A hybrid war raises cyber concerns. Conti's still in business. BlackCat ransomware and the More

Announcement

Celebrate with us: our sixth anniversary is this week.

This week we've been celebrating our sixth anniversary as an independent company, and we invite you to join us. During these past six years the CyberWire has delivered your daily dose of the top cybersecurity news, and we're pleased to have become a trusted source for the industry. To celebrate our big 6, and as a special thanks to all of our CyberWire listeners and readers, for one week we're offering a discount of 60% on annual subscriptions of CyberWire Pro. Use the code 'CyberWireAnniversary2022' by April 25th to take advantage of this celebratory discount. Subscribe and save now, but above all, thank you for listening to the CyberWire.

Special Section

By The CyberWire staff.

Russia's endgame in its war against Ukraine.

It seems that Russian victory will not be achieved in time for Easter (this Sunday, by the Julian calendar). It's widely expected that May 9th, Victory Day (a commemoration of the defeat of Germany in World War Two, and a vastly more important holiday in Russia than is the American V-E Day, which has for the most part faded from US calendars), is now the date by which President Putin wishes to declare success.

TASS has published an account of Russia's war aims, as explained by Alexey Polishchuk: "The special military operation will end once its tasks are fulfilled. Among them are the protection of the peaceful population of Donbass, demilitarization and denazification of Ukraine, as well as the elimination of threats to Russia coming from the Ukrainian territory due to its colonization by NATO members." These are essentially the goals Russia announced at the outset of its special military operation. Mr. Polishchuk does not hold high hopes for negotiations with Ukraine, complaining of Ukrainian waffling and bad faith, both inspired and abetted by Western powers. "At the ongoing negotiations the Ukrainian delegation’s stance is wiggling from side to side. Just as before, the negotiating process is accompanied by aggressive rhetoric in Kiev and in the West, Western arms supplies and the sending of instructors and mercenaries," he told TASS.

Updates on US aid to Ukraine.

US President Biden yesterday pledged $1.3 billion in further aid for Kyiv in both security and economic assistance. He's also appointed an official to coordinate delivery of the aid. Defense News reports that retired US Army Lieutenant General Terry Wolff will “help coordinate the security assistance the U.S. and our partners are providing to Ukraine, which they are using every day to defend their country.” The US State Department yesterday published a list of "security assistance committed to Ukraine" so far.

Russian malware used against Ukrainian targets.

The Record has an overview of the Russian malware that's been used against Ukrainian targets. Wiper malware has been particularly prominent so far in Russia's hybrid war. Citing conversations with Ukrainian security officials, they describe WhisperGate, WhisperKill, HermeticWiper, IsaacWiper, AcidRain, CaddyWiper, DoubleZero, and Industroyer2.

Actual and potential targets harden themselves against Russia cyberattacks.

Ukraine has, the Straits Times reports, worked to upgrade its defenses (for the most part through implementation of widely understood best practices).

This week's joint Cybersecurity Advisory by the Five Eyes is prompting similar moves in other countries, Bloomberg reports. The energy sector is receiving particular attention, an essay in the Wall Street Journal explains.

China, looking on as an observer generally sympathetic to Russia, sees US preparation in cyberspace as dangerous provocation. The Global Times (a Beijing mouthpiece) argues that US defend-forward policy is destabilizing and contravenes international norms of conduct.

Sanctions and the criminal underworld.

Sanctions designed to inhibit the flow of money to the entities they affect have a collateral impact on the parasitic criminal economy that accompanies legitimate markets. Flashpoint describes the ways in which sanctions against Russia have made it more difficult for cyber gangs to cash out. The takedown of the Hydra Market, for example, represented a direct interdiction of a traditional cash-out avenue. And not only do the sanctions themselves directly impede the gangs, but the countermeasures Russia is taking to increase central control of its economy are also having an effect. Flashpoint writes that gangland chatter suggests the criminals are looking into peer-to-peer cryptocurrency exchanges, conventional bank transfers that sanctions don't (yet) reach, and Chinese-run UnionPay cards. The gangs are also considering "hunkering down" and holding their gains in cold wallets until the heat blows over.

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Summary

By the CyberWire staff

Secureworks looks at Gold Ulrick, a prominent operator of what the researchers characterize as Conti ransomware's name-and-shame site, and describes how it's adapted to recent revelations and setbacks.

Costa Rican authorities are also blaming Conti for attacks aimed at disrupting that country's presidential transition. Six public institutions have been affected.

eSentire reports a fresh infestation of More_eggs malware across various company networks. The credential-stealer is being distributed in a spearphishing campaign that targets corporate hiring managers with phishbait representing itself as resumes from (fictitious) job applicants. More_eggs last surfaced a year ago.

The US FBI has issued a FLASH alert on BlackCat ransomware, describing the indicators of compromise associated with this strain of double-extortion malware. The alert also describes the typical course of a BlackCat attack: "BlackCat/ALPHV ransomware leverages previously compromised user credentials to gain initial access to the victim system. Once the malware establishes access, it compromises Active Directory user and administrator accounts. The malware uses Windows Task Scheduler to configure malicious Group Policy Objects (GPOs) to deploy ransomware. Initial deployment of the malware leverages PowerShell scripts, in conjunction with Cobalt Strike, and disables security features within the victim’s network. BlackCat/ALPHV ransomware also leverages Windows administrative tools and Microsoft Sysinternals tools during compromise." BleepingComputer reports that BlackCat has affected at least sixty organizations worldwide.

The US Cybersecurity and Infrastructure Security Agency (CISA) has released three new industrial control system (ICS) advisories. The products affected include Delta Electronics ASDA-Soft, Johnson Controls Metasys SCT Pro, and Hitachi Energy MicroSCADA Pro/X SYS600.

Dateline Moscow, Kyiv, London, Washington, Beijing: Russia's possible endgames in its "special military operation."

Ukraine at D+57: Endames and the definition of victory. (The CyberWire) Russia's enduring goals in Ukraine find a shifting expression on the ground. In cyberspace, Ukraine and its Western sympathizers prepare to sustain, and parry, further Russian cyberattacks.

Russia’s invasion of Ukraine: List of events from day 58 (Al Jazeera) As the Russia-Ukraine war enters its 58th day, we take a look at the main developments.

Why Mariupol matters to Russia in three maps (Washington Post) Russia declared victory in Mariupol on Thursday, even though a bastion of Ukrainian resistance remains in the Azovstal Iron and Steel Works plant, where hundreds of Ukrainian fighters and civilians are holed up.

Russia outlines when Ukraine war will end (Newsweek) Russian Foreign Ministry official Alexey Polishchuk told news agency TASS that all of Russia's goals "will be reached."

Ukraine Endgame: Putin’s Bad Options (Defense One) No matter which one he chooses, the Western response should be the same.

Russia plans to hold sham independence vote in southern Ukraine, Zelenskiy says (the Guardian) Ukraine president warns citizens against handing over personal information, as satellite images of mass graves emerge near Mariupol

Russia racing against clock to win Ukraine war before May 9 'Victory Day' (Newsweek) British defense ministry says Moscow wants "significant successes" ahead of the annual WW2 commemoration.

What war in Ukraine reveals about information age conflict (C4ISRNet) Questions that need asking and topics that need addressing across the Department of Defense, Lt. Gen. Michael Groen said, include “the transformation of the character of warfare in an information age” and what that means for capabilities being developed or gear that is purchased.

Russia’s Catastrophic Geopolitics (Wilson Center) Russia’s war against Ukraine can be seen as a culmination of decades of Russian society poisoning itself with stories of foreign encirclement and mistreatment by the West. For more than two decades now, politicians and the state-run media have peddled external-threat scares, the West’s containment of Russia, and national grievances related to alienated territories and economic failures.

Climbing the ladder: How the west can manage escalation in Ukraine and beyond (Atlantic Council) Russia’s invasion of Ukraine and NATO’s response increase the possibility of purposeful or inadvertent escalation in Europe. Understanding how these dynamics might impact the war and further degrade transatlantic stability is critical.

Congress' Nuclear Adviser Wonders Whether Russia Is Stoking WW3 - Air Force Magazine (Air Force Magazine) The whole point of Russia’s war in Ukraine could be to drag the West into World War 3, said Congress’ nuclear adviser.

Siegfried Hecker: Putin has destroyed the world nuclear order. How should the democracies respond? - Bulletin of the Atomic Scientists (Bulletin of the Atomic Scientists) In this interview, renowned nuclear security and policy expert Sig Hecker explains the enormous damage that Russian President Vladimir Putin has done to the world nuclear order via his decision to invade Ukraine. That decision marks, Hecker contends, a turning point in world nuclear affairs as momentous as the dissolution of the Soviet Union.

Ukraine reveals Russian military plans for “full-scale invasion of Belarus” (Atlantic Council) With Belarusians uneasy over their country's role in Putin's Ukraine War, Moscow may revive earlier plans for the military takeover of Belarus if growing anti-war sentiment threatens to undermine Russian influence.

Possible mass graves near Mariupol as Russia attacks in east (AP NEWS) Mounds of dirt seen in satellite imagery that Ukrainian officials say indicate new mass graves highlighted the savagery of a war that showed no signs of abating Friday, as Russia pounded targets in eastern Ukraine in a new offensive to take the country's industrial heartland .

Lithuania's president calls for more NATO troops (Reuters) NATO should increase its deployment of troops in Lithuania and elsewhere on Europe's eastern flank following Russia's invasion of Ukraine, Lithuania's president told Germany's foreign minister during a meeting in Vilnius on Friday.

A deeper look at the malware being used on Ukrainian targets (The Record by Recorded Future) Over the last two months, the number of cyberattacks against Ukrainian government agencies, security and defense services, and commercial organizations has soared.

Ukraine ramps up cyber defences to slow surge in attacks (The Straits Times) To deal with the threat, Ukrainian authorities on April 5 certified government use of physical security keys. . Read more at straitstimes.com.

Five Eyes Alert Warns of Heightened Risk of Russian Cyber Attacks (Bloomberg) Critical infrastructure organisations within the UK have been urged to ramp up their cyber security defences as they face a heightened risk of Russian state-sponsored cyber attacks.

Russian cyber attack warning for NHS and UK nuclear power plants (WalesOnline) Moscow-based hackers may be looking to target the NHS, power stations and government offices

NHS and UK nuclear stations 'could be at risk of Russian cyber attacks', Five Eyes warns (ITV News) Critical infrastructure organisations within the UK face a heightened risk of Russian state-sponsored cyber attacks, an international intelligence alliance has said.

Preparing for Energy Industry Cyberattacks (Wall Street Journal) The conflict in Ukraine has put officials on high alert for attacks on the energy industry, both inside Ukraine and elsewhere. This paper discusses why the energy sector stands out as susceptible to hacks, why people outside the industry should be concerned and best practices that are relevant to those both within and those reliant upon it.

US sets dangerous precedents in cyberspace (Global Times) Cyberspace is a common space shared by all countries. The US should stop “playing the touch ball” in cyberspace. Instead, it is supposed to shoulder the responsibility of a major power, avoid strategic misjudgments, and earnestly maintain strategic stability among major powers and build a peaceful and secure cyberspace.

NATO Cyber Exercise Proceeds Against Backdrop of Ukraine War (Wall Street Journal) This year’s ‘Locked Shields’ war game has participants fighting off simulated hacks on power grids and financial-messaging systems.

Cyber criminals are ‘drinking the tears’ of Ukrainians (The Hill) In biology, when an insect drinks the tears of a large creature, it is called lachryphagy. And in cyberspace, malicious actors are likewise “drinking tears” by exploiting humanitarian concerns abou…

Russia’s War in Ukraine Has Complicated the Means Through Which Cybercriminals Launder Funds. Here’s How They’re Adapting (Flashpoint) Perfect storm: Sanctions and counter-sanctions Sanctions introduced against Russia in the wake of the 2022 Russian invasion of Ukraine—coupled with

From YouTube to Rutube. Inside Russia’s Influence Campaign. (Wall Street Journal) As part of an expansive effort to control the narrative about its invasion of Ukraine, the Kremlin is pushing Russians to embrace homegrown social-media platforms.

Scholz says top priority is avoiding NATO confrontation with Russia (Reuters) NATO must avoid a direct military confrontation with Russia that could lead to a third world war, German Chancellor Olaf Scholz said in an interview with Der Spiegel when asked about Germany's failure to deliver heavy weapons to Ukraine.

Biden pledges $1.3 billion more for weapons, economic assistance for Ukraine (Chicago Tribune) President Joe Biden on Thursday announced an additional $800 million in military aid to help Ukraine fight back against the Russian invasion.

White House appoints Ukraine security aid coordinator (Defense News) The White House announced Thursday it has appointed a retired three-star general who previously helped coordinate the U.S.-led anti-ISIS coalition to manage the steadily increasing influx of military assistance for Ukraine.

U.S. Security Cooperation With Ukraine (United States Department of State) The United States, our allies, and our partners worldwide are united in support of Ukraine in response to Russia’s premeditated, unprovoked, and unjustified war against Ukraine. We have not forgotten Russia’s earlier aggression in eastern Ukraine and occupation following its unlawful seizure of Crimea in 2014. The United States reaffirms its unwavering support for Ukraine’s […]

Small group of Ukrainian troops begins training on US howitzers (Military Times) The 50 trainees will return to Ukraine to train the rest of the artillery force.

Treasury Department sanctions Russian crypto mining giant BitRiver (The Record by Recorded Future) The US Treasury Department’s Office of Foreign Assets Control (OFAC) issued sanctions against multiple companies operating in Russia’s virtual currency mining industry.

U.S. Treasury Designates Facilitators of Russian Sanctions Evasion (U.S. Department of the Treasury) Treasury Targets Financial and Operational Support Networks for Attempts to Evade U.S., International Sanctions Treasury Takes New Step of Designating a Virtual Currency Mining Company

Russia says nyet, sanctions Mark Zuckerberg, LinkedIn’s Roslansky, VP Harris and other US leaders (TechCrunch) From the department of Tit for Tat, on the heels of a cascade of sanctions against Russia, Russian organizations and Russian individuals over Russia’s aggressive war in Ukraine, the Russian Foreign Ministry now has issued a list of U.S. figures that are now prohibited from entering Russia &#8…

Attacks, Threats, and Vulnerabilities

Costa Rica's Alvarado says cyberattacks seek to destabilize country as government transitions (Reuters) Costa Rican President Carlos Alvarado said on Thursday that recent cyberattacks on state computer systems are aimed at destabilizing the Central American country as it transitions to the new government of president-elect Rodrigo Chaves.

GOLD ULRICK continues Conti operations despite public disclosures (Secureworks) Leaks of GOLD ULRICK communications and operational details have not hampered ransomware activity.

Hackers Spearphish Corporate Hiring Managers with Poisoned Resumes, Infecting Them with the More_Eggs Malware, Warns eSentire (eSentire) Read this blog to learn about the eSentire Threat Response Unit (TRU)’s recent discovery of a phishing campaign where hackers are posing as job applicants, luring hiring managers to download poisoned resumes, and infecting their victims’ IT systems with the more_eggs malware. Find out how to…

Critical bug could have let hackers commandeer millions of Android devices (Ars Technica) Flaw could be exploited with malicious audio file.

FBI Shares Information on BlackCat Ransomware Attacks (SecurityWeek) The FBI has published indicators of compromise (IOCs) associated with the BlackCat Ransomware-as-a-Service (RaaS).

FBI: BlackCat ransomware breached at least 60 entities worldwide (BleepingComputer) The Federal Bureau of Investigation (FBI) says the Black Cat ransomware gang, also known as ALPHV, has breached the networks of at least 60 organizations worldwide, between November 2021 and March 2022.

FBI Issues Warning About Unique BlackCat Ransomware Attacks (Forbes) The Bureau states that the gang’s ransomware has been used to attack at least 60 organizations around the world so far. There’s something different about BlackCat’s ransomware: the way it’s coded.

BlackCat/ALPHV Ransomware Indicators of Compromise (IC3) This FLASH is part of a series of FBI reports to disseminate known indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs) associated with ransomware variants identified through FBI investigations.

These hackers showed just how easy it is to target critical infrastructure (MIT Technology Review) Two Dutch researchers have won a major hacking championship by hitting the software that runs the world’s power grids, gas pipelines, and more. It was their easiest challenge yet.

Crypto Thieves Get Bolder by the Heist, Stealing Record Amounts (Wall Street Journal) A hacker stole $182 million over the weekend, the fifth largest hack on record.

CVE-2022-21449 - Analyzing the Java Vulnerability (JFrog) Details on CVE-2022-21449 “Psychic Signatures” Apache vulnerability: when it applies, and how to remediate it? By the JFrog Security Research Team

Spoofing Credit Unions for Profit (Avanan) Hackers are spoofing credit unions to gain credentials and profits from end-users.

Security Patches, Mitigations, and Software Updates

Cisco Releases Security Updates for Multiple Products (CISA) Cisco has released security updates to address vulnerabilities in multiple Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA encourages users and administrators to review the following Cisco advisories and apply the necessary updates:

Drupal Releases Security Updates (CISA) Drupal has released security updates to address vulnerabilities affecting Drupal 9.2 and 9.3. An attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Drupal security advisories SA-CORE-008 and SA-CORE-009 and apply the necessary updates.

Delta Electronics ASDA-Soft (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: ASDA-Soft Vulnerabilities: Out-of-bounds Write, Out-of-bounds Read 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow arbitrary code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of ASDA-Soft servo software are affected:

Johnson Controls Metasys SCT Pro (CISA) 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls, Inc. Equipment: Metasys Vulnerability: Server-side Request Forgery 2.

Hitachi Energy MicroSCADA Pro/X SYS600 (CISA) 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: MicroSCADA Pro/X SYS600 Vulnerabilities: Observable Discrepancy, HTTP Request Smuggling, Classic Buffer Overflow, Improper Certificate Validation, Improper Restriction of Operations within the Bounds of a Memory Buffer, Exposure of Sensitive Information to an Unauthorized Actor 2.

Trends

Intelligence Insights: April 2022 (Red Canary) SocGholish falls from first place, Yellow Cockatoo rebounds in March, and Qbot campaigns leverage Windows Installer packages.

SecZetta Shares New Research: Lack of Diligence in Managing Third-Party Identity Risk Increases Vulnerability to Cyberattacks (Business Wire) SecZetta, the leading provider of third-party identity risk solutions, in partnership with ESG, an IT analyst, research, validation, and strategy firm

New Satori State of Data Security Operations (DataSecOps) in Cloud Report Reveals 61% of data leaders point to manual processes and tools for data access management slowing down data initiatives (GlobeNewswire News Room) As data democratization continues its march, 75% are working on increasing access to data for more users; yet, 61% point to manual processes and tools...

Zero Tolerance: More Zero-Days Exploited in 2021 Than Ever Before (Mandiant) We identified 80 zero-days exploited in the wild in 2021, more than we've seen in any year.

Google, Mandiant Share Data on Record Pace of Zero-Day Discoveries (SecurityWeek) Google and Mandiant separately warn that nation-state APT actors, ransomware gangs and private mercenary exploit firms are burning through zero-days at record pace.

Critical infrastructure: Under cyberattack for longer than you might think (WeLiveSecurity) Lessons from history and recent attacks on critical infrastructure throw into sharp relief the need to better safeguard our essential systems and services.

When does cyber crime become fincrime? And what are the consequences? (Global Banking & Finance Review) By Taylor Humphreys, FinCrime Threat Intelligence Analyst at BAE Systems Cyber crime as a mechanism to commit financial crime (fincrime) has escalated in the last decade as the digital age has grasped our lives. The complex interplay between cyber crime and fincrime is becoming more visible, with countries such as the UK raising cyber crime’s […]

Many Industrial Firms Say Cybersecurity Systems Cause Problems to Operations (SecurityWeek) Despite an increase in attacks, ICS/OT companies admit that they turn off cybersecurity systems if they cause problems to operations.

D&O Liability survey 2022 (Willis Towers Watson) Results from our 2022 Directors and Offices Liability survey including cyber, insolvency and climate change.

Marketplace

Devo Acquires AI-Powered Security Automation Innovator to Deliver the “Autonomous SOC” (GlobeNewswire News Room) Kognos threat hunting solution, paired with the Devo cloud-native security analytics platform, transforms petabytes of security data into comprehensive...

ThreatLocker Scores $100M In Funding Led By General Atlantic, Zeroes In On $1B Unicorn Valuation (CRN) Here's a look at how ThreatLocker scored $100 million in funding from private equity powerhouse General Atlantic.

U.S. Air Force Academy Awards $3.1M Contract to Telos Corporation (Telos Corporation) Ashburn, Va. – April 22, 2022 – Telos® Corporation (NASDAQ: TLS), a leading provider of cyber, cloud and enterprise security solutions for the world’s most security-conscious organizations, today announced that it was awarded a $3.1M contract for the United States Air Force Academy (USAFA) Wi-Fi network expansion program. Under this contract, Telos will upgrade and... Read more

Elon Musk Says He Has $46.5 Billion in Funding for Twitter Bid (Wall Street Journal) The financing commitments lend credibility to what had looked more like a personal lark than a bona fide takeover play.

ICS Exploits Earn Hackers $400,000 at Pwn2Own Miami 2022 (SecurityWeek) Pwn2Own Miami 2022, a hacking contest focusing on industrial control systems (ICS), has come to an end, with contestants earning a total of $400,000 for their exploits.

Meta Offers Rewards for Flaws Allowing Attackers to Bypass Integrity Checks (SecurityWeek) Facebook parent company Meta today announced that its bug bounty program will cover vulnerabilities that can be exploited to bypass integrity safeguards.

Veracode Named a Leader in the 2022 Gartner® Magic Quadrant™ for Application Security Testing for Ninth Consecutive Time (Veracode) Also recognized as a 2021 Customers’ Choice for Application Security Testing

Conquest Cyber announces executive team addition, Jason Weiss as Chief Software Officer (EIN News) Conquest Cyber has continued the expansion of top-tier executive growth with the addition of a new Chief Software Officer.

National Security Veteran Alexander Gates Joins Shift5 as Chief Research Officer (Shift5) Cybersecurity Leader from Department of Energy, National Security Agency to Drive OT Cybersecurity Threat Intelligence Amid Era of Cyber-Physical Threats

HelpSystems Appoints Onkar Birk as Alert Logic Managing Director (Alert Logic) Alert Logic today announced that Onkar Birk has been named Alert Logic Managing Director for HelpSystems. In his new role, Birk will oversee the Alert Logic business as it continues providing the most innovative managed detection and response (MDR) solution to security-strapped organizations. He previously served as Chief Operating Officer and Chief Technology Officer for Alert Logic until the company’s acquisition by HelpSystems in March 2022.

Products, Services, and Solutions

Dynatrace Advances Observability and AIOps for Databases (Business Wire) Software intelligence company Dynatrace (NYSE: DT) today announced it has extended its advanced AIOps capabilities for leading database environments,

Committed to Open Source - Sumo Logic Simplifies Infrastructure and Application Monitoring Deployments (GlobeNewswire News Room) Introduces the Sensu Integration Catalog – an open marketplace featuring turn-key integrations to accelerate deployments...

Red Sift OnDOMAIN Proactively Uncovers Impersonated & Forgotten Domains Before They Can Be Weaponized (Business Wire) Red Sift OnDOMAIN enables security-first organizations to enhance brand protection and prevent BEC attacks by shutting down phishing sites

Cybereason DFIR Solution Contains Cyberattacks in Minutes (Cybereason) Cybereason, the XDR company, today launched Cybereason DFIR (Digital Forensics Incident Response), a solution designed to automate incident response (IR) investigations by incorporating nuanced forensics artifacts into threat hunting, reducing remediation time by enabling security analysts to contain cyberattacks in minutes.

Alert Logic Releases Industry's Most Holistic and Intuitive MDR Incident Response Capability for Addressing a Breach (PR Newswire) Alert Logic by HelpSystems today announced general availability of its new intelligent response capabilities. The innovations, including simple...

Digital Element Announces Nodify Threat Intelligence Solution (PR Newswire) Digital Element, the global IP geolocation and audience insights leader, today announced the launch of Nodify™, a threat intelligence solution...

Resecurity’s cyber threat intelligence for SAMA compliance protects Saudi’s financial services sector (Arabian Business) Cyber threat intelligence has become mandatory for financial institutions in the Saudi Arabia to achieve SAMA Cybersecurity Framework Compliance

Entelar Signs Reseller Agreement with Radware (GlobeNewswire News Room) Entelar to offer Radware’s application and network security solutions...

Eset To Further Secure Organizations To Enhance Their Digital Transformation Process (Enterprise Security) Social engineering, ransomware, and advanced persistent threats (APTs) have become more common in the last decade. Unfortunately, it is difficult to protect...

Neustar Security Services’ UltraDNS Integrates Terraform for Streamlined, Automated DNS Management (Business Wire) Neustar Security Services, a leading provider of cloud-oriented security services that enable global business to thrive online, has launched an integr

North American Private Equity Firm Stops HR-Spoofing Cyber-Attack with Darktrace AI (Dark Trace) Attackers Used Fake Microsoft Branding and Company Research to Pose as Employees in Targeted Phishing Campaign

Design and Innovation

Digging Into the Science of Behaviour to Tackle Cyber Extortion (Infosecurity Magazine) When building a strategy to tackle cyber extortion, it is crucial to remember the complexity of human behavior

Academia

Minot State earns National Security Agency Cyber Defense designation (Minot Daily News) A capacity crowd of students, professors, and state dignitaries gathered in the hallway outside the Minot State University Cyber Center in Old Main on Wednesday. The University announced that the Management Information Systems program has been designated by the National Security Agency and the Department of Homeland Security as a Center of Academic Excellence in […]

College students defend against cyberattacks during competition in San Antonio (KSAT) Cyberattacks are becoming an everyday part of life, and this week, the future generation of students who will fight back against these threats are in San Antonio.

UCF Earns National Victory in NSA-Sponsored Pilot Cybersecurity Competition | University of Central Florida News (University of Central Florida News | UCF Today) UCF competed against 21 other colleges and universities to take first place in three of the five modules in the inaugural competition.

Legislation, Policy, and Regulation

New Zealand Deal May Put Japan Closer to ‘Five Eyes’ Intelligence Alliance (New York Times) The two countries announced a goal of “seamless” sharing of classified information as China moves to expand its influence in the Asia-Pacific region.

China's Xi proposes 'global security initiative', without giving details (Reuters) Chinese President Xi Jinping on Thursday proposed a "global security initiative" that upholds the principle of "indivisible security", a concept also endorsed by Russia, although he gave no details of how it would be implemented.

Navy’s Cyberspace Boss: 5-domain conflict is the new norm (DVIDS) Vice Adm. Ross Myers, commander, U.S. Fleet Cyber Command/U.S. 10th Fleet (FCC/C10F), participated in the 5th Joint Service Academy Cybersecurity Summit, Apr. 20.

NDIA Policy Points: U.S. Can’t Wait Any Longer for a Cyber Force (National Defense) In 1947, the United States acknowledged that air power had fundamentally changed warfare by creating the Department of the Air Force.

House introduces cyber bill intended to safeguard energy sectors (The Hill) House lawmakers introduced a cybersecurity bill on Thursday that would address rising cyber threats against U.S. energy sectors. The Energy Cybersecurity University Leadership Program Act, a bill c…

Bipartisan bill would create grant program for energy sector cyber research (The Record by Recorded Future) A bipartisan House duo on Thursday introduced legislation intended to bolster the energy sector’s ability to combat future cyberattacks and other digital threats.

White House Official Urges Cyber Protection of Solar Energy (GovTech) In San Antonio on Wednesday, a White House official urged the private sector to partner with government to build a "cybersecurity foundation" to protect solar power sources from cyber attacks.

Obama calls for tech regulation to combat disinformation on social media (CNBC) Former President Barack Obama said on Thursday that tech "platforms seems to be tilting us in the wrong direction."

Litigation, Investigation, and Law Enforcement

EU’s Vestager brushes off spyware threat (POLITICO) Commissioner says her phone and devices only hold ‘boring’ information.

House Democrats ramp up investigation into impact of election disinformation (Washington Post) Democrats probe officials in Florida, Arizona, Texas and Ohio on impact of election disinformation

Greek prosecutor to probe alleged bugging of journalist's phone (Reuters) A Greek prosecutor said on Thursday she had begun an investigation into an allegation by a journalist that his smartphone had been infected by surveillance software in an operation by the country's intelligence service.

DOJ Puts Google's $5.4B Cyber Deal Under The Microscope (Law360) Cybersecurity firm Mandiant disclosed Wednesday that the U.S. Department of Justice had initiated an in-depth investigation into the company's $5.4 billion acquisition by Google, a move that freezes the review clock for the transaction meant to boost the tech giant's cloud business.

Ronan Farrow on investigating the world's most notorious spyware company: NSO Group (NPR) NPR's Daniel Estrin speaks with Ronan Farrow about his New Yorker investigation into Israeli spyware company NSO Group, and his interview with an employee who quit.

Meta’s Sheryl Sandberg Pressured Daily Mail to Drop Bobby Kotick Reporting (Wall Street Journal) The social-media executive, who dated the Activision Blizzard CEO, was part of a campaign to persuade the U.K. tabloid to shelve a potential article.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Global Cyber Innovation Summit (Baltimore, Maryland, United States, Apr 27 - 28, 2022) The Global Cyber Innovation Summit brings together a preeminent group of leading Global 2000 CISO executives, cyber technology innovators, policy thought leaders, and members of the cyber investment community to catalyze the industry into creating more effective cyber defenses. This unique, invitation-only forum will foster a dynamic exchange of ideas, discussion and collaboration designed to drive true innovation in the efficiency and effectiveness of global cyber security strategies and solutions. CARPE COMMINATIONE. The Global Cyber Innovation Summit is an invitation-only event.

Events

The Canadian Oil & Gas Industry Conference: The New Cyber Threat (Virtual, Apr 26, 2022) Cyber attacks hit the energy sector at nearly double the rate they hit other industries. The threat has risen with the increased risk of Russian action. This conference's agenda will address: Setting the Stage; An industry perspective; Best practices by an industry leader; and Next Steps – Defending against the Unknown. It will include a roundtable discussion and summary closing remarks.

Cyber Security for Critical Assets APAC Summit (Singapore, Apr 26 - 27, 2022) CS4CA APAC unites IT & OT security leaders online to network, learn and collaborate towards cyber resilience by exchanging first-hand expert information and joining forces in addressing common concerns. Senior experts share first-hand insights through real-life case studies, panel debates, and keynote presentations, while bringing forth urgent topics to be discussed over roundtables and networking breaks.

ICSJWG 2022 Spring Virtual Meeting (Virtual, Apr 26 - 27, 2022) The Industrial Control Systems Joint Working Group (ICSJWG) will hold its Spring 2022 Virtual Meeting April 26–27. ICSJWG meetings facilitate relationship building among critical infrastructure stakeholders and owners/operators of industrial control systems, idea exchanges regarding critical issues affecting industrial control systems (ICS) cybersecurity, and information sharing to reduce the risk to the nation’s industrial control systems. The ICSJWG Spring 2022 Virtual Meeting will feature two full days of presentations, technical workshop presentations, and an ICS Training overview of Cyber-CHAMP©. ICSJWG meetings are open to all who are interested and are free for all attendees.

Back to Basics: Overcoming Uncertain Times with Security Fundamentals (Virtual, Apr 27, 2022) As governments around the world call for increased cyber vigilance following the news of Russia’s invasion of Ukraine, the fundamentals of cybersecurity have never been more important. While prioritizing security can be a challenge during uncertain times, there are simple steps organizations of all sizes can take to prepare for a potential cyberattack. Join Brad Thies, founder and president of BARR Advisory, and Alex Nette, CEO and co-founder of Hive Systems, for a conversation on how to implement fundamental cybersecurity practices that can protect you and your business. This webinar will provide insight on how to navigate through these uncertain times, including a discussion of what organizations need to know about the heightened cyber risks due to the ongoing geopolitical tensions and how to build a business continuity plan.

Versatility 2022 (Santa Clara, California, USA, Apr 27 - 28, 2022) Versatility 2022 includes inspirational keynotes, technical deep dives, and interactive sessions that will give attendees the edge in their daily work and in their careers. We’re arming the new generation of Security and Networking leaders with the most up-to-date knowledge and technical information in the industry. Join cybersecurity visionaries, Versa technical experts, and many of your peers for a packed agenda with more than 10 keynotes and nearly 20 deep-dive educational sessions. You’ll also have plenty of opportunities for networking with your peers and we think you’ll have fun, too.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

A hybrid war raises cyber concerns. Conti's still in business. BlackCat ransomware and the More_eggs credential stealer.