Dateline
Ukraine at D+54: Timing as influence. (The CyberWire) The second phase in Russia's war against Ukraine opens, and the symbolic importance of two dates may be influencing Russian commanders.
Ukraine Update: Zelenskiy Says Battle for Donbas Has Begun (Bloomberg) Ukrainian President Volodymyr Zelenskiy said Monday that Russian forces had begun the campaign to conquer the Donbas region in Ukraine’s east as Moscow continues moving troops and materiel into that part of the country.
Russia ratchets up battle for control of eastern Ukraine (AP NEWS) Russia ratcheted up its battle for control of Ukraine’s eastern industrial heartland on Tuesday, intensifying assaults on cities and towns along a front hundreds of miles long in what officials on both sides described as a new phase of the war .
Battle for the Donbas begins as Russia launches major offensive (The Telegraph) Volodymyr Zelensky says the assault, which will seek to surround and destroy Ukrainian forces in Donetsk and Luhansk, has commenced
We will fight, says Volodymyr Zelensky as Russian begins offensive in eastern Ukraine (The Telegraph) Volodymyr Zelensky said on Monday night Russia's large-scale offensive in the eastern Donbas region has begun.
Military intel chief believes Russia not to achieve any wins in Ukraine by Easter as Kremlin wishes (Ukrinform) The Russians are intensively preparing for a decisive battle that will unfold in the east of Ukraine, expecting to gain ground by Easter. However, the occupiers won’t succeed, says Ukrainian military intelligence chief, Major General Kyrylo Budanov. — Ukrinform.
What Happened on Day 54 of the War in Ukraine (New York Times) Russia said it had hit hundreds of targets around Ukraine with missiles and artillery, apparent preparation for the onslaught in eastern Ukraine.
Ukraine Live Updates: Russia Declares New Phase of War as Forces Clash in East (New York Times) Ukraine said it was resisting Russia’s initial thrusts in a sprawling offensive that could reshape the conflict. The Pentagon estimated that Moscow has added thousands of troops in Ukraine in recent days.
Sinking of Russian warship raises tense questions about fate of crew (Washington Post) Some families report sailors dead or missing in Moskva sinking despite Defense Ministry claim that all were evacuated
Pictured: First images of damaged Moskva emerge as Russian families claim dozens dead (The Telegraph) Russian naval sources suggest 37 crew members may have died, as pictures of burning missile cruiser are seen for first time
Syrian fighters ready to join next phase of Ukraine war (Military Times) So far, only a small number of Syrian fighters appear to have arrived in Russia for military training ahead of deployment on the front lines.
Ukraine war: First civilian deaths in Lviv shatter sense of safety (BBC News) The western city's mayor says the strikes show there are "no safe and unsafe locations" in Ukraine.
Putin’s Gruesome Playbook (Foreign Policy) Russia’s indiscriminate bombing in Ukraine looks startlingly familiar.
Russian War Report: Russia falsely accuses Ukraine of provoking conflict even after it knew war was coming (Atlantic Council) Russia has rehashed several old narratives in their continued attempts to justify the war in Ukraine including misrepresented statements from Ukrainian officials.
Putin Decorates Army Unit That Ukraine Blames for Bucha Deaths (Bloomberg) Ukraine accused 64th Motorized Infantry Brigade of war crimes. Mass graves were discovered in Bucha with most victims shot.
Never Again? (Atlantic Council) Ever since the Nazi Holocaust, German leaders have declared "never again," but they are now guilty of failing to prevent Russia from committing a new genocide in Ukraine, says Victor Pinchuk.
How Putin’s Russia embraced fascism while preaching anti-fascism (Atlantic Council) Vladimir Putin poses as an "anti-fascist" leader engaged in the noble task of “de-Nazifying” Ukraine, but in reality it is Putin's increasingly fascist Russia that is in urgent need of “de-Nazification,” writes Taras Kuzio.
Moscow Strikes Back at Countries That Cross It (Foreign Policy) Russia seeks diplomatic payback at the United Nations and other forums against countries that have denounced its invasion of Ukraine.
Is Negotiating with Putin even possible at this point? (The Cipher Brief) With no signs of a negotiated end to the conflict, do world leaders possess the ability to make Putin reconsider actions in Ukraine?
Ukraine War Divides Orthodox Faithful (New York Times) Around the world, national churches, parishes and even families are reassessing relations with Patriarch Kirill of Moscow, who has encouraged Russia’s aggression.
Bosnians warn Ukrainians: It's a long journey to justice (AP NEWS) Regardless of how the Russian war in Ukraine ends, getting justice for human rights abuses suffered during the conflict will inevitably be a long and painful process for those who survive to tell of the atrocities they witnessed.
US officials ramp up warnings about Russian cyberattacks (The Hill) Top U.S. officials are ramping up their warnings about possible Russian cyberattacks on critical infrastructure as the war in Ukraine escalates. In an interview with “60 Minutes” on CBS, Deputy Att…
Doval Highlights The Crisis Between Ukraine And Russia To Explain The Dangers Of A Cyber War (Defence Aviation Post) National Security Adviser Ajit Doval stated on Monday that not only territorial integrity but also national sovereign cyber space must be protected. Doval included cyberspace in his remarks about the first-of-its-kind "hybrid" war between Russia and Ukraine
In Iran, Russia's war on Ukraine is a political flash point (AP NEWS) During its 1979 Islamic Revolution, Iran embraced the protest cry of “neither East nor West,” rejecting both the U.S. and the Soviet Union, then locked in the Cold War. The phrase to this day hangs over the doors of Iran’s Foreign Ministry.
Hundreds of thousands flee Russia and Putin’s ‘two wars’ (Al Jazeera) Some 200,000 Russians have left their homes and jobs, fearful of being persecuted for opposing Putin’s war on Ukraine.
UK shuns Moscow Stock Exchange in fresh blow to pariah Putin - live updates
(The Telegraph) The UK is revoking the Moscow Stock Exchange’s status as a recognised stock exchange in the latest sign of Russia’s isolation from the global financial system.
German bosses, unions jointly oppose boycott of Russian gas (AP NEWS) Germany's employers and unions have joined together in opposing an immediate European Union ban on natural gas imports from Russia over its invasion of Ukraine, saying such a move would lead to factory shutdowns and the loss of jobs in the bloc's largest economy.
Decades of leaning on Russia forces Germany into a perilous decision: continue to buy Russian oil or risk economic catastrophe (Business Insider) Russia supplied 30% of Germany's energy needs last year. Germany needs to keep the lights on, but doing so directly funds the invasion of Ukraine.
Bleak assessments of the Russian economy clash with Putin’s rosy claims. (New York Times) While Vladimir Putin boasts that Russia is holding up under Western sanctions, his central bank chief and the mayor of Moscow warned that the worst was yet to come.
Russia Has Found No Place Yet to Invest Reserves After Sanctions (Bloomberg) Sanctions cut off access to half of reserves, Nabiullina says. Central bank spent years reducing its exposure to dollars.
Attacks, Threats, and Vulnerabilities
North Korean State-Sponsored APT Targets Blockchain Companies (CISA) CISA, the Federal Bureau of Investigation (FBI), and the U.S. Treasury Department have released a joint Cybersecurity Advisory (CSA) that details cyber threats associated with cryptocurrency thefts and tactics used by a North Korean state-sponsored advanced persistent threat (APT) actor known as the Lazarus Group.
TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies (CISA) Actions to take today to mitigate cyber threats to cryptocurrency: • Patch all systems. • Prioritize patching known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Use multifactor authentication.
US warns of Lazarus hackers using malicious cryptocurrency apps (BleepingComputer) CISA, the FBI, and the US Treasury Department warned today that the North Korean Lazarus hacking group is targeting organizations in the cryptocurrency and blockchain industries with trojanized cryptocurrency applications.
Crypto has weak spots. Hackers are pouncing. (Protocol) The blockchain is where the money is, and that means vulnerabilities can be costly.
StarJacking - Making Your New Open Source Package Popular in a Snap (Checkmarx.com) Checkmarx supply chain security has recently found a malicious PyPi package with more than 70,000 downloads using a technique we dubbed StarJacking - a way to make an open source package instantly look popular by abusing the lack of validation between the package to its GitHub repository.
How Democracies Spy on Their Citizens (The New Yorker) The inside story of the world’s most notorious commercial spyware and the big tech companies waging war against it.
Webex Monitors Microphone Even When Muted, Researchers Say (SecurityWeek) A group of academic researchers show that video conferencing applications transmit microphone telemetry even when the user's microphone is muted in the software.
FBI Warns of 'Reverse' Instant Payments Phishing Schemes (SecurityWeek) The FBI warns that cybercriminals have extensive knowledge of a victim's background information and use it to prove their legitimacy to the victims.
ESET warns of three flaws that affect over 100 Lenovo notebook models (Security Affairs) Lenovo warns of vulnerabilities in its Unified Extensible Firmware Interface (UEFI) shipped with at least 100 notebook models. Lenovo has published a security advisory to warn customers of vulnerabilities that affect its Unified Extensible Firmware Interface (UEFI) loaded on at least 100 of its notebook models, including IdeaPad 3, Legion 5 Pro-16ACH6 H, and Yoga […]
LinkedIn brand takes lead as most impersonated in phishing attacks (BleepingComputer) Security researchers are warning that LinkedIn has become the most spoofed brand in phishing attacks, accounting for more than 52% of all such incidents at a global level.
Trends in the Recent Emotet Maldoc Outbreak | FortiGuard Labs (Fortinet Blog) FortiGuard Labs observed a recent Emotet outbreak being spread through a variety of malicious Microsoft Office files, or maldocs, attached to phishing emails. Read our blog to learn how the malware…
Beanstalk DeFi platform loses $182 million in flash-loan attack (BleepingComputer) The decentralized, credit-based finance system Beanstalk disclosed on Sunday that it suffered a security breach that resulted in financial losses of $182 million, the attacker stealing $80 million in crypto assets.
18.04.2022: Spring Framework Vulnerabilities Included in DerScanner Updated Search Database (DerSecur) DerSecur has updated the vulnerabilities search database of the DerScanner application code analyzer. The update includes several zero-day vulnerabilities found in the Spring Framework which is used in Java applications.
GitHub Warns of Private Repositories Downloaded Using Stolen OAuth Tokens (SecurityWeek) GitHub warns that compromised OAuth user tokens were abused to download data belonging to dozens of organizations.
Wyandotte County government hit by cyber attack (KSNT 27 News) The Unified Government of Wyandotte County and Kansas City, Kansas data centers were hit by a cybersecurity attack over Easter weekend.
A 2020 ransomware attack is still harming Baltimore teachers (Washington Post) Europe is asleep at the wheel and needs an awakening before it crashes, warned Lt. Gen. Riho Terras, commander of Estonian Defense Forces
99% of Executives Listed on More Than Three-Dozen Data Broker Websites (BlackCloak) This BlackCloak blog shares research that identifies how easy it is to find executives' personal information on online data brokers.
Security Patches, Mitigations, and Software Updates
Patches issued for Juniper Networks bugs (SC Magazine) More than 30 security flaws across Juniper Networks' product portfolio, including its Contrail Networking and Junos OS, have been addressed last week.
Trends
Cyber Risk Index | Trend Micro (Trend Micro) We teamed up with the Ponemon Institute to investigate the level of cyber risk across organizations and create a Cyber Risk Index (CRI). Refreshed regularly, the CRI is a comprehensive measure of the gap between an organization's current security posture and its likelihood of being attacked. Our second survey shows an increase in the risk, particularly in terms of the attacks targeting organizations.
APAC consumers share more data, but will ditch firms over security breach (ZDNet) While they have shared more personal data now than they did two years ago, 50% of consumers in Singapore and Australia will stop using services from companies that suffer a security breach, higher than the global average of 43%.
Marketplace
Fortress Information Security Receives $125 Million Strategic Investment from Goldman Sachs Asset Management (Fortress Information Security) Fortress Information Security, the leading supply chain cybersecurity provider for critical industries, has received a $125 million strategic investment from Goldman Sachs Asset Management.
We Just Raised $94M to Help You Fight Fraud (SEON) SEON has always been about delivering the best anti-fraud tools into everyone’s hands. Our Series B investors made that goal one step closer to reality. Those familiar with the SEON story will already know that it was born out of a real necessity. When we first opened our crypto exchange, we were assailed by fraudsters. […]
The Gately Report: CP Expo Edition with Trellix’s Kristi Houssiere, Cybersecurity Peer Group, More (Channel Futures) Trellix needs its partners now more than ever.
Objective: the government's cyber-ally (Intelligent Investor) Remote work and cybersecurity are driving growth, but cash flow is the real show-stopper. Find out more at Intelligent Investor.
Gigamon Appoints Shane Buckley to President and CEO (Business Wire) Gigamon, the leading deep observability company, today announced the appointment of Shane Buckley as President and Chief Executive Officer (CEO), effe
Products, Services, and Solutions
SecurityScorecard and Carahsoft to Deliver Critical Cyber Risk Rating Capabilities to the Public Sector (SecurityScorecard) Market-Leading Platform From SecurityScorecard Helps Mitigate Cyber Risks Related to Supply Chain and Critical Function Oversight for Federal, State and Local Government and Educational Contract Vehicles New York and Reston, VA— April 18, 2022 — SecurityScorecard , the global leader in…
Swimlane Extends Cloud-Based Security Automation into APJ Amid Momentous Growth in Region (Business Wire) Swimlane, the leader in low-code security automation, announces the general availability of Swimlane Cloud in the Asia-Pacific Japan (APJ) region
Quad9 Bolsters its DNS Coverage With i3D.net’s Global Network (PRWeb) i3D.net and Quad9 today announced their partnership where i3D.net will be supplying Quad9 with servers and network connectivity in sev
Intel, FiVerity and Fortanix Bring Confidential Computing to the Fight (PRWeb) FiVerity, Inc., a provider of digital fraud prevention solutions, Fortanix® Inc., the data-first multi-cloud securi
Cybersecurity Leader eSentire and Brigantia Partner to Provide 24/7… (eSentire) Learn more about eSentire’s and Brigantia’s partnership and what it means for Brigantia’s MSP clients and & end users in the UK and Ireland.
ConnectWise Amplifies MSP Cyberattack Defense with Incident Response Service (ConnectWise) New service provides MSPs with immediate access to cyber experts for faster remediation of security incidents
PerimeterX Code Defender Extends Capability To Stop Supply Chain Attacks (PerimeterX) Client-side web app security solution introduces features that give real-time visibility and control of the website attack surface, enabling businesses to stop PII theft and comply with data privacy regulations
How to Mitigate Client-side Supply Chain Threats | PerimeterX (PerimeterX) Using client-side code from third-party libraries can put you at risk of a supply chain attack. Learn how to mitigate client-side threats.
Technologies, Techniques, and Standards
NATO Plays Cyberwar to Prep for a Real Russian Attack (Gizmodo) Cybersecurity experts from 30 NATO members are cooperating to stave off an attack on the fictional island country of “Berylia.”
FS-ISAC Leads Financial Sector in Global Live-Fire Cyber Exercise Locked Shields (PR Newswire) FS-ISAC, the only global cyber intelligence sharing community solely focused on financial services, announced today that it will lead the...
SCuBA gears up agencies to survive the ‘next’ SolarWinds attack (Federal News Network) Vincent Sritapan, the Cyber Quality Service Management Office section chief at the Cybersecurity and Infrastructure Security Agency, said agencies and industry can comment on new guidance documents to…
Pulling back the curtain on the ZLoader takedown, and the power of security, nonprofit threat sharing (SC Magazine) Health-ISAC’s Errol Weiss offered SC Media a behind the scenes look at how the Microsoft-led collaboration enabled the takedown of the ZLoader botnet, and what’s needed to continue disruption of criminal gangs through cross-sector threat sharing.
How Hackers Use Reconnaissance - and How to Protect Against It (eSecurityPlanet) Hackers often spend more time probing networks for weaknesses than they do attacking them. Here's what to look for and protect.
Patching is security industry's "thoughts and prayers": ex-NSA man Aitel (iTWire) Patching of vulnerabilities is the security industry's equivalent of thoughts and prayers, a prominent American security expert has said during a debate on the topic "Patching is useless" at a recent online conference named Hack At The Harbor. Dave Aitel, 46, a former NSA computer scient...
OHSU Apologizes After Phishing Test Draws Complaints (SecurityWeek) Officials at Oregon Health & Science University have apologized to employees after a fake phishing test drew complaints about raising false hopes.
Academia
Cyberattacks Pose ‘Existential Risk’ To Colleges—And Sealed One Small College’s Fate (Forbes) With their low spending on cybersecurity, culture of information sharing and different computer systems across departments, colleges can be easy targets for hackers.
U.S. Air Force Academy's computer and cyber sciences department recognized as 'National Center of Academic Excellence' (United States Air Force Academy) By Ray Bowden U.S. Air Force Academy Public Affairs U.S. AIR FORCE ACADEMY, Colo. – The National Security Agency named the U.S. Air Force Academy’s computer and cyber sciences department […]
Legislation, Policy, and Regulation
Opening Stages in UN Cybercrime Treaty Talks Reflect Human Rights Risks (Just Security) The first session provided a valuable view into where States stand, what the convention may aim to achieve, and its political viability.
Cyberspace linked to India’s socio-economic, national security: Doval (Hindustan Times) He made the comments at the inauguration of a cybersecurity training workshop on Monday to equip over 140 officials to combat internal and external threats
Any threat in cyberspace impacts our national security: Ajit Doval (The Sentinel Assam) National Security Advisor (NSA) Ajit Doval said that any threat in the cyberspace directly impacts the country’s social
FTC Appears Ready To Begin Enforcing Its Health Breach Notification Rule (New York Law Journal) Although the Health Breach Notification Rule has long been available to the FTC, the FTC has not actively enforced it. However, the FTC now appears to be poised to changing its approach. It has signaled renewed interest in the Rule, largely in recognition of the evolution of technology and health care since the Rule’s passage that has caused an explosive expansion of the amount of health data collected by organizations and entities that are not otherwise governed by HIPAA and its progeny.
Biden urged to consider federal digital identity framework (Biometric Update |) U.S. President Joe Biden has been advised to consider putting in place a nationwide digital identity framework to help fight identity theft in the country.
Cyber Command details $236 million in new spending wish list (The Record by Recorded Future) U.S Cyber Command has outlined just over $236 million in priorities that weren’t included in the command’s fiscal year 2023 spending request.
A Year of Hacks and Cyberwar: How Biden Is Tackling Cybersecurity (The National Interest) Biden’s team has amassed an impressive record of accomplishments over its first fifteen months, but there remains much work to do.
Pressure Builds On Senate To Confirm FCC Commissioner (Law360) Most U.S. senators are away from Washington for the long spring break, but when they head back to the Beltway in late April, they'll have to confront a few realities — one being that they still haven't confirmed a third Democrat to the Federal Communications Commission.
Litigation, Investigation, and Law Enforcement
Web scraping is legal, US appeals court reaffirms (TechCrunch) The landmark web scraping case was bounced back to the Ninth Circuit by the U.S. Supreme Court.
