraine: how cyber-attacks became so important to the conflict (The Conversation) Cyber-attacks are adding to the pressure on Ukraine as it faces Russian troops on its borders.

US, Allies Warn Possible Russian Cyberattacks Could Reverberate Globally (VOA) Cybersecurity officials say they're bracing for potential spillover if Russia continues attacking Ukrainian digital infrastructure

Online shopping, card payments and NHS records could be targeted in Russian cyber attack (inews.co.uk) Russia has been accused of orchestrating numerous cyber attacks against Ukraine since 2014

DOJ official warns companies 'foolish' not to shore up cybersecurity amid Russia tensions (ABC News) It comes as other U.S. agencies warned of Russia's cyber capabilities.

Ukraine-Russia ceasefire frays with nursery shelling allegation, other claims (Newsweek) Ukrainian President Volodymyr Zelenskyy said that the shelling of a kindergarten in Stanytsia Luhansk, allegedly by pro-Russian forces, was a "big provocation."

East Ukraine sees its worst shelling in years (Reuters) Russian-backed separatists in eastern Ukraine said on Friday they planned to evacuate their breakaway region's residents to Russia, a stunning turn in a conflict the West believes Moscow could use to justify an invasion of Ukraine.

Ukraine and Moscow-backed separatists trade accusations of shelling in potential eastern flash point; Moscow expels senior U.S. diplomat (Washington Post) Ukraine and Russian-backed separatists accused each other Thursday of violating a cease-fire in the eastern part of the country, a potential flash point in what Western officials say are Russian preparations for a possible attack by growing forces massed near Ukraine’s borders.

Russia accused of shelling Ukraine in bid to provoke war (The Telegraph) Liz Truss says military activity on eastern border was ‘a blatant attempt to fabricate pretexts for invasion’

Russia begins ‘false flag’ attacks against Ukraine (The Telegraph) Joe Biden and Boris Johnson warn invasion could take place within days

Ukraine says nation does not want war with Russia, but will defend itself (Newsweek) "We don't want to fight with Russians, but we will defend our country if we have to," the Ukrainian Ambassador to the United States, Oksana Markarova said.

Rebel leader in east Ukraine announces civilian evacuation (AP NEWS) A separatist leader in eastern Ukraine has announced the evacuation of civilians to Russia amid soaring tensions. Denish Pushilin, the head of the separatist government in the Donetsk region, said in a statement Friday that women, children and the elderly will be evacuated first, and that Russia has prepared the necessary facilities to accommodate them.

Russia Claims It’s Withdrawing More Tanks From Border Amid Fresh Claims Of Ceasefire Violations In Eastern Ukraine (Forbes) U.S. officials have dismissed Russia’s force drawdown claims calling them a deliberate ruse and have warned that Moscow is seeking a pretext for invasion.

Russia has massed up to 190,000 personnel in and near Ukraine, U.S. says (Reuters) Russia's build-up of military personnel threatening Ukraine probably totals up to 190,000, the U.S. ambassador to the Organization for Security and Cooperation in Europe said in a statement to an OSCE meeting on the Ukraine crisis on Friday.

Russia has up to 190,000 military personnel in or near Ukraine, says US – live updates (the Guardian) US claims number of Russian troops inside Ukraine or near its borders is significantly higher than previously known

U.S. says Russian claim of pullback around Ukraine is ‘false,’ accuses Moscow of adding troops instead (Washington Post) Western officials say Russia is showing no sign of pulling back its forces from the border with Ukraine — and that the Kremlin, contrary to President Vladimir Putin’s public statements, has instead recently added thousands more troops to the gathered ranks in preparation for a possible attack.

Russia doesn’t appear to be leaving Ukraine border, SECDEF warns (Military Times) Increased logistical support by Russian troops offers a strong sign that they aren't going home, Defense Secretary Lloyd Austin said.

Scorn poured on Russia’s claims of withdrawal from Ukraine as Putin accused of faking de-escalation (The Telegraph) Risk of invasion remains ‘very high’ as Kremlin showed to merely be repositioning troops ready for attack

U.S. Ramps Up Ukraine Warnings as Russia Denies Invasion Plans (Bloomberg) Stocks slump and oil spikes amid back-and-forth between sides. Russia expels senior U.S. embassy official in Moscow.

Blinken Calls Russian Aggression Against Ukraine a 'Moment of Peril' (Bloomberg) U.S. Secretary of State Antony Blinken calls the Russian aggression against Ukraine a "moment of peril." He spoke before the U.N. Security Council. He says this crisis affects every country in the world. (Source: Bloomberg)

No Invasion Wouldn’t Mean an End to the Ukraine Crisis (Foreign Policy) Moscow has plenty of options short of full-blown war.

Ukraine Live Updates: Shelling Raises Fears Ukraine Conflict Is Heating Up (New York Times) Russian-backed separatists say they came under attack, raising fears in the West that Moscow may claim an opening for military action. Ukraine said the separatists shelled a kindergarten, wounding three people.

NATO allies fear Putin’s Belarus military build-up will be permanent (Atlantic Council) At the moment all eyes are on the Ukrainian border. But regardless of how Vladimir Putin's manufactured crisis in Ukraine ends, the threat to NATO's eastern flank from Russia's growing military presence in Belarus will remain.

Twenty questions (and expert answers) about what’s happening with Ukraine and Russia (Atlantic Council) As the crisis in Eastern Europe continues to unfold, we tapped our expert network to answer the burning questions about the implications for Russia, Ukraine, and the wider world.

What would constitute victory for Putin in his war with Ukraine? (Atlantic Council) In order to achieve his long-term foreign policy goal of subjugating a hostile Ukraine, Russian President Vladimir Putin must militarily seize and occupy a large portion of what is the largest country wholly in Europe.

US consulting with NATO, allies, about future troop deployments to Europe (Military Times) U.S. President Joe Biden sounded unusually dire Thursday, as he warned that Washington saw no signs of a promised Russian withdrawal.

US 2nd Cavalry troops deploying to Bulgaria as NATO reinforces Russia’s neighbors (Stars and Stripes) Defense Secretary Lloyd Austin said Thursday that a company of troops will travel to Bulgaria to train with allies following the recent repositioning of 1,000 other regiment troops to Romania.

Ukraine, UK, Poland announce security pact amid heightened tensions (Defense News) The tie-up is meant to deepen Ukraine’s relationships with the two European nations in matters of cyber security, energy security and countering disinformation, said the Ukrainian Ministry of Foreign Affairs.

China: US should oblige Russian "legitimate, reasonable concerns" in Europe (Newsweek) Chinese Foreign Ministry spokesperson Wang Wenbin asked that the U.S. not "hype up and sensationalize the crisis and escalate tensions" over Ukraine.

Moscow presses demands to block Ukraine from NATO (Washington Post) President Biden offered a bleak warning on Thursday that Russia will attack Ukraine “in the next several days,” as the Kremlin rejected U.S. security proposals and shelling escalated in eastern Ukraine.

China accuses U.S. of hyping up threat of Russia invading Ukraine (Newsweek) Russia has announced the withdrawal of some forces near Ukraine, but NATO says it sees no real signs of de-escalation.

How to know if Ukraine war will break out—watch China's embassy (Newsweek) China's Foreign Ministry called for restraint and said its diplomatic staff would continue to work as normal in Ukraine's capital Kyiv.

How to Make a Deal With Putin (Foreign Affairs) Only a comprehensive pact can avoid war.

Vice President Harris is meeting leaders in Munich to talk about Russia and Ukraine (NPR) This is Harris' highest-stakes foreign trip yet. She will meet some 13 heads of state to discuss the threat posed by Russia, and will speak at the Munich Security Conference.

What Kamala Harris can achieve at the Munich Security Conference (New Statesman) Harris must remember one thing above all: at stake is not her future political career but European security.

Turkey’s Russia-crisis strategy rests on one fact: It has too much to lose (Atlantic Council) Turkey's approach underlines the significant risks a conflict poses to the delicate balance between its diplomatic and economic relationships, and security concerns around the region.

Europe Moves to Shield Economy From Possible Russia Sanctions (Bloomberg) Germany, Italy among nations seeking to avoid sanction fallout. EU’s top diplomat touts unanimous support for sanction package.

Russia invading Ukraine would be "insane," ambassador says (Newsweek) NATO Secretary-General Jens Stoltenberg expressed skepticism that Russian troops were pulling back from the border.

America’s Eyes in the Skies Over Ukraine (Foreign Policy) U.S. spy planes are keeping Putin’s buildup in the open—for now.

If Russia Invades Ukraine, TikTok Will See It Up Close (Wired) As troops amass on Ukraine’s border, civilians capture it all on camera. Online sleuths are now unpacking the details.

Attacks, Threats, and Vulnerabilities

Iranian hackers actively exploiting Log4j vulnerability to compromise VMware Horizon servers (Computing) After successfully exploiting the bug, they can run malicious PowerShell commands, install backdoors, and steal credentials from infected machines

Log4j2 In The Wild | Iranian-Aligned Threat Actor "TunnelVision" Actively Exploiting VMware Horizon (SentinelOne) Threat actor exploits Log4j2 vulnerabilities to drop PowerShell backdoors, harvest credentials, and communicate via legitimate services.

Deep dive into hack against Iranian state TV yields wiper malware, other custom tools - CyberScoop (CyberScoop) The Jan. 27 hack of Iranian state broadcaster IRIB — which ran a message of support for opposition leaders and called for the assassination of Iran’s supreme leader — came with previously unidentified wiper malware, according to research that suggests the incident was more destructive than initially assumed.

EvilPlayout: Attack Against Iran’s State Broadcaster (Check Point Research) In the past few months, a new wave of cyberattacks has been flooding Iran. These attacks are far from minor website defacements – the recent wave is hitting national infrastructure and causing major disruptions to public services. This article provides an in-depth technical analysis of one of the attacks against the Iranian national media corporation,... Click to Read More

Bots and Fake Accounts Push China’s Vision of Winter Olympic Wonderland (New York Times) The country’s propagandists have used a variety of tools online to promote a vision of the Games that is free of rancor or controversy.

Researchers Warn of a New Golang-based Botnet Under Continuous Development (The Hacker News) Kraken, a new Golang-based botnet has been discovered that is under active development and offers several backdoor capabilities.

Baby Golang-Based Botnet Already Pulling in $3K/Month for Operators (Threatpost) Newborn as it is, the Kraken botnet has already spread like wildfire, thanks to the malware's author tinkering away over the past few months, adding more infostealers and backdoors.

New Botnet Kraken Deploys Backdoor to Steal Sensitive Information (GBHackers On Security) The cybersecurity researchers at ZeroFox Intelligence have recently discovered a new Golang-based botnet which is dubbed Kraken.

Hackers Had Access to Red Cross Network for 70 Days (SecurityWeek) One month after disclosing a data breach that affected roughly 515,000 people, the Red Cross announced that the hackers had access to its network for 70 days before the attack was discovered.

Malicious Emails Can Crash Cisco Email Security Appliances (SecurityWeek) A vulnerability in Cisco’s Email Security Appliance can be exploited for DoS attacks using specially crafted emails.

‘Zero-Click’ Hacks Are Growing in Popularity. There’s Practically No Way to Stop Them (Bloomberg) Cutting-edge technology means even ‘the most skeptical, scrupulous targets can be spied on’

Security Patches, Mitigations, and Software Updates

Intel Software and Firmware Updates Patch 18 High-Severity Vulnerabilities (SecurityWeek) Many high-severity privilege escalation vulnerabilities have been patched in Intel firmware and software with the first round of security updates released in 2022.

Google Introduces 'Privacy Sandbox' for Ads on Android (SecurityWeek) Google this week announced Privacy Sandbox on Android, a new initiative expected to lead to more private advertising solutions for its mobile users.

RIP GAID: Privacy Sandbox is coming to Android. What advertisers need to know. (Mobile Dev Memo) RIP GAID: Privacy Sandbox is coming to Android. What advertisers need to know.. Mobile marketing and advertising, freemium monetization strategy, and

Microsoft bolsters Edge browser security with enhanced features (The Daily Swig) Latest protections unveiled

Trends

2022 SonicWall Cyber Threat Report | Threat Intelligence (SonicWall) The SonicWall 2022 Cyber Threat Report provides the latest cybersecurity data and statistics, giving organizations the insights they need to defend against evolving cyberattacks.Get the free report now.

Appsec Stats Flash (WhiteHat Security) The state of application security is rapidly evolving and there is a need for a more frequent analysis of the threat landscape.

2022 Emerging Technology Trends: Market and Legal Insight for Innovators (Perkins Cole) Technology—and the innovative deployment of new technologies—has increasingly shaped the way we live and interact with the environment.

Attacks using social media as a threat channel doubled in 2021 says new report (Continuity Central) Social media as a threat channel saw a two-fold increase in attacks throughout 2021, according to the latest Quarterly Threat Trends & Intelligence Report from PhishLabs by HelpSystems.

Cyberattackers Hone Their Playbooks, Become More Agile (Dark Reading) Less malware, more interactive intrusions, and big game hunting lead to more success, with an 82% increase in ransomware-related data leaks, new reports show.

Axway Survey Finds People Are Willing to Open up Their Data If It Leads to Better Experiences (Business Wire) In a global consumer survey, Axway (Euronext: AXW.PA), an API Management leader, finds that almost 60% of people believe it's worth allowing companies

Marketplace

CDPQ Is Said to Buy Stake in Warburg-Backed Cybersecurity Firm (Bloomberg) Company now valued at $1.2 billion following investment. ESentire helps companies detect, respond to security threats.

Radware Buys SecurityDAM For $30M To Thwart DDoS Attacks (CRN) Radware has purchased cloud DDoS network operator SecurityDAM for $30 million to accelerate the growth of its cloud security services business.

NortonLifeLock delays completion of deal for Avast (Reuters) U.S. cybersecurity firm NortonLifeLock Inc on Thursday delayed the expected completion date for its buyout of London-listed rival Avast Plc to April 4, saying it was awaiting regulatory nods in the United Kingdom and Spain.

Israeli software developer WhiteSource takes over Croatian peer DefenseCode (SeeNews) Israeli software developer WhiteSource said it has acquired Croatian peer DefenseCode, with customers in Europe and North America, for an undisclosed sum.To a

Cybersecurity M&A Roundup for February 1-15, 2022 (SecurityWeek) Nearly two dozen cybersecurity-related mergers and acquisitions were announced in the first half of February 2022.

Cybersecurity Stocks Provide a Haven During Technology Selloff (Bloomberg) Zscaler, Fortinet manage to keep a big part of pandemic gains. Analysts bullish on security stocks amid geopolitical tensions.

CrowdStrike: Do Or Die Territory (NASDAQ:CRWD) (SeekingAlpha) CrowdStrike has not been spared with the recent attack on growth stocks.

ImmuniWeb Announces Sales Record in 2021 and Unveils New Platform Updates (ImmuniWeb) With 70% YoY revenue growth in 2021 and 250 recurrent enterprise customers from over 50 countries, ImmuniWeb announces new Platform features and improvements.

High-profile cybersecurity leaders back bot defence specialist (BusinessCloud) Manchester-headquartered Netacea to expand in US - where it recently secured Shutterstock as a client - as well as UK following £9m Series A

Canadian Pension Fund CDPQ to Buy Stake in Cyber-Security Firm ESentire: Sources (Insurance Journal) ESentire Inc., a cyber-security company backed by private equity firm Warburg Pincus, has struck a deal to sell a stake to two investment firms at a $1.2

Arlo Solutions Named to Inc. Magazine's Vet100 List (Arlo Solutions) Arlo Solutions (Arlo) has been named to annual Vet100 list—a compilation of the nation’s fastest growing veteran-owned businesses.

Code42 Deepens Cybersecurity Leadership with Appointment of Maria Izurieta as Chief Financial Officer (Business Wire) Code42 names Maria Izurieta as its Chief Financial Officer.

PacketViper Strengthens Advisory Board With Appointment Of C... (MENAFN) PacketViper, LLC, a leading provider of cyber-physical security

Redbot Security Names New Chief Security Officer as the Company Continues Its Rapid Growth (WFMZ) Redbot Security, a leading provider of Manual Controlled Penetration Testing (MCPT®) focused on protecting critical data and systems, today announced another executive role within

KnowBe4 CFO to step down, new exec is named (St Pete Catalyst) Clearwater-based KnowBe4 Inc. (NASDAQ: KNBE), a provider of the world's largest security awareness training, is making changes to its C-Suite. KnowBe4 announced Wednesday that Krish Venkataraman will be stepping down from his role as the co-President and Chief Financial Officer. Venkataraman will be appointed to the company's board of directors. In addition, KnowBe4 announced that [...]

Former NHS Scotland tech boss joins leading cybersecurity firm | FutureScot (FutureScot) Former NHS Scotland tech boss Deryck Mitchelson has joined a leading global cybersecurity firm, it has been announced

Products, Services, and Solutions

Medigate by Claroty Wins Best in KLAS Award for Second Consecutive Year (PR Newswire) Medigate by Claroty, healthcare's leading clinical device data security and integration platform, today announced its selection by KLAS...

Satori Sweeps the Prestigious Cybersecurity Excellence Awards, Winning in Four Categories (Satori) DataSecOps platform recognized as best product in data governance, data security, identity and access management, and secure access categories

Retrospect Backup 18.5 released: with new anomaly detection added to ransomware protection (Continuity Central) Retrospect has announced the general availability of Retrospect Backup 18.5, featuring new anomaly detection, customizable filtering and thresholds, and enhanced ransomware protection to help businesses quickly detect and protect against malicious attacks.

Technologies, Techniques, and Standards

The OT network community cares about data; the engineering community cares about deaths (Control Global) Network security is of course important, whether for IT or OT networks. But the security, safety, and availability of industrial systems rests ultimately on the reliability and accuracy of data delivered to those networks at the sensor level. Ignoring sensor-level security could be, literally, a fatal oversight.

NSA Publishes Best Practices for Selecting Cisco Password Types (National Security Agency/Central Security Service) The National Security Agency published guidance today to help administrators secure network infrastructure devices and their credentials. The “Cisco Password Types: Best Practices”

Academia

What Is Identity and Access Management for K–12? (EdTech) What is IAM, and how does it improve cybersecurity for staff and students?

Legislation, Policy, and Regulation

Cybersecurity: The Fourth Battleground (Security Boulevard) In recent months, there has been significant momentum within the U.S. government and lawmakers to introduce more stringent and effective cybersecurity

Hackers to face 25 years in jail for cyber attacks on Australia's national infrastructure (IT PRO) The proposals aim to update current laws to account for cyber threats like ransomware

Expanded regulation of cybersecurity incidents - new UK government consultation (Lexology) The Government’s Department of Digital, Culture, Media and Sport (“DCMS”) has announced plans to reform the Network and Information Security (NIS)…

Will the Cybersecurity Literacy Act Make a Difference? (Security Boulevard) On this episode of The View With Vizard, Mike Vizard talks with CyberGRX CISO Dave Stapleton about the Cybersecurity Literacy Act, its promise and whether

DOJ Is Amping Up Its Crypto Scrutiny, Naming Head of New Enforcement Team (Bloomberg) Monaco says the crypto ecosystem must be trusted, policed. Choi says she’ll head ‘one-stop shop’ of department’s experts.

New FBI Unit Will Focus on Cryptocurrency Exploitation (Decipher) The FBI is forming a new Virtual Asset Exploitation unit to trace cryptocurrency crimes and ransomware profits.

Justice Department Installs New FBI Crypto Crime Unit (Wall Street Journal) The team will focus on tracking and seizing cryptocurrency used in crimes as prosecutors eye broader international cooperation.

Cyber Reporting Proposals: Assessing Liability Protections and Legal Privileges (Lawfare) Where is Congress on cyber reporting requirements?

Deputy Attorney General Lisa O. Monaco Delivers Remarks at Annual Munich Cyber Security Conference (US Department of Justice) Thank you so much, Gordon, and it’s great to be back with you. Thank you all for having me here today. I am honored to be a part of this conference again this year.

Litigation, Investigation, and Law Enforcement

EU to probe use of cloud services across EU bodies, overseas data transfers (The Record by Recorded Future) The European Data Protection Board (EDPB) has announced plans to probe the use of cloud-based services across EU public bodies as part of an effort to investigate GDPR compliance and detect possible data transfers of EU data overseas.

Nigerian police arrest 29 in online fraud crackdown (The Record by Recorded Future) Local authorities also said they seized mobile phones, laptops, and cars.

Cooley Privacy Talks: Overview of Privacy Enforcement Actions in the US and EU (cyber/data/privacy insights) This post relates to Cooley’s Privacy Talks series – a webinar program featuring Cooley practitioners discussing practical guidance and best practices around managing data protection-related issues. Sessions range from the European General Data Protection Regulation (GDPR) to the California Consumer

Criminal Whales Hold over $25 Billion in Cryptocurrency From Multitude of Illicit Sources (Chainalysis) This blog is a preview of our 2022 Crypto Crime Report. Sign up here to download your copy now! One positive development in the last year has

Canada’s Banks Pressed Into Effort to Quell Protests (Wall Street Journal) Canadian banks have begun cutting off financial services to people linked with ongoing demonstrations against vaccine mandates, an unprecedented use of financial power following an emergency order from the government.

Wife of Navy engineer could change plea in submarine spy case (Navy Times) A plea hearing for Diana Toebbe is scheduled for Friday morning in federal court in Martinsburg, West Virginia, according to a court notice.

Amid high-profile dispute with prosecutors, lawyer charged by Durham asks court to toss his case (Washington Post) The lawyer charged by Special Counsel John Durham with lying to the FBI when he passed along information about then-candidate Donald Trump has asked a judge to dismiss the case — saying that even if he did what Durham alleged, it was not a crime.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Cisco’s Talos Incident Response 2021 Year-in-Review (Virtual, USA, Feb 24, 2022) Join Cyber Threat Alliance Chief Analytic Officer Neil Jenkins and Cisco Talos’ Head of Strategic Analysis Dave Liebenberg as they explore the top threats, initial vectors and major security incidents the Cisco Talos Incident Response handled in 2021, as well as provide insight into what they believe will shape the threat landscape in 2022 and beyond.

CTA Webinar - Talos Incident Response Year-in-Review for 2021 (Virtual, Feb 24, 2022) Join Neil Jenkins, Chief Analytic Officer @CTA, and Dave Liebenberg, Head of Strategic Analysis @Cisco Talos, as they discuss the Talos Incident Response Year-in-Review for 2021. This talk will explore the top threats, initial vectors, and major security incidents that Cisco Talos Incident Response (CTIR) dealt with in 2021. In addition, it provides some insight into what CTIR believes will shape the threat landscape in 2022 and beyond.

8th Annual Cybersecurity Conference for Executives (Virtual, USA, Mar 16, 2022) What will be the top cybersecurity threats in 2022 and lessons learned from 2021 trends? Join us for the 8th Annual Cybersecurity Conference for Executives, hosted by Ankura and the Johns Hopkins University Information Security Institute on March 16, 2022 for insights from industry experts on a variety of topics including: Trending Cyber Challenges, Supply Chain Cyber Risk Management, Creating a Human Firewall, Emerging Threats in AI, Autonomous Systems, & Machine Learning, Future of Cyber Regulatory Compliance, Ransomware.

(ISC)² SECURE Summit – London (London, England, UK, Apr 7, 2022) (ISC)² SECURE Summits – London is open to both (ISC)² members and non-members. Cybersecurity professionals in every stage of their career are encouraged to participate, from those new to the field to established experts and seasoned practitioners. This one-day event will bring together information security professionals from London and surrounding areas to explore the most current issues impacting cybersecurity. A keynote presentation by Chris Ensor, Deputy Director for Cyber Skills and Growth, National Cyber Skills Center, and exciting breakout sessions will focus on topics such as: Ransomware Incidents: How to Prepare, How to Respond (featuring real-world examples); Security Awareness: Planning and Delivering a Successful Program; Which leading cloud provider has the most effective security features -- AWS, Azure or Google Cloud (GCP)? Attendees will also have plenty of opportunities to meet and network with peers throughout the day.

Events

Certified CMMC Professional (CCP) Exam Prep (Virtual, Feb 14 - 18, 2022) Edwards CMMC-AB approved CCP courses make you a valuable resource to a consultancy providing CMMC preparation/assessments or organization interested in having in-house CMMC trained resources. The release of CMMC 2.0 hasn’t changed what Edwards has to offer our CCP Exam Prep Course participants. The CMMC-AB has directed all LTPs to deliver CCP courses without modification, and will provide a free CMMC 2.0 “delta training” for all students before the exam becomes publicly available. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC Industry’s most respected consultants (Jacob Horne, Amira Armond, Chris Silvers, Sara Deaton, and Tony Buenger) along with Edwards’ internal SMEs (Joy Beland and Brian Hubbard) to deliver their action packed boot camps. Learn more and register now!

Acronis #CyberFit Summit World Tour 2021: Singapore (Singapore (and virtual), Feb 17 - 18, 2022) Discover how to maximize your potential by leaning into cyber protection opportunities. As the premier event series dedicated to enhancing your cyber protection business, we attract the top channel, cybersecurity, and industry experts from across the globe.

Ontic Summit 2022 - A Protective Intelligence Event (Austin, Texas, USA, Feb 22 - 23, 2022) Join us for three days in Austin to explore the latest strategies and technologies propelling protective intelligence forward. Learn from renowned speakers, industry leaders, and practitioners on the future of security, and network with your peers. Hear keynote sessions designed to bring a macro view on global security trends as well as breakout sessions featuring security leaders and practitioners sharing best practices and case studies. Discover new technology innovation in Ontic’s product showcase, and walk away with fresh perspectives and actionable insights to elevate your protective intelligence program.

Emerging Technologies, Existing Policies and Architectures (Columbia (or Virtual), Maryland, USA, Feb 23, 2022) This presentation will discuss current architectures and policies and how it's hard to match the speed of change. That the coalition of the willing can create change through sharing and leveraging the grassroots of organizations and drive-up consistencies in leveraging what you have to meet new constructs and open a discussion on what policies are required.