Unpatched instances of Visual Studio, win32k, MOVEit continue. Hacktivism hits Russia, Ukraine. Mt. Gox case indictment.

Summary

By the CyberWire staff

At a glance.

Attacks against unpatched Visual Studio and win32k continue.
MOVEit exploit update: Progress Software patched two MOVEit vulnerabilities including widely exploited CVE-2023-34362.
Minnesota Department of Education among victims of MOVEit vulnerability exploitation.
Cyber Anarchy Squad claims to have taken down Russian telecom provider's infrastructure.
RomCom resumes its activity in the Russian interest.
Jamming GPS to jam JDAMs.
Mt. Gox hacking indictment unsealed.

Attacks against unpatched Visual Studio and Win 32k continue.

Threat actors continue to exploit a vulnerability in Microsoft's Visual Studio installer, the Register reports. According to researchers at Varonis, the flaw can allow an attacker “to spoof an extension signature and effectively impersonate any publisher.” Microsoft patched this vulnerability on April 11th.

Attackers are also exploiting a privilege escalation vulnerability affecting win32k, according to researchers at Numen. Microsoft issued a patch for this flaw in May. Numen states, “While this vulnerability seems to be non-exploitable on the Win11 system version, it poses a significant risk to earlier systems.”

Early bird registration is open. Get the lowest price we offer.

MOVEit exploit update: Progress Software patched two MOVEit vulnerabilities including widely exploited CVE-2023-34362.

Progress Software released an update to its MOVEit file transfer software that patched the previously exposed and exploited CVE-2023-34362. It also disclosed (and fixed) a new, yet-to-be exploited bug. The new vulnerability, which hasn’t yet been assigned a CVE, was discovered during an investigation with cybersecurity firm Huntress. That investigation, Progress explained, reviewed code “as an added layer of protection for our customers.” Progress advises users to update their software, and explicitly urges users to only update their products through Progress’s blog. “MOVEit Cloud has been patched with the latest patch released on June 9, 2023. We encourage customers to review their audit logs for signs of unexpected or unusual file downloads, and continue to review access logs and systems logging, together with our systems protection software logs.” Progress added, “We are urging customers to use only the patch links included in our documentation. Do not use third-party resources.”

The future of security is identity and with CyberArk, the future of identity is secure.

With 84% of organizations experiencing an identity-related breach, identity is the new battlefield. As the pioneers of privileged access management, we started by protecting the most privileged users and most critical data. With intelligent privilege controls, today we’re applying the same levels of security and protection to every identity – both human and machine. CyberArk offers the most advanced identity security platform in the world, surrounding every identity with a powerful force field of continuous protection.

Minnesota Department of Education and UK's Ofcom among victims of MOVEit vulnerability exploitation.

On Friday, June 9th, The Minnesota Department of Education (MDE) reported that one of its servers was compromised through exploitation of the earlier MOVEit vulnerability, CVE-2023-34362, which the MDE had not yet patched. MDE explained that twenty-four files had been accessed, which compromised “approximately 95,000 names of students placed in foster care throughout the state, 124 students in the Perham School District who qualified for Pandemic Electronic Benefits Transfer (P-EBT), 29 students who were taking PSEO classes at Hennepin Technical College in Minneapolis, and five students who took a particular Minneapolis Public Schools bus route.” No financial information was exposed. MDE recommends that affected individuals should monitor their credit reports and take steps to protect their identity.

The74 reported that ransomware gang Medusa has claimed responsibility for the breach, and is demanding $1 million dollars in ransom. “A preliminary review of the gang’s dark web leak site by The 74 suggest the compromised files include a significant volume of sensitive documents, including records related to student sexual violence allegations, district finances, student discipline, special education, civil rights investigations, student maltreatment and sex offender notifications.”

In the UK, regulatory body Ofcom this morning disclosed that it too had been affected by exploitation of this vulnerability. "A limited amount of information about certain companies we regulate – some of it confidential – along with personal data of 412 Ofcom employees, was downloaded during the attack," Ofcom said. Investigation and remediation are in progress.

Are you compliant yet? You better be if you want your prospects to buy.

Your prospects are demanding SOC 2 and you're not closing deals without it. Scytale's security compliance automation platform helps companies get compliant and stay compliant with frameworks like SOC 2, ISO 27001, HIPAA, GDPR and PCI-DSS without breaking a sweat.

Save hundreds of hours with streamlined compliance and dedicated support, remain compliant all year round with automated monitoring and alerts, and most importantly, boost sales by providing proof of information security to your customers.

Cyber Anarchy Squad claims to have taken down Russian telecom provider's infrastructure.

The Cyber Anarchy Squad, which represents itself as a hacktivist organization dedicated to supporting Ukraine in defending itself against Russia, claimed to have hit, successfully, the Russian telecommunications provider Infotel JSC last Thursday evening. Infotel JSC confirmed that its systems had indeed come under attack, BleepingComputer reports: "We would like to inform you that as a result of a massive hacker attack on the network of Infotel JSC, some of the network equipment was damaged. Restoration work is currently underway. Additional deadlines for completing the work will be announced. We hope for your understanding and further cooperation."

For its part, the Cyber Anarchy Squad crowed, as quoted by the Record, "We have completely destroyed their infrastructure. There is nothing left alive. Let them try to restore it now, but their chances are as slim as finding an easy life in Russia," Infotel JSC has a number of clients in the financial sector, including Russia's Central Bank of Russia. Connectivity between the Central Bank and other financial service and e-commerce businesses depends to a significant extent on the telco's infrastructure, and the Cyber Anarchy Squad claims that its attack has rendered it difficult and in some cases impossible for banks to conduct routine transactions.

The attack coincided with the opening of Ukraine's counteroffensive, and according to Security Affairs included website defacements celebrating Ukraine's attack. There are no obvious indications, however, that the cyberattack was a closely coordinated combat support operation. It seems rather to have been malign exuberance directed Russiawards.

What are your biggest resource challenges? Expel makes every investment could.

ISOs have lots to think about. Teams and tech stacks. Budgets and booming attack surfaces. Security strategies evolving to address business goals. All of the above?

Expel’s software-driven approach to managed security puts your existing tech to work across cloud (and Kubernetes!), on-prem, network, SaaS, and SIEM, automating alert analysis, prioritization, and remediation so you get better answers to what matters the most. Fast.

Optimize your tech. Support your team. Stretch your budget. Expel.

RomCom resumes its activity in the Russian interest.

BlackBerry researchers find that the operators of the RomCom remote access Trojan (RAT) have recently stepped up their activity against, among other targets, Ukrainian politicians working closely with Western governments and at least one US organization involved in delivering relief to Ukrainian refugees. The goal is collection of information. "The threat actor behind the RomCom RAT appears to be actively interested in what Western countries are doing to support Ukraine, what Ukraine is doing, and who the refugees are receiving help from in the United States," BlackBerry writes. "If medical records stored electronically are stolen, it would be easy for the threat actor (and those they are affiliated with) to profile the patient and use that data in future war scenarios and in geopolitics in general. Even the extraction of partial information, such as name, sex, date of birth, and related data, poses a potential risk to that person and those who provide them with any type of aid in future."

Jamming GPS to jam JDAMs.

The US-developed and manufactured Joint Direct Attack Munition (JDAM), which has been supplied to Ukraine, is a precision, GPS-guided weapon that can be fixed to a bomb to give it the capability of striking a selected target with great accuracy. The Royal United Services Institute reports that high-power, broadband Russian jamming may be degrading some of JDAM's accuracy. The jamming represents a trade-off: it might render incoming JDAM less accurate, but it also will affect Russian systems with indiscriminate electronic noise. And the high-power jammers are themselves electronically very conspicuous, which exposes the jammers themselves to a hard-kill by anti-radiation weapons. Russian commanders may think the trade-off worth it in protecting their high-value targets from Ukrainian JDAM strikes.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Mt. Gox hacking indictment unsealed.

Two Russian nationals were charged with the 2014 hack of the Mt. Gox cryptocurrency exchange, described by CoinDesk as one of the biggest cryptocurrency heists in crypto history. An indictment from 2019 was unsealed last Friday, detailing how the two hackers, Alexey Bilyuchenko and Aleksandr Verner, stole upwards of 647,000 bitcoins from the exchange between 2011 and 2017, and used it in Mr. Bilyuchenko’s illicit crypto exchange known as BTC-e, the Record reports. Authorities allege Mr. Bilyuchenko was an operator of the BTC-e exchange.

The duo was said to gain “unauthorized access” to the crypto wallets within the Mt. Gox exchange around September of 2011, says a release from the Department of Justice. Once the funds were lifted, they were then laundered. Both Messrs. Bilyuchenko and Verner are being charged with conspiracy to commit money laundering, while Mr. Bilyuchenko is also facing a charge for operating an unlicensed money services business.

“For years, Bilyuchenko and his co-conspirators allegedly operated a digital currency exchange that enabled criminals around the world — including computer hackers, ransomware actors, narcotics rings, and corrupt public officials — to launder billions of dollars,” said U.S. Attorney Ismail Ramsey.

Notes.

Today's issue includes events affecting Canada, China, Cuba, the European Union, France, Russia, Ukraine, the United Kingdom, and the United States.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+473: Counterattack toward the Sea of Azov. (CyberWire) Ukraine's counteroffensive is under way. Hacktivists hit Russia telecom provider.

Russia-Ukraine war at a glance: what we know on day 474 of the invasion (the Guardian) Ukraine claims to have liberated frontline villages in western Donetsk; cooling ponds at Zaporizhzhia nuclear plant are ‘stable and sufficient’

Ukraine counter-offensive: Kyiv says it has liberated villages in Donetsk region (BBC News) The four small villages are the first officially publicised gains in Kyiv's counter-offensive.

Ukraine accuses Russia of destroying another dam (the Guardian) A week after collapse of Kakhovka dam – for which Kyiv blames Moscow – Russia accused of blowing up smaller dam in Donetsk region

Russia-Ukraine war: List of key events, day 474 (Al Jazeera) As the war enters its 474th day, these are the main developments.

Ukraine claims first counter-offensive gains (The Telegraph) Kyiv says three Donetsk villages have been liberated by troops while railway lines in Crimea are rocked by explosions

Ukraine claims recapture of 4th village in eastern Donetsk as counteroffensive operations roll on (AP NEWS) Ukrainian military officials say their troops have retaken another southeastern village from Russian forces. It is among the first — small — successes in stepped-up counteroffensive operations against Moscow’s more than 15-month invasion of Ukraine. Deputy Defense Minister Hanna Maliar wrote on Telegram that Ukraine’s flag was again flying over the village of Storozhov, She predicted the liberation of “all Ukrainian land” would be the final outcome. A day earlier, Ukrainian officials said three other small villages clustered together south of the town of Velika Novosilke in eastern Donetsk region had been liberated.

Opinion 5 questions about Ukraine’s counteroffensive, answered (Washington Post) The long-anticipated Ukrainian counteroffensive against Russian invaders is underway, Ukraine’s President Volodymyr Zelensky confirmed Saturday. It has been underway since at least last Monday, according to U.S. officials — marking a new phase of a conflict that in recent weeks has been increasingly difficult to follow.

Zelenskyy says Ukraine ‘counteroffensive, defensive actions’ underway (Military Times) The Ukrainian leader spoke at a news conference while hosting Canadian Prime Minister Justin Trudeau.

Russia-Ukraine war at a glance: what we know on day 473 of the invasion (the Guardian) Volodymyr Zelenskiy confirms ‘counteroffensive and defensive actions’; president says his generals are in ‘positive mood’ but gives no more details

Moscow Rigs Toxic Chemical Plant Next to Sulfuric Acid Lake with Explosives, Ukraine Claims (Kyiv Post) The Crimean Titan chemical plant is ready to blow, and if the Ukrainian army gets close and the charges are set off, the toxic cloud released will be ‘worse than Chornobyl,’ one official said.

Reports of Russian casualties as they 'withdraw through their own minefields' driven back by Ukraine's counteroffensive, UK intel says (Business Insider) Military progress on both sides of the Ukraine counteroffensive has been "mixed" in the last two days, the UK MoD said in a statement on Saturday.

Ukraine live briefing: Zelensky confirms counteroffensive; Kyiv reports small gains (Washington Post) Ukrainian President Volodymyr Zelensky confirmed his country’s counteroffensive during a visit by Canadian Prime Minister Justin Trudeau in Kyiv on Saturday, according to news reports from Ukraine.

Russia-Ukraine war live: Kyiv reports advances as UK says Russian lines breached in some areas (the Guardian) UK Ministry of Defence says Ukraine has ‘likely made good progress’ in some areas but that progress is ‘slower’ in others

The Russian fortifications Ukraine needs to break through in its counter-offensive (The Telegraph) New satellite images reveal the array of minefields, anti-tank ditches and trenches lying ahead of Ukrainian troops

Weapons of Ukraine - Your essential guide (The Telegraph) Since the outbreak of war in February 2022, The Telegraph has been tracking donations and deliveries of weapons to Ukraine. Our defence correspondents have reported on their use on the battlefield and our experts have analysed their effectiveness. Many of the resources we have produced so far can now be found here, along with details of other key weapons.

Ukraine-Russia war: Putin gives date for nuclear weapons to Belarus (The Telegraph) Vladimir Putin has set a date to deploy tactical nuclear weapons to Belarus as he shared his plans over lunch with ally Alexander Lukashenko.

Ukraine's counter-offensive against Russia under way (BBC News) It's been talked of for months, now it looks like Ukraine is finally launching its plan to recapture land.

How Ukraine finally launched its counter-offensive – and whether it will succeed (The Telegraph) Ukrainian military opted for a series of mini-offensives in phase one of their counter attack

Wagner boss refuses to allow his mercenaries to join Putin's forces (The Telegraph) Yevgeny Prigozhin has repeatedly attacked Vladimir Putin’s top military brass for failing to fight the war in Ukraine properly

Wagner group accused of stoking ‘anarchy’ on Russia’s frontlines (the Guardian) Kremlin commander claimed the mercenaries had kidnapped and tortured his soldiers during battle for Bakhmut

Russia claims it blew up advanced Ukrainian tank, but video shows its helicopter attacked a tractor (AP NEWS) A grainy black-and-white gunsight video Russia released this week to bolster a claim its military blew up some of Ukraine's most fearsome tanks actually documented the destruction of a tractor, according to a visual analysis by The Associated Press.

British-made tanks are about to sweep Putin’s conscripts aside (The Telegraph) As a former tank commander, I know the Challenger 2 vastly outmatches what’s left of Russia’s armour

Secret recording 'proves dam explosion was Russian sabotage gone wrong' (The Telegraph) Intercepted call reveals conversation between alleged soldiers and proves Russia blew up dam

The disastrous bursting of Ukraine’s Nova Kakhovka dam – and the battle that is to come (the Guardian) The evidence suggests Russia destroyed the vast, vital dam. Now the long cleanup for the human, environmental and potentially nuclear catastrophe must begin amid a brutal war

UN concerned by ‘discrepancy’ in Ukraine nuclear plant water levels after dam collapse (the Guardian) IAEA head Rafael Grossi, who will visit Zaporizhzhia nuclear plant, says there is a difference of about 2 metres from the reservoir that cools the plant

Russia Is Building an Attack-Drone Factory With Iranian Supplies, US Says (Bloomberg) US says satellite images show the factory site in Russia. Iranian drones were used in recent strikes on Kyiv, Kirby says.

New U.S. intelligence shows Russia's deepening defense ties with Iran (POLITICO) The Biden administration aims to disrupt the “full-scale defense partnership that is harmful to Ukraine.”

Biden Administration Announces Additional Security Assistance for Ukraine (U.S. Department of Defense) The Department of Defense announced a new security assistance package, underscoring the unwavering U.S. support for Ukraine.

US announces new $2.1 billion package of military aid to Ukraine (Military Times) The new assistance package includes funding for more Patriot missile battery munitions, Hawk air defense systems and missiles, and small Puma drones.

Russian-designed tanks roll toward Aberdeen Proving Ground in Maryland to aid Ukraine, boost U.S. intelligence (Baltimore Sun) Two Soviet-era tanks were recently hauled to Aberdeen Proving Ground, a U.S. Army testing and research site.

How Wars Don’t End (Foreign Affairs) Ukraine, Russia, and the lessons of World War I.

The West must remove Putin from power (The Telegraph) Without regime change in Russia Europe will never be safe from Putin’s warmongering

The end of Putin’s empire could be sudden (The Telegraph) History tells us that foreign humiliation can quickly rob dictators of control. Chaos could soon result

‘Three months ago, this wasn’t possible’: exiled Russians dare to dream of Putin’s fall (the Guardian) Opposition leaders have begun to plan for the end of the regime – and some believe it is now inevitable

Who Can Pacify Russia? (Wilson Center) No end to the hostilities in Ukraine is in sight. The situation on the front line may change many times over before a peace is achieved. Yet, some fundamental outlines of the postwar world arrangement can be discerned even in the fog and darkness of this war.

How Putin’s War Became Russia’s War (Foreign Affairs) The country will struggle to reckon with its crimes in Ukraine.

The Russian Idea Revisited (Wilson Center) Some years after the Soviet Union’s collapse, President Boris Yeltsin initiated a national search for a new Russian idea. The past was too raw and controversial, however, to reach any consensus on or reconciliation as to what constitutes Russian identity.

Ukrainian hackers take down service provider for Russian banks (BleepingComputer) A group of Ukrainian hackers known as the Cyber.Anarchy.Squad claimed an attack that took down Russian telecom provider Infotel JSC on Thursday evening.

Pro-Ukraine hackers claim to take down Russian internet provider (Record) Pro-Ukrainian hacktivists have hit a Russian internet and telecommunications company used mostly by banks and online stores with a “massive” cyberattack.

Pro-Ukraine Cyber Anarchy Squad claims the hack of the Russian telecom provider Infotel JSC (Security Affairs) Pro-Ukraine hackers Cyber Anarchy Squad claimed responsibility for the attack that hit Russian telecom provider Infotel JSC. Pro-Ukraine hacking group Cyber.Anarchy.Squad claimed responsibility for an attack on Russian telecom provider Infotel JSC. The company provides connectivity services to the Russian banking system, for this reason, the attack had a severe impact on the operations of […]

RomCom Resurfaces: Targeting Politicians in Ukraine and U.S.-Based Healthcare Providing Aid to Refugees from Ukraine (BlackBerry) In RomCom’s latest campaign, BlackBerry observed the threat actor targeting politicians in Ukraine who are working closely with Western countries, and a U.S.-based healthcare company providing humanitarian aid to refugees fleeing from Ukraine.

Jamming JDAM: The Threat to US Munitions from Russian Electronic Warfare (Royal United Services Institute) Leaked US documents show that Russian electronic warfare may be having a negative effect on US-supplied Joint Direct Attack Munitions.

The Ukrainian Cities Obliterated In Russia's Self-Proclaimed 'Liberation' (RadioFreeEurope/RadioLiberty) Russia’s full-scale war on Ukraine has nearly wiped multiple cities and towns from the face of the earth, despite the Kremlin's claim that it is conducting a campaign of “liberation.”

‘Masterpiece’ house is latest victim of Putin’s war on Ukrainian heritage (the Guardian) Artists from across Ukraine made pilgrimages to Polina Rayko’s home, which many fear has been destroyed after Kakhovka dam collapse

‘War criminals: whatever you do, we’ll record it’: the ‘merciless’ Ukrainian film about Mariupol (the Guardian) 20 Days in Mariupol by Mstyslav Chernov traces the Russian siege of the port in harrowing detail. Here, he discusses his documentary with a fellow war reporter

The Story of One Woman and a Kitten Reveals the Pain of a Society (Wilson Center) How do civilian survivors of war tell themselves that they have endured? How do they reassert their humanity?

Attacks, Threats, and Vulnerabilities

WSJ News Exclusive | How North Korea’s Hacker Army Stole $3 Billion in Crypto, Funding Nuclear Program (Wall Street Journal) The reclusive regime has trained cybercriminals to impersonate tech workers or employers, amid other schemes, helping fund its defense despite Western sanctions.

SeroXen remote access Trojan being used to target gamers, bigger targets could follow (Cybersecurity Connect) Security researchers have uncovered a stealthy new remote access that is being used – for the moment – to largely target video gamers.

FBI warns farmers of rising cyberattacks on ag industry (KFXL) The FBI warns farmers may be under attack. Cyberattacks on grain co-ops and packing plants are on the rise.The modern tractor is stuffed with technology sending

JBS’s cybersecurity was unusually poor prior to 2021 ransomware attack, internal homeland security records show (Iowa Capital Dispatch) Overall, food processing companies are vulnerable to cyberattacks, experts said.

MOVEit announces second vulnerability; Minnesota schools agency breached with original bug (Record) The company behind the popular MOVEit file transfer product has announced a second vulnerability within its software as more entities come forward to announce breaches stemming from the program’s issues.

New MOVEit Transfer critical flaws found after security audit, patch now (BleepingComputer) Progress Software warned customers today of newly found critical SQL injection vulnerabilities in its MOVEit Transfer managed file transfer (MFT) solution that can let attackers steal information from customers' databases.

Shell Recharge security lapse exposed EV drivers' data (TechCrunch) The internal database contained millions of logs, including details about customers who used the EV charging network.

Muggers make serious moves on unpatched Microsoft bugs (Register) Win32k and Visual Studio flaws are under attack

Analysis of CVE-2023-29336 Win32k Privilege Escalation (Numen) Analyzing CVE-2023-29336 Win32k vulnerability, its exploitation, and mitigation measures in the context of evolving security practices.

Easily Exploitable Microsoft Visual Studio Bug Opens Developers to Takeover (Dark Reading) The bug is very dangerous and impacts a big swath of the developer community, researchers warn.

SaaS Ransomware Attack Hit Sharepoint Online Without Using a Compromised Endpoint (SecurityWeek) A successful ransomware attack hit Sharepoint Online via a Microsoft Global SaaS admin account rather than a compromised endpoint.

Strava heatmap feature can be abused to find home addresses (BleepingComputer) Researchers at the North Carolina State University Raleigh have discovered a privacy risk in the Strava app's heatmap feature that could lead to identifying users' home addresses.

Behind the screen: three vulnerabilities in RenderDoc (iTWire) The Qualys Threat Research Unit (TRU) has discovered three vulnerabilities in RenderDoc. This blog will delve into the details of these three newly discovered vulnerabilities found within RenderDoc’s implementation. As part of our ongoing commitment to safeguard digital assets and str...

BlackCat ransomware fails to extort Australian commercial law giant (BleepingComputer) Australian law firm HWL Ebsworth confirmed to local media outlets that its network was hacked after the ALPHV ransomware gang began leaking data they claim was stolen from the company.

University of Manchester hit by cyber attack (BBC News) A university spokesman said there was "no known link" to the recent MOVEit hack.

University of Manchester says hackers ‘likely’ stole data in cyberattack (BleepingComputer) The University of Manchester warns staff and students that they suffered a cyberattack where threat actors likely stole data from the University's network.

University of Manchester hit by cyber attack (ComputerWeekly.com) The University of Manchester has been hit by a cyber attack of an undisclosed nature.

University of Manchester announces cyber incident, says data ‘likely’ copied (Record) The university, which is one of the United Kingdom's largest institutions of higher learning, apologized to students and staff.

Aix-Marseille, France’s largest university, hit by cyberattack (Record) The institution’s management described the attack as coming “from a foreign country” but said the network was taken offline before “great damage” was caused.

Minnesota Department of Education cyberattack: Over 95k students data breached (FOX 9 Minneapolis-St. Paul) The Minnesota Department of Education (MDE) announced on Friday they were hit by a cybersecurity attack that contained information for thousands of students, including those placed in foster care.

Cyberattack disrupts New Jersey township (SC Media) Cyberattack disrupts New Jersey township Operations at the Montclair Township in New Jersey have been disrupted by a cyberattack, which township Communications Director Katya Wowk said was not associated with recent MOVEit attacks, according to The Record, a news site by cybersecurity firm Recorded Future.

HSE again impacted by cyber-attack (Dublin's Q102) This is the second time in two years that the HSE has been targeted.

Illinois assessing damage from worldwide ransomware attack (US99) The repercussions from a recent, global ransomware attack are being felt right here in Illinois. Federal authorities said cyber criminals exploited a vulnerability in a widely used, third-party “MoveIT” file transfer system.

Petaluma Health Center notifies patients of data breach (Santa Rosa Press Democrat) Patient information – including names, addresses, Social Security numbers and more – was compromised in the March 14 incident.

Nova Scotia identifies thousands of stolen records in global security breach (CityNews) Officials in Nova Scotia have identified thousands of files stolen in a global data breach affecting the personal information of at least 100,000 people in the province.

Security Patches, Mitigations, and Software Updates

Fortinet fixes critical RCE flaw in Fortigate SSL-VPN devices, patch now (BleepingComputer) Fortinet has released new Fortigate firmware updates that fix an undisclosed, critical pre-authentication remote code execution vulnerability in SSL VPN devices.

MOVEit Transfer and MOVEit Cloud Vulnerability (Progress.com) This page provides the latest information on the MOVEit Transfer and MOVEit Cloud vulnerabilities. As we continue our investigation and new details are uncovered, this page will be updated. Please check back frequently for updates.

Win32k Elevation of Privilege Vulnerability CVE-2023-29336 Security Vulnerability (Security Update Guide - Microsoft Security Response Center) Impact: Elevation of Privilege Max Severity: Important

PoC released for Windows Win32k bug exploited in attacks (BleepingComputer) Researchers have released a proof-of-concept (PoC) exploit for an actively exploited Windows local privilege escalation vulnerability fixed as part of the May 2023 Patch Tuesday.

Trends

Rezilion 2023 First-Half Critical Vulnerabilities Report: Key Software Applications Under Fire (Rezilion) Vulnerabilities continue to plague enterprises and small organizations alike, and researchers are regularly discovering new flaws.

Report: 55% of organizations have experienced a SaaS security incident (Security Magazine) A new survey found while the use of cloud services is increasing, the pace of adoption is dependent on the speed of meeting security and operational expectations.

Cybersecurity vigilance, safeguards heralded to protect ever vulnerable senior living groups (McKnight's Senior Living) With senior living vulnerable to cyber attacks, having thorough cybersecurity strategies in place is vital for senior living administrators.

Verizon 2023 Data Breach Report shows rising cost of ransomware (Security Magazine) A new report reveals ransomware remains one of the top cyberattack methods making up 24% of all breaches.

Cyber extortion hits all-time high (Help Net Security) Cyber extortion attacks have become increasingly prevalent in recent years, posing a significant threat to organizations, researchers found.

Use of Multi-Factor Authentication (MFA) Nearly Doubles Since 2020, New Okta Secure Sign-In Trends Reports Finds (Okta) Okta, Inc. (NASDAQ: OKTA), the leading independent identity partner, today announced the release of its international Secure...

Marketplace

Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats (SecurityWeek) Blackpoint Cyber raises $190 million in a growth funding round led by Bain Capital Tech Opportunities.

Ellicott City's Blackpoint Cyber raises $190M in Greater Baltimore's first megadeal of the year (Maryland Inno) An Ellicott City cybersecurity firm landed the first Baltimore-area megadeal of 2023 on Thursday, offering a glimmer of hope during a down year for technology funding.

Bain Capital Invests in Blackpoint Cyber (Mergers & Acquisitions) Blackpoint Cyber is a cybersecurity company providing its security suite via managed service providers.

Booz Allen invests in onboard data firm Shift5 (Consulting) Booz Allen Ventures, the corporate venture capital arm of IT consultancy Booz Allen, has invested in Shift5, an Arlington, VA-based onboard data company.

Shift5 Closes $83M Series B Funding, Boosts U.S. Cyber Defense Business (MSSP Alert) Shift5 has landed some $33 million in Series B funding led by Moore Strategic Ventures.

Group-IB named a Representative Vendor in Gartner® 2023 Market Guide for Digital Forensics and Incident Response Services (Group-IB) Group-IB, a global cybersecurity leader headquartered in Singapore, is pleased to announce that it was recognized by Gartner in their 2023 Market Guide for Digital Forensics and Incident Response Services (Gartner subscription required). In the report, Gartner identified Group-IB as a representative vendor for incident response services.

Oracle’s Answer to the Microsoft-OpenAI Alliance: Cozying Up to Cohere (The Information) Oracle has invested in Cohere, an artificial intelligence startup that competes with OpenAI, the startup said on Thursday. What Cohere didn’t say: Oracle plans to make the startup a centerpiece of its strategy to catch up to bigger cloud rivals that sell services powered by large-language ...

Sumo Logic Cuts Staff After Francisco Partners Takeover (The Information) Data analytics software company Sumo Logic made widespread layoffs this week, according to people familiar with the matter and an email to staff viewed by The Information, less than a month after private equity firm Francisco Partners bought the company for $1.7 billion. The exact size of the ...

FIRST expands its leadership team (Help Net Security) FIRST has elected Tracy Bills as a new chair and appointed a new cyber security expert, Carlos Alvarez, to its Board of Directors.

Products, Services, and Solutions

US Army Makes $2M Investment in Quantum-Resilient Cybersecurity (IoT World Today) QuSecure contract aims to secure tactical edge and IoT devices from quantum cyberattacks

Datadobi Now Available in AWS Marketplace (Datadobi) StorageMAP Assess solution and StorageMAP Unstructured Data Management software are now available in AWS Marketplace.

Cycode Launches CI/CD Pipeline Monitoring Solution (Cimon) to Prevent Software Supply Chain Attacks (GlobeNewswire News Room) Cycode, the leading application security platform, today announced the launch of Cimon, a seamless...

BIO-key Partners with Savvy Info. Tech to Offer Powerful Identity and Access Management Solutions in Ethiopia’s Fast-Growing Economy (Globe Newswire) BIO-key International, Inc. (NASDAQ: BKYI), an innovative provider of Identity and Access Management (IAM) solutions featuring Identity-Bound Biometrics (IBB), today announced a partnership with Savvy Information Technology to bring BIO-key solutions to customers in Ethiopia.

StarHub launches Mobile Threat Defence solution to shield enterprises from mobile security threats (PR Newswire) StarHub today launched its Mobile Threat Defence (MTD) solution to address the increasing threat of mobile security breaches encountered by...

Security Innovation Launches New, Realistic Cyber Range to Help Companies Develop More Secure Software Applications (GlobeNewswire News Room) Company’s latest CMD+CTRL Cyber Range uses gamification and challenges teams to think like an attacker...

Fortinet Deepens its Dedication to Flexible Licensing with Expansion of FortiFlex Program (Fortinet) Simpler Procurement and Usage-Based Licensing for Security Across Cloud, Hybrid Cloud, and On-Premises Deployments Empowers Customers to More Easily Access the Solutions They Need

Technologies, Techniques, and Standards

US cyber experts sent to Latin America on ‘hunt-forward’ mission (Defense News) “We had our first defend-forward mission, a hunt-forward mission, in SOUTHCOM just recently, which is amazing.”

Cyber Yankee Prepares Military, Business for Cyber Threats (MilitarySpot.com) JUNE 9, 2023 - In the face of rising cyber threats, the Department of Defense has increased its efforts to recruit and build cyber capabilities. According

Cyber Yankee 23 (United States Marine Corps Flagship) Reserve Marines with Defensive Cyberspace Operations-Internal Defensive Measures Companies A and B, 6th Communication Battalion and Marine Innovation Unit participated in Cyber Yankee at Camp Net, CT,

DOD’s David McKeown: Pentagon Moving to Quantum-Resistant Algorithms in Crypto Modernization Push (Gov Con Wire) Quantum computing is a rapidly-growing technology that, when fully developed, will far surpass the capabilities of classical computers. But although these capabilities are still years out from being realized, public and private sector leaders are already anticipating the threats that will emerge from quantum computing, and they’re working to stay ahead of the curve to protect their systems and data before it’s too late.

Thoughts on scheduled password changes (don’t call them rotations!) (Naked Security) Does swapping your password regularly make it a better password?

Design and Innovation

Investing tips from AI: A chatbot was asked to pick five stocks (This is Money) AI is having a major, disruptive impact on many walks of life - including the world of investing. But can it pick your investments?

Research and Development

Hyperdimensional Computing Reimagines Artificial Intelligence (WIRED) By imbuing enormous vectors with semantic meaning, scientists can get machines to reason more abstractly—and efficiently—than before.

The hard problem (The Economist) The final brief in our series looks at the most profound scientific mystery of all: the one that defines what it means to be human

Yuval Noah Harari argues that AI has hacked the operating system of human civilisation (The Economist) Storytelling computers will change the course of human history, says the historian and philosopher

Legislation, Policy, and Regulation

When Dragons Watch Bears: Information Warfare Trends And Implications For The Joint Force – Analysis (Eurasia Review) Over the past decade, the People’s Republic of China (PRC) has watched Russia’s employment of information warfare (IW) with great interest.

China has had a spy base in Cuba since at least 2019, US confirms (Military Times) The U.S. intelligence community has been aware of China’s effort to set up intelligence-gathering operations around the globe for some time.

Hysteria Won’t Help the U.S. Counter China’s Spy Base in Cuba (World Politics Review) The hot-button issue of great power competition between the US and China will likely fuel hysterical debates about China’s spy base in Cuba.

White House extends secure software attestation deadlines, offers clarifying guidance (Federal News Network) A memo released today extends the deadline for when agencies have to start collecting secure software attestation forms from vendors.

U.S. Federal Agencies Cut TikTok Ad Spending (The Information) Parts of the federal government are pulling back from advertising on TikTok, according to an advertising executive who works with government agencies, as the U.S. government restricts federal employees’ and contractors’ use of the app, a unit of China’s ByteDance. Last week, NASA, the Department ...

Introducing the Defense Civilian Training Corps (Federal News Network) This week, the Department of Defense launched the Defense Civilian Training Corps, a scholarship for service program designed to modernize the civilian acquisition workforce in partnership with higher…

The Gray Rhino in space: US must update military requirements for satellite cyber defense - Breaking Defense (Breaking Defense) In this op-ed, former vice-chairman of the Joint Chiefs of Staff Sandy Winnefeld and former Air Force Materiel Command head Ellen Pawlikowski call for greater, more flexible cybersecurity options for space systems.

A New Crypto Banking System Arises Under the Shadow of a Regulatory Crackdown (Bloomberg) US regional lenders step in, along with Swiss, Asian, UK firms. Scrutiny increases with SEC lawsuits against Binance, Coinbase.

FBI: FISA Section 702 'absolutely critical' (Register) No protection without surveillance?

New WA law requires clear disclosures for ‘deepfakes’ used in election media (Center for an Informed Public) Washington Gov. Jay Inslee signed a bill this spring that will require clear disclosure when manipulated or synthetic video, images, and audio, sometimes called “deepfakes,” are used in election-re…

Litigation, Investigation, and Law Enforcement

The Great Grift: How billions in COVID-19 relief aid was stolen or wasted (AP NEWS) An Associated Press analysis found that fraudsters potentially stole more than $280 billion in COVID-19 relief funding; another $123 billion was wasted or misspent. Combined, the loss represents 10% of the $4.2 trillion the U.S. government has disbursed in COVID relief aid

Indictment charging Trump with mishandling classified documents unsealed (the Guardian) Trump took steps to retain classified documents subpoenaed by the justice department, according to indictment

Opinion | A Strong Trump Indictment—but Is It Strong Enough? (Wall Street Journal) The evidence against the former president is powerful, but the jurors aren’t the only ones who will need convincing.

What might the Espionage Act mean for Donald Trump? (Reuters) To obtain a conviction against Trump, the Justice Department will need to prove beyond a reasonable doubt that he willfully retained classified documents and failed to turn them over to the government.

Opinion A shower full of secret documents leads to a solid Trump indictment (Washington Post) No one should celebrate Thursday’s indictment of Donald Trump in a case involving classified documents improperly stored at his Mar-a-Lago estate. Something has gone deeply wrong when, in a historic first, federal prosecutors reach the point of filing criminal charges against a former and possibly future president. Yet, in this matter, the defendant appears to have left them little choice.

National Security Implications of Trump’s Indictment: A Damage Assessment (Just Security) The former president's retention of highly classified intelligence has potentially grave implications for U.S. national security.

National security experts weigh in on Trump's alleged mishandling of classified documents (PBS NewsHour) Following the federal indictment of former President Donald Trump, Geoff Bennett discussed the case with two experts in national security and handling classified documents, Oona Hathaway, a former special counsel at the Pentagon, and Jamil Jaffer, who served in the National Security Division at the Justice Department and as associate counsel to President George W. Bush.

Who is Aileen Cannon, the judge assigned in Trump’s Mar-a-Lago case? (the Guardian) The Florida district judge was appointed by the ex-president three years ago and there’s no certainty she will remain on the case but her name is on the summons

Ex-Trump official's ominous warning about classified documents mishandling (Newsweek) "If you're a foreign intelligence agency, you know that Mar-a-Lago is a great target..." Elizabeth Neumann said on Sunday.

Opinion | What Donald Trump and Reality Winner Have in Common (New York Times) The president’s own Justice Department vigorously enforced the Espionage Act, sending people to prison for much less than the actions described in his indictment.

Several charged in coordinated action in business email compromise and money laundering schemes (United States Attorney's Office for the Southern District of Texas) A total of 11 people in multiple states are now in custody on charges filed in two separate business email compromise prosecutions in the Southern Districts of Texas and New York

Russian Nationals Charged With Hacking One Cryptocurrency Exchange and Illicitly Operating Another (US Department of Justice) The Justice Department unsealed charges related to the 2011 hack of the cryptocurrency exchange Mt. Gox and the operation of the illicit cryptocurrency exchange BTC-e.

DOJ charges two Russian nationals with historic Mt. Gox hack (CyberScoop) Alexey Bilyuchenko is also alleged to have conspired with a Russian man seeking to be included in a swap for an imprisoned U.S. journalist.

Russians charged with hacking Mt. Gox crypto exchange, running BTC-e (BleepingComputer) Russian nationals Alexey Bilyuchenko and Aleksandr Verner have been charged with the 2011 hacking of the leading (at the time) cryptocurrency exchange Mt. Gox and the laundering of around 647,000 bitcoins they stole.

Mt. Gox's Hackers Are 2 Russian Nationals, U.S. DOJ Alleges in Indictment (Coin Desk) One of the individuals also operated BTC-e, the DOJ alleged.

Russian nationals accused of Mt. Gox bitcoin heist, shifting stolen funds to BTC-e (Record) U.S. prosecutors unsealed charges against Alexey Bilyuchenko and Aleksandr Verner, accusing them of stealing 647,000 bitcoins from Mt. Gox and using it to underpin BTC-e from 2011 to 2017.

Reminder: The FTC “Safeguards Rule” Compliance Date is June 9 (JD Supra) The FTC’s Safeguards Rule compliance deadline is right around the corner – June 9. The Safeguards Rule requires non-banking financial institutions to...

US offers $5M reward for Swedish fugitive who sold encrypted phones monitored by FBI (Record) The U.S. State Department is offering a reward of up to $5 million for information that leads to the arrest of a 40-year-old Swedish national who acted as the administrator of an encrypted communication service used by criminal gangs worldwide.

San Francisco 49ers agree to pay out victims of 2022 data breach (Record) More than 20,000 employees and fans will be eligible for a payout from the NFL team, which the BlackByte ransomware gang attacked in February 2022.

Microsoft Sued Over Alleged Misuse of Stolen Passwords (MSN) A security firm claims the software giant violated a promise.

Opinion | Why Secrets Lost Their Sizzle (New York Times) Unlike previous leaks, the revelations in the “Discord Leaks” have largely failed to capture the American public’s attention.

Stigmatization, not loneliness, is the true national security threat (Military Times) If the takeaway from the Discord leaker is that loneliness risks national security, troops may reject getting mental health help.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

The Private Sector’s Evolving Role in Conflict—From Cyber Assistance to Intelligence (Washington, DC, USA, Jun 13, 2023) Various outside entities have engaged in the Ukraine conflict, from nations to individuals. One group has emerged as an important contributor but has not traditionally been connected with military crises: the private sector. Companies of various sizes and from different industries have engaged in the Ukraine conflict from offering products to open-source intelligence (OSINT). While the Ukraine conflict shows one example of private sector involvement in military conflict, it is imperative to consider how such companies might engage in future conflicts and think through outstanding questions in advance. Join the R Street Institute, in collaboration with the Congressional Cybersecurity Caucus and Recorded Future, for an event exploring this timely topic. It will feature a panel of diverse experts from academia, government and industry.

AWS Summit New York (New York, New York, USA, Jul 26, 2023) The cloud event for everyone. You’re invited to be part of our free, in-person event that brings together cloud enthusiasts for a day of learning, networking, and collaboration. Attend keynotes, breakout content, and interactive labs led by AWS experts, partners, and customers - and network with other industry professionals about the latest cloud computing technologies.

SANS Network Security 2023 (Las Vegas, Nevada, USA, Sep 6 - 11, 2023) At SANS Network Security 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Events

AWS re: Inforce (Anaheim, California, USA, Jun 13 - 14, 2023) Accelerated, actionable, expert-led learning. Get the security expertise you need right now. AWS re:Inforce is a security learning conference featuring AWS experts and industry-leading customers. Hear from AWS leaders and AWS Security Competency Partners including CrowdStrike, Datadog, Palo Alto Networks, Snyk, and Wiz.

The Compass Community’s Summit – ISTARI (Watford, England, United Kingdom, Jun 13 - 15, 2023) The Compass is a global community of cybersecurity experts from government, the intelligence community, venture capital funds and multinational companies, spanning sectors from professional services to energy. As a group, we explore, debate, discuss and take collective action on the forces shaping cyber resilience today and in the future — from geopolitics, deglobalisation and the march of frontier technologies like quantum computing and AI. Each summer, the ISTARI Compass Summit convenes the Compass community to explore the forces shaping cyber resilience today and in the future. This year's theme is Leadership in an Age of Uncertainty.

SecureWorld Eastern Virtual Conference (Virtual, Jun 14, 2023) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 5 CPE credits learning from nationally recognized industry leaders. The agenda offers 15+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Cyber Civil Defense Summit 2023 (Washington, DC, USA, Jun 14, 2023) The UC Berkeley Center for Long-Term Cybersecurity is pleased to host this inaugural Cyber Civil Defense Summit to bring together cyber defenders from all sectors in this common mission. This year’s theme is Innovation, and the Summit will showcase and analyze creative programs aimed at helping community organizations, including providing proactive services to bolster resilience and reactive services to enhance incident response and recovery. The Summit endeavors to join forces across defenders, academics, volunteers, and public servants to showcase replicable models of regional cyber defense.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.