Dateline Moscow, Kyiv, Prague, Berlin, Brussels, London, New York, Washington: a lull in maneuver, but a continuation of fire (and cyber ops).
Ukraine at D+41: Russia reconstitutes maneuver forces; expect fire and cyber. (The CyberWire) Infantry and armor withdraw from the north of Ukraine, but Russian artillery continues its reduction of such Ukrainian cities as are within range. Cyber operations continue, and Ukraine is apparently getting some help from abroad (at least some defensive help).
Live Updates: U.N. Security Council to Meet as Evidence of War Crimes Mounts (New York Times) China and Russia are unlikely to support any measures that France, the U.S. and Britain propose. European leaders sought to impose more sanctions, but were divided on whether to ban Russian natural gas.
When It Comes to U.N. Diplomacy, Not All Abstentions Are Equal (World Politics Review) Abstentions at the U.N. may seem like a way to avoid hard choices on tough crises. But U.N. diplomacy is rarely that simple. In recent weeks, U.N. members from China to Burkina Faso have abstained on votes in U.N. forums on the war in Ukraine, or just not voted on them. What do such ambiguous votes and nonvotes mean?
Russia-Ukraine war: what we know on day 42 of the Russian invasion (the Guardian) Donetsk governor says Russian artillery has killed civilians at aid point, while Russian governor claims border guards were fired at
Russia’s invasion of Ukraine: List of key events on Day 42 (Al Jazeera) As the Russia-Ukraine war enters its 42nd day, here is a look at the main developments.
Russian military ‘weeks’ from being ready for new push as war takes its toll (The Telegraph) ‘Significant movement’ of troops away from Kyiv to regroup, rearm and resupply as Nato appeals to allies for weapons to reinforce Ukraine
Russia's failure to take down Kyiv was a defeat for the ages (AP NEWS) Kyiv was a Russian defeat for the ages. The fight started poorly for the invaders and went downhill from there. When President Vladimir Putin launched his war on Feb. 24 after months of buildup on Ukraine's borders, he sent hundreds of helicopter-borne commandos — the best of the best of Russia's “spetsnaz” special forces soldiers — to assault and seize a lightly defended airfield on Kyiv's doorstep.
Ukraine says two civilians killed at aid distribution point, east under heavy fire (Reuters) Russian artillery fire killed at least two people and wounded five at a humanitarian aid distribution point on Wednesday as Moscow's forces bombarded towns and cities in eastern Ukraine, local officials said.
At Least 200 Feared Dead in Apartments Hit by Russia, Officials Say (New York Times) After Russian forces withdrew from Borodyanka, a commuter town near Ukraine’s capital, families are searching the rubble for bodies.
As the dead lie beneath the rubble of Borodyanka, the gruesome toll could be worse than Bucha (The Telegraph) Starved civilians, decimated homes and dead animals lying on the street paint a picture of ‘hell’ in devastated Ukrainian town
From clothes to children's toys to washing machines: Ukraine accuses Russian soldiers of looting (Newsweek) "I stole some cosmetics for you," a Russian soldier tells a relative in a phone intercept. "That will make for a nice 'hello from Ukraine,'" she replies.
In shattered Chernihiv, Russian siege leaves a city asking, ‘Why?’ (Washington Post) ‘We don’t know what we did to deserve this,’ says one resident
Satellite images of Bucha dead could provide ‘irrefutable’ proof of Russian war crimes (The Telegraph) Kremlin insists images of bodies lying in the streets were staged by Ukrainians, but ‘eyes in the skies’ may prove otherwise
Russian media campaign dismisses Bucha deaths as fakes (AP NEWS) As gruesome videos and photos of bodies emerge from the Kyiv suburb of Bucha, Kremlin-backed media are denouncing them as an elaborate hoax — a narrative that journalists in Ukraine have shown to be false.
Bucha survivor: ‘Russian soldiers gave rations to people in a basement – and then threw in a grenade’ (The Telegraph) Kateryna Ukraintseva, a city councillor and Ukraine defence force volunteer, tells of random killings and says Russians came looking for her
After the horrors of Bucha, Ukrainians have changed the way we look at this war | Nataliya Gumenyuk (the Guardian) The Russian military are now circling the Donbas. I’m terrified for people there who were loyal to Ukraine for the past eight years, says Ukrainian journalist Nataliya Gumenyuk
China says Bucha killings "deeply disturbing," calls for verification (Newsweek) China's representative to the UN didn't assign blame for the deaths in Bucha, but hinted at Beijing's support for an investigation into the incident.
Russia committing genocide in Ukraine, says Holocaust expert (Newsweek) Eugene Finkel's comments follow Ukraine President Volodymyr Zelensky's claim that Russia sought "the elimination of the whole nation."
The whole world would benefit from a Ukrainian victory over Russia (Atlantic Council) From the countries of the former USSR to nations targeted by Vladimir Putin's destabilization campaigns and secret wars, the whole world would stand to gain from a Ukrainian victory over Russia.
Putin Unbound (Foreign Affairs) Repression at home presaged belligerence abroad.
The Return of Conquest? (Foreign Affairs) The future of global order hinges on Ukraine.
The Outsiders (Foreign Affairs) The international system can still check China and Russia.
How will the Russia-Ukraine war reshape the world? Here are four possible futures. (Atlantic Council) Putin’s war of choice in Ukraine is a world-historical event, marking the final act of the post-Cold War period and the start of a new era, yet unwritten. The spectrum of possible outcomes ranges from a volatile new cold or hot war involving the United States, Russia, and China; to a frozen conflict in Ukraine; to a post-Putin settlement in which Russia becomes part of a revised European security architecture.
Ukraine must govern the terms of peace (The Washington Times) Will Russia’s illegal war against Ukraine end on terms that will promote the security of Europe and the integrity of Ukraine, or will the peace be illusory and portend future conflict and strife?
NATO says Ukraine to decide on peace deal with Russia — within limits (Washington Post) Ukraine’s Western backers have vowed to respect Kyiv’s decisions in any settlement to end the war with Russia, but with larger issues of global security at stake, there are limits to how many compromises some in NATO will support to win the peace.
Ukraine's leader to brief top UN body on alleged massacres (AP NEWS) Ukraine's president planned to address the U.N.'s most powerful body on Tuesday after even more grisly evidence emerged of civilian massacres in areas that Russian forces recently withdrew from .
We are racing to document war crimes in Ukraine (The Telegraph) This is the beginning of what might well be a long process, but it is essential that we preserve evidence for future justice
Nuremberg has shown that tyrants like Vladimir Putin can be brought to justice (The Telegraph) A looming trial could 'peel away the doubters in the camp around Putin' by offering them immunity, said Prof Philippe Sands
Vladimir Putin can be put on trial, and he will be convicted (The Telegraph) There are ways to ensure Russia's president is prosecuted for his war crimes
What are war crimes, and how are they prosecuted? (New York Times) World leaders have vowed to hold President Vladimir V. Putin responsible for any atrocities by Russian forces. Past experience shows such cases take years to build and prosecute.
U.S. Cyber Command providing cyber expertise and intelligence in Ukraine's fight against Russia (FedScoop) U.S. Cyber Command has been very active in addressing security concerns regarding Russia’s invasion of Ukraine, from assisting the Ukrainians to providing intelligence to hardening networks domestically and globally, its commander said Tuesday. “U.S. Cyber Command (with NSA) has been integral to the nation’s response to this crisis since Russian forces began deploying on Ukraine’s […]
Cyber Command chief: U.S. has 'stepped up' to protect Ukraine's networks (The Record by Recorded Future) U.S. Cyber Command chief Gen. Paul Nakasone said Tuesday that his organization has “stepped up” its efforts to strengthen Ukraine’s networks and cyber defenses against Russian digital attacks since Moscow began its invasion in February.
How Ukraine has defended itself against cyberattacks – lessons for the US (FIU News) This article was written by Robert Peacock, Assistant Professor of Criminology and Criminal Justice, republished from The Conversation.
Hackers’ Fake Claims of Ukrainian Surrender Aren’t Fooling Anyone. So What’s Their Goal? (New York Times) Experts say the hackers’ intentions might not be to actually trick anyone, but to erode confidence in Ukrainian media outlets and institutions.
Russian Cyberattacks Increase on Ukraine’s Critical Infrastructure: Report (Wall Street Journal) Microsoft and Cisco are helping Ukraine respond to a March 28 hack on telecommunications company Ukrtelecom.
French Regulator Claims Russia Is Jamming Commercial Aircraft Satellite Navigation (Simple Flying) According to DGAC, Russian military equipment used to block GPS-guided missiles is to blame for ongoing commercial GPS issues over the Baltic Sea.
The Myth of the Missing Cyberwar (Foreign Affairs) Russia's hacking succeeded in Ukraine—and poses a threat elsewhere, too.
Five things we learned from the Conti chat logs (Digital Shadows) At the end of February, the cybersecurity community was rocked by the appearance of alleged chat logs recording conversations between members of the prolific Russian-speaking ransomware group Conti.
Ukraine, Conti, and the law of unintended consequences (CSO Online) How the Russian invasion of Ukraine undid the world’s biggest ransomware gang
Phishing Campaigns Pick-Up in the Wake of the Ukraine Invasion (Tessian) Scammers and bad actors didn't waste anytime capitalizing on the war in Ukraine, here are some of the scams to avoid, and how to donate safely
Leave your Message after the Beep: WhatsApp Voicemail Phishing Attack from Russia (Armorblox) This blog examines a phishing attack that spoofs a voice message notification from WhatsApp, an international, mobile messenger application. Clicking the link attempts to install Infostealer malware.
Nestlé’s Data Leak Shows War-Related Hacktivism Risks (Wall Street Journal) Companies, already warned to remain alert to potential Russian cyberattacks, are battling operations by online activists aiming to bruise corporate reputations amid the war in Ukraine.
ExtraHop Urges Organizations to Adopt Shields Up Guidance, Offers Complimentary Readiness Assessment (ExtraHop) The invasion of Ukraine has the cybersecurity community on high alert; ExtraHop puts AI-backed network intelligence to work to assess security controls and detect attack activity.
The Next Sino-Russian Split? (Foreign Affairs) Beijing will ultimately come to regret its support of Moscow.
Putin’s Doomsday Threat (Foreign Affairs) How to Prevent a Repeat of the Cuban Missile Crisis in Ukraine
Czech Republic sends tanks, infantry fighting vehicles to Ukraine (Reuters) The Czech Republic has sent T-72 tanks and BVP-1 infantry fighting vehicles to Ukraine, a Czech defence source told Reuters on Tuesday, confirming a local media report.
Czech Republic becomes first Nato country to send tanks to Ukraine
(The Telegraph) More than a dozen T-72 tanks as well as BVP-1 infantry fighting vehicles have been loaded on to trains destined for front line combat
Are US Troops Still Training Ukrainians? (Defense One) The military’s top officials did not clear things up on Tuesday.
If Finland and Sweden apply to join NATO, they would be welcomed, Stoltenberg says (Reuters) NATO allies would welcome Finland and Sweden into the alliance if they decided to join but any such move is up to the two nations, NATO Secretary-General Jens Stoltenberg said on Tuesday.
The War in Ukraine Has Put EU Enlargement Back in the Spotlight (World Politics Review) Russia's invasion of Ukraine has put EU expansion back into the spotlight, with all eyes now on Ukraine, rather than the Western Balkans. Despite the urgency of Kyiv's emergency membership bid, the EU's non-response to it is hardly surprising given the current political context within the bloc on expansion and internal cohesion.
US and allies to hit Russia with new sanctions as outrage over civilian killings grows (the Guardian) US, G7 and EU to target Moscow with new measures as Ukraine says 4,400 incidents of alleged ‘war crimes’ being investigated
Ukraine’s Zelensky Calls for Removing Russia From U.N. Security Council After Alleged War Crimes (Wall Street Journal) Volodymyr Zelensky warned that newly uncovered atrocities following the withdrawal of Moscow’s forces near Kyiv could be worse than those in the city of Bucha.
West set to toughen sanctions on Russia; Ukraine urges more (AP NEWS) Western governments prepared Wednesday to toughen sanctions against Russia and send more weapons to Ukraine, after President Volodymyr Zelenskyy pointedly accused the world of failing to end Moscow’s invasion of his country and what he said was a campaign of murders, rapes and wanton destruction by Russian forces.
Russia-Ukraine latest news: US to ban all new investment in Russia in fresh round of sanctions (The Telegraph) The United States will ban all new investments in Russia after the emergence of troubling new evidence of war crimes in Ukraine, according to the White House.
Ukraine Update: U.S. Plans New Sanctions, Zelenskiy Rebukes UN (Bloomberg) The U.S. and allies are poised to announce new sanctions Wednesday, including a ban on all new investments in Russia, to punish the Kremlin for alleged atrocities committed by its forces in Ukraine.
The United Nations has the power to punish Putin. This is how it can be done | Simon Tisdall (the Guardian) Ukraine urgently needs help – and if the UN can’t act, the global consequences could be catastrophic, says foreign affairs commentator Simon Tisdall
EU Proposes Ban on Russian Coal Imports, Ships After Atrocities (Bloomberg) Sanctions package to include ban on most Russian trucks, ships. Bloc will keep discussing how to restrict imports of oil.
European Union proposes Russian coal ban in new sanctions (AP NEWS) The European Union’s executive branch proposed Tuesday a ban on coal imports from Russia in what would be the first EU sanctions targeting the country's lucrative energy industry over its war in Ukraine .
Germany Wrestles With Dependence on Russian Fossil Fuel (Bloomberg) Government prepared to consider coal embargo as first response. Oil and gas are harder to replace in economy relying on import.
Treasury bars Russia payments in dollars from US accounts (AP NEWS) The Treasury Department is moving to keep the Russian government from making debt payments at U.S. banks with U.S. dollars, restricting one of the strategies President Vladimir Putin is using to stave off default, an agency official said Tuesday.
U.S, EU to Hit Russian Investments With New Round of Sanctions (Bloomberg) U.S. to ban Russia investments; EU to ban ships, trucks, coal. Measures aimed at degrading Kremlin power, U.S. official says.
Russia is back on the brink of a debt default after the US blocked its dollar payments. Here's what happens next. (Business Insider) The US Treasury blocked Russia from using American bank accounts, complicating Moscow's ability to pay its debts.
U.S. pushes Russia to the brink of default (Newsweek) The U.S. government has prevented Russia from paying those who hold its sovereign debt amid the ongoing invasion of Ukraine.
Yellen to Warn of ‘Enormous Economic Repercussions’ From Ukraine Invasion (New York Times) The Treasury secretary plans to highlight risks of rising food and energy prices at a congressional hearing on Wednesday.
Intel shuts down all business operations in Russia (BleepingComputer) US chipmaker Intel announced Tuesday night that it had suspended all business operations in Russia, joining tech other companies who pulled out of the country due to the invasion of Ukraine.
Vladimir Putin’s daughters on EU sanctions hit list (The Telegraph) Katerina Tikhonova and Mariya Vorontsova on Brussels’ draft list of targets as it ramps up embargoes on Russia
Russian appeals against sports bans to be heard by CAS (AP NEWS) Russian federations and athletes have filed multiple legal challenges to fight their bans from international sports events because of their country waging war on Ukraine.
Punishments mustn’t play into Putin’s hands (Telegraph) What exactly would be the point of banning the Russian tennis player Daniil Medvedev from Wimbledon?
Why Tracking Putin’s Wealth Is So Difficult (New York Times) Amid speculation that oligarchs are holding cash and luxury assets for the Russian president, many of his extravagances can be traced elsewhere: the Russian state.
Can crypto deliver aid amid war? Ukraine holds the answer. (Atlantic Council) Ukraine has received an outpouring of global support—from weapons to volunteer soldiers—as it bravely battles Russia’s war machine. But there’s a less obvious way in which it has sought and gained help: more than one hundred million dollars in cryptocurrency donations for humanitarian relief and defense.
Harvard students' site helping Ukraine refugees find housing (AP NEWS) Two Harvard University freshmen have launched a website designed to connect people fleeing Ukraine to those in safer countries willing to take them in — and it's generating offers of help and housing worldwide.
Attacks, Threats, and Vulnerabilities
Symantec: Chinese APT Group Targeting Global MSPs (SecurityWeek) A Chinese threat actor known as Cicada (APT10, Stone Panda) has expanded its target list to include government, legal, religious, and non-governmental organizations (NGOs) in multiple countries around the world.
Cicada: Chinese APT Group Widens Targeting in Recent Espionage Activity (Symantec) Government orgs and NGOs among victims in a wide-ranging and sustained campaign.
SpringShell attacks target about one in six vulnerable orgs (BleepingComputer) Roughly one out of six organizations worldwide that are impacted by the Spring4Shell zero-day vulnerability have already been targeted by threat actors, according to statistics from one cybersecurity company.
Microsoft detects Spring4Shell attacks across its cloud services (BleepingComputer) Microsoft said that it's currently tracking a "low volume of exploit attempts" targeting the critical Spring4Shell (aka SpringShell) remote code execution (RCE) vulnerability across its cloud services.
Fake e‑shops on the prowl for banking credentials using Android malware (WeLiveSecurity) ESET researchers have analyzed three malicious Android apps that attempt to steal their login credentials.from the customers of eight Malaysian banks.
FIN7 Morphs into a Broader, More Dangerous Cybercrime Group (Dark Reading) Mandiant has now tied the group to at least eight unattributed clusters of activity targeting organizations across various industries and regions.
New npm Flaws Let Attackers Better Target Packages for Account Takeover (Aquasec) Team Nautilus discovered & analyzed two npm flaws related to 2FA that can allow attackers to target packages for account takeover & supply chain attacks
Conti ransomware deployed in IcedID banking Trojan attack (SearchSecurity) The DFIR Report detailed a December 2021 cyber attack in which a threat actor used a banking Trojan and phishing emails to deploy Conti ransomware.
Ransomware Gang Leaks Files Stolen From Industrial Giant Parker Hannifin (SecurityWeek) The Conti ransomware group has leaked over 5 Gb of files allegedly stolen from US industrial components giant Parker Hannifin.
CashApp Says Ex-Employee Stole Customer Stock Trading Data (SecurityWeek) CashApp said the stolen data includes brokerage account numbers, full names, brokerage portfolio values, and brokerage portfolio holdings for one trading day.
Block Says Former Worker Accessed U.S. Customer Data Without Approval (Wall Street Journal) The downloaded reports from the company’s Cash App included full names and brokerage-account numbers, according to an SEC filing.
Block confirms Cash App breach after former employee accessed US customer data (TechCrunch) The digital payments giant is contacting 8.2 million current and former customers about the data breach.
Block, Inc. Form 8-K (US Securities and Exchange Commission) On April 4, 2022, Block, Inc. (the “Company”) announced that it recently determined that a former employee downloaded certain reports of its subsidiary Cash App Investing LLC (“Cash App Investing”) on December 10, 2021 that contained some U.S. customer information. While this employee had regular access to these reports as part of their past job responsibilities, in this instance these reports were accessed without permission after their employment ended.
The Works forced to close some stores after cyber-attack (the Guardian) UK retailer says security breach has not given hackers access to customer payment data
Discount retailer The Works hit by cyber attack (ComputerWeekly) A small number of The Works’ bricks-and-mortar stores were forced to close amid a cyber attack of an undisclosed nature.
A ‘bug’ that leaves the data of ultra-Orthodox people exposed has devastating results (Haaretz) A well-known loophole exposes a rare stigma in Israel’s ultra-Orthodox community. Instead of fixing the issue – which is leading to expulsions from religious schools – Israel is ignoring it
Report: FOX NEWS Exposed Nearly 13 Million Content Management Records Online (Website Planet) Security researcher Jeremiah Fowler together with the Website Planet research team discovered an open and non-password protected database that contain
Indian Loans App Exposes Scraped Customer PII (SafetyDetectives) The SafetyDetetectives security team discovered a data breach affecting CashMama, a money lending platform based in India, which exposed a comprehensive array o
NFTs Are a Privacy and Security Nightmare (Wired) The blockchain isn't as "anonymous" as you might think.
An ex-cop fell for Alice. Then he fell for her $66 million crypto scam. (Washington Post) Savvy people are getting hustled out of their crypto left and right. And there’s almost nothing they can do to get it back.
Academics Devise Side-Channel Attack Targeting Multi-GPU Systems (SecurityWeek) A group of academic researchers has devised a side-channel attack targeting architectures that rely on multiple graphics processing units (GPUs) for resource-intensive computational operations.
CISA adds Spring4Shell vulnerability, Apple zero-days to exploited catalog (The Record by Recorded Future) The Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its catalog of exploited bugs, including the much-discussed “Spring4Shell” remote code execution (RCE) vulnerability.
Security Patches, Mitigations, and Software Updates
44 Vulnerabilities Patched in Android With April 2022 Security Updates (SecurityWeek) The Android updates released by Google for April 2022 include patches for 44 vulnerabilities, including several rated “critical severity.”
Google’s monthly Android updates patch numerous “get root” holes (Naked Security) Get the update now… if it’s available for your phone. Here’s how to check.
Apple patched critical macOS flaws in Monterey only (Register) About 35-40 per cent of iGiant's desktop OS installs potentially vulnerable, says Intego
Apple Fails to Patch Big Sur and Catalina, Leaves Older Macs Vulnerable to Two Security Exploits (The Mac Observer) Apple has not issued security updates for macOS Big Sur and Catalina, leaving many older Macs vulnerable to two security exploits.
Firefox 99 is out – no major bugs, but update anyway! (Naked Security) Firefox’s four-weekly updates just dropped – here’s what you need to know.
Yokogawa Patches Flaws Allowing Disruption, Manipulation of Physical Processes (SecurityWeek) Vulnerabilities found in Yokogawa’s CENTUM and Exaopc control systems products can be exploited for disruption or manipulation of physical process controls.
LifePoint Informatics Patient Portal (CISA) 1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: LifePoint Informatics Equipment: Patient Portal Vulnerability: Authentication Bypass Using Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of this vulnerability could disclose sensitive information, including HIPAA-protected PII.
Rockwell Automation ISaGRAF (CISA) 1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: ISaGRAF Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow arbitrary code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Rockwell Automation products are affected:
Johnson Controls Metasys (CISA) 1. EXECUTIVE SUMMARY CVSS v3 8.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Inc. Equipment: Metasys Vulnerability: Server-side Request Forgery 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious code into the MUI PDF export feature.
Philips Vue PACS (Update A) (CISA) 1. EXECUTIVE SUMMARY
CVSS v3 9.8
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Philips
Equipment: Vue PACS
--------- Begin Update A Part 1 of 4 ---------
Trends
State of Pentesting Report 2022 (Cobalt) With a thorough analysis of pentesting data, Cobalt's State of Pentesting Report 2022 can help improve your security awareness. ✓ Read the report today!
A Fight for Coverage: Cyber Insurance Risk in 2022 (Black Kite) Volatility and complexity have toppled the cyber insurance landscape, forcing the industry to reassess cyber risk overall. By 2026, the global cyber insurance market is forecasted to grow at a compounded average of 25% yearly[1], while simultaneously pricing out insureds and establishing an extremely stringent criteria for coverage.
Our Take: SentinelOne’s 2022 MITRE ATT&CK Evaluation Results (SentinelOne) Singularity XDR’s context delivers maximum cybersecurity value for the third year running - learn more about how and why.
New Invicti Research: Vulnerabilities on the Rise; Public Sector Particularly at Risk (PR Newswire) Invicti Security™ today released its Spring 2022 AppSec Indicator, which reveals a rise in severe web vulnerabilities and the need for...
In the Crosshairs: Organizations and Nation-State Cyber Threats (Trellix) The constant outpouring of news highlights that nation-state cyberattacks are a growing threat. Governments are behind many of the most dramatic successes
Most Common Passwords 2022 - Is Yours on the List? (CyberNews) We analyzed more than 15 billion passwords to see the most common password phrases, including city, sports team, year, name, and more.
Marketplace
NATO releases OSINT RFI (Intelligence Community News) On April 4, the North Atlantic Treaty Organization (NATO), via the U.S. Department of Commerce, issued a request for information (RFI) for open-source intelligence (OSINT) services. Responses are due by 5:00 p.m. Eastern on May 27.
Cybersecurity Funding Remains High Even As Venture Cools Off (Crunchbase News) Funding to venture-backed cybersecurity startups continues at an impressive clip—although significantly off the record high set last quarter.
Airgap Networks Announces $13.4M Series A Funding to Deliver an Indust (PRWeb) Airgap Networks, today announced the closing of a $13.4M Series A funding round. Storm Ventures led with support from all existing investors, including
Nudge Security announces seed funding with Ballistic Ventures (Nudge Security) Cybersecurity leaders from AlienVault, AT&T and Fortify reunite to take on cybersecurity’s core challenge: human behavior.
API IAM Security Provider Corsha Raises $12 Million (SecurityWeek) API security firm Corsha has raised $12 million in a Series A funding round led by Ten Eleven Ventures and Razor’s Edge Ventures.
Corsha Raises $12M Series A to Reduce the API Attack Surface - Corsha (Corsha) Corsha is a leading cybersecurity company that is defining the landscape of API security. APIs are the thread that stitch together hybrid and multi-cloud networks. Corsha's game-changing API Security Platform solves the growing security concerns facing enterprises as attacks on APIs increase. Our platform empowers CTOs, CISOs and other security professionals to protect their data and applications as they traverse hybrid and multi-cloud environments.
Two Six Technologies purchases cyber research firm (Washington Technology) The Carlyle Group-backed company is looking to bolster its rapid development function.
Area 1 Security Is Now Under the Leadership of Cloudflare (ReadITQuik) The security, performance and reliability firm Cloudflare announced completing the acquisition of Area 1 Security to help enterprises secure their applications. By integrating Area 1 Security’s robust email security with Cloudflare’s global networks, the duo will provide a complete zero trust security platform.
Brisbane MSP Wyntec acquires security training provider Layer 8 Security (CRN Australia) Complementing its security governance and risk offerings.
Zoom’s Bug Bounty Program: 2021 in Review (Zoom Blog) Zoom has invested in a skilled, global team of security researchers via a private bug bounty program on HackerOne’s platform.
Find and $eek! Increased rewards for Google Nest & Fitbit devices (Google Online Security Blog) Posted by Medha Jain, Program Manager, Devices & Services Security At Google, we constantly invest in security research to raise the bar fo...
ExpressVPN increases bug bounty reward to US$100,000 (PR Newswire) Leading consumer privacy and security company ExpressVPN is offering US$100,000 via Bugcrowd's Bug Bounty solution to researchers who can find...
Okta CEO Says Breach Is ‘Big Deal,’ Aims to Restore Trust (1) (Bloomberg Law) Okta Inc. doesn’t yet know how many of its customers were affected by a January data breach that the company waited nearly two months to make public, Chief Executive Officer Todd McKinnon said Monday during an interview with Bloomberg Television.
Rapid7 Cybersecurity Foundation (Rapid7) The Foundation’s mission is to close the security achievement gap by making the most successful security technologies and practices accessible to the underrepresented and underserved.
Obsidian Security Hires Industry-Leader Xinran Wang as New EVP of Engineering (Business Wire) Obsidian Security, the leader in SaaS security and posture management (SSPM), announced Xinran Wang has joined as the EVP of engineering. Wang bolster
Aware Appoints Sonos Leader as Company's First-Ever Chief People Officer (PR Newswire) Aware, the leading enterprise-grade collaboration governance, compliance, and insights platform, today announced the appointment of Erin Souza...
Trulioo Appoints Identity Industry Expert Dawn Crew as First Chief Marketing Officer (Business Wire) Trulioo, the leading global identity verification company, today announced the appointment of Dawn Crew as its first Chief Marketing Officer.
Cybereason hires Hussam Sidani to lead Middle East and Turkey operations (Gulf Business) Sidani joins the company with more than 20 years of security experience, having most recently led Gulf, Levant, and Africa sales for FireEye.
LogRhythm shakes up executive team with new hires, promotions (Boulder Daily Camera) Cybersecurity firm LogRhythm Inc. has hired or promoted a handful of new executives, including Chris O’Malley, the company’s new CEO.
Obsidian Security appoints Xinran Wang as EVP of Engineering - Help Net Security (Help Net Security) Obsidian Security announced Xinran Wang has joined as the EVP of engineering, bringing more than 20 years of experience in malware research.
Open Systems Appoints Chief People Officer to Support Growing Demand for Its Managed Security Services (Business Wire) Open Systems, the only cybersecurity services provider with Mission Control, has appointed Alaska May as its Chief People Officer to lead the global P
Products, Services, and Solutions
Lightspin Launches Free AWS Cloud Security Tool to Reveal Publicly Exposed Cloud Assets on Any Domain (PR Newswire) Lightspin, the next-generation cloud security platform, today announced the first free AWS cloud security tool that scans any and all domains...
Cloudentity Secures SOC Type 2 and ISO 27001 Compliance, Solidifying its Position as a Trusted Leader in Authorization for Modern Applications (Yahoo Finance) Cloudentity earns two globally recognized security certifications, supporting stringent compliance standards across global markets and industries
Dibbs Transforms Collector Onboarding Experience with Socure (Socure) With the accuracy of Socure’s industry-leading, graph-defined identity verification & fraud platform, Dibbs expects at least a 20% increase in first-time deposits.
Trustwave Launches New Palo Alto Networks Cortex XSOAR and Xpanse Service Offerings (Trustwave) Trustwave, a leading managed security services provider focused on managed detection and response, today announced the availability of XSOAR powered by Trustwave service and Xpanse powered by Trustwave service – two new services for Palo Alto Networks’ Cortex® XSOAR and Cortex Xpanse.
Red Sift Strengthens Email Security For Cybersecurity-First Organizations Hosted on Microsoft Azure (Business Wire) Red Sift, integrated cloud email and brand protection platform provider, today announced that the company is rapidly expanding its strategic investmen
Resecurity introduces Novel Cyber Intelligence Platform at African Land Forces Summit (ALFS22) (Breaking Defense) Los-Angeles cybersecurity company sets its sights on rapidly expanding across the Sahel G5 region with AI-powered solutions for defense
Announcing IBM z16: Real-time AI for Transaction Processing at Scale and Industry's First Quantum-Safe System (IBM Newsroom) IBM unveiled IBM® z16™, IBM's next-generation system with an integrated on-chip AI accelerator—delivering latency-optimized inferencing.
Netsurit launches advanced integrated cyber risk and compliance management platform (ITWeb) The company partners with Centraleyes to bring SaaS-based, next-generation GRC to customers.
Cybersecurity Leader eSentire Cuts Incident Response Costs in Half… (eSentire) eSentire Cuts Incident Response Costs in Half Using its New Automated Forensic Triage Capabilities, Which Reduces the Time it takes to complete a Digital Forensic and Incident Response Engagement to Days, versus the standard weeks or months.
Adcash Selects Leaseweb As Exclusive Infrastructure Provider for Its G (PRWeb) Leaseweb Global, a leading hosting and cloud services company, today announced that Adcash, a global online advertising platform, has selected Leaseweb Dedicated
Cybersixgill Partners with Snowflake to Deliver Cybersecurity Threat Intelligence on the Data Marketplace (Cybersixgill.com) Snowflake Security Data Lake Customers Harness The Power Of Cybersixgill’s Extensive, Automated Collection Of Deep, Dark, And Clear Web Threat Intelligence Tel Aviv, Israel – April 5, 2022 – Cybersixgill, the premier vendor of real-time and actionable threat intelligence, announced today its partnership with Snowflake, the Data Cloud Company, to add comprehensive cyber threat intelligence, […]
Incode Technologies Redefines Event Experiences With a Single, Portable ID That Unifies Fan Interactions (Business Wire) Incode, the next-generation identity verification and authentication platform for global enterprises, is redefining event experiences and how stadiums
SailPoint Sets the Standard for the Core of Identity Security (SailPoint) New product suites put the next generation of identity security in the hands of today’s modern enterprise AUSTIN, April 5, 2022 – SailPoint
Advanced Cybersecurity Protection Now Part of Satellite Flight Software (Space Ref) Proven via an AFWERX Space Challenge in 2020 and a U.S. Space Force-funded prototype in 2021, RunSafe Security's advanced cybersecurity protection is now part of Emergent's Gear satellite flight software production build chain. Emergent's customers achieve increased cyber resilience, benefiting from RunSafe's run-time protections embedded in Emergent's flight software.
PlainID Launches Strategic Partnership with iC Consult to Leverage Global Support for Clients (PR Newswire) PlainID, The Authorization Company, a leading provider of authorization and policy-based access solutions, today announced it has launched a...
Fortinet Unleashes Flood of Security Features (SDxCentral) Fortinet revamped its FortiOS operating system with a bevy of new features designed to accelerate threat detection and mitigation.
ThetaRay chooses Screena as sanctions list screening solutions partner (Paypers) Israel-based ThetaRay has integrated Screena’s screening system into its SONAR SaaS transaction monitoring ...
AVANT Launches Enhanced Security Practice To Fuel Tech Leaders’ Securi (PRWeb) AVANT, a platform for IT decision-making and the nation’s premier Technology Services Distributor, today launched an enhanced Security practice, naming a new senior
SmallSat Launch Company Teams with C8 Secure to Provide Cybersecurity Solutions for Space Industry (Yahoo) SmallSat launch services provider Vaya Space announced their strategic partnership with C8 Secure to provide turn-key cybersecurity solutions for the space industry. In addition, Vaya Space has agreed to provide launch services to Continent 8 Technologies, the parent corporation of C8 Secure, as they develop and implement plans to create a new satellite constellation to augment their global network of data centers.
Blumira Offers Industry's Only Free Cloud SIEM With Integrated Detection and Response for SMBs (PR Newswire) Blumira, a leading cybersecurity provider of automated threat detection and response technology, today announced the availability of the...
Hunters Announces Partner Certification Program and Online Hub to Enable its Growing Partner Ecosystem (GlobeNewswire News Room) Cybersecurity company Hunters today announced the formation of its Partner...
Deep Instinct Announces First-Of-Its-Kind Stratosphere Partner Program (Business Week) Deep Instinct, the first company to apply end-to-end deep learning to cybersecurity, today announced its new partner program, Stratosphere. The model
LightBeam Launches Data Privacy Automation Platform to Help Businesses (PRWeb) LightBeam.ai, a pioneer in data privacy automation, came out of stealth today and announced the general availability of its category-defining, AI-powered,
Rabobank Counters Growing Ransomware Menace with Cloudian Object Storage (GlobeNewswire News Room) Cloudian® today announced that Rabobank, a Dutch multinational banking and financial services...
Technologies, Techniques, and Standards
Why Some CISOs Fail (SecurityWeek) There is no universally accepted definition of the CISO role, its methods or its responsibilities; and CISOs are left to find or forge their own paths. Some fail to choose or find the right path.
IT-ISAC Launches Special Interest Group for Critical Software as a Service Providers (IT-ISAC) Group aims to increase customer trust in participating organizations and the broader SaaS industry.
What is Mobile App Shielding? (Security Boulevard) As mobile devices become increasingly popular in the workplace, so do attacks targeting mobile apps. In fact, according to a recent 2021 cybersecurity study by Checkpoint, 46% of organizations had at least one employee download a malicious mobile application threatening networks and data. What is mobile app shielding and how can it help protect businesses that rely on mobile apps?
Akamai CTO: All access is remote access (Light Reading) Robert Blumofe, EVP and CTO at Akamai, said his company's recent acquisition of Linode, combined with Akamai's content delivery and security capabilities, "creates a full spectrum of compute capabilities that modern applications really depend on." That full spectrum includes an array of services "from edge computing, to core cloud computing and everything in between, because it's not a one size fits all," he said.
Design and Innovation
300 US-based Developers to Talk Metaverse and the Future (Agora) The metaverse is an interactive space that combines real-life social interaction with extended reality (XR). It is game-changing across a wide range of industries.
SURVEY: Developers Cite Data Privacy and Security and Disinformation and Hate Speech as Top Metaverse Challenges (PR Newswire) Agora, Inc. (NASDAQ: API), a pioneer and leading platform for real-time engagement APIs, today announced the results of a commissioned study...
Meta’s encryption plan has human rights benefits, report says (Washington Post) A nonprofit association that promotes social responsibility among corporations has concluded in a new report that Meta’s planned expansion of strong encryption to its Messenger and Instagram services will do more good than harm for human rights, giving the company more ammunition as it fights efforts in the United Kingdom and other countries to carve out exceptions to make police work easier.
Human Rights Impact Assessment: Meta's Expansion of End-to-End Encryption (BSR) In March 2019, Mark Zuckerberg shared his view that “privacy-focused communications platforms will become even more important than today's open platforms” and that “the future of communication will increasingly shift to private, encrypted services where people can be confident what they say to each other stays secure and their messages and content won't stick around forever.”
Legislation, Policy, and Regulation
Cyberspace Solarium Co-Chairs Urge President Biden to Maintain Cyberdeterrence Posture (Congressman Mike Gallagher) Rep. Mike Gallagher (R-WI) and Senator Angus King (I-ME), Co-Chairs of the Cyberspace Solarium Commission (CSC), are urging President Joe Biden to keep a key cyberdeterrent in place after reports indicated that the administration is considering changes to the policy. In a letter to President Biden, Gallagher and King lay out the critical importance of National Security Presidential Memorandum – 13 (NSPM-13), which established an agile workflow allowing the Department of Defense to plan and conduct time-sensitive offensive cyber operations.
SEC Weighs Path Forward for Crypto Trading Platforms (Wall Street Journal) SEC Chairman Gary Gensler said the agency is studying ways to make it more feasible for cryptocurrency trading platforms to register as exchanges.
NSA Director: 'We Need Speed, Agility, and Unity of Effort' (Decipher) Joint partnerships between the government and private sector are helping to harden U.S. networks and address ongoing threats.
Around the horn with the head of U.S. Cyber Command (The Record by Recorded Future) U.S. Cyber Command chief Gen. Paul Nakasone made a pair of appearances before House and Senate lawmakers on Tuesday, offering insights on the latest digital threats to the nation and how his agency is adapting to meet them.
The US Navy had cybersecurity wrong. Expect change. (C4ISRNet) “We have 15 years of track record that proves that the current approach to cybersecurity, driven by a checklist mentality, is wrong,” says Aaron Weis, the service's chief information officer. “It doesn’t work.”
State cyber leaders aim for more scrutiny of cloud vendors (StateScoop) More states are developing their own certification models when considering the security of cloud platforms.
Litigation, Investigation, and Law Enforcement
Top EU court says phone data cannot be held 'indiscriminately' (Reuters) The European Union's top court ruled on Tuesday that national authorities cannot retain phone data in a "general and indiscriminate" manner, but could use specific information to tackle some very serious crime.
The FBI is spending millions on social media tracking software (Washington Post) Social media users seemed to foreshadow the Jan. 6 attack on the U.S. Capitol — and the FBI apparently missed it.
NSO hacked new Pegasus victims weeks after Apple sought injunction (TechCrunch) Jordanian journalists, lawyers and human rights defenders were targeted in the latest wave of phone hacking.
Israeli firm's spyware used on Jordan activists, report says (Washington Post) Digital-rights researchers have concluded that the mobile phones of four Jordanian human rights activists were hacked with software made by the Israeli spyware company NSO Group
Treasury Sanctions Russia-Based Hydra, World’s Largest Darknet Market, and Ransomware-Enabling Virtual Currency Exchange Garantex (U.S. Department of the Treasury) United States, International Partners Carry Out Multilateral Operation Targeting Russian Cybercrime
Hydra Market Takedown Indicative of ‘More Intense’ Law Enforcement Efforts (Decipher) The takedown by German authorities of Hydra Market is only the latest law enforcement operation impacting darknet marketplaces.
The Future of NFTs Lies With the Courts (Wired) As the first cases involving NFTs hit the dockets, courts will decide questions around ownership, art, and commerce.
Hackers Stole More Than $600 Million in Crypto. Laundering It Is the Tricky Part. (Wall Street Journal) The transparency of cryptocurrency leaves thieves with limited options for laundering the funds.
