Nuisance-level cyber ops in Russia's hybrid war. Lapsus$ gang chatter. Ag sector warning. Locked Shields concludes.

Special Section

By The CyberWire staff.

Stamp collecting.

The Snake Island garrison's defiant "Russian warship, go f**k yourself" became a rallying call in Ukraine, especially after the Moskva, the Russian warship to whom the message was directed, sank after being hit by two Ukrainian Neptune anti-ship missiles. Ukrposhta, Ukraine's national postal service, issued stamps commemorating the incident, showing a Ukrainian soldier (presumably Roman Hrybov, who radioed the defiant reply to Moskva's demand that the garrison surrender) flipping the bird in the direction of a large but ineffectual looking Moskva. Within a few days of the stamp's issue, Ukrposhta said it had come under a distributed denial-of-service (DDoS) attack apparently intended to disrupt domestic and international sales of the commemorative stamp. Ukrposhta offered no attribution, but in this case the circumstantial evidence pointing to Moscow is, as Gizmodo points out, too obvious to ignore. The postal service is working through the effects of the DDoS attack, and says that a lot of people are still getting through to buy the stamp. (Supplies are limited, collectors; act now.)

#OpRussia: Anonymous counts coup.

The hacktivist collective has tweeted Its tally of recent successes claimed against Russian organizations: "#OpRussia: Since declaring 'cyber war' on Kremlin's criminal regime, the #Anonymous collective has now published approximately 5.8 TB of Russian data via #DDoSecrets. #Anonymous vows to release more data belonging to Russian entities and government, including a commercial bank."

On Sunday Security Affairs published the results of its sifting through the documents Anonymous had leaked "over the last three days" and found that files were taken from four commercial businesses:

"Enerpred is the largest producer of hydraulic tools in Russia and the CIS, specializing in the energy, petrochemical, coal, gas and construction industries. The collective has leaked a 432GB archive containing 645,000 emails."
"Accent Capital is a commercial real-estate investment firm that owns or is directly involved with the management of many of the properties its clients invest in. The collective has leaked a 211GB archive containing 365,000 emails."
"Sawatzky is a property management company. Sawatzky’s clients include Du Pont, Lenovo, Whirlpool, Aveva, Wella, Johnson + Johnson, Cisco, Google, Swatch, Avito, Samsung, Microsoft, Western Union, Saint-gobain, Turkish Airlines, and British American Tobacco. The collective has leaked a 432GB archive containing 575,000 emails."
"Worldwide Invest is an investment firm with ties to Estonia and Russian railways. The collective has leaked a 130GB archive containing 250,000 emails."

That #OpRussia represents a successful hacktivist action seems beyond dispute, but its achievements also seem to confirm that hacktivism in this ongoing hybrid war has yet to rise above nuisance levels. The nuisance is real, but it remains exactly that: a nuisance.

"Lacryphages," privateers, and state actors.

Anonymous has been operating in the Ukrainian interest. There has been evidence of hacktivism in the Russian interest as well, although in that case it's difficult to distinguish from opportunistic cybercrime that exploits sympathy for Ukrainian suffering ("lachryphagy," "drinking of tears," in the colorful term used by an op-ed in TheHill), gangland privateering, and direct state action. CNN reports that humanitarian organizations working on Ukrainian relief have been the targets of phishing, or, as CNN puts it "malicious links and pornographic material on their cell phones." Most aid organizations are relatively poorly protected non-governmental organizations, and in many cases have difficulty even recognizing that they're under attack, still less able to respond to an attack quickly and effectively. CNN quotes Amazon Web Services as explaining that the attacks seem intended to “to spread confusion and cause disruption,” which seems particularly odious when the activities being disrupted are the distribution of food, clothing, and medical supplies.

Alternative energy suppliers in Europe sustain cyberattacks.

The Wall Street Journal reports that three alternative energy companies in Europe have sustained cyberattacks since Russia's invasion of Ukraine began. WindEurope, a wind-power industry group based in Brussels, says it believes the attacks originate with Russia. Presumably the goal is to make a shift from Russian oil and natural gas more difficult for European, especially German, markets. Two German turbine manufacturers (Enercon GmbH and Nordex SE) and one turbine maintenance firm (Windtechnik AG) have been affected.

Rosaviatsiya recommends that Russian airlines prepare for operations without GPS.

Isvestia reports that the Russian federal air transport authority, Rosaviatsiya, has counseled airlines to be prepared to operate without GPS. "This is due to its possible shutdown, as well as "jamming" of GPS signals and spoofing attacks when flying in the Kaliningrad region, over the Black Sea, east of Finland and the Mediterranean." GPS spoofing and jamming have been reported in those regions by Western sources, and that activity has generally been chalked up to Russian operators, but Isvestia offers no such attribution. RIA Novosti cites Roskosmos to the effect that it would be difficult to selectively turn GPS off in Russia, and that in any case GLONASS offers a viable alternative to GPS.

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

Summary

By the CyberWire staff

KrebsOnSecurity reports that internal Lapsus$ gang chatter the week before some of the group's (alleged) members were arrested last month indicated that the gang had made multiple incursions into T-Mobile's systems. For reasons that are unclear, Lapsus$ exhibited a strong interest in source code. They compromised employee accounts either by social engineering or--mark this--buying them from Russophone initial access brokers. T-Mobile told KrebsOnSecurity, "Several weeks ago, our monitoring tools detected a bad actor using stolen credentials to access internal systems that house operational tools software. The systems accessed contained no customer or government information or other similarly sensitive information, and we have no evidence that the intruder was able to obtain anything of value. Our systems and processes worked as designed, the intrusion was rapidly shut down and closed off, and the compromised credentials used were rendered obsolete.”

Costa Rica continues to work toward recovery from a ransomware campaign that afflicted government sites during the country's presidential transition. ABC has summarized the attack and the government's response. The Conti gang has claimed responsibility for the campaign, which appears to be a double extortion operation in which data are both encrypted and stolen. The Costa Rican government has refused to pay the ransom.

The FBI warned last week that agricultural cooperatives should expect to become targets of ransomware operators during crucial, seasonal inflection points, particularly around harvest and—right now—around planting times.

NATO's Exercise Locked Shields has concluded, and a team from Finland won the competitive phase of the exercise.

Dateline Moscow and Kyiv: Low-level cyber exchanges continue.

Ukraine at D+60: Russia's slow advance in its hybrid war. (The CyberWire) No major progress in the Donbas or Azov regions as Russia's offensive resumes, slowly. Both sides exchange nuisance-level cyberattacks.

Russia’s invasion of Ukraine: List of key events from day 61 (Al Jazeera) As the Russia-Ukraine war enters its 61st day, we take a look at the main developments.

Ukraine repels first week of assaults by Russian forces in Donbas region (The Telegraph) Analysts are warning that Russian forces may only have one chance to win the war before exhausting their army

Vladimir Putin Has to Appear Victorious 14 days from Today. Can He? (Newsweek) Russia has stumbled again. Its southern offensive, the second phase of the Ukraine war, has failed to be the "biggest tank war since World War II," as some analysts were predicting. Instead, Russia's ground forces have shown the same lackluster performance on the ground, unable to break through anywhere.

Zelenskiy warns Ukraine invasion only the beginning as Russia signals southern push (the Guardian) President’s warning comes after Russian military chief said forces want to seize southern Ukraine, in a move that could give access to Moldova

Kremlin Seeks Control of Southern Ukraine, Russian General Says (Bloomberg) Goal is land bridge to Crimea, control of ports, general says. Russia hasn’t stated such sweeping territorial goals.

Russia seeks to capture all of southern Ukraine in major expansion of war goals (The Telegraph) A top Russian commander says troops are aiming to occupy all of southern Ukraine, potentially up to Transnistria in Moldova

With exhausted troops and low morale, Vladimir Putin’s gamble in the Donbas could backfire (The Telegraph) Russia may have high aspirations to take southern Ukraine, but its forces are vulnerable and facing steely opponents

Will Russia invade Moldova next? Experts weigh in (Newsweek) Russian commander Rustam Minnekaev referred to the breakaway Moldovan region of Transnistria, sparking a fierce debate.

Ukraine war: Fears Russia plans to 'conscript Ukrainian men' in Kherson to 'fight against their own army' (Sky News) Two people fleeing Kherson said that adults without children are being stopped from leaving and that there are fears the "Russians are going to conscript the men who are left there" so "our countrymen will go and fight on their side and fight against the Ukrainian army".

Russia hits rail, fuel facilities in attacks deep in Ukraine (AP NEWS) Russia unleashed a string of attacks against Ukrainian rail and fuel facilities Monday, striking crucial infrastructure far from the front line of its eastern offensive, which Britain said has yet to achieve a significant breakthrough.

Ukraine now has more tanks on the battlefield than Russia (The Telegraph) Kyiv’s arsenal boosted by Soviet-era T-72 tanks from European Nato allies – and they could prove crucial on the flat terrain of the Donbas

UK set to provide Poland with Challenger II tanks in Ukraine arms drive (The Telegraph) Boris Johnson announces plans to ‘backfill’ supplies of Soviet-era tanks in latest push to fight off Russian advances

The Belarusian railway workers who helped thwart Russia’s attack on Kyiv (Washington Post) A clandestine network of railway workers, hackers and dissident security forces wreaked havoc on supply lines

Ukraine Can Win (Foreign Affairs) The case against compromise.

The awful truth is dawning: Putin may win in Ukraine. The result would be catastrophe | Simon Tisdall (the Guardian) A Russian victory would herald a new age of instability, economic fragmentation, hunger for millions and social unrest

I’ve dealt with Putin before: I know what it will take to defeat this brutal despot | Viktor Yushchenko (the Guardian) International solidarity is the best weapon we have against Russia’s dictator, says former Ukrainian president Viktor Yushchenko

Putin has ignited a new anti-colonial struggle. This time, Moscow is the target | Nick Cohen (the Guardian) Belarusian exiles watch events in Ukraine with fear but also hope. Could they too fight back?

What Does the West Want in Ukraine? (Foreign Affairs) Defining success—before it's too late.

Why the War in Ukraine Won’t Go Nuclear (Foreign Affairs) Old rules still apply to a new era of limited conflict.

Possible mass graves near Mariupol as Russia attacks in east (AP NEWS) Mounds of dirt seen in satellite imagery that Ukrainian officials say indicate new mass graves highlighted the savagery of a war that showed no signs of abating Friday, as Russia pounded targets in eastern Ukraine in a new offensive to take the country's industrial heartland .

UN rights chief sees 'horror story' of violations in Ukraine (AP NEWS) The United Nations' human rights office on Friday pointed to what it said is growing evidence of war crimes since the Russian invasion of Ukraine, declaring that humanitarian law appears to have been “tossed aside.”

Evidence some Ukrainian women raped before being killed, say doctors (the Guardian) Forensic specialists carrying out autopsies north of Kyiv say they ‘still have hundreds of bodies to examine’

Crimes against history: mapping the destruction of Ukraine’s culture (the Guardian) US-based lab documents destruction of churches and theatres

Vladimir Putin sets up Stalin-esque network of state informers (The Telegraph) The plants will report back to the president's office on the 'emotional state and mood' of staff in government ministries

Britain, India call for immediate cease-fire in Ukraine (AP NEWS) India and Britain on Friday called on Russia to declare an immediate cease-fire in Ukraine, as British Prime Minister Boris Johnson announced an expansion of economic and defense ties that could help India reduce its dependence on Moscow.

Canada says it has provided heavy artillery to Ukraine forces (Reuters) Canada said on Friday it has provided heavy artillery to Ukrainian security forces, following up on a pledge by Prime Minister Justin Trudeau earlier this week to send more artillery weaponry to Ukraine in the face of a Russian assault on its East.

US pledges extra $713m for Ukraine war effort and to weaken Russia (the Guardian) Moscow complains about US military aid as Washington promises more support, including advanced weapons

Blinken and Austin meet in Kyiv with Zelensky. (New York Times) Secretary of State Antony J. Blinken and Defense Secretary Lloyd J. Austin III met Sunday with President Volodymyr Zelensky, the first senior U.S. officials known to have visited Ukraine since the invasion.

Blinken due to meet Zelenskiy in first wartime visit by top US officials to Ukraine (the Guardian) US defence secretary Lloyd Austin will join secretary of state in Sunday’s meeting as Russia continues attacks in south and east Ukraine

Austin says US wants to see Russia's military capabilities weakened (CNN) Secretary of State Antony Blinken and Secretary of Defense Lloyd Austin insisted Monday that Russia was failing in its Ukraine incursion, with Austin explicitly saying that the US wants to see Russia's military capabilities weakened.

Kyiv pushes for weapons ahead of expected Blinken, Austin visit (Washington Post) U.S. Secretary of State Antony Blinken and Defense Secretary Lloyd Austin are expected to visit Ukraine on Sunday in what would be the highest-level visit by an American delegation since the start of the war. Before the trip, which marks two months since Russia invaded Ukraine, the State Department praised Ukrainian forces for achieving “nothing short of victory on the battlefield.”

EXPLAINER: Why Washington is boosting heavy arms for Ukraine (AP NEWS) Eight weeks into the war, the Biden administration's decision to dramatically ramp up delivery of artillery guns to Ukraine signals a deepening American commitment at a pivotal stage of fighting for the country's industrial heartland.

Calling all weapons makers: Pentagon seeks new ideas to arm Ukraine (Defense News) In its effort to quickly arm Ukraine against Russia, the Pentagon has announced the equivalent of an open casting call for companies to offer weapons and commercial systems that can be rushed to the fight.

The Belarusian railway workers who helped thwart Russia’s attack on Kyiv (Washington Post) A clandestine network of railway workers, hackers and dissident security forces wreaked havoc on supply lines

Will Russia invade Moldova next? Experts weigh in (Newsweek) Russian commander Rustam Minnekaev referred to the breakaway Moldovan region of Transnistria, sparking a fierce debate.

Boris Johnson warns UN chief that Putin will 'manipulate' him on Moscow visit (The Telegraph) Boris Johnson has warned the UN Secretary General that Vladimir Putin will attempt to manipulate his visit to Moscow this week.

Zelenskiy’s economic guru: ‘Germany can survive without Russian oil: I wouldn’t want my country facing the shame’ (the Guardian) Exclusive President Zelenskiy’s economic adviser, Oleg Ustenko, tells of his fury at how Europe’s refusal to act is piling more misery on Ukraine

Exclusive: France and Germany evaded arms embargo to sell weapons to Russia (The Telegraph) Paris and Berlin sent Moscow £230m of military hardware, including bombs, rockets and missiles, that is likely being used in Ukraine

German government faces crisis as opposition aims to force weapons to Ukraine vote (The Telegraph) Friedrich Merz, the CDU leader, will ask parliament to vote on motion calling for ‘immediate’ deliveries of heavy weapons including tanks

Putin’s Unholy War (Atlantic Council) Vladimir Putin's unholy war in Ukraine has sought to exploit centuries of shared Orthodox faith but the ongoing invasion has only served to expose the growing gulf separating modern Ukraine from Russia.

Ukraine issues warning to its citizens regarding possible cyber attacks on Orthodox Easter (Republic World) Ukraine has warned its citizens about the cyberattacks on the Easter holiday, which is considered one of the most important holidays of the year.

Seven reasons Putin hasn’t launched a cyberwar in Ukraine - yet (The Sydney Morning Herald) When Russian tanks began rolling over Ukraine’s border on February 24, many expected an online throw-down of epic proportions.

Ukraine's Postal Service DDOS'd After Printing Moskova Stamps (Gizmodo) The stamp showed a Ukrainian guard telling the Moskova to "go f**k itself." The post office didn't disclose where the attack came from, but we have an idea.

European Wind-Energy Sector Hit in Wave of Hacks (Wall Street Journal) Cyberattacks on three European wind-energy companies since the start of the war in Ukraine have raised alarm that hackers sympathetic to Russia are trying to cause mayhem in a sector set to benefit from efforts to lessen reliance on Russian oil and gas.

Schneider Electric says no evidence that Incontroller/Pipedream malware exploits vulnerabilities (MarketScreener) The malware, described as a modular ICS attack framework and a collection of custom-made tools, can be used by threat actors to target ICS and SCADA devices, including programmable logic controllers ... | April 25, 2022

Since declaring cyber war on Russia Anonymous leaked 5.8 TB of Russian data (Security Affairs) OpRussia continues unabated, since declaring ‘cyber war’ on Russia Anonymous has now published approximately 5.8 TB of Russian data. The #OpRussia launched by Anonymous on Russia after the criminal invasion of Ukraine continues to collect successes, the collective claims to have published approximately 5.8 TB of Russian data via DDoSecrets. The collective vows to release […]

Aid groups helping Ukraine face both cyber and physical threats (CNN) Employees at Insecurity Insight, a Switzerland-based nonprofit, received a string of malicious links and pornographic material on their cell phones after publishing a report last month on Russian attacks on hospitals in Ukraine.

The next stage of war is unfolding, and it includes cyber attacks on power grids and oil refineries (MarketWatch) Malware is simple to create and sell on the dark web. But even if the U.S. is targeted, it can easily strike back, escalating risks to dangerous levels.

Russian War Report: Forged document claims Ukraine is selling surplus weapons to African countries (Atlantic Council) A Kremlin-tied Telegram channel published a forged document claiming that Ukraine was selling surplus weapons to African countries.

Russia Faces ‘Reverse Industrialization’ in Sanction Squeeze (Bloomberg) Bank of Russia publishes first detailed outlook since invasion. Long, deep recession seen with return of some 1990s phenomena.

Attacks, Threats, and Vulnerabilities

BlackCat's Rust-based ransomware could be more reliable and faster than other attacks (Computing) The new ransomware group BlackCat has attacked at least 60 organisations around the world as of last month, says the FBI.

FBI says BlackCat Rust-based ransomware scratched 60+ orgs (Register) Plus: Cisco Umbrella flaw patched, lid blown off TeamTNT, and ICS security folks join JCDC party

American Phone-Tracking Firm Demo’d Surveillance Powers by Spying on CIA and NSA (The Intercept) Anomaly Six, a secretive government contractor, claims to monitor the movements of billions of phones around the world and unmask spies with the press of a button.

FBI Warns of Targeted Cyberattacks on Food Plants Amid Heightened Coverage of Fires (NTD) The FBI's Cyber Division issued a warning about potential cyberattacks on agricultural cooperatives and food plants amid increasing ...

Ransomware Attacks on Agricultural Cooperatives Potentially Timed to Critical Seasons (IC3) The Federal Bureau of Investigation (FBI) is informing Food and Agriculture (FA) sector partners that ransomware actors may be more likely to attack agricultural cooperatives during critical planting and harvest seasons, disrupting operations, causing financial loss, and negatively impacting the food supply chain. The FBI noted ransomware attacks during these seasons against six grain cooperatives during the fall 2021 harvest and two attacks in early 2022 that could impact the planting season by disrupting the supply of seeds and fertilizer.

Cyberattack causes chaos in Costa Rica government systems (ABC News) Nearly a week into a ransomware attack that has crippled Costa Rican government computer systems, the country refuses to pay a ransom as it struggles to implement workarounds and braces itself as hackers begin publishing stolen information

Iran Foils Large-scale Cyber Attack Against Infrastructures (Iran Front Page) An Iranian cyber security institution says its experts have thwarted a large-scale cyber attack originating from IPs in Western states against the country’s infrastructure, conducted through the security loopholes of an application commonly used at different institutions.

Report: Pro-Iran hackers target Israel Airports Authority website (Israel Hayom) The IAA confirmed that the site had experienced a DDoS attack, but said that its operational systems and networks were unaffected.

Israel’s cyber directorate issues annual warning ahead of Iran’s ‘Jerusalem Day’ (Times of Israel) Cyberattack operations around April 29 expected to attempt to breach Israeli websites, spreading propaganda messages and attacks on Israeli information systems

Israel on alert for possible cyberattacks in run-up to Quds Day (Business Standard) Quds Day, is an annual event marked in support of the Palestinians on the last Friday of the Muslim holy month of Ramadan

New BotenaGo Malware Variant Targeting Lilin Security Camera DVR Devices (The Hacker News) A new variant of an IoT botnet called BotenaGo has emerged in the wild, specifically targeting Lilin security camera DVR devices with malware.

Hackers hammer SpringShell vulnerability in attempt to install cryptominers (Ars Technica) Thousands of hack attempts made in the days following discovery of the vulnerability.

Leaked Chats Show LAPSUS$ Stole T-Mobile Source Code (KrebsOnSecurity) KrebsOnSecurity recently reviewed a copy of the private chat messages between members of the LAPSUS$ cybercrime group in the week leading up to the arrest of its most active members last month. The logs show LAPSUS$ breached T-Mobile multiple times…

Lapsus$ hackers breached T-Mobile’s systems and stole its source code (The Verge) T-Mobile says the attack didn’t affect customer data.

Lapsus$ hackers targeted T-Mobile (TechCrunch) This latest security incident is T-Mobile's seventh data breach in four years.

JekyllBot:5 vulnerabilities threaten hospital robots (Avast) Researchers found serious flaws in Aethon TUG autonomous logistics robots used in hospitals that would allow for complete hijacking of the machines.

Several Critical Vulnerabilities Affect SmartPTT, SmartICS Industrial Products (SecurityWeek) A security researcher has discovered several vulnerabilities, including ones rated critical- and high-severity, in industrial products made by Elcomplus

Critical bug could have let hackers commandeer millions of Android devices (Ars Technica) Flaw could be exploited with malicious audio file.

Audio Codec Made by Apple Introduced Serious Vulnerabilities in Millions of Android Phones (SecurityWeek) The open source Apple Lossless Audio Codec (ALAC) is affected by serious vulnerabilities that have been pushed out to millions of Android devices by major mobile chipset manufacturers.

Unpatched Vulnerability Allows Hackers to Steal Emails of RainLoop Users (SecurityWeek) An unpatched vulnerability affecting the RainLoop open source webmail client can be exploited to hijack a user’s session and steal their emails.

The ink-stained trail of GOLDBACKDOOR (Stairwell) Over the past 10 years, the Democratic People’s Republic of Korea (DPRK) has adopted cyber operations as a key means of supporting the regime. While significant attention has been paid to the purported use of these operations as a means of funding DPRK’s military programs, the targeting of researchers, […]

Wealthy cybercriminals are using zero-day hacks more than ever (MIT Technology Review) The most valuable hacking tools were once the domain of governments. Not anymore.

Crypto Thieves Get Bolder by the Heist, Stealing Record Amounts (Wall Street Journal) A hacker stole $182 million over the weekend, the fifth largest hack on record.

QNAP warns of new bugs in its Network Attached Storage devices (Naked Security) Here’s what you need to know – plus some sensible advice for all the devices on your home or small biz network!

Rio de Janeiro finance department hit with LockBit ransomware (The Record by Recorded Future) The Secretary of State for Finance of Rio de Janeiro confirmed on Friday that it was attacked by the LockBit ransomware group.

Sunwing working to clear backlog of delayed flights after cyberattack (Toronto City News) Delays continue for Sunwing Airlines passengers after a cyberattack caused a system-wide failure earlier this week.

Romance scam features text messages and picture of random woman (KGTV) A text scam featuring an unknown woman has been reported all over the country. The text messages are another ploy to get your personal information or money, according to cybersecurity experts.

‘He kept winning my confidence:’ Couple loses $21,000 from social engineering scam (NBC 12) A Henrico woman called 12 On Your Side after she and her husband lost thousands to scammers. The couple wants to help and warn others who may not be tech savvy.

Cyber attack on school data (Stamford Mercury) Computer systems at a town school were hacked during the Easter holidays.

D51 Superintendent Sirko addresses data breach (The Grand Junction Daily Sentinel) In her weekly update Friday, Mesa County School District 51 Superintendent Diana Sirko addressed protected student data being potentially compromised in school districts around Colorado.

Investigation launched as 2,000 health workers caught up in data breach (Belfas Ttelegraph) More than 2,000 health workers are at the centre of a data breach over the disclosure of their personal details, Sunday Life can reveal.

What Are Initial Access Brokers? (MUO) These hackers give other criminals access to vulnerable networks by selling stolen credentials on the dark web.

Security Patches, Mitigations, and Software Updates

Atlassian addresses a critical Jira authentication bypass flaw (Security Affairs) Atlassian fixed a critical flaw in its Jira software, tracked as CVE-2022-0540, that could be exploited to bypass authentication. Atlassian has addressed a critical vulnerability in its Jira Seraph software, tracked as CVE-2022-0540 (CVSS score 9.9), that can be exploited by an unauthenticated attacker to bypass authentication. A threat actor could trigger the vulnerability by […]

Experts warn of need to patch critical cryptographic Java bug (The Record by Recorded Future) Cybersecurity experts urged administrators to push through a patch for CVE-2022-21449 -- an Oracle bug affecting Java.

Hot Log4jShell Fix from AWS Needs a Fix on Kubernetes Clusters (Container Journal) AWS, after being alerted by security researchers at Palo Alto Networks, has produced an update to a hot fix for the Log4jShell vulnerability.

Apple App Store appears to be widely removing outdated apps (The Verge) Apple is giving developers just 30 days to update their apps.

Trends

Google, Mandiant say zero-day numbers reached all-time highs in 2021 (The Record by Recorded Future) Google and Mandiant released reports this week indicating the number of disclosed and exploited zero-days reached record highs in 2021.

2021 was a record year for exploited zero-day security bugs (Register) Now that's a race condition

Chinese hackers behind most zero-day exploits during 2021 (BleepingComputer) Threat analysts report that zero-day vulnerability exploitation is on the rise with Chinese hackers using most of them in attacks last year.

Cyberattacks rise at oil firms as hackers step up their game (mint) According to CyberPeace Foundation, a civil society organization, nearly 360,000 attacks on Indian oil companies were detected by threat intelligence sensors deployed to analyze real-time cyberthreats between October 2021 and 12 April

Virtuelle Welt, reale Gefahr (IT Markt) Die Digitalisierung bietet eine Fülle von neuen Chancen - auch für Kriminelle und verfeindete Staaten. Um sich davor zu schützen, braucht es vielschichtige Massnahmen.

VMware's Head of Cybersecurity Strategy Discusses Modern Bank Heists (SecurityWeek) Tom Kellermann, head of cybersecurity strategy at VMware, discusses Modern Bank Heists 5.0, the fifth iteration of an annual report on security in the finance sector.

5 Cyber Threats Community Organizations Can't Ignore (Risk & Insurance) Community associations are susceptible to cyber attacks as they tend to lack sophisticated cyber defenses and hack recovery resources.

Marketplace

Synthetic Data Startups Pick Up More Real Cash (Crunchbase News) The still nascent market of synthetic data—or artificially manufactured data—seems to be having a moment right now.

Cyber Command awards nearly $60M contract for 'hunt forward' operations (FedScoop) U.S. Cyber Command has awarded a nearly $60 million contract to Sealing Technologies to provide equipment to conduct defensive cyber operations abroad on the networks of partner nations, the company announced Thursday. Specifically, the award is for so-called hunt-forward operations, which involve physically sending defensively-oriented cyber protection teams from the Cyber National Mission Force to […]

Strike Security Scores Funding for 'Perpetual Pentesting' for SMBs (SecurityWeek) South American startup Strike Security has secured $5.4 million to fund an ambitious plan to disrupt the penetration testing and attack surface management business.

Why London was the right place to take Darktrace public (Times) I am often asked why we listed Darktrace in London. As a business founded and headquartered in Cambridge, the UK felt like the natural place for our initial pub

Twitter’s Board Is Said to Seriously Consider Elon Musk’s Bid (New York Times) Twitter’s 11-member board met on Sunday morning to discuss Mr. Musk’s offer to buy the company and take it private.

WSJ News Exclusive | Twitter in Talks to Strike a Deal With Elon Musk (Wall Street Journal) Twitter is in discussions to sell itself to Elon Musk and could finalize a deal as soon as this week, people familiar with the matter said.

One year after KnowBe4 went public at a $1B valuation, is it still considered a unicorn? (Tampa Bay Business Journal) The cybersecurity company debuted as KNBE on the Nasdaq one year ago.

Cybersecurity firm Darktrace is enjoying rapid growth, but the competition could prove too much (MoneyWeek) Darktrace, an AI-driven cybersecurity firm, is growing fast and beating its own earnings projections. But is it an undervalued growth stock or a disaster waiting to happen? Rupert Hargreaves investigates.

Fortinet to Seek Hldr Approval for 5-for-1 Share Split (MarketWatch) By Stephen Nakrosis Cybersecurity company Fortinet Inc. on Friday said it will seek shareholder approval to implement a five-for-one forward stock split of...

Is cybersecurity talent shortage a myth? (Help Net Security) In this interview for Help Net Security, Ricardo Villadiego, CEO at Lumu, explains why he thinks the cybersecurity talent shortage is a myth.

Palantir's poaching of former NHSX AI chief branded “scandalous” (IT PRO) The controversial tech company is currently competing for a £240 million NHS federated data platform (FDP) contract

Former NHS AI leader joins US spy-tech firm Palantir (Register) Move coincides with NHS England's procurement of a far-reaching data platform

Shift5 hires NSA, Energy cyber vet as research chief (Washington Technology) The operational technology-focused outfit is positioning for growth in defense and transportation markets.

Silk Road Prosecutor Jumps to Freshfields Cyber, Crypto Group (Bloomberg Law) Timothy Howard, the Manhattan prosecutor who helped bring down dark web marketplace Silk Road, is joining the Freshfields law firm to focus on cybersecurity and cryptocurrency.

Huawei names Meng Wanzhou as rotating chair (iTWire) Telecom giant Huawei has named chief financial officer Meng Wanzhou, who returned to China in 2021 after nearly three years of detention in Canada, as its rotating chairwoman, according to the company’s website. The daughter of Huawei founder Ren Zhengfei, Meng will act as the company’s head honcho...

Products, Services, and Solutions

New infosec products of the week: April 22, 2022 (Help Net Security) The featured infosec products this week are from: Arcanna.ai, Finite State, Hillstone Networks, Prevailion, and Vicarius.

GitLab 14.10 released with individual compliance violation reporting and a UI for streaming audit events (GitLab) Today, we are excited to announce the release of GitLab 14.10 with Compliance report individual violation reporting, a UI for streaming audit events, GitLab Runner operator for Kubernetes, escalating manually created incidents and much more!

22.04.2022: DerScanner 3.11 app security analyzer has been released (DerSecur) DerSecur introduced the new version of the security code analyzer DerScanner 3.11. It now features the option to classify detected vulnerabilities according to the latest versions of international standards OWASP Top 10 2021 and CWE/SANS Top 25 2021. The new release allows for uploading reports in editable DOCX and SARIF formats. The system interface now offers filtering vulnerabilities by package or file affiliation, source of vulnerability, and sink.

How a European Electronics Retailer Ended the Bot Menace on its Portal | Radware Blog (Radware Blog) It’s May 2020 and a large European electronic goods retailer realizes its bot problem is going from bad to worse. In a single week, its online store is hit with eight million bot visits to systematically scrape pricing and product information without authorization — not to mention 53,000 customer account takeover attempts, 136,000 denial of […]

IBM spin-off Kyndryl and SAP team up on digital transformation (Silicon Republic) Together, Kyndryl and SAP will use their expertise to help businesses embrace new tech and accelerate the move to the cloud.

iatricSystems, Inc Achieves Cybersecurity Transparent Status from KLAS (PRWeb) iatricSystems Inc., a healthcare technology company committed to helping healthcare organizations better protect patients, connect systems, and optimize

Trend Micro Unites Industry With Most Powerful and Complete Security Platform (PR Newswire) Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, announced the launch of Trend Micro One, a unified...

Technologies, Techniques, and Standards

Finland wins NATO cyber defense competition (C4ISRNet) The multi-day event is typically conducted under intense conditions, simulating a spreading crisis that ropes in the military and civilian worlds and the public and private sectors.

CISA expands cyber collaboration to include GE, Siemens (Becker's Hospital Review) The Cybersecurity and Infrastructure Security Agency expanded the Joint Cyber Defense Collaborative to include GE and Siemens.

Motorola Launches Cyber Threat Information Sharing Hub for Public Safety (SecurityWeek) Motorola Solutions announces the Public Safety Threat Alliance, a cyber threat intelligence sharing hub for the public safety community.

What is Motorola Solutions cyber threat organisation? (Technology) Motorola Solutions Public Safety Threat Alliance has been created as a services hub for information sharing and threat intelligence collaboration

How to Make Your MSP Stand Out as a Cybersecurity Leader (Vade Secure) Establishing your MSP as a leader in cybersecurity will better position you to acquire new business and put your clients at ease.

Combatting a BlackCat Ransomware Active Directory Attack (Semperis) The FBI has released recommended mitigations for BlackCat/ALPHV ransomware. Discover potential next steps in "Combatting a BlackCat Ransomware Active Directory Attack".

“Hack DHS” Program Successfully Concludes First Bug Bounty Program (US Department of Homeland Security) DHS announced the results of its first bug bounty program. Through the “Hack DHS” program, vetted cybersecurity researchers and ethical hackers are invited to identify potential cybersecurity vulnerabilities in select external DHS systems. In the first phase of this program, more than 450 vetted security researchers identified 122 vulnerabilities, of which 27 were determined to be critical. DHS awarded a total of $125,600 to participants for identifying these verified vulnerabilities.

First phase of 'Hack DHS' finds over 120 vulnerabilities (The Record by Recorded Future) The initial leg of the Homeland Security Department’s first-ever bug bounty program uncovered more than 120 cybersecurity vulnerabilities in some of its external systems, the agency announced on Friday.

'Hack DHS' bug hunters find 122 security flaws in DHS systems (BleepingComputer) The Department of Homeland Security (DHS) today revealed that bug bounty hunters enrolled in its 'Hack DHS' bug bounty program have found 122 security vulnerabilities in external DHS systems, 27 of them rated critical severity.

Skeletons in the Closet: Security 101 Takes a Backseat to 0-days (Threatpost) Nate Warfield, CTO at Prevailion, discusses the dangers of focusing on zero-day security vulnerabilities, and how security teams are being distracted from the day-to-day work that prevents most breaches.

An introduction to binary diffing for ethical hackers (SearchSecurity) Learn how to get started with binary diffing practices and tools in this excerpt from 'Gray Hat Hacking: The Ethical Hacker's Handbook, Sixth Edition.'

Design and Innovation

Biometrics’ potential on feature phones and data privacy threats illustrate AI reward and risk | Biometric Update (Biometric Update |) The potential for feature phones to act as remote biometric capture devices to open up new markets is enormous. Biometric data privacy violations continue.

Research and Development

US govt grants academics $12M to develop cyberattack defense tools (BleepingComputer) The US Department of Energy (DOE) has announced that it will provide $12 million in funding to six university teams to develop defense and mitigation tools to protect US energy delivery systems from cyberattacks.

Academia

NJCU Announces International Academic Partnership with Caucasus University in the Republic of Georgia (New Jersey City University) New Jersey City University (NJCU) has announced it has entered into an innovative international academic partnership with Caucasus University (CU) in the Republic of Georgia to offer students the ability to complete a 1+1+1 bachelor’s degree in cybersecurity.

The Citadel Dept. of Defense Cyber Institute cadets and faculty mentors earn two of three awards at first joint SMC event (The Citadel Today) Cyberspace is a battlefield and the adversary is always out there. We need you defending our country in the cyber environment.

Cybersecurity contest pits students against ransomware attackers (San Antonio Report) The largest college cybersecurity competition in the country took place in San Antonio this week, as ransomware attacks continue to rise.

WCSU Pioneers New M.S. in Homeland Security Degree Program (Naugatuck, CT Patch) One of your neighbors posted in Schools. Click through to read what they have to say. (The views expressed in this post are the author’s own.)

Texas A&M Central Texas launches new lab focused on cybersecurity (KXXV) Technology is embedded into everything we do these days, so it's important to protect it. Over at Texas A&M Central Texas, thanks to some state and university funding, the university is launching a state-of-the-art cybersecurity lab.

Legislation, Policy, and Regulation

India, UK commit to open, peaceful cyberspace partnership for vision 2030 (Business Standard) India and the United Kingdom said that they will work in partnership to increase their mutual cyber resilience, taking a holistic and whole-of-society approach

Britain, India join hands against threats on ‘land, sea, air, cyberspace’ (DAWN) Johnson says New Delhi’s position on Russia not going to change, Ukraine war could last until end of 2023...

India and UK Will Work in Partnership to Increase Their Mutual Cyber Resilience (News18) India and UK Will Work in Partnership to Increase Their Mutual Cyber Resilience

iTWire - European Union agrees on laws to crack down on digital companies (IT Wire) The European Parliament has reached a political agreement that will provide a transparent and safe online environment for its 27 member nations. In a statement, the 705-member body, one of three legislative bodies of the European Union, outlined the benefits of the agreement which is known as the Di...

New EU law will force Big Tech to regulate online content - update (Computing) The European Union has agreed the final form of the Digital Services Act, placing unprecedented restrictions on online content.

Google, Meta, and others will have to explain their algorithms under new EU legislation (The Verge) The EU’s new legislation is designed to explain the web to users

Report reveals how Big Tech lobbied to weaken EU rules (TechCrunch) A new report has peeled back the curtain on big tech’s frenzied lobbying of European Union lawmakers as they finalize a major series of updates to the bloc’s digital rulebook. It reveals some of the arguments used by tech giants including Apple, Amazon, Google, Meta (Facebook) and Spoti…

As Europe Approves New Tech Laws, the U.S. Falls Further Behind (New York Times) Federal privacy bills, security legislation and antitrust laws to address the power of the tech giants have all failed to advance in Congress, despite hand wringing and shows of bipartisan support.

Ottawa faces blowback for plan to regulate internet (The Globe and Mail) Twitter Canada called Ottawa’s proposal similar to actions employed by authoritarian states, documents reveal

Data breach reporting system up and running (BusinessWorld Online) THE NATIONAL Privacy Commission (NPC) said it has launched a reporting system for data breaches that facilitates notifications in instances where data has been compromised.

House Bill Aims to Tackle Potential Quantum Security Risk (Executive Gov) A bipartisan bill introduced by three House lawmakers calls for the federal government to develop a strategy to incorporate quantum-resistant algorithms and encryption tools into agency information technology systems.

How to develop the cyber warfare leaders the military needs (Federal News Network) The armed services need to expend their numbers of high-ranking cybersecurity and cyber warfare officers.

State Department hiring 50 data scientists to meet ‘increasing demand’ for their skills (Federal News Network) Bureaus and offices across the State Department are looking for data scientists to join their ranks and lead several major projects under the agency's new data strategy.

FRANCE : DGSE juggles between its Paris headquarters (Intelligence Online) France's external intelligence service has an envelope of €889m this year to build its future headquarters at the Fort of Vincennes, on the outskirts of Paris. In the meantime it is cosying up to the

CISA names former DNC official as a senior advisor (The Record by Recorded Future) The Cybersecurity and Infrastructure Security Agency announced Monday that Bob Lord, a digital security veteran, would join the organization as a senior technical advisor.

Litigation, Investigation, and Law Enforcement

U.S. hasn’t stopped N. Korean gang from laundering its crypto haul (Washington Post) Despite U.S. law enforcement identifying the Lazarus Group as the thieves, the hackers have laundered 17 percent of their $600 million haul

Spain's ombudsman to probe alleged cyber spying of Catalan figures (Reuters) Spain's ombudsman said on Sunday it would investigate the government's alleged spying of Catalan separatist figures during the height of the region's bid for independence, while the government announced a separate inquiry by its CNI intelligence agency.

‘Democracies don't spy on citizens’: Catalan leader infected with Pegasus speaks out (Haaretz) Catalonia's Regional President Pere Aragonès, who was reportedly infected by Israeli NSO's Pegasus spyware, tells Haaretz that he places the blame on the Spanish government, and warns of dire consequences for democracy.

Catalan chief accuses Spain's intelligence agency of hacking (AP NEWS) The head of Catalonia's regional government is accusing Spain's intelligence agency of conducting what he calls “massive political espionage” on the northeastern region's independence movement and says that relations with Spain's national authorities are “on hold" as a consequence.

Binance freezes stolen Axie Infinity crypto after North Korean hackers move funds (The Record by Recorded Future) Binance CEO Changpeng Zhao said the cryptocurrency platform has frozen $5.8 million in funds that were stolen from Axie Infinity by cybercriminals connected to the North Korean government.

Special Report: How crypto giant Binance built ties to a Russian FSB-linked agency (Reuters) In April 2021, Russia's financial intelligence unit met in Moscow with the regional head of Binance, the world's largest crypto exchange. The Russians wanted Binance to agree to hand over client data, including names and addresses, to help them fight crime, according to text messages the company official sent to a business associate.

A $3 Billion Silk Road Seizure Will Erase Ross Ulbricht's Debt (Wired) In a twist, a massive trove of stolen bitcoins will repay the dark web market creator's $183 million restitution.

Seized Silk Road Bitcoin to Clear Ross Ulbricht's $183M Debt (CoinDesk) A court filing reveals that bitcoin seized in 2020 will be used to repay the Silk Road founder's debt to the U.S. government.

Kronos cyber attack sparks lawsuits against employers (BenefitsPRO) This latest crop of lawsuits shows how third-party cybersecurity breaches can lead to problems for the companies that use those products or services.

Class-Action Lawsuit Filed Against Intuit for Trezor Phishing Scam (BeInCrypto) A class-action lawsuit has been filed against Intuit for the Trezor phishing scam that occurred back in April.

20 of the Biggest Cryptocurrency Scams of the Past Year (24 7 Wall Street) Cryptocurrencies have an air of being 100% secure. Yet the past year was full of hacks and scams resulting in billions of dollars worth of cryptos lost. Mostly, the large hacks have to do with the systems that help users transact, such as decentralized finance, or DeFi, platforms, many of them barely one to two-years-old. […]

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Global Cyber Innovation Summit (Baltimore, Maryland, United States, Apr 27 - 28, 2022) The Global Cyber Innovation Summit brings together a preeminent group of leading Global 2000 CISO executives, cyber technology innovators, policy thought leaders, and members of the cyber investment community to catalyze the industry into creating more effective cyber defenses. This unique, invitation-only forum will foster a dynamic exchange of ideas, discussion and collaboration designed to drive true innovation in the efficiency and effectiveness of global cyber security strategies and solutions. CARPE COMMINATIONE. The Global Cyber Innovation Summit is an invitation-only event.

National Cyber Summit (Huntsville, Alabama, USA, Sep 21 - 22, 2022) National Cyber Summit is the nation’s most innovative cyber security-technology event, offering unique educational, collaborative and workforce development opportunities for industry visionaries and rising leaders. NCS offers more value than similar cyber conferences with diverse focus-areas, premier speakers, and unmatched accessibility. Our core focus is on three things: education, collaboration and innovation.

Events

The Canadian Oil & Gas Industry Conference: The New Cyber Threat (Virtual, Apr 26, 2022) Cyber attacks hit the energy sector at nearly double the rate they hit other industries. The threat has risen with the increased risk of Russian action. This conference's agenda will address: Setting the Stage; An industry perspective; Best practices by an industry leader; and Next Steps – Defending against the Unknown. It will include a roundtable discussion and summary closing remarks.

Cyber Security for Critical Assets APAC Summit (Singapore, Apr 26 - 27, 2022) CS4CA APAC unites IT & OT security leaders online to network, learn and collaborate towards cyber resilience by exchanging first-hand expert information and joining forces in addressing common concerns. Senior experts share first-hand insights through real-life case studies, panel debates, and keynote presentations, while bringing forth urgent topics to be discussed over roundtables and networking breaks.

ICSJWG 2022 Spring Virtual Meeting (Virtual, Apr 26 - 27, 2022) The Industrial Control Systems Joint Working Group (ICSJWG) will hold its Spring 2022 Virtual Meeting April 26–27. ICSJWG meetings facilitate relationship building among critical infrastructure stakeholders and owners/operators of industrial control systems, idea exchanges regarding critical issues affecting industrial control systems (ICS) cybersecurity, and information sharing to reduce the risk to the nation’s industrial control systems. The ICSJWG Spring 2022 Virtual Meeting will feature two full days of presentations, technical workshop presentations, and an ICS Training overview of Cyber-CHAMP©. ICSJWG meetings are open to all who are interested and are free for all attendees.

Back to Basics: Overcoming Uncertain Times with Security Fundamentals (Virtual, Apr 27, 2022) As governments around the world call for increased cyber vigilance following the news of Russia’s invasion of Ukraine, the fundamentals of cybersecurity have never been more important. While prioritizing security can be a challenge during uncertain times, there are simple steps organizations of all sizes can take to prepare for a potential cyberattack. Join Brad Thies, founder and president of BARR Advisory, and Alex Nette, CEO and co-founder of Hive Systems, for a conversation on how to implement fundamental cybersecurity practices that can protect you and your business. This webinar will provide insight on how to navigate through these uncertain times, including a discussion of what organizations need to know about the heightened cyber risks due to the ongoing geopolitical tensions and how to build a business continuity plan.

Versatility 2022 (Santa Clara, California, USA, Apr 27 - 28, 2022) Versatility 2022 includes inspirational keynotes, technical deep dives, and interactive sessions that will give attendees the edge in their daily work and in their careers. We’re arming the new generation of Security and Networking leaders with the most up-to-date knowledge and technical information in the industry. Join cybersecurity visionaries, Versa technical experts, and many of your peers for a packed agenda with more than 10 keynotes and nearly 20 deep-dive educational sessions. You’ll also have plenty of opportunities for networking with your peers and we think you’ll have fun, too.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.