Facing a costly and time-consuming app modernization project? Don't worry, you're not alone. Join industry leaders from Fortune 500 organizations like Kroger, to secure your apps on any cloud with any IDP no matter how complex your environment is. We call this Identity Orchestration. The best part? You’ll eliminate the need to refactor apps and say goodbye to legacy tech debt. Try it for free today to experience no-code identity modernization.
We're always looking for ways to improve the CyberWire, now N2K Cyber Network, to give you an intelligence-driven news experience that saves you time and keeps you in the know on the latest developments in cybersecurity. Please share your feedback in our 2023 Audience Survey and you will have a chance to win a $100 Amazon gift card. Take the survey.
Progress Software on Wednesday disclosed a critical vulnerability in its MOVEit Transfer managed file transfer software. Researchers at Rapid7 say they’ve observed exploitation of the vulnerability before it was disclosed, and these attacks have increased since its disclosure. The researchers note, “Our teams have so far observed the same webshell name in multiple customer environments, which may indicate automated exploitation.” BleepingComputer reports that attackers are exploiting the vulnerability “to perform mass downloading of data from organizations.” Reuters quotes Mandiant’s Chief Technology Officer as stating that “Mass exploitation and broad data theft has occurred over the past few days.”
Rapid7 adds, “The MOVEit Transfer advisory has contradictory wording on patch availability, but as of June 1, it does appear that fixed versions of the software are available. Patches should be applied on an emergency basis.”
Progress stated, “[an] SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an un-authenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements. All MOVEit Transfer versions are affected by this vulnerability.”
With 84% of organizations experiencing an identity-related breach, identity is the new battlefield. As the pioneers of privileged access management, we started by protecting the most privileged users and most critical data. With intelligent privilege controls, today we’re applying the same levels of security and protection to every identity – both human and machine. CyberArk offers the most advanced identity security platform in the world, surrounding every identity with a powerful force field of continuous protection.
Researchers at Akamai describe a Magecart-style web skimmer campaign that steals credit card information and personally identifiable information (PII) by exploiting legitimate websites. So far the researchers have identified victims in North America, Central America, and Europe. Akamai writes: “Some victims are estimated to handle hundreds of thousands of visitors per month, potentially putting tens of thousands of shoppers’ PII and credit cards at risk of being stolen and abused or sold on the dark web. Generally, these attacks cannot be detected by popular methods of web security, such as web application firewalls (WAFs), and are executed on the client side. This may result in Magecart attacks remaining unnoticed for long periods.”
The new campaign represents an evolution over its Magecart predecessor. While Magecart typically exploited Magento systems, the criminal activity Akamai describes also afflicts WooCommerce, WordPress, and Shopify, showing, Akamai says, "the growing variety of vulnerabilities and abusable platforms that are available for attackers."
This campaign seems to be a long-term effort that works to conceal itself by setting up C2 nodes in victims’ websites, creating a host by which they can then distribute malware to other secondary retail websites. Some of the deceptive hosting operations involve repeat victims: the researchers say they’ve seen a host abused twice, once in the initial infection and a second time when the threat actors employ their web skimmer. To obfuscate and hide their code the actors have imitating third party services like Google Analytics and Google Tag Manager.
Register now for Mandiant’s mWISE security conference.
Another report on skimmers claims to have identified the individual behind a series of incidents. The hacking outfit XeGroup, active since at least 2013, uses a multitude of tactics, techniques, and procedures (TTPs) in its cybercriminal activity, Menlo Security reports. The gang has been observed having involvement in supply chain attacks that resemble that of Magecart. The gang has also been seen creating fake websites in order to lift personal information, as well as selling data on the dark web.
The Hacker News reports that the gang has been “known to compromise internet-exposed servers with known exploits and monetize the intrusions by installing password theft or credit card skimming code for online services.” One of the identities of an associated hacker has been revealed as Nguyen Huu Tai, seen also going by the names Joe Nguyen and Thanh Nguyen. The researchers assess that it’s “highly likely” that this threat actor is based in Vietnam.
Your prospects are demanding SOC 2 and you're not closing deals without it. Scytale's security compliance automation platform helps companies get compliant and stay compliant with frameworks like SOC 2, ISO 27001, HIPAA, GDPR and PCI-DSS without breaking a sweat.
Save hundreds of hours with streamlined compliance and dedicated support, remain compliant all year round with automated monitoring and alerts, and most importantly, boost sales by providing proof of information security to your customers.
Apple denied working with NSA or any other agency to backdoor its own products in the interest of espionage or surveillance, Reuters reports. In response to FSB charges that Apple had colluded with the US National Security Agency to enable surveillance of Russian iPhone users, Apple said it had "never worked with any government to insert a backdoor into any apple product and never will." TASS reported the FSB's allegations yesterday. "The information obtained by the Russian special services demonstrates close cooperation between Apple and the [US] national intelligence community, in particular the US NSA [National Security Agency], and confirms that Apple’s declared policy of ensuring the privacy of the personal data of users of Apple devices does not correspond to reality.... The company provides US intelligence services with a wide range of opportunities to monitor both anyone of interest to the White House, including their partners in anti-Russian activities, and their own citizens," the FSB said. The FSB's claims have been received with some skepticism. WIRED, for example, characterizes the allegations as "wild."
Meanwhile, Russian cybersecurity firm Kaspersky has observed zero-day exploitation of some of its iPhones (it calls the incident "Operation Triangulation") by an unknown APT using imperfectly understood techniques. Kaspersky doesn't offer any attribution and doesn't allege Apple collusion with the attackers.
The exploit is delivered via iMessage, and is triggered without user interaction. The researchers are still analyzing the final payload, and so far have determined that “[t]he code is run with root privileges, implements a set of commands for collecting system and user information, and can run arbitrary code downloaded as plugin modules from the C&C server.” The company describes the payload as a “fully-featured APT platform.”
Kaspersky says that Operation Triangulation has been in progress since 2019, and that it continues into the present.
Russian cyber auxiliary NoName057(16) has been conducting a distributed denial-of-service (DDoS) and defacement campaign against Lithuanian websites this week. On Monday the group posted on its Telegram page that they would begin attacks against Lithuanian targets in response to the country’s continued support of Ukraine and the decision to classify Russia as a terrorist state. "The war against Ukraine by the Russian Federation is a genocide of the Ukrainian nation carried out by Russia. The Russian Federation is a country that supports and executes terrorism," the Lithuanian government’s statement reads.
NoName claims it has attacked thirty-nine Lithuanian websites since Monday, May 29th. The group this week seems to have focused principally on Lithuania, with a few attacks against Latvia interspersed with its actions against Lithuanian targets. The group’s attacks seem to be randomly dispersed across sectors that include agriculture, financial, and energy.
The US is funding Starlink communications for Ukraine, C4ISRNet reports. Because of the sensitivity of the nature of the services provided, the Department of Defense provided no information on their cost, duration, or coverage. Starlink has over the course of the war provided valuable and resilient connectivity to Ukraine.
The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.
Today's issue includes events affecting Brazil, China, Indonesia, Israel, Moldova, NATO/OTAN, Russia, Slovakia, Singapore, Ukraine, the United Kingdom, and the United States.
Ukraine at D+463: Cross-border raids continue. (CyberWire) Russian missile strikes against Ukrainian cities and intra-Russian fighting around Belgorod continue. Apple denies FSB allegations that it enabled NSA cyberespionage and surveillance.
Russia-Ukraine war: List of key events, day 464 (Al Jazeera) As the war enters its 464th day, here’s a look at the main developments.
Russia-Ukraine war at a glance: what we know on day 464 of the invasion (the Guardian) Kyiv mayor orders air raid shelters to be open 24 hours after death of child; Ukraine claims to have shot down 15 cruise missiles and 21 drones
Anti-Putin partisans shell Russian town four miles from Ukraine border (the Guardian) Governor of Belgorod says attack injured 12 people, in second partisan assault inside Russia in two weeks
As missiles exploded over Kyiv, they raced for a shelter. It was locked. (Washington Post) When the air raid alarm blared across Ukraine’s capital at 2:49 a.m. Thursday, Yaroslav Riabchuk and his wife and daughter rushed outside to find shelter, as they often did, in the nearest basement: a medical clinic in front of their apartment building.
Zelenskiy accuses Kyiv mayor of negligence after civilian deaths (the Guardian) Witness reports say bomb shelter had not been opened in time to prevent deaths of two women and girl
Ukraine takes the war to Russia’s border regions, unnerving Moscow and Washington (Washington Examiner) ‘RUSSIA HAS INCREASINGLY CEDED THE INITIATIVE’: As the beginning of Ukraine's long-awaited counteroffensive grows nearer, cross-border attacks against Russian targets have grown more brazen and have forced Russian commanders to redeploy forces in response.
Russia says cross-border attacks repelled, 30 fighters killed (Al Jazeera) Ahead of an expected Ukrainian counteroffensive, Russia has come under repeated attack in recent days.
Russian War Report: Moscow is on edge after the latest drone attack (Atlantic Council) Drone strikes in Moscow have the Kremlin on high alert. In Georgia, the pro-Russia Prime Minister blamed NATO for Russian invasion of Ukraine.
Ukraine war: Buildings ablaze in Russian town as pro-Ukraine fighters launch attack (The Telegraph) Pro-Ukrainian fighters have “invaded” Russia for the second time in a week, destroying several buildings and causing hundreds of residents to flee.
Putin is plotting a new front in his war on the West (The Telegraph) Russia would like nothing more than to foment unrest in the Balkans, the soft underbelly of Europe
Russian mercenaries exploit African country as they fight in Ukraine (NBC News) “I asked everyone for help. ... Was I supposed to refuse the help from those who wanted to help us?” Central African Republic President Faustin-Archange Touadéra tells NBC News.
In Ukraine, Russia is nearly down to its nukes (The Hill) Sixteen months into the war, Putin and his generals still do not have an answer to Ukraine.
Putin no longer has the money or the kit to sustain a high-tech modern war (The Telegraph) The West is degrading Russia’s war machine sufficiently to give Ukraine a fighting chance
For Moldova, a European Summit Draws More Support to Ward Off Russian Influence | RANE (Stratfor) Increased aid from its European neighbors will bolster Chisinau's ability to maintain its pro-Western course, but powerful pro-Russian Moldovans will continue to foment unrest.
US takes ‘countermeasures’ against Russia’s violations of nuclear treaty (The Hill) The Biden administration on Thursday announced it is holding back key information on U.S.-nuclear weapons stockpiles as part of requirements of the New START treaty with Russia in the wake of Mosco…
Biden shows growing appetite to cross Putin’s red lines (Washington Post) Despite warnings that arming Ukraine will start a world war, President Biden continues to push the Russian leader’s limits — a strategy that brings risk and reward
Pentagon confirms SpaceX deal for Ukraine Starlink services (Defense News) U.S. officials did not disclose details of the deal — including cost, contract timing or the length of service — citing operational security concerns.
SpaceX wins Pentagon satellite contract for Ukraine (Cybernews) The US Department of Defense has awarded SpaceX’s Starlink a government contract to provide its satellite service in Ukraine.
Exclusive: US seeking explosives in Japan for Ukraine artillery shells (Reuters) The United States is seeking to secure supplies of TNT in Japan for 155mm artillery shells, as Washington rushes weapons and ammunition to Ukraine for a counteroffensive against Russian forces, two people familiar with the matter told Reuters.
Europe sends big hitters to Singapore to rally Asian allies against Russia (POLITICO) A high-profile European delegation is heading to the Shangri-La Dialogue to push Asian countries on the war in Ukraine.
Did Macron just dispel Central and Eastern Europe’s skepticism about France? (Atlantic Council) French President Emmanuel Macron chose Bratislava, Slovakia, to deliver a speech aimed at reassuring Central and Eastern European partners of France's reliability.
British PM Rishi Sunak says Ukraine's rightful place is in NATO (CNBC) U.K. Prime Minister Rishi Sunak said Thursday that Ukraine's "rightful place" is within the NATO military alliance.
Britain’s defense chief, a contender to run NATO, lays out his vision (Washington Post) In an interview, British Defense Secretary Ben Wallace says the alliance must press its members to spend more on defense if Russia is to be contained
To Protect Europe, Let Ukraine Join NATO—Right Now (Foreign Affairs) No country is better at stopping Russia.
China stands to gain from a weakened Russia. The West should prepare now. (Atlantic Council) A protracted war of attrition in Ukraine serves Beijing’s interests in that it will lead to the long-term weakening of Russia, thereby fundamentally shifting the Sino-Russian power balance in China’s favor.
Russia says thousands of iPhones were hacked, blames U.S. and Apple (Washington Post) Apple denied the charge and Russia cybersecurity company Kaspersky Lab said it did not have enough data to blame any government
Kaspersky Says New Zero-Day Malware Hit iPhones—Including Its Own (WIRED) On the same day, Russia’s FSB intelligence service launched wild claims of NSA and Apple hacking thousands of Russians.
Kaspersky says attackers hacked staff iPhones with unknown malware (TechCrunch) The Russian cybersecurity company Kaspersky said that hackers working for a government targeted several dozen employees’ iPhones with unknown malware. On Thursday, Kaspersky announced the alleged cyberattack and published a technical report analyzing it, where the company admitted its analysis is not yet complete. The company said that the hackers, who at this point are […]
Apple denies surveillance claims made by Russia's FSB (Reuters) Apple Inc is denying claims made by Russia's Federal Security Service (FSB) that it cooperated with American spies to surveil Russian iPhone users.
Bratislava faced massive cyber-attack during GLOBSEC conference (euractiv) Electronic systems and parking services of Slovakia’s capital were down during an international security conference, GLOBSEC, on Wednesday, with an anti-NATO group claiming responsibility for the attack.
OSCE assists Ukrainian law enforcers in investigating cybercrimes and trafficking in human beings (OSCE) The first group of 30 law enforcement officers from the National Police of Ukraine (the NPU) have improved their knowledge and skills in countering cybercrime during the 3-day training course organised by the OSCE Support Programme for Ukraine in Lviv from 29 to 31 May 2023.
Unmasking malicious extensions: Avast detects new threats on the Chrome Web Store (Avast) Avast recently discovered a series of malicious browser extensions on the Chrome Web Store that are spreading adware and hijacked search results.
Indonesian Hacking Group Claims Cyber Attack On Israel's Iron Dome Air Defense System (MEMRI) A channel on the encrypted Rocket.Chat server operated by the Islamic State (ISIS) reported that an Indonesian hacker group carried out a cyber attack on Israel's mobile air defense Iron Dome system, in support of the "Palestinian resistance." The Indonesian hacking group, which mostly targets government sites in Thailand, Cambodia, and Nepal, reported on carrying out the attack on May 14 on its Twitter account.
New Horabot campaign targets the Americas (Cisco Talos Blog) Cisco Talos has observed a threat actor deploying a previously unidentified botnet program Talos is calling “Horabot,” which delivers a known banking trojan and spam tool onto victim machines in a campaign that has been ongoing since at least November 2020.
New Horabot campaign takes over victim's Gmail, Outlook accounts (BleepingComputer) A previously unknown campaign involving the Hotabot botnet malware has targeted Spanish-speaking users in Latin America since at least November 2020, infecting them with a banking trojan and spam tool.
New Magecart-Style Campaign Abusing Legitimate Websites to Attack Others (Akamai) Akamai researchers have discovered and analyzed a new ongoing Magecart-style web skimmer campaign, designed to steal personally identifiable information (PII) and credit card information from digital commerce websites.
Not your average Joe: An analysis of the XeGroup’s attack techniques (Menlo Security) XeGroup is a hacking group that has been active since at least 2013. The group is believed to have been involved in various cybercriminal activities. This threat actor uses many different attack techniques including:
Unmasking XE Group: Experts Reveal Identity of Suspected Cybercrime Kingpin (The Hacker News) Unmasking the E-Crime Mastermind: Vietnamese suspect linked to notorious XE Group unveiled!
Hackers use flaw in popular file transfer tool to steal data, researchers say (Reuters) Hackers have stolen data from the systems of a number of users of the popular file transfer tool MOVEit Transfer, U.S. security researchers said on Thursday, one day after the maker of the software disclosed that a security flaw had been discovered.
MOVEit Transfer Critical Vulnerability (May 2023) (Progress Customer Community) Progress has discovered a vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment. If you are a MOVEit Transfer customer, it is extremely important that you take immediate action as noted below in order to help protect your MOVEit Transfer environment, while our team produces a patch.
Rapid7 Observed Exploitation of Critical MOVEit Transfer Vulnerability (Rapid7) Rapid7 is observing exploitation of a critical vulnerability in Progress Software’s MOVEit Transfer solution across multiple customer environments.
Progress Software Releases Security Advisory for MOVEit Transfer | CISA (Cybersecurity and Infrastructure Security Agency CISA) Progress Software has released a security advisory for a vulnerability in MOVEit Transfer—a Managed File Transfer Software. A cyber threat actor could exploit this vulnerability to take over an affected system.
MOVEit Transfer Critical Vulnerability Rapid Response (Huntress) Our team is tracking in-the-wild exploitation of a zero-day vulnerability against Progress' MOVEit Transfer web application that allows for escalated privileges and unauthorized access.
Experts warn of MOVEit Transfer tool exploitation using zero-day bug (Record) Hackers are exploiting a new zero-day vulnerability affecting a popular file transfer tool used by thousands of major companies.
Zero-day vulnerability in MoveIt Transfer under attack (Security | TechTarget) Progress Software disclosed a zero-day vulnerability in its MoveIt Transfer product, and Rapid7 reported the flaw is under attack.
New MOVEit Transfer zero-day mass-exploited in data theft attacks (BleepingComputer) Hackers are actively exploiting a zero-day vulnerability in the MOVEit Transfer file transfer software to steal data from organizations.
CyRC Vulnerability Advisory: CVE-2023-32353, Apple iTunes local privilege escalation on Windows (Application Security Blog) Synopsys Cybersecurity Research Center has discovered a local privilege escalation vulnerability in Apple iTunes on Microsoft Windows.
When byte code bites: Who checks the contents of compiled Python files? (ReversingLabs) ReversingLabs researchers identified a PyPI attack using compiled Python code to evade detection — possibly the first PYC file direct-execution attack.
PyPI malware ramps up the threat to the code repository (Register) Oh cool, something else to scan for
Python byte code used to avoid detection and load malware (SC Media) ReversingLabs researchers say the ability to execute malicious Python byte code files poses yet another supply chain risk.
Improved BlackCat Ransomware Strikes with Lightning Speed and Stealthy Tactics (The Hacker News) Sneakier & faster! New BlackCat ransomware variant Sphynx sharpening claws on evasion techniques & encryption
BlackCat claims the hack of the Casepoint legal technology platform used by US agencies (Security Affairs) The BlackCat ransomware gang claims to have hacked the Casepoint legal technology platform used US agencies, including SEC and FBI. The cybersecurity researcher Dominic Alvieri first noticed that the BlackCat ransomware gang added the company Casepoint to the list of victims on its Tor Dark Web site. Casepoint provides a leading legal discovery platform used by […]
Legal tech firm Casepoint investigates breach after hackers claim theft of government data (TechCrunch) Casepoint is investigating a cybersecurity incident after hackers claimed they compromised the legal tech platform to steal terabytes of data.
How to stay safe while streaming Champions League matches (Avast) Avast researchers have observed a significant increase in blocked URL attacks on match days as viewers search for free streaming platforms.
UK streaming alert should worry anyone watching football online for free (Mirror) If you enjoy watching football online without paying for a premium subscription…beware!
Enzo Biochem Announces Ransomware Attack Resulted in Data Breach Impacting Nearly 2.5 Million Consumers (JD Supra) On May 30, 2023, Enzo Biochem, Inc. filed documents with the Securities and Exchange Commission announcing that the company experienced a ransomware...
Harvard Pilgrim Health Care ransomware attack hits 2.5 million people (BleepingComputer) Harvard Pilgrim Health Care (HPHC) has disclosed that a ransomware attack it suffered in April 2023 impacted 2,550,922 people, with the threat actors also stealing their sensitive data from compromised systems.
Apria Healthcare Data Breach Exposed Sensitive Information of Nearly 2 Million Patients (CPO Magazine) Apria healthcare data breach has exposed the personal, medical, and financial information of up to 1.8 million individuals.
City updates employees on cyberattack (Lowell Sun) Both the city and the school side of Lowell’s municipal operations updated employees on the cyber attack that has disrupted operations since April 24.
May 31, 2023 CISA KEV Breakdown | Barracuda, Zyxel (Nucleus Security) In this Breakdown, two vulnerabilities in Zyxel and Barracuda were added to the Known Exploited Vulnerabilities Catalog.
Ask Fitis, the Bear: Real Crooks Sign Their Malware (KrebsOnSecurity) Code-signing certificates are supposed to help authenticate the identity of software publishers, and provide cryptographic assurance that a signed piece of software has not been altered or tampered with. Both of these qualities make stolen or ill-gotten code-signing certificates attractive…
What is Deepfake Technology and How Are Threat Actors Using It? (Flashpoint) Deepfake technology is a form of artificial intelligence that employs machine learning algorithms to generate realistic media content.
CISA Releases Five Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency CISA) CISA released five Industrial Control Systems (ICS) advisories on June 1, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.
Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks (SecurityWeek) Critical authentication bypass and high-severity command injection vulnerabilities have been patched in Moxa’s MXsecurity product.
Cybersecurity Risks and Privacy Rules Add Pressure on Boards (Wall Street Journal) Directors are finding they have to get up to speed on emerging threats quickly, as regulations loom.
Company Data Breaches : Four Months Into 2023, More Than 340 Million Accounts Compromised (Global Security Mag Online) Company Data Breaches : Four Months Into 2023, More Than 340 Million Accounts Compromised an exclusive new research by the Independent Advisor
New Independent Research Study Reveals Majority of Global Financial Institutions Are Unable to Respond Effectively to Fraud and Financial Crime (PR Newswire) BioCatch, the pioneer of behavioral biometric intelligence and a leader in digital fraud detection, today announced the findings of a new...
Two-Thirds of Americans Believe Parents Should Have Legal Access to Kids’ Passwords (Password Manager) A new law introduced in Utah aims to protect children online by requiring minors to obtain parental permission when signing up for social media accounts, as well as requiring social media companies to provide parents with passwords for their childrens’ existing accounts.
Cybersecurity Now Trumps Financial Performance for Most CEOs (Digital Information World) This data comes from a survey of around 2,500 CEOs which was conducted by Palo Alto Networks.
iNovex acquires Secure Innovations (Intelligence Community News) On June 1, Columbia, MD-based iNovex, a provider of software development solutions focused on cybersecurity, Signals Intelligence (SIGINT), data analysis, and robotic process automation (RPA) for the Intelligence Community, announced that it has reached a deal to acquire Secure Innovations, a leading cybersecurity business serving the Intelligence Community and Department of Defense.
AI frenzy sweeps China as companies search for their own ChatGPT (Nikkei Asia) Money is no object as investors big and small rush into chatbot technology
Multiple companies could win work on US Army’s Project Linchpin AI (C4ISRNet) Through Project Linchpin, the service intends to deliver artificial intelligence capabilities across the intel, cyber and electronic warfare worlds.
Meta is slashing another 1,125 Bay Area workers (Silicon Valley Business Journal) Here's how many people Meta is cutting in the Bay Area as part of its latest cuts, where those workers are based and what they do.
Meta Calls Employees Back to Office Three Days a Week (The Information) Meta Platforms has notified employees they will need to return to the office three days a week starting in September, according to a person familiar with the matter. The announcement, which has not been previously reported, marks the strictest policy changesince it embraced remote work during ...
Zscaler hits but SentinelOne misses big in latest cybersecurity earnings results (SiliconANGLE) Zscaler hits but SentinelOne misses big in latest cybersecurity earnings results - SiliconANGLE
SentinelOne Lays Off 5% of Staff as Data Consumption Tumbles (Gov Info Security) SentinelOne plans to ax approximately 105 workers after a significant drop in data usage for products with consumption-based pricing caused revenue to fall short of
ISRAEL : NSO's big data successor Bold looks to expand in Europe (Intelligence Online) Bold Analytics, which took over the big data activities of the Israeli cyber-intelligence firm NSO, is looking to develop its business in Europe.
Huntress Wins 2023 Fortress Cyber Security Award (GlobeNewswire) Company recognized for superior threat detection in its mission to protect SMBs
Code42 names Wayne Jackson to its Board of Directors (Help Net Security) Code42 names Wayne Jackson to its Board of Directors to challenge traditional approaches to data protection and bring innovations to market.
Amanda Cody Rejoins Booz Allen as CISO (GovCon Wire) Looking for the latest GovCon News? Check out our story: Amanda Cody Rejoins Booz Allen as CISO. Click to read more!
Pinpoint Places Two Execs For DefenseStorm (Pinpoint Search Group) Pinpoint successfully completes executive searches for DefenseStorm. Places chief customer officer and senior vice president of sales.
One of Elon Musk's top executives at Twitter just resigned (Fortune) Twitter VP or Trust and Safety Ella Irwin's internal Slack account was suddenly de-actived on Thursday.
New infosec products of the week: June 2, 2023 (Help Net Security) The featured infosec products this week are from: Bitdefender, ConnectSecure, CYTRACOM, Permit.io, and PingSafe.
CrowdStrike Achieves IL5 Authorization to Secure U.S. Department of Defense (CrowdStrike) Cybersecurity leader earns highest unclassified level of authorization to protect extensive range of mission critical DoD systems.
Impossible Cloud Launches Partner Program to Help Resellers and Others Capitalize on Web3 (Business Wire) Partner-Friendly Program Eases Collaboration and Integration of S3-Compatible Enterprise-Grade Cloud Solutions Built on Web3 Technology
Embroker Releases New Digital Excess Tech E&O Cyber Product For Brokers (Business Wire) 100% digital tool empowers brokers to quickly and easily supplement traditional and insurtech E&O/cyber policies with overhanging limits up to $5 million
ON2IT Expands its Zero Trust as a Service Cloud Platform to Support the CISA Zero Trust Maturity Model (PR Newswire) ON2IT, a leading provider of managed cybersecurity services, announces the addition of the CISA Zero Trust Maturity Model into its Zero Trust...
Horizon3.ai and Autonomos.ai Partner to Introduce Advanced Cybersecurity into Africa (Business Wire) Autonomos.ai has joined forces with Horizon3.ai, a U.S.-based cybersecurity firm, as a fully licensed and Certified Partner to introduce advanced cybersecurity services to the African continent. This partnership aims to provide enterprises, governments, and NGOs with a comprehensive and proactive defense against cyber threats.
Secureworks Unifies Industrial Cybersecurity with the First Integrated MDR Solution for OT and IT (PR Newswire) Secureworks® (NASDAQ: SCWX), a global leader in cybersecurity, today announced two new offerings to unify the way industrial organizations...
Lantum Deploys Lookout Secure Cloud Access to Protect Sensitive Data, Minimize the Risk of Exposure and Ensure Compliance (Business Wire) Healthcare workforce platform used by 37,000 clinicians supports staffing for the U.K.’s National Health Service; Lookout Secure Cloud Access provides visibility into usage and access of all corporate data
Growing hacking threat to satellite systems compels global push to secure outer space (CyberScoop) An international group of experts are working to build the next generation of secure-by-design space systems.
The Clock is Ticking for Healthcare Organizations to Become PCI 4.0 Compliant (Avertium) A one-size-fits-all approach to PCI compliance is no longer practical for healthcare organizations. Take a look at the most recent iteration, PCI 4.0.
CrowdStrike CEO calls generative AI an 'arms race,' but says company is positioned well to face adversaries (CNBC) CEO of cybersecurity firm CrowdStrike George Kurtz told CNBC's Jim Cramer on Thursday that his company is ready to take on "adversarial AI."
Palantir CEO: AI So Powerful ‘I’m Not Sure We Should Even Sell This’ (Bloomberg) Alex Karp touted the power of its AI tools at a customer conference.
OpenAI is pursuing a new way to fight A.I. 'hallucinations' (CNBC) AI hallucinations occur when models like OpenAI's ChatGPT or Google's Bard fabricate information entirely.
Innovative blockchain patent extends RKVST leadership in data provenance and integrity (Business Wire) New patent addresses challenges created by ever-growing blockchain storage requirements
AI-Controlled Drone Goes Rogue, Kills Human Operator in USAF Simulated Test (Vice) The Air Force's Chief of AI Test and Operations said "it killed the operator because that person was keeping it from accomplishing its objective."
All the unexpected ways ChatGPT is infiltrating students’ lives (Washington Post) Far beyond cheating, artificial intelligence is changing the way some students learn and live
To Compete with China, Promote Internet Freedom from Space (The National Interest) Promoting domestic competition in the satellite internet industry is a critical aspect of geopolitical competition with China and an essential element in the pursuit of global internet freedom.
New law protects student data privacy, restricts targeted advertising on education apps (The Capitolist) The Student Online Personal Information Protection Act was signed into law this week, introducing new restrictions on education websites and applications to prevent data harvesting and targeted adv…
Senate Bill 662 (2023) (The Florida Senate) Student Online Personal Information Protection; Citing this act as the “Student Online Personal Information Protection Act”; prohibiting operators from knowingly engaging in specified activities relating to students’ covered information; providing circumstances under which an operator may disclose students’ covered information; providing construction; providing for enforcement under the Florida Deceptive and Unfair Trade Practices Act; providing that the Department of Legal Affairs is the sole entity authorized to bring specified actions, etc.
CISA Releases the FY 2023 Rural Emergency Medical Communications Demonstration Project (REMCDP) Notice of Funding Opportunity (Homeland Security Today) Applicants must demonstrate their ability to leverage technologies and engage non-medical professionals to help enhance statewide or regional medical communications systems.
What the debt ceiling deal means for U.S. cyber agency (Washington Post) Debt ceiling agreement has little impact on old CISA money, agency says, but prospects are dicier going forward
Don’t Leave the NSA in the Dark (Bloomberg) A vital surveillance tool is up for reauthorization. A group of lawmakers wants to kill it. Lives are in the balance.
Homeland Official Defends Domestic Intelligence Work to Congress (Bloomberg Law) The Department of Homeland Security is defending its domestic intelligence-gathering tactics after critics accused the agency of violating Americans’ civil rights and civil liberties.
FTC’s Khan Says Enforcers Need to Be ‘Vigilant Early’ With AI (Bloomberg) Agency already seeing AI used to ‘turbocharge’ fraud, scams. Laws against deception, discrimination already apply, she says.
The Illusion of China’s AI Prowess (Foreign Affairs) Regulating AI will not set America back in the technology race.
Top National Guard officer vows intel leaks ‘will never happen again’ (Military Times) Gen. Daniel Hokanson said investigations so far have not shown systemic problems with who has access to the military's most sensitive secrets.
Federal vision to streamline cyber incident reporting expected this summer (Nextgov.com) The Cyber Incident Reporting Council will issue a report to Congress "in the next month or two" with recommendations on ways to achieve harmony across a complex network of federal cyber mandates.
DNI Haines Statement on President Biden's Nomination of Lt. Gen. Timothy D. Haugh to Lead the National Security Agency and U.S. Cyber Command (ODNI News Release) “I am delighted to congratulate Lieutenant General Timothy D. Haugh on his nomination to serve as the Commander of U.S. Cyber Command, the Director of the National Security Agency, and the Chief of the Central Security Service.
A Confession Exposes India’s Secret Hacking Industry (The New Yorker) The country has developed a lucrative speciality: cyberattacks for hire.
Retired Air Force officer sentenced to 3 years for storing classified information at his Florida home (CNN Politics) A retired Air Force lieutenant colonel was sentenced to three years in federal prison Thursday for storing files with classified information at his Florida home, the Department of Justice announced.
Behind-the-scenes videos of Tucker Carlson were leaked. Was it a crime? (Washington Post) Federal investigators are probing the videos as a possible hack of Fox News. But a lawyer for a former Deadspin journalist under investigation says his client used publicly accessible information.
For a complete running list of events, please visit the Event Tracker.
MILIPOL Paris2023 (Paris Nord Villepinte, France, Nov 14 - 17, 2023) During 4 days, Milipol Paris 2023, organised under the auspices of the French Ministry of Interior and in partnership with several governmental bodies, will be the epicentre of all security-related innovations. For this new edition, Milipol will gather over 1,000 exhibitors, 65% of whom are from outside-France, 30,000 attendants from more than 150 countries, and 150 official delegations.
35th Annual FIRST Conference (Montréal, Québec, Canada, Jun 4 - 9, 2023) FIRST is an international non-profit association of Computer Security and Incident Response Teams (“CSIRTs”), Product Security and Incident Response Teams (“PSIRTs”), and independent security researchers from the public, private, and academic sectors. Membership comprises of over 600 teams with representation from over 100 nations. The annual conference provides a forum for sharing goals, ideas, and information on how to improve global cyber security. FIRST is a front-line enabler in the global response community, providing access to the best practices, tools, and trusted communication with its member teams. Named one of the Top 19 Information Security Conferences of 2020 by TripWire, the FIRST annual conference promotes worldwide coordination and cooperation among computer security and incident response teams (CSIRTs). The conference provides a forum for sharing goals, ideas, and information on how to improve computer security on a global scale.
IT Nation Secure 2023 (Orlando, Florida, USA, Jun 5 - 7, 2023) Network with peers to solve cybersecurity business challenges. Join us June 5-7 in Orlando to see how IT Nation Secure can help you transform your cybersecurity services, make meaningful connections, and ultimately protect your business and customers.
Techno Security & Digital Forensics Conference (Wilmington, North Carolina, USA, Jun 5 - 8, 2023) Techno Security & Digital Forensics Conference provides a unique education experience that blends the digital forensics and cybersecurity industries for collaboration between government and private sectors. The 2023 East edition of Techno Security & Digital Forensics Conference will feature educational sessions, industry-leading speakers, and sponsors/exhibits over four days of networking among cybersecurity and digital forensics industry professionals. Learn about new tools and techniques, discuss important case studies, and share insight on future trends and the current state of the industry. Educational sessions cover a wide range of topics within the following primary tracks from which CPE credits can be earned: Audit/Risk Management, eDiscovery (New!), Forensics, Information Security, Investigations, Magnet Forensics Lab, Cellebrite Lab, and Sponsor Demos. In addition to educational sessions, sponsoring/exhibiting companies will be on hand to introduce and demonstrate the latest products and services in the industry. Learn from industry experts, connect with leading suppliers, explore the latest tools, and network with cybersecurity and digital forensics professionals.
Telecom Threat Intelligence Summit 2023 (Virtual, Jun 6 - 7, 2023) An event dedicated to improving cyber security outcomes for the telecom sector and its customers through better use of cyber threat intelligence. TTIS 2023 serves as a forum for advancing best practise as regards threat intelligence sharing between telcos in different countries as well as within their domestic markets; between telcos and other leading actors in the ICT ecosystem; between telcos and their customers; and between different groups and departments within the telco organisation.
ENISA AI Cybersecurity Conference (Brussels, Belgium, Jun 7, 2023) The AI Cybersecurity conference aims at discussing key aspects of cybersecurity in AI systems as well as challenges associated with implementation and supervision of secure and trustworthy AI. This conference will provide an opportunity to bring the AI cybersecurity community together and share experiences, challenges and good practices; discuss developments, initiatives and challenges related to implementing of cybersecurity in AI; and raise awareness on the need to promote cooperation between different stakeholders for effective AI cybersecurity.
