Updates on Cl0p's MOVEit exploitation. Telerik advisory. Shampoo malware. Hybrid war update. Arrests and indictments.

Announcement

Join the Q2 Cybersecurity Analyst Call

We'd like to invite you to the Q2 Cybersecurity Analyst Call on Thursday, June 29th, 2023 at 2pm EST to take a look at exactly which developments and topics were the most important this quarter. Join our host, CSO, Chief Analyst, & Senior Fellow, Rick Howard, with N2K Networks President, Simone Petrella, and CISO of Centene, Alan Berry for an insightful discussion about industry events from this quarter that have made material impacts. This live event is typically a CyberWire Pro exclusive, but will be open to all readers and listeners! Be sure to submit questions and/or topics with your registration. Register now.

We also invite your feedback.

We're always looking for ways to improve the CyberWire, now N2K Cyber Network, to give you an intelligence-driven news experience that saves you time and keeps you in the know on the latest developments in cybersecurity. Please share your feedback in our 2023 Audience Survey and you will have a chance to win a $100 Amazon gift card. Take the survey.

Summary

By the CyberWire staff

At a glance.

US Government discloses exploitation of MOVEit instances.
US Department of Energy affected by Cl0p exploitation of MOVEit Transfer.
CISA and other agencies release updated advisory for Telerik vulnerabilities affecting Government IIS servers.
Shampoo, a new ChromeLoader-esque malware campaign with multiple persistence mechanisms.
Recent activity by Russian cyber auxiliaries.
The IT Army of Ukraine as an example of a cyber auxiliary.
Influence operations in the current phases of Russia's war.
Russophone gamers hit with ransomware.
Alleged LockBit operator arrested.
Federal grand jury indicts alleged Discord Papers leaker.

US Government discloses exploitation of MOVEit instances.

CISA director Jen Easterly disclosed in a press briefing yesterday that several US government agencies were compromised by the Cl0p ransomware gang via the recently disclosed MOVEit file-transfer vulnerability, the Register reports. Easterly said, “Since the vulnerability was disclosed, we have been working closely with Progress Software, with the FBI, and with our federal partners to understand prevalence within federal agencies. We are now providing support to several federal agencies that have experienced intrusions affecting their MOVEit applications.” Easterly added, “We are not aware of Clop actors threatening to extort, or release any data stolen from government agencies. Although we are very concerned about this, we're working on it with urgency. This is not a campaign like SolarWinds that presents a systemic risk to our national security or our nation's network.” She noted that the threat actors are “only stealing information that is specifically stored on your file transfer application at the precise time that the intrusion occurred.”

Early bird registration is open. Get the lowest price we offer.

US Department of Energy affected by Cl0p exploitation of MOVEit Transfer.

The US Department of Energy is among the compromised agencies. A Department spokesperson told the Register, “Upon learning that records from two DOE entities were compromised in the global cyberattack on the file-sharing software MOVEit Transfer, DOE took immediate steps to prevent further exposure to the vulnerability and notified CISA.” Federal News Network says the two compromised DOE entities are Oak Ridge Associated Universities and the Waste Isolation Pilot Plant in New Mexico.

For more on these latest developments in MOVEit vulnerability, see CyberWire Pro.

The future of security is identity and with CyberArk, the future of identity is secure.

With 84% of organizations experiencing an identity-related breach, identity is the new battlefield. As the pioneers of privileged access management, we started by protecting the most privileged users and most critical data. With intelligent privilege controls, today we’re applying the same levels of security and protection to every identity – both human and machine. CyberArk offers the most advanced identity security platform in the world, surrounding every identity with a powerful force field of continuous protection.

CISA and other agencies release updated advisory for Telerik vulnerabilities affecting Government IIS servers.

The Cybersecurity and Infrastructure Security Agency (CISA), with support from the FBI and the Multi-State Information Sharing and Analysis Center (MS-ISAC), released an updated Cybersecurity Advisory (CSA) regarding the Telerik vulnerability. The original CSA reported indicators of compromise in a Federal Civilian Executive Branch (FCEB) agency. Multiple threat actors and at least one APT were able to “exploit a .NET deserialization vulnerability (CVE-2019-18935) in Progress Telerik user interface (UI) for ASP.NET AJAX, located in the agency’s Microsoft Internet Information Services (IIS) web server.”

The updated report reports that forensic analysis at another FCEB agency identified more indicators of compromise by an unattributed APT, which exploited CVE-2017-9248 (Telerik RadControls Cryptographic Weakness), rated as “Critical” (9.8) on the CVSS scale. This vulnerability, as described by Telerik, can lead to “cross-site-scripting (XSS) attacks, leak of MachineKey, compromise of the ASP.NET ViewState, and arbitrary file uploads/downloads.” The agencies recommend patching all software, prioritizing fixes to the Known Exploited Vulnerabilities catalog. Telerik added, “Due to the .NET JavaScriptSerializer Deserialization (CVE-2019-18935) vulnerability, we strongly recommend upgrading to R1 2020 (version 2020.1.114) or later since the patches provided for CVE-2017-9248, CVE-2017-1135, CVE-2014-2217 and CVE-2017-11317 do not prevent it. Only the upgrade to R1 2020 (2020.1.114) or later can prevent the known vulnerabilities at the time of writing.”

Are you compliant yet? You better be if you want your prospects to buy.

Your prospects are demanding SOC 2 and you're not closing deals without it. Scytale's security compliance automation platform helps companies get compliant and stay compliant with frameworks like SOC 2, ISO 27001, HIPAA, GDPR and PCI-DSS without breaking a sweat.

Save hundreds of hours with streamlined compliance and dedicated support, remain compliant all year round with automated monitoring and alerts, and most importantly, boost sales by providing proof of information security to your customers.

Shampoo, a new ChromeLoader-esque malware campaign with multiple persistence mechanisms.

HP’s Wolf Security reports a newly detected malicious ChromeLoader-like malware campaign called “Shampoo.” The researchers say, “ChromeLoader is a family of Google Chrome browser extension malware first analyzed in early 2022 by security researchers. Its goal is to install a malicious extension in Google Chrome that is used for advertising.” The infection chain starts when a user downloads an iso file from a malicious website. That in turn initiates the download of a VBScript, which eventually downloads the malicious browser extension. After installation the malware monitors the victim’s searches and injects advertisements into their browser. The Shampoo malware is very difficult for a user to get rid of, as “it has multiple persistence mechanisms.” One such mechanism is a built-in installation script that repeats every thirty-five to seventy-five minutes. The report explains: “A PowerShell script run by ChromeLoader Shampoo sets up a scheduled task named ‘chrome center’ that triggers every 50 minutes. This persistence mechanism allows the malware to remain active despite reboots or the script being killed by a security tool or user. It also unregisters a list of tasks. These tasks are prefixed with ‘chrome_’, for example ‘chrome engine’, ‘chrome policy’, chrome about’. This is likely done to remove any previous or competing version of the same malware.” Shampoo differs from a standard ChromeLoader by adding some additional counter security features like encryption of locally stored files, and by its use of VBScript instead of an ISO file for initial infection.

What are your biggest resource challenges? Expel makes every investment could.

ISOs have lots to think about. Teams and tech stacks. Budgets and booming attack surfaces. Security strategies evolving to address business goals. All of the above?

Expel’s software-driven approach to managed security puts your existing tech to work across cloud (and Kubernetes!), on-prem, network, SaaS, and SIEM, automating alert analysis, prioritization, and remediation so you get better answers to what matters the most. Fast.

Optimize your tech. Support your team. Stretch your budget. Expel.

Recent activity by Russian cyber auxiliaries.

Dutch media have attributed last week's distributed denial-of-service attacks against the websites of the ports of Rotterdam and Eemshaven/Delfzijl (Groningen Seaports) to Russian hacktivists, specifically to NoName05716.

The IT Army of Ukraine as an example of a cyber auxiliary.

The IT Army of Ukraine, an acknowledged hacktivist auxiliary working against Russian targets in loose concert with Ukraine's government, offers an unusually transparent example of offensive cyber operations, hacktivism, and the mobilization of a cyber auxiliary. Lawfare summarizes some of the key features of the group's performance during Russia's war: it's demonstrated the ability to conduct "sabotage, denial of service, doxing, and defacement;" it crowd-sources its operations over Telegram; and its targeting has been opportunistic but selective.

The transparency of the IT Army's operations and relations with the Ukrainian government is relative. Kyiv has maintained that the IT Army coordinates only with civilian government agencies, not military or intelligence services, but it's clear that some coordination occurs with military and intelligence organizations. Some of that cooperation is done for deconfliction, some to receive direction, and, in a few cases, for direct combat support.

Influence operations in the current phases of Russia's war.

The IT Army of Ukraine also uses its Telegram channel to post news and opinion selected to influence its followers' views of the war. Russia has also mobilized social media to push its own narratives, most recently the narrative that Ukraine's counteroffensive has failed. That particular view seems not only false (in addition to being in any case grossly premature) but it also appears to have gained little traction, according to the Atlantic Council's DFRLab monitoring. Some of the posts that have failed to gain significant "virality" are associated with Mr. Kim Dotcom--@kimdotcom, to use his screen name. Mr. Dotcom's motivation in serving the Russian organs as a useful idiot is unclear.

Russophone gamers hit with ransomware.

Cyble Research and Intelligence Labs this week reported a ransomware campaign against Russian-speaking gamers playing the first-person-shooter, multiplayer game Enlisted. The attackers (so far unknown, but suspected of being motivated by Russia's war in Ukraine) use a ransomware they're calling Wannacry 3.0. It is, however, unrelated to the genuine Wannacry released in 2017.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Alleged LockBit operator arrested.

CyberScoop reports that a 20 year old Russian national has been arrested on charges of involvement with the LockBit ransomware gang. Ruslan Magomedovich Astamirov was taken into custody on Wednesday in Arizona, according to a criminal complaint. The charges identify the Chechnya native, Mr. Astamirov, as perpetrating at least five attacks targeting United States, Asia, Europe, and Africa-based victims between August 2020 and March 2023, the Record reports. His charges include “conspiracy to transmit ransom demands, commit wire fraud, and intentionally damage protected computers.”

BleepingComputer highlights the fact that this is the third affiliate of LockBit charged by the US Department of Justice (DOJ) within the last seven months. November 2022 saw charges against Mikhail Vasiliev, said to be in Canadian custody awaiting US extradition. Last month Mikhail Pavlovich Matveev was charged with involvement not only in LockBit attacks, but with Babuk and Hive ransomware as well.

Federal grand jury indicts alleged Discord Papers leaker.

Massachusetts Air National Guardsman Jack Teixeira has been indicted on felony charges involving leaks of classified military documents in Discord, AP News reports. Mr. Teixeira faces six counts of willful retention and transmission of national defense information.

The investigation into the leak began in April after classified US intelligence was seen circulating in social media. The former airman’s position in the Guard gave him a top-secret clearance, which allowed him to access sensitive information. Newsweek writes that he was subsequently identified by investigators and accused of sharing hundreds of pages of sensitive information on a Discord server. A conviction could mean ten years in prison and a $250,000 fine for each count of willful transmission of classified information.

The Guardian quotes US Attorney General Merrick Garland on the case: “Teixeira is charged with sharing information with users on a social media platform he knew were not entitled to receive it. In doing so, he is alleged to have violated US law and endangered our national security.”

Notes.

Today's issue includes events affecting China, the European Union, Moldova, NATO/OTAN, the Netherlands, Russia, Sweden, Turkey, Ukraine, the United Kingdom, and the United States.

Juneteenth greetings.

Monday is the US Federal holiday Juneteenth, and we won't be publishing that day. We'll be back as usual on Tuesday. In the meantime, enjoy the holiday.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+477: Targeting, kinetic and cyber. (CyberWire) With two hours' dwell time, anything that's just ten miles away can be hit. In the cyber phase of the hybrid war, a look at the role played by hacktivist auxiliaries and useful idiots.

Russia-Ukraine war: List of key events, day 478 (Al Jazeera) As the war enters its 478th day, these are the main developments.

Ukraine-Russia war latest: Kremlin bombards Kyiv during South African leader's visit (The Telegraph) Russia bombarded Kyiv with “hypersonic” missiles as African leaders arrived to meet Volodymyr Zelensky on a peace mission from the continent.

Himars strike wipes out crowd of Russian soldiers lined up to hear general's speech (The Telegraph) More than 100 troops may have been killed in occupied Ukrainian town of Kreminna after they were left waiting for hours in large numbers

Watch: Why early failures in Ukraine's counter-offensive aren't Russian victories (The Telegraph) As Ukraine begins to push Russia back, we must remember that some failed advances don't spell disaster

UN atomic watchdog chief visits embattled Ukraine nuclear plant (Military Times) A recent dam burst and Kyiv’s new counteroffensive against Russia’s invasion have heightened safety risks at the Russia-occupied Zaporizhzhia plant.

Russian War Report: Anti-Ukrainian counteroffensive narratives fail to go viral (Atlantic Council) As the Ukrainian counteroffensive continues in Ukraine's south and east, false narratives calling it unsuccessful fail to gain traction on Twitter.

NATO sees no change in Russia nuclear posture despite Belarus claims (Military Times) NATO doubts President Alexander Lukashenko's claims that Belarus has already received some tactical nuclear weapons from Moscow.

Pentagon predicts Ukraine offensive will be long and ‘very violent’ (Washington Post) The sobering forecast comes as Western military officials plot to arm Ukraine for years to come, beyond its current push to retake Russian-occupied territory

Ukraine’s fight a ‘marathon’ not a ‘sprint,’ Secretary of Defense says (Military Times) Defense Secretary Lloyd Austin urged continued support for Ukraine at the latest Ukraine Defense Contact Group meeting.

Here’s why Putin really invaded Ukraine (The Independent) Why did Russia invade Ukraine?

Putin is retreating into dangerous fantasies (The Telegraph) The Russian president is desperate to appease ultra-nationalists. But all he has left are empty gestures

Nations Step Up With New Ukraine Military Assistance (U.S. Department of Defense) Germany and Poland committed to sustaining Ukraine's new Leopard tanks, and the Netherlands and Denmark shared progress made on their plans to train pilots on fourth-generation fighter aircraft,

Ukraine allies debate how to boost support as Russia invasion drags on (Military Times) NATO members discussing how to further arm Ukraine, while charting out a path to full membership in the alliance.

US training of Ukrainian troops adequate but not perfect, IG reports (Military Times) DoD investigators found U.S. Army soldiers have met Ukrainian training needs, but not without hiccups.

What Can History Tell Us About Ukraine’s Future? (Foreign Affairs) A Conversation With Margaret MacMillan

Why Ukrainian NATO membership would actually be good for Russia (Atlantic Council) Vladimir Putin claims one of the main goals of his Ukraine invasion is to prevent the country joining NATO, but in reality this objective actually goes directly against Russia’s own national interests, writes Leonid Gozman.

Flake pours cold water on odds of Sweden joining NATO before summit (Axios) The U.S. ambassador to Turkey, former Sen. Jeff Flake (R-Ariz.), acknowledged in an interview with Axios that it’s "unlikely" Sweden will be able to join NATO before next month’s summit in Vilnius.

Putin’s man in Nato is becoming dangerous (The Telegraph) President Erdogan of Turkey can’t be allowed to block Sweden from joining the North Atlantic Alliance

The Dynamics of the Ukrainian IT Army’s Campaign in Russia (Lawfare) The Ukrainian IT Army offers a unique perspective into the choices of an offensive actor in a war.

Shuckworm: Inside Russia’s Relentless Cyber Campaign Against Ukraine (Symantec) Attackers heavily focused on acquiring military and security intelligence in order to support invading forces.

Russia sent its reserve team to wipe Ukrainian hard drives (Register) WhisperGate-spreading Cadet Blizzard painted as haphazard but dangerous crew

Cyber attacks on Rotterdam and Groningen websites (WorldCargo News) The websites of both the Port of Rotterdam and Eemshaven/Delfzijl (Groningen Seaports) were crashed in a cyber attack that is alleged to have originated in Russia.

Threat Actor Targets Russian Gaming Community With WannaCry-Imitator (Cyble) Cyble analyzes WannaCry-Imitator Ransomware, a phishing gaming site targeting the Russian Gaming community.

Hackers infect Russian-speaking gamers with fake WannaCry ransomware (Record) Researchers have uncovered a phishing campaign targeting Russian-speaking players of Enlisted, a multiplayer first-person shooter.

Moldova needs an energy overhaul (Atlantic Council) If energy security is national security, then Moldova is one of the most vulnerable countries in the world and is in need of a comprehensive energy sector overall, writes Suriya Evans-Pritchard Jayanti.

Indonesia’s Ukraine Peace Plan Makes Sense—for Indonesia (World Politics Review) Indonesia’s proposed plan to end Russia’s war in Ukraine reveals a lot about the country’s foreign policy objectives.

Ukrainian defense firms seek ties to Europe’s industry (Defense News) Kyiv is walking the line between taking foreign assistance and building a self-sufficient domestic industry.

The Other Counteroffensive to Save Ukraine (Foreign Affairs) A new European recovery program.

Putin moves to seize assets of ‘naughty’ Western companies fleeing Russia (The Telegraph) Kremlin move would make it harder for companies to leave Russia

Attacks, Threats, and Vulnerabilities

Shampoo: A New ChromeLoader Campaign (HP Wolf Security) Don’t let cyber threats get the best of you. Read our post, Shampoo: A New ChromeLoader Campaign, to learn more about cyber threats and cyber security.

'Shampoo' ChromeLoader Variant Difficult to Wash Out (Dark Reading) A new version of the infamous browser extension is spreading through files on websites offering pirated wares, and leverages unique persistence mechanisms.

Brute-forcing ButterflyMX Virtual Keys and Hacking Time Limits (Trustwave) Recently, I discovered two vulnerabilities in the ButterflyMX system which were responsibly disclosed to the vendor. The vendor has mitigated the highest-risk vulnerability, which enabled unauthorized attackers to gain access to buildings equipped with the ButterflyMX Access Control System.

Exclusive: US government agencies hit in global cyberattack (CNN) Several US federal government agencies have been hit in a global cyberattack by Russian cybercriminals that exploits a vulnerability in widely used software, according to a top US cybersecurity agency

Russian Ransomware Group Breached Federal Agencies in Cyberattack (New York Times) The top U.S. cybersecurity agency said it did not have evidence that the group was acting in coordination with the Russian government.

Companies and Governments Disclose Data Theft From Attack on File-Sharing Tool (Wall Street Journal) Companies and government offices across Europe and the U.S. say they were hit by a cyberattack on widely used file-sharing software, as hackers warned victims they would publish stolen data online unless they paid a ransom this week.

The MOVEit ransomware reckoning has begun (Washington Post) Clop’s exploitation of the MOVEit vulnerability claims government victims

US energy department, other agencies hit in global hacking spree (Reuters) The U.S. Department of Energy and several other federal agencies were hit in a global hacking campaign that exploited a vulnerability in widely used file-transfer software, officials said on Thursday.

US government agencies hit by cyberattack, official says (ABC News) U.S. government networks were hit by a cyberattack affecting several agencies, but the attack does not pose a major risk to national security, an official said Thursday

US government hit by Clop in MOVEit mass attack (Register) CISA chief tells us exploitation 'largely opportunistic', not on same level of SolarWinds

Energy Department among ‘several’ federal agencies hit by MOVEit breach (Federal News Network) Sources confirmed the Energy Department is treating it as "major incident," with other agencies uncovering intrusions as well.

A US radioactive waste storage facility was one of the targets of the global CLOP hack (Quartz) The Waste Isolation Pilot Plant was one of the two US Department of Energy entities affected

Ransomware gang lists first victims of MOVEit mass-hacks, including US banks and universities (TechCrunch) The hackers responsible for exploiting a flaw to target users of a popular file transfer tool has begun listing victims of the mass-attacks

Potential University System of Georgia security breach likely exposed access to unauthorized data (11Alive.com) The potential breach is linked to the USG's MOVEit Security File Transfer and Automation software, which is used for storing and transferring sensitive data.

Cyber attack results in data breach of all Louisiana driver licenses, IDs (wwltv.com) According to the state, the data transfer service used to send large files was targeted by cyber attackers.

Act now: Louisiana residents data exposed in OMV cyber attack (WDSU) The governor's office says there is no indication at this time that cyber attackers who breached MOVEit have sold, used, shared or released the OMV data obtained from the MOVEit attack.

Here's what to know, how to act after huge Louisiana OMV data breach (NOLA.com) As Louisiana's Office of Motor Vehicles grapples with a massive cyberattack that officials say could affect everyone with a state driver's license, they're advising people to take several steps to

Massive hack of Oregon DMV system puts estimated 3.5 million driver license and ID card info at risk, officials say (oregonlive) The Oregonian/OregonLive first made inquiries about the security breach on Wednesday; DMV officials did not respond until today.

CISA, FBI, and MS-ISAC Update Joint CSA on Progress Telerik Vulnerabilities (Cybersecurity and Infrastructure Security Agency CISA) Today, CISA, the Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC) released an update for joint Cybersecurity Advisory (CSA) Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server.

Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server (Cybersecurity and Infrastructure Security Agency CISA) From November 2022 through early January 2023, the Cybersecurity and Infrastructure Security Agency (CISA) and authoring organizations identified the presence of indicators of compromise (IOCs) at a federal civilian executive branch (FCEB) agency.

US Organizations Paid $91 Million to LockBit Ransomware Gang (SecurityWeek) LockBit ransomware operators launched 1,700 attacks in the US and received roughly $91 million in ransom payments.

A Shady Chinese Firm’s Encryption Chips Got Inside NATO and NASA (WIRED) The US government warns encryption chipmaker Hualan has suspicious ties to China’s military. Yet US agencies still use one of its subsidiary’s chips, raising fears of a backdoor.

How cybercriminals target energy companies (Help Net Security) This video discusses how cybercriminals employ specialized strategies when targeting energy companies around the world.

What makes hospitals and healthcare organizations attractive targets for cybercriminals? (TheHealthSite) Cyberattacks on hospitals and healthcare organizations are becoming more common these days. Why healthcare is being targeted frequently for cyberattacks?

Security Patches, Mitigations, and Software Updates

MOVEit Transfer Critical Vulnerability – CVE Pending (June 15, 2023) (Progress Customer Community) Progress has discovered a vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment. If you are a MOVEit Transfer customer, it is extremely important that you take immediate action as noted below in order to help protect your MOVEit Transfer environment.

Progress Software Releases Security Advisory for MOVEit Transfer Vulnerability (Cybersecurity and Infrastructure Security Agency CISA) Progress Software has released a security advisory for a privilege escalation vulnerability in MOVEit Transfer—a Managed File Transfer Software. A cyber threat actor could exploit this vulnerability to take control of an affected system.

Barracuda Email Security Gateway Appliance (ESG) Vulnerability (Barracuda) Barracuda ESG Appliance Vulnerability Status Update

Barracuda Networks Releases Update to Address ESG Vulnerability (Cybersecurity and Infrastructure Security Agency CISA) Barracuda Networks has released an update to their advisory addressing a vulnerability—CVE-2023-2868—in their Email Security Gateway Appliance (ESG). According to Barracuda, customers should replace impacted appliances immediately.

CISA Releases Fourteen Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency CISA) CISA released fourteen Industrial Control Systems (ICS) advisories on June 15, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

Trends

Industry Insights Report Reveals Top Cyber Threats in the Retail & Hospitality Sector (RH-ISAC) Credential harvesting, ransomware, and phishing represent the largest share of threats facing the community, according to data from Verizon and the Retail & Hospitality ISAC.

Insider Threats in Healthcare (Avertium) Whether intentional or negligent, let’s explore insider threats in healthcare and how healthcare organizations can remain safe.

Proofpoint’s 2023 Human Factor Report: Threat Actors Scale and Commoditize Uncommon Tools and Techniques (GlobeNewswire News Room) New research provides an in-depth analysis of the modern attack chain and today’s biggest threats...

Threat actors scaling and commoditising uncommon tools and techniques finds Proofpoint research (ITWire) Cybersecurity and compliance company Proofpoint has released its annual Human Factor report, revealing 2022 was back-to-business for the world's cybercriminals, but also showed they found new ways to make a living. Proofpoint's Human Factor report found after two years of pandemic-induced di...

Marketplace

Future of Privacy Forum Recognizes Two Privacy and Technology Leaders with Career Awards (Future of Privacy Forum) The Future of Privacy Forum (FPF) — presented Maneesha Mithal, a long-time leader in privacy and consumer protection at the Federal Trade Commission, the Distinguished Public Service Award, and Jane Horvath, Apple’s former Chief Privacy Officer and a privacy and technology trailblazer of more than two decades, the Career Achievement Award.

Axio Experiences Significant Customer Momentum, Appoints Industry Veterans to Accelerate Rapid Global Growth (Business Wire) Energy Executive Felipe Bayón Joins as Special Advisor to Help Drive Leadership Position in Emerging Markets

Cybersecurity firm goes internal for new chief operating officer (BusinessCloud) Cambridge-based Trustonic has promoted Suzie Smith to COO after first joining the company in 2020 as chief marketing officer

Products, Services, and Solutions

Solidus Labs Taps Forta Network to Enhance Fraud Protections for DeFi Investors (News Direct) Solidus Labs Taps Forta Network to Enhance Fraud Protections for DeFi Investors

Bluescape's FedRAMP-Authorized Digital Workbench Available Through Carahsoft's Public Sector Contract Vehicles (Benzinga) Carahsoft will serve as Bluescape's Master Government Aggregator®, making the company's industry leading digital workbench platform available to Government agencies through Carahsoft's reseller partners, GSA

Cyberattacks And Supply Chain Disruptions Put Focus On FiscalNote’s (NYSE: NOTE) Dragonfly Security Intelligence To Help Leading Organizations Build Resilience Through Intelligence | News Direct (News Direct) Cyberattacks And Supply Chain Disruptions Put Focus On FiscalNote’s (NYSE: NOTE) Dragonfly Security Intelligence To Help Leading Organizations Build Resilience Through Intelligence

Introducing Mayhem Security‍ (Mayhem) Today, we’re proud to announce a completely re-imagined Mayhem and the debut of Mayhem.security - a central home for everything Mayhem-related.

Absolute Software Adds Secure Web Gateway Service to its Differentiated Security Service Edge Solution (Absolute) Absolute Software announced the expansion of its differentiated Security Service Edge (SSE) solution with the launch of the Absolute Secure Web Gateway Service.

Coalition Releases Security Vulnerability Exploit Scoring System (Business Wire) Coalition ESS Uses AI to Generate Dynamic Risk Scores to Help Organizations Mitigate Their Most Critical Risks Faster

Torq Delivers Cybersecurity’s Highest-Upside  Partner Program With Guaranteed Margins Up to 25% (Torq) New Torq Partner Acceleration Program provides 100% transparency and eliminates burdensome “precious metals” leveling to incentivize ecosystem and ignite global co-selling opportunities New York, NY, June 15, 2023—Torq, the security...

Veza Reaches Milestone 100 Integrations to Secure Identity Access… (Veza) Veza Integration Ecosystem Enables Faster Deployment for the Enterprise PALO ALTO, CA – June 15, 2023 – Veza , the identity security company, today announced support for 100 integrations across cloud providers, SaaS apps, data systems, and custom and on-premise applications, to accelerate…

GitLab Dedicated single-tenant SaaS now generally available (GitLab) Last year, we launched the Limited Availability release of GitLab Dedicated, a fully managed, single-tenant SaaS deployment of our comprehensive DevSecOps platform designed to address the needs of customers with stringent compliance requirements.

Technologies, Techniques, and Standards

ICS attack classifications: differentiating between Cyberwarfare, Cyberterrorism, & Hacktivism (Outpost24 blog) ICS attacks and how properly managed threat classifications can help harden cybersecurity defenses.

4 Things People Get Wrong About Zero Trust Security (Virtual Strategy) Some know it as “never trust, always verify,” while others in the form of the Russian proverb “trust but verify”. Here, we talk about the concept of zero trust in cybersecurity.

Six meaningful benefits of modernising SOCs (ITWeb) The benefits translate into increased defensive and offensive security for the enterprise and its SecOps teams, as well as reducing risk and security costs for the company.

Red teaming can be the ground truth for CISOs and execs (Help Net Security) While cyber is a priority in boardrooms, execs have still yet to take full responsibility for their security posture and deploy red teams.

Design and Innovation

DOD Committed to Ethical Use of Artificial Intelligence (U.S. Department of Defense) A top Pentagon technology official underscored the U.S. commitment to leading the international conversation surrounding artificial intelligence during a panel discussion in Washington.

Research and Development

IBM Announces Its Achievement of a New Breakthrough in Quantum Computing, Demonstrating Capabilities Surpassing Supercomputing (LatestLY) Tech major IBM has announced a new breakthrough in quantum computing, demonstrating for the first time that quantum computers can produce accurate results at a scale of more than 100 qubits reaching beyond leading classical supercomputing.

Legislation, Policy, and Regulation

The world’s regulatory superpower is taking on a regulatory nightmare: artificial intelligence (Atlantic Council) Atlantic Council experts answer the most pressing questions on the EU's AI Act, including what's in it, when it could become law, and what it means for the world.

Breton urges more EU countries to ban Huawei, ZTE from networks (Reuters) EU industry chief Thierry Breton on Thursday urged more EU countries to join the 10 that have restricted or banned China's Huawei (HWT.UL) and ZTE from their 5G telecoms networks, citing risks to the bloc's collective security.

EU tells members to ban Huawei and ZTE over ‘materially higher risks’ (South China Morning Post) Decision to publicly go after blue-chip 5G providers reflects Brussels’ frustration with the bloc’s slow pace of change in ensuring network security.

Banning Huawei and ZTE from 5G networks 'justified', EU says (euronews) European Commissioner Thierry Breton said that more EU member states needed to implement the bloc's cybersecurity guidelines.

Who’s Afraid of the SEC? (DFRLab) The SEC wants to require fast, public disclosure of cybersecurity incidents. These rules could benefit investors—and the cyber ecosystem.

Impacts of the National Cybersecurity Strategy on Government and Private Sector Collaboration (Lexology) On March 2, 2023, the Biden-Harris Administration released the National Cybersecurity Strategy.[i] The highly anticipated Strategy has illuminated…

Litigation, Investigation, and Law Enforcement

Court unseals long-awaited election security reports (Washington Post) Voting machine security reports highlight ongoing fight

The Law Is Coming for AI—But Maybe Not the Law You Think (The Information) While the approval of the AI Act in the European Parliament on Wednesday will no doubt go down in history as a day of reckoning for generative artificial intelligence, it was not the first. That honor belongs to March 31, when, citing a lack of compliance with various European data protection ...

Guardsman indicted on charges of disclosing classified national defense information (AP News) The Massachusetts Air National Guardsman accused of leaking highly classified military documents has been indicted on federal felony charges, the Justice Department said Thursday.

Jack Teixeira, Pentagon leaks suspect, indicted by federal grand jury (the Guardian) US airman charged with six counts of retention and transmission of classified documents relating to national defense, DoJ says

Charges against alleged Pentagon leaker Jack Teixeira explained (Newsweek) Teixeira, 21, is accused of leaking hundreds of pages of classified Pentagon documents to an online group chat on the social media platform Discord.

Suspected LockBit ransomware affiliate arrested, charged in US (BleepingComputer) Russian national Ruslan Magomedovich Astamirov was arrested in Arizona and charged by the U.S. Justice Department for allegedly deploying LockBit ransomware on the networks of victims in the United States and abroad.

Russian national arrested in Arizona, charged for alleged role in LockBit ransomware attacks (CyberScoop) The group is one of the most prolific ransomware gangs, responsible for an estimated $91 million paid by U.S. victims.

NH residents file class action lawsuits against Harvard Pilgrim over data breach (NH Business Review) After an April cybersecurity incident compromised millions of customers’ data, some of those affected are taking legal action.

Capita faces lawsuit over data breach (Business Insurance) Law firm Barings Ltd. has launched legal proceedings against U.K.-based business process outsourcing company Capita P.L.C. on behalf of clients who suspect that their personal data may have got compromised during a cyber attack earlier this year, Professional Pensions reported. Investigations by Barings found alarming potential breaches of personal data, including emails, home addresses and compromised passports. The cyber attack also targeted pensions which were administered through Capita’s systems.

Hospital data breach triggers two class-action lawsuits - Iowa Capital Dispatch (Iowa Capital Dispatch) An Iowa hospital chain is facing lawsuits over a cyberattack that may have given hackers access to information on more than 20,000 patients.

Florida-based dental insurer sued after hackers steal info about 8.9 million people (Yahoo News) It doesn’t take long after announcing a data breach for companies to become targets of class-action lawsuits. One such company, Miramar, Florida-based Managed Care of North America Dental, reported on May 26 that it suffered a ransomware breach between Feb. 26 and March 7 that affected 8.9 million individuals. MCNA Dental is the nation’s largest dental insurer for government-funded Medicaid, ...

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

CYBER.ORG EdCon 23 (Mesa, Arizona, USA, Jun 20 - 22, 2023) CYBER.ORG EdCon 23 (formerly CEDF) is a national conference designed to inspire and empower novice and expert K-12 cybersecurity educators alike. Attendees will have the opportunity to: learn ready-to-implement lessons from CYBER.ORG curriculum developers, explore at-no-cost resources from industry experts, and gain firsthand knowledge from K-12 educators teaching foundational and technical cybersecurity.

Infosecurity Europe (London, England, UK, Jun 20 - 22, 2023) Infosecurity Europe is the meeting place for the industry’s finest minds, most important names and biggest ideas. Delivering expertise and knowledge from the world’s most celebrated cybersecurity experts, it’s a huge opportunity to connect with suppliers to find true solutions. 2022 saw us bring together industry peers to network, share and ultimately, grow stronger and more resilient together, and we’d love to see you in 2023.

Women in Cybersecurity at Infosecurity Europe 2023 (London, UK, Jun 21, 2023) Infosecurity Magazine is excited to be hosting the seventh annual Women in Cybersecurity networking event at Infosecurity Europe on Wednesday 21 June 2023 Men still outnumber women in cybersecurity by three to one and overall representation of women in the sector is hovering at around 24%, according to (ISC)2’s Women in Cybersecurity report. That’s why it continues to be important to champion the achievements of women in our sector, build bridges with allies in the information security world and empower women both at the start of their careers and progressing up the ladder. Hosted by Infosecurity Magazine Editor, Beth Maundrill, this exclusive event will consist of networking, an exciting keynote presentation and a panel discussion featuring some of the industry’s most inspiring women.

SecureWorld Government Virtual Conference (Virtual, Jun 21, 2023) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 5 CPE credits learning from nationally recognized industry leaders. The agenda offers 15+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

CYBERJUTSU CON 4.0 and the 10th Annual Cyberjutsu Awards (TBD, Jun 24, 2023) Join us on June 24th as we learn, grow, and build together. Cyberjutsu Con will consist of Hands-on Workshops, Capture The Flag (CTF) Competitions, Professional Headshots, Recruiting Opportunities, Celebration, and more. Participants will walk away with hands-on knowledge that can be applied immediately on the job.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.