Conti presses Costa Rica. Bluetooth LE proof-of-concept. Making initial access more difficult. Cyber phases of hybrid wars.

Summary

By the CyberWire staff

At a glance.

Conti continues to press Costa Rica.
Bluetooth Low Energy proof-of-concept hack.
Advice on how to make initial access more difficult.
Cyber phases of a hybrid war.
NATO's Article 5 in cyberspace.

Conti's ransomware attack against Costa Rica spreads, in scope and effect.

Reuters reports that the number of Costa Rican organizations affected by Conti's ransomware attack has now grown to twenty-seven. Recently elected President Rodrigo Chaves has said that nine institutions, most of them governmental, were heavily affected, and that the attacks were having an "enormous" impact on foreign trade and tax collection. The governments of Israel, the United States and Spain are all providing Costa Rica with assistance in recovery and remediation, but a lot of work remains to be done.

Conti (and remember, the ransomware gang operates from Russia and with the effective protection of the Russian government) has been crowing large over its malign intentions for the Central American country. “Just pay before it’s too late, your country was destroyed by 2 people, we are determined to overthrow the government by means of a cyberattack, we have already shown you all the strength and power, you have introduced an emergency,” the gang said in a recent online communiqué quoted by Recorded Future. And, by the way, the ransom demand has gone up to $20 million, and (somewhat irrelevantly) US President Biden is a "terrorist." Costa Rica has refused to pay the ransom.

Bluetooth vulnerabilities demonstrated in proof-of-concept.

NCC Group researchers have demonstrated that Bluetooth Low Energy (BLE) systems are vulnerable to link layer relay attack. The news has been generally reported with headlines that point out that crooks could now open and start your Telsa without so much as a by-your-leave, but the problem is more widespread than that. BLE is, NCC Group explains, "the standard protocol used for sharing data between devices that has been adopted by companies for proximity authentication to unlock millions of vehicles, residential smart locks, commercial building access control systems, smartphones, smart watches, laptops and more." It's not the kind of problem that can be resolved with a patch. Rather, NCC Group argues, it's the kind of issue that arises when technologies are extended beyond their intended purposes, and BLE, they say, was never designed for use in critical systems. The researchers offer three recommendations, two for manufacturers, one for users:

"Manufacturers can reduce risk by disabling proximity key functionality when the user’s phone or key fob has been stationary for a while (based on the accelerometer)
"System makers should give customers the option of providing a second factor for authentication, or user presence attestation (e.g., tap an unlock button in an app on the phone)
"Users of affected products should disable passive unlock functionality that does not require explicit user approval, or disable Bluetooth on mobile devices when it’s not needed"

CISA and its international partners urge following best practices to prevent threat actors from gaining initial access.

The US Cybersecurity and Infrastructure Security Agency (CISA) and its partners in Canada, the Netherlands, New Zealand, and the United Kingdom this morning issued Alert (AA22-137A) "Weak Security Controls and Practices Routinely Exploited for Initial Access." The Alert describes "common weak security controls, poor configurations, and poor security practices" that are used for initial access, and it recommends particular attention to seven best practices.

"Control access.
"Harden Credentials.
"Establish centralized log management.
"Use antivirus solutions.
"Employ detection tools.
"Operate services exposed on internet-accessible hosts with secure configurations.
"Keep software updated."

The following sections pertain directly to the cyber phases of Russia's hybrid war against Ukraine. CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

An assessment of the current Russian cyber threat.

An op-ed by Akamai in CSO warns that "the cyberwar against pro-Ukrainian countries is real," and then goes on to describe the nature of those threats. They're the sorts of activity that have been much in evidence recently: Russian-aligned cybercriminal gangs engaged in ransomware, and Russian-aligned hacktivist groups engaged in distributed denial-of-service attacks. The author urges organizations to apply sound best practices to protect themselves. Against ransomware they recommend network segmentation. Against DDoS they recommend "conducting service validations, confirming authorized mitigation service contacts, reviewing and updating runbooks, performing operational readiness drills, and updating your emergency methods of communication."

NATO expansion, and Article 5 in cyberspace.

Sweden this morning joined Finland in formally seeking NATO membership. Prime Minister Magdalena Andersson said Russia’s invasion of Ukraine motivated the decision. “We are leaving one era and moving into another,” the Prime Minister said. “To remain outside of NATO alone, would put Sweden in a very vulnerable position. So the best thing for Sweden’s security and the Swedish people’s security is that we join NATO together with Finland." Turkey is the sole dissenter within NATO to the admission of Finland and Sweden. Ankara is aggrieved, the BBC reports, by what it perceives as the two Nordic countries' support for Kurdish separatists. All current NATO members must agree to the admission of a new member, and thus continuing Turkish objections would amount to a veto on membership.

With a hybrid war in progress and NATO directly adjacent to that war's active theater of operations, the European Leadership Network has published an essay that argues for greater clarity in how the Atlantic Alliance will execute its commitment to collective defense when the attack comes in cyberspace. The authors offer five recommendations:

"In the event of adversarial cyberspace actions warranting Article 5 action, the NATO Commander becomes the commander and coordinator for all cyberspace activities, both defensive and offensive, by NATO nations within the area of hostilities.
"NATO identifies, establishes, prioritises, and continually refines critical infrastructure and key resources within member nations, as well as criteria for what constitutes necessary action for collective responses.
"NATO identifies limits of activity, or 'red lines' resulting in Article 5 response discussions.
"NATO members present the NATO Commander intelligence identifying indications, warnings, and attribution of cyberspace attacks, both for response action and, where applicable, public consumption.
"NATO members present legal constraints and capabilities of nations to the NATO commander allowing maximisation of nations’ capacity and capability."

Dateline

Ukraine at D+82: Micromanagement and failed military reform. (The CyberWire) Ukraine winds up its resistance in Mariupol, but it amounts to a Pyrrhic victory for Russia as its military failures continue in the Donbas. The cyber phase of the hybrid war remains characterized by politically aligned cybercrime and nuisance-level hacktivism. As Sweden and Finland formally apply for NATO membership, scholars consider the meaning of Article 5 in cyberspace.

AP PHOTOS: 10 weeks in Ukraine, making images hard to forget (AP NEWS) The bodies of Russian soldiers, some horribly disfigured. Relatives weeping over the dead, some killed because they were in the wrong place at the wrong time. And always, the thousands of Ukrainians fleeing horrific destruction as their cities and villages came under bombardment.

Russia’s invasion of Ukraine: List of key events, day 83 (Al Jazeera) As the Russia-Ukraine war enters its 83rd day, we take a look at the main developments.

What Happened on Day 82 of the War in Ukraine (New York Times) Hundreds of Ukrainian fighters were taken by bus to Russian-controlled territory. Ukraine’s president said the combat mission in the city was over, capping some of the longest, fiercest resistance of the war.

In Ukraine and internationally, scenario darkens for Russia (AP NEWS) Europe pushed Monday to sharpen and expand its response to Russia's invasion of Ukraine, with Sweden poised to follow Finland in seeking membership of NATO and European Union officials working to rescue proposed sanctions that would target Russian oil exports helping the Kremlin finance its war.

Ukraine mounts effort to rescue last fighters at steel mill (AP NEWS) Efforts were underway Tuesday to rescue the last of the defenders inside the Azovstal steel plant in the ruined city of Mariupol after Ukrainian officials said the fighters had “completed their mission” and there was no way to free the plant by military means.

Hundreds of Ukrainian troops evacuated from Mariupol steelworks after 82-day assault (the Guardian) Blow for Ukraine as removal of soldiers, many wounded, suggests city that became symbol of resistance has fallen into Russian hands

Wounded Ukrainian defenders rescued from Mariupol steelworks to be exchanged for captive Russians (The Telegraph) Ukrainian President Volodymyr Zelensky called it a 'difficult day', but said it was 'aimed at saving our country and our people'

Ending weeks of standoff, Russia takes Mariupol but sees setbacks elsewhere (Los Angeles Times) Moscow is scrambling to adjust to a new security picture in Europe brought about by its invasion of Ukraine, where fighting is ravaging the east.

Russia-Ukraine latest news: Kremlin claims 265 'surrender' at Azovstal steelworks (The Telegraph) Russia's defence ministry has said that 265 Ukrainian soldiers, including several dozen wounded, surrendered at the besieged Azovstal steel plant in Ukraine's port city of Mariupol.

Vladimir Putin cannot afford another defeat like Kharkiv (The Telegraph) It is important to remember that Kharkiv was the backup option, and he still wasn't able to take it

Vladimir Putin takes personal control of Russia's faltering Donbas offensive (The Telegraph) The Russian president is reportedly interfering in low-level tactical decisions usually made by much junior figures

Russia Planned a Major Military Overhaul. Ukraine Shows the Result. (New York Times) Russia wanted to build a leaner, more flexible fighting force and eliminate waste, bureaucracy and corruption. But entrenched, Soviet-era practices endure.

‘I look at my government differently’: losses in Ukraine test Russians’ faith (the Guardian) Information about the damage being done in Ukraine is leaking out, and discouraging some of those who used to back the war

Russian strike on Mykolaiv beach bar gives sobering hint at what lies ahead (The Telegraph) Residents brace for same relentless siege as Mariupol, as Kremlin tries once again to capture the Ukrainian port city

A Ukrainian City Under a Violent New Regime (The New Yorker) How the Russian occupation transformed life in Melitopol.

War Crimes Watch: Targeting schools, Russia bombs the future (AP NEWS) As she lay buried under the rubble, her legs broken and eyes blinded by blood and thick clouds of dust, all Inna Levchenko could hear was screams. It was 12:15 p.m. on March 3, and moments earlier a blast had pulverized the school where she’d taught for 30 years.

Russia offers Ukrainians cash to blame Zelensky troops for destroyed homes (Newsweek) Mariupol residents must blame Ukrainian troops and President Zelensky for destroyed housing or killed family members to get the money, a mayoral adviser warned.

Ukraine is now using Russia's own tanks against them (Task & Purpose) Ukraine pulled out the Uno reverse card.

Russian propaganda has reached new depths of insanity (The Telegraph) The Russian media is not just a mouthpiece but an actor within the regime, and currently it is normalising talk of nuclear annihilation

Putin is "seriously ill," potentially terminal, ex-MI6 Russia head says (Newsweek) Former MI6 officer Christopher Steele cited sources in Russia for his claim, but said it's "not clear" how ill Putin is or what illness he has.

Putin and Parkinson's: What experts say about his health (Deutsche Welle) A video released by the Kremlin last weekend shows Putin in seemingly bad health. Some commentators and tabloids claim he has Parkinson's. What do doctors think?

Russian officers killing their own wounded, say captured soldiers in video (Newsweek) "The lieutenant-colonel was walking around," captured Russian soldiers claimed. "He shot four or five like this. They were all young men."

Estonia’s Tough Voice on Ukraine Urges No Compromise With Putin (New York Times) Kaja Kallas, the prime minister, remembers the repression of life under Soviet rule and sees the same brutality in occupied Ukraine, which she believes is fighting for all of Europe.

Western advocates of appeasement need a crash course in Putinology (Atlantic Council) The war in Ukraine has exposed the fundamental failure of international audiences to appreciate the true nature of modern Russia. Western advocates of appeasement clearly need a crash course in Putinology.

Five ways Ukraine's partners can defeat Putin and shape the future (Atlantic Council) It's time for Kyiv and its allies to seize the momentum. Here's how they can do it.

G7 Statement on Russia’s war against Ukraine (GAC) We, the G7 Foreign Ministers of Canada, France, Germany, Italy, Japan, the United Kingdom, the United States of America, and the High Representative of the European Union, are steadfast in our solidarity with and our support for Ukraine as it defends itself against Russia’s unjustifiable, unprovoked and illegal war of aggression, a war in which Belarus is complicit. We are committed to helping Ukraine, a democracy and a UN member, uphold its sovereignty and territorial integrity, to defend itself and resist future attacks or coercion, choose its own future and prosper.

Once neutral Sweden seeks NATO membership in historic shift (Defense News) Sweden will follow neighboring Finland and apply for NATO membership because of Russia’s invasion of Ukraine, ending more than 200 years of military nonalignment in the Nordic nation.

Vladimir Putin threatens ‘response’ if Nato military infrastructure deployed on Nordic soil (The Telegraph) Russian president draws a line on missile systems as Sweden follows Finland in applying to join the alliance

Turkey objects as Sweden, Finland seek NATO membership (AP NEWS) Turkey´s president on Monday complicated Sweden and Finland´s historic bid to join NATO, saying he cannot allow them to become members of the alliance because of their perceived inaction against exiled Kurdish militants.

Why Turkey dissents on Finland and Sweden joining NATO and why it matters (Washington Post) Finnish and Swedish officials have declared in recent days their intention to join NATO, citing Russia’s invasion of Ukraine. But their acceptance to the alliance requires unanimous consent among members, and the leader of one such state — President Recep Tayyip Erdogan of Turkey — has voiced hesitation about the two nations.

Collective cyber defence and attack: NATO’s Article 5 after the Ukraine conflict (European Leadership Network) The cyber side of conflict has become a prominent topic in recent years, and Russia's invasion of Ukraine has made the discussion of this topic all the more relevant. In this commentary, Michael Klipstein and Tinatin Japaridze argue that NATO should consider and create policy for collective cyber defence, and potentially offense, under Article 5 of the NATO Charter.

The Cyberwar Against Pro-Ukrainian Countries is Real. Here’s What to Do (CSO Online) Strong foundational controls are critical to protect your organization from attacks.

Europe Is Stumbling Through a ‘Worldmaking’ Moment (World Politics Review) The war in Ukraine continues to dominate the attention of policymakers and pundits in Europe and the U.S. But if it has returned clarity and purpose to Europe as a pillar of the West, it has so far triggered little thought to the long-term consequences for the global order as well as Europe’s role in it.

Biden administration can’t overlook the Balkans when sanctioning Russia (The Hill) The Kremlin and its supporters are scouring the globe for jurisdictions to use to evade sanctions.

The Right Way to Sanction Russian Energy (Foreign Affairs) How to slash Moscow’s revenues without crippling the global economy.

EU's Russia sanctions effort slows over oil dependency (AP NEWS) The European Union’s efforts to impose a new round of sanctions against Russia over the war in Ukraine appeared to bog down on Monday, as a small group of countries continued to oppose a ban on Russian oil imports.

De-Arching: McDonald's to sell Russia business, exit country (AP NEWS) McDonald's is closing its doors in Russia, ending an era of optimism and increasing the country's isolation over its war in Ukraine .

McDonald’s seeks to sell Russian business that is ‘no longer tenable’ (Washington Post) After more than three decades, McDonald’s is pulling out of Russia and seeking to find a “local buyer” for its business there, which includes 850 restaurants in the country.

Attacks, Threats, and Vulnerabilities

Cyber attack on Costa Rica grows as more agencies hit, president says (Reuters) The number of Costa Rican institutions hit in a wave of cyber attacks in the past month has grown to 27, President Rodrigo Chaves said on Monday, in one of the earliest challenges to face the new leader during his first month in office.

Ransomware gang threatens to ‘overthrow’ new Costa Rica government, raises demand to $20 million (The Record by Recorded Future) Conti actors levied several violent charges against Costa Rica this weekend, raising the ransom demand to $20 million and threatening to “overthrow” the government of new President Rodrigo Chaves.

Russian Disinformation Threatens Presidential Elections in Colombia - Diálogo Américas (Diálogo Américas) Colombia remains on alert to the possibility of foreign interference in the May 29 presidential elections. The U.S. and Colombian governments are cooperating to prevent this, Colombia’s Radio Cadena Nacional (RCN) said on April 26. “We are concerned […] about the possible intervention of other countries in the elections. We are working with the government, […]

Third-party web trackers log what you type before submitting (BleepingComputer) An extensive study looking into the top 100k ranking websites has revealed that many are leaking information you enter in the site forms to third-party trackers before you even press submit.

Over 200 Apps on Play Store Caught Spying on Android Users Using Facestealer (The Hacker News) More than 200 Android apps masquerading as fitness, photo editing, and puzzle apps have been caught infecting users' Android devices with spyware.

Hackers can exploit iPhones' low-power mode to run malware even when device is off, researchers warn (Computing) Wireless chips in modern iPhones pose a new threat model

Hacker Shows Off a Way to Unlock Tesla Models, Start Cars (Bloomberg) Method to exploit smart technology tied to Bluetooth protocol. No evidences of thieves using technique to access cars.

NCC Group uncovers Bluetooth Low Energy (BLE) vulnerability that puts millions of cars, mobile devices and locking systems at risk (NCC Group) Our research shows that systems that people rely on to guard their cars, homes and private data are using Bluetooth proximity authentication mechanisms that...

Technical Advisory – Tesla BLE Phone-as-a-Key Passive Entry Vulnerable to Relay Attacks (NCC Group Research) The Tesla Model 3 and Model Y employ a Bluetooth Low Energy (BLE) based passive entry system. This system allows users with an authorized mobile device or key fob within a short range of the vehicle to unlock and operate the vehicle, with no user interaction required on the mobile device or key fob. This system infers proximity of the mobile device or key fob based on signal strength (RSSI) and latency measurements of cryptographic challenge-response operations conducted over BLE.

Technical Advisory – Kwikset/Weiser BLE Proximity Authentication in Kevo Smart Locks Vulnerable to Relay Attacks (NCC Group Research) The Kwikset/Weiser Kevo line of smart locks support Bluetooth Low Energy (BLE) passive entry through their Touch-to-Open functionality. When a user touches the exterior portion of the lock, the lock checks that an authorized BLE device is exterior to and within a short distance of the smart lock, and then performs a cryptographic handshake over a BLE connection to verify the identity of the device

Technical Advisory – BLE Proximity Authentication Vulnerable to Relay Attacks (NCC Group Research) NCC Group has developed a tool for conducting a new type of BLE relay attack operating at the link layer, for which added latency is within the range of normal GATT response timing variation, and which is capable of relaying encrypted link layer communications. This approach can circumvent the existing relay attack mitigations of latency bounding or link layer encryption, and bypass localization defences commonly used against relay attacks that use signal amplification.

Engineering firm Parker discloses data breach after ransomware attack (BleepingComputer) The Parker-Hannifin Corporation announced a data breach exposing employees' personal information after the Conti ransomware gang began publishing allegedly stolen data last month.

Brazilian e-commerce firm Americanas reports multimillion-dollar loss following cyberattack (ZDNet) The company's transactional platforms were unavailable for a week following the incident in February.

Your CEO Doesn't Want Gift Cards: Signs You're Being Scammed (Digital Journal) Mimecast: There is nothing worse than feeling like you've been scammed but having your company scammed hits

AGCO Provides Update on Recovery from Ransomware Cyber Attack (Business Wire) AGCO, Your Agriculture Company (NYSE:AGCO), a worldwide manufacturer and distributor of agricultural equipment and infrastructure, announced today tha

The City of Quincy’s email system expected to be up and running Tuesday after cyber attack last week (WGEM) The City of Quincy is still investigating the cyberattack that disrupted emails and phones last week, halting communication between departments and the community.

CISA Adds Two Known Exploited Vulnerabilities to Catalog (CISA) CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added vulnerabilities in the catalog, click on the arrow on the of the "Date Added to Catalog" column, which will sort by descending dates.

Bulletin (SB22-136) Vulnerability Summary for the Week of May 9, 2022 (CISA) The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

Security Patches, Mitigations, and Software Updates

CISA warns not to install May Windows updates on domain controllers (BleepingComputer) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has removed a Windows security flaw from its catalog of known exploited vulnerabilities due to Active Directory (AD) authentication issues caused by the May 2022 updates that patch it.

Apache Releases Security Advisory for Tomcat (CISA) The Apache Software Foundation has released a security advisory to address a vulnerability in multiple versions of Tomcat. An attacker could exploit this vulnerability to obtain sensitive information. CISA encourages users and administrators to review Apache’s security advisory and apply the necessary updates.

Trends

China has released its list of top five sources of online fraud in 2022 (Business Insider) Brushing, false investment and money management are top online fraud types in China. The list was released by China’s Ministry of Public Security. India witnessed

Fifth of Businesses Say Cyber-Attack Nearly Broke Them (Infosecurity Magazine) Attacks surge 12% in 2021, according to insurer

Europeans users' data shared with advertisers 376 times per day (Computing) Real-time bidding is the 'biggest data breach ever recorded,' says ICCL

Proofpoint’s 2022 Voice of the CISO Report Reveals Half of Global CISOs Feel Unprepared to Cope with a Cyber Attack, Despite Growing Confidence in their Security Posture (Proofpoint) Proofpoint, Inc., a leading cybersecurity and compliance company, today released its annual Voice of the CISO report, which explores key challenges facing chief information security officers (CISOs). While the world’s CISOs spent 2021 coming to terms with new ways of working, many now feel much more in control of their environment: 48% feel that their organization is at risk of suffering a material cyber attack in the next 12 months, down from 64% last year.

Second Annual Voice of the CISO Report Reveals Continued Challenges, Despite Growing Confidence in Global CISOs’ Security Posture (Proofpoint) More than two years into the COVID-19 pandemic, organizations have adapted to their new normal. But for CISOs, 2021 was another challenging year as many disruptive, large-scale attacks kept organizations on high alert. And just as the chaos of the pandemic dissipated, new events—including the Great Resignation and geopolitical tensions in Europe—added to CISOs' already significant stress levels.

Marketplace

Investment firm Carlyle to buy ManTech in $4.2B deal (Defense News) The acquisition, if approved by shareholders and the government, is expected to be completed later this year.

Pathlock Secures $200M; Completes Merger with Appsian and Security Weaver (PR Newswire) Pathlock, the leading provider of access governance solutions for business applications, today announced a merger with Appsian, the leading...

French group Thales buys two cybersecurity firms (Reuters) France's Thales said on Tuesday it had struck a deal with Sonae Investment Management to acquire two European cybersecurity companies, S21sec and Excellium, for an enterprise value of 120 million euros ($125.32 million)

Thales signs an agreement with Sonae Investment Management to acquire S21sec and Excellium, reinforcing its cybersecurity activities (Thales Group) Thales (Euronext Paris: HO) announces today the signature of a definitive agreement with Sonae Investment Management to acquire two of European leading cybersecurity companies, S21sec and Excellium, gathered under the holding company Maxive Cybersecurity.

Ballistic Ventures Announces $300 Million Debut Fund to Fuel Entrepreneurs in Global Cybersecurity Fight (Business Wire) Ballistic Ventures, a new venture capital firm dedicated exclusively to funding and incubating entrepreneurs and innovations in cybersecurity, today a

Pangea Cyber Secures $25M Series A to Launch API-based Cloud Security Services for Application Builders (Business Wire) Pangea Cyber Corporation today emerged from stealth to announce $25M in Series A funding to become the first company to offer application builders a c

Imply Announces $100M Investment Led by Thoma Bravo to Drive the Market Shift to Modern Analytics Applications (Business Wire) Imply Data, Inc., the company founded by the original creators of Apache Druid, today announced its $100 million Series D financing, which values the

Navy Exercises $231M Option on Multiple-Award Cyberspace Operations Support Contract (GovCon Wire) Looking for the latest GovCon News? Check out our story: Navy Awards $231M Cyber Technical Support Contract Option to 8 Vendors. Click to read more!

Quantum Computing Gains Momentum (Crunchbase News) The promise of quantum computing has swirled for decades, but as it gets closer to reality more investors, the government and several industries seem to be taking note.

Finalists: Early-Stage Investor of the Year (SC Magazine) The best ideas will wither on the vine without adequate funding to get them off the ground.

Kaspersky Channel Vet Joins Cyware, a Threat Intelligence Provider (Channel Futures) Kaspersky's North America channel chief has vacated that role to lead North America channel at Cyware, a threat intelligence provider.

Manu Heirbaut Joins Datadobi as Company’s Vice President of Engineering (Datadobi) Announcing the appointment of Manu Heirbaut as the company’s Vice President of Engineering. Heirbaut takes over the role from Datadobi Chief Architect and co-founder Kim Marivoet to allow Marivoet to focus 100% on architecting the future products of unstructured data management that enterprises urgently need.

Blackpoint Cyber Welcomes Christine Gassman, Director of Channel Engagement (Business Wire) Blackpoint Cyber, a leading technology-focused cybersecurity company, appointed Christine Gassman as Director of Channel Engagement to lead and expand

Query.AI Appoints Jeremy Fisher as Chief Technology Officer (Query.AI) Respected senior technology executive tapped to lead technical strategy and execution as the disruptive startup accelerates product development and innovation efforts BROOKINGS, S.D. – May 17, 2022 – Query.AI, the provider of the market’s only security investigations control plane for modern enterprises, today the appointment of Jeremy Fisher as chief technology officer (CTO). Fisher joins Query.AI with […]

Products, Services, and Solutions

Rezilion launches Dynamic SBOM for software supply chain devsecops (CSO Online) Rezilion’s new Dynamic SBOM (software bill of materials) works with its devsecops platform and is designed to help security teams understand how software components are being executed in runtime.

Palo Alto Networks and Deloitte Deepen Strategic Alliance Into Managed Security Services (PR Newswire) Palo Alto Networks (NASDAQ: PANW) and Deloitte today announced the expansion of their existing strategic alliance to offer managed security...

ThreatQuotient Selected By Comcast To Support Cybersecurity Operations (Business Wire) ThreatQuotient announced that Comcast has selected the ThreatQ Platform and ThreatQ Investigations to meet its cybersecurity operations needs.

Armis Launches ‘Critical Infrastructure Protection Program’ with Three Months of Complimentary Service to Support SHIELDS UP Initiative (Armis) Under this new program, critical infrastructure providers in the U.S. and NATO-aligned countries will have complimentary access to the Armis platform for three months. Helping organizations supplying systemically important entities such as energy, water, marine ports, and wastewater pinpoint and fortify assets in need of urgent security improvements.

Qualys Adds Custom Assessment and Remediation to its Cloud Platform (PR Newswire) Qualys, Inc. (NASDAQ: QLYS), a pioneer and leading provider of disruptive cloud-based IT, security and compliance solutions, today unveiled...

Syxsense Joins Microsoft Active Protections Program (MAPP) Expanding Company’s Threat Intelligence Capabilities (Business Wire) Syxsense, a global leader in IT and security management solutions, today announced it has joined an elite group of cybersecurity software providers pa

Omada Introduces Connectivity Community to Democratize Connectivity (PR Newswire) Omada A/S ("Omada"), a global leader of Identity Governance and Administration (IGA), announced today that it has introduced the Omada...

Favendo, Abeeway and Actility Release a Custom-fit Hybrid RTLS Solution (Actility) Actility, Abeeway & Favendo announce the release of a new joint IoT tracking Evaluation Kit that offers a complete location solution.

Technologies, Techniques, and Standards

NSA Cyber Chief Vows 'No Backdoors' in Quantum Encryption Standards (Dark Reading) New quantum encryption standards will stand up to spy-snooping, NSA cybersecurity director said.

Cybersecurity for IoT: The Road We’ve Traveled, The Road Ahead (NIST) The NIST Cybersecurity for IoT program published Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks (

The downside of ‘debugging’ ransomware (WeLiveSecurity) The decision to release a ransomware decryptor is a balancing act between helping victims recover their data and alerting crooks to errors in their code.

Recovering from a cybersecurity earthquake: The lessons organizations must learn (Help Net Security) It’s been over a year since the SolarWinds supply chain hack, but this cybersecurity earthquake is by no means over.

Research and Development

Cobalt Iron Receives European Patent for Dynamic Authorization Control That Automatically Responds to Threats and Events (Cobalt Iron) Cobalt Iron Inc., a leading provider of SaaS-based enterprise data protection, today announced that it has been granted a European patent on its technology for dynamic authorization control based on conditions and events.

Academia

Coast Guard graduates first class of cyber majors (FCW) A "handful" of newly minted cyber specialists will go to the Coast Guard’s Cyber Command headquarters for their initial assignment, the service's chief told Congress last week.

Using gamification to improve cybersecurity awareness (Singapore Management University) Team CISA – comprising students Sheena Loo, Huang Ching Wen, Manikandan Isha and Angela Lorenza Tjandra from the School of Computing and Information Systems - has emerged first runner-up at an international IT competition organised by Hilti, a multinational company that offers premium products and services for professionals on construction sites around the globe.

S.C. State University students to get training with IBM in cybersecurity (ABC Columbia) A Midlands University could play a prominent role in training students in security in the digital age

IBM funding new cybersecurity center at Southern University (Baton Rouge Business Report) Six historically Black universities will be getting the first IBM cybersecurity centers aimed at training underrepresented communities,

Legislation, Policy, and Regulation

Building a secure world (Google) The following is adapted from remarks delivered by Royal Hansen, Vice President of Privacy, Safety and Security during his keynote United in Cyberpower: The Role of Companies in Building a Cybersecure World at Cybersec Europe 2022 in Katowice, Poland.

China's cyber espionage focus: intellectual property theft (CSO Online) The recently uncovered Operation CuckooBees campaign shows how serious China is about using IP theft as a competitive advantage. Protect IP now or chase it later.

Europe moves closer to stricter cybersecurity standards (Register) More types of biz fall under expanded rules – and fines for those who fall short

2022 Civil Nuclear Cyber Security Strategy (Department for Business, Energy, and Industrial Strategy) As the Minister for Energy, Clean Growth and Climate Change, I am delighted to present the 2022 Civil Nuclear Cyber Security Strategy, which sets out an ambitious vision and five year roadmap of activities for the UK’s civil nuclear sector.

UK updates strategy to harden nuclear sector from cyberattacks (The Record by Recorded Future) The UK on Friday released new plans to address the cyber risks to the country’s civil nuclear sector as the government helps orchestrate a shift towards net-zero carbon emissions.

Bill introduced calls upon CISA to develop standards, recommendations to safeguard commercial satellite industry (Industrial Cyber) New bill introduced calls upon CISA to develop standards and recommendations to safeguard the commercial satellite industry.

The US federal cybersecurity bureaucracy: A guide (CSO Online) A high-level look at the national offices and organizations involved in protecting the US from cyber threats.

Is Energy’s decision not to name a political appointee to oversee cyber a mistake? (Federal News Network) Former officials call the Energy Department’s decision not to name a political appointee to lead its Office of Cybersecurity, Energy Security and Emergency Response (CESER) a mistake.

New York Lawmakers Pass Grid Cyber Defense Legislation (GovTech) The recently passed legislation would take steps to regulate the state's energy companies ensuring that they improve their cybersecurity practices to avoid cyber attacks that could impact the electric grid.

Litigation, Investigation, and Law Enforcement

Buffalo gunman laid out plans online weeks before shooting (The Hill) A document posted online by the suspected shooter in the Buffalo supermarket massacre detailed his initial plans weeks before the shooting. According to a document obtained by the Washington …

Livestreamed carnage: Tech's hard lessons from mass killings (AP NEWS) These days, mass shooters like the one now held in the Buffalo, N.Y., supermarket attack don’t stop with planning out their brutal attacks. They also create marketing plans while arranging to livestream their massacres on social platforms in hopes of fomenting more violence.

Buffalo suspect may be latest mass shooter motivated by ‘eco-fascism’ (the Guardian) Buffalo suspect allegedly calls himself ‘eco-fascist’ and blames migration for harm to the environment in document posted online

Hacker and Ransomware Designer Charged for Use and Sale of Ransomware, and Profit Sharing Arrangements with Cybercriminals (U.S. Attorney’s Office for the Eastern District of New York) A criminal complaint was unsealed today in federal court in Brooklyn, New York, charging Moises Luis Zagala Gonzalez (Zagala), also known as “Nosophoros,” “Aesculapius” and “Nebuchadnezzar,” a citizen of France and Venezuela who resides in Venezuela, with attempted computer intrusions and conspiracy to commit computer intrusions. The charges stem from Zagala’s use and sale of ransomware, as well as his extensive support of, and profit sharing arrangements with, the cybercriminals who used his ransomware programs.

US prosecutors allege Venezuelan doctor is ransomware mastermind (ZDNet) Justice Department officials claim the doctor is behind notorious ransomware including Jigsaw and Thanos.

'Multi-tasking doctor' was mastermind behind 'Thanos' ransomware builder, DOJ says (The Record by Recorded Future) Luis Zagala Gonzalez, a cardiologist, not only created Thanos but also showed cybercriminals how to organize their efforts, the DOJ says.

U.S. Charges Venezuelan Doctor for Using and Selling Thanos Ransomware (The Hacker News) U.S. Department of Justice accuses a 55-year-old cardiologist from Venezuela of being the mastermind behind the Thanos ransomware.

Court dismisses cyber libel charges against Nordis editor, reporter (RAPPLER) Nordis, NUJP welcome ruling and urge officials to 'stop blaming the media whenever they receive flak for their irresponsible statements'

Clearview AI CEO: Settlement could be a template for others, won’t materially change business (The Record by Recorded Future) “We're very happy to reach a settlement and then move on,” Hoan Ton-That told the Click Here podcast and The Record in an interview.

Trial of Clinton Lawyer Michael Sussmann Puts Spotlight on a Veteran Tech Executive (Wall Street Journal) Federal prosecutors are probing Rodney Joffe’s role in 2016 research that pointed to unsubstantiated ties between Donald Trump’s company and a Russian bank.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Georgetown University Master's in Cybersecurity Risk Management (Virtual, Jun 7, 2022) The Master's in Cybersecurity Risk Management from Georgetown University prepares you to develop and execute integrated strategies, policies, and safeguards to manage cybersecurity risks across an enterprise. Join our webinar on June 7 to learn more.

Events

(Virtual, May 9 - 23, 2022) What does it take to be the best cyber defense team in the world? Being the best is about a lot more than just saying you are the best; it's about proving it. The International Cyber League (ICL) was formed to put your incident response skills to the test against simulated attackers. What you need to know: Teams are comprised of 3 SOC or IR team members from the same organization (one team captain and two teammates). They will face a series of complex cyber labs and challenging live-fire, cyber-attack scenarios. Three rounds will determine which team is The World's Best Defensive Cyber Team!

AppSecCon 2022 (Virtual, May 18 - 19, 2022) The World's largest AppSec Conference provides a multi-perspective experience for thousands of virtual attendees. The event is focused on solving the industry's most pressing concerns, sharing ideas and best practices and highlighting unique case studies from trusted leaders. AppSecCon 2022 will feature some of the biggest name speakers in the industry. Additionally, the event will officially launch The Purple Book, an open source best practice guide developed by 29 top security leaders including executives from startups to leading Fortune 500 companies.

Enterprise Security Operations: Needs, Challenges, and Opportunities (Virtual, May 19, 2022) Gain valuable insights on the state of security operations center (SOC) implementations and core pillars of “SOC” capability. Explore the challenges in building an effective “SOC” to identify, investigate and respond to growing cybersecurity incidents, risks, challenges and opportunities. Discover how to quickly and cost-effectively implement SOCs through the use of automation (SOAR) and shared/outsourced services. Featuring keynote speaker Col. Neil Khatod, the Director of G36 (U.S. Army Cyber Command), along with panelists from the U.S. Patent and Trademark Office, Carnegie Mellon University’s Software Engineering Institute and more.

Secutech India (Mumbai, India, May 19 - 21, 2022) Secutech India, India’s leading security business event will mark its return in 2022 re-uniting the security industry from 19 – 21 May at the Bombay Exhibition Centre in Mumbai. As the first edition post-lockdown, the platform will spotlight the latest security technologies, trends and innovations as well as the post-pandemic response of the industry that are shaping product developments in India’s physical security, cyber security, fire & safety, smart home & automation markets.

Community College Cyber Summit (3CS) (Dayton, Ohio, USA, May 23 - 25, 2022) The 2022 Community College Cyber Summit (3CS) at Sinclair Community College marks the 8th annual edition of 3CS. 3CS provides a forum for higher education faculty and administrators, as well as various partners and sponsors to share new initiatives, demonstrate techniques and tactics, and showcase effective programs and practices. This summit will expand your mind to the development of new programs, program components, labs, courses, practices, and methods of instruction within the NIST/NICE Cybersecurity Workforce Framework.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.