Recent cyberespionage campaigns. New infection vectors for Mirai. A Cozy Bear sighting. Anonymous Sudan (from Russia).

Announcement

Join the Q2 Cybersecurity Analyst Call

We'd like to invite you to the Q2 Cybersecurity Analyst Call on Thursday, June 29th, 2023 at 2pm EST to take a look at exactly which developments and topics were the most important this quarter. Join our host, CSO, Chief Analyst, & Senior Fellow, Rick Howard, with N2K Networks President, Simone Petrella, and CISO of Centene, Alan Berry for an insightful discussion about industry events from this quarter that have made material impacts. This live event is typically a CyberWire Pro exclusive, but will be open to all readers and listeners! Be sure to submit questions and/or topics with your registration. Register now.

We also invite your feedback.

We're always looking for ways to improve the CyberWire, now N2K Cyber Network, to give you an intelligence-driven news experience that saves you time and keeps you in the know on the latest developments in cybersecurity. Please share your feedback in our 2023 Audience Survey and you will have a chance to win a $100 Amazon gift card. Take the survey.

Summary

By the CyberWire staff

At a glance.

Update on Barracuda ESG exploitation.
Camaro Dragon’s current cyberespionage tools spread through infected USB drives.
Mirai update: new infection vectors.
Microsoft Threat Intel report: Midnight Blizzard, a Russian SVR threat actor.
Ukraine experiencing a "wave" of cyberattacks during its counteroffensive.
"Anonymous Sudan" is neither.
Proof-of-concept: Microsoft Teams as potential attack vector.

Update on Barracuda ESG exploitation.

Proofpoint has tweeted updates on exploitation of CVE-2023-2868, a vulnerability found in Barracuda's Email Security Gateway (ESG). UNC4841, the "aggressive and highly skilled actor conducting targeted activity" is believed to be acting on behalf of the Chinese government. Its targets, geographically, have been, from the most to least frequently affected, the United States, Norway, Taiwan, and Poland. By sector, UNC4841 has been most interested in academic institutions, defense establishments, and the US Federal Government.

Michael Raggi, Staff Threat Research Engineer at Proofpoint, explained. “Proofpoint has observed intermittent exploitation attempts by Chinese state-aligned threat actor UNC4841 targeting CVE-2023-2868 from October 2022 through May 29, 2023. This vulnerability was being actively used in the wild by an APT actor as recently as three weeks ago. While the phishing campaigns involved conventional espionage operations, the threat actor also exhibited a sustained focus on scientific research, energy entities, and public health data which demonstrates a more complex tasking than initially disclosed publicly. This zero-day vulnerability continues an increasing trend of vulnerable email gateway appliances being exploited via advanced exploits contained within phishing emails.”

Barracuda has issued both mitigations and patches.

The future of security is identity and with CyberArk, the future of identity is secure.

With 84% of organizations experiencing an identity-related breach, identity is the new battlefield. As the pioneers of privileged access management, we started by protecting the most privileged users and most critical data. With intelligent privilege controls, today we’re applying the same levels of security and protection to every identity – both human and machine. CyberArk offers the most advanced identity security platform in the world, surrounding every identity with a powerful force field of continuous protection.

Camaro Dragon’s current cyberespionage tools spread through infected USB drives.

Check Point Research released a report focusing on a USB-propagated malware campaign that it attributes to the Chinese-based espionage group Camaro Dragon. The Check Point Research Incident Response Team (CPIRT) discovered the malware while investigating an incident in a European hospital earlier this year. “The investigation showed that the malicious activity observed was likely not targeted but was simply collateral damage from Camaro Dragon’s self-propagating malware infections spreading via USB drives.” Patient Zero, as CPR calls the first victim, initially received the infection while attending a conference in China and connecting a USB drive to a colleague's already infected computer.

The malware hides all of the victim’s files on the drive and shows a program that appears to merely display the files, but which launches a backdoor in the background. The tools involved in the infection, WispRider and HopperTick, seem to align with other tools used by Camaro Dragon, including TinyNote (a Go-based backdoor) and HorseShell (a malicious router firmware).

The malware spreads through human interaction with infected machines. Check Point writes, “The ability to propagate autonomously and uncontrollably across multiple devices enhances this threat’s reach and potential impact. This approach not only enables the infiltration of potentially isolated systems but also grants and maintains access to a vast array of entities, even those that are not primarily targeted.” The researchers have since noticed several newer variations of these backdoors, all seeming to originate in Southeast Asia. Check Point reports that Camaro Dragon uses its own FTP servers and third-party services like Google Drive to exfiltrate data.

Wish you had a cheat sheet for AWS investigations? Expel created one!

We remediate loads of cyber incidents in Amazon Web Services (AWS), and some common themes have emerged re: attacker use of APIs. We’ve noticed they map nicely to MITRE ATT&CK tactics.

So we captured them in a mind map of possible attack paths once hackers are inside an AWS environment. This resource should be helpful if you ever find yourself chasing a baddie through the cloud and want to catch them sooner than later.

Mirai update: new infection vectors.

A version of the Mirai botnet is exploiting vulnerabilities affecting D-Link, Arris, Zyxel, TP-Link, Tenda, Netgear, and MediaTek devices, BleepingComputer reports. According to Palo Alto Networks’ Unit 42, “The threat actors have the ability to gain complete control over the compromised devices, integrating those devices into the botnet. These devices are then used to execute additional attacks, including distributed denial-of-service (DDoS) attacks.”

Akamai has observed Mirai botnet samples exploiting CVE-2023-26801, a command injection vulnerability affecting certain versions of LB-LINK wireless routers. The researchers stated, “This can lead to various security risks, including unauthorized access, device compromise, and further exploitation within the network.”

Are you compliant yet? You better be if you want your prospects to buy.

Your prospects are demanding SOC 2 and you're not closing deals without it. Scytale's security compliance automation platform helps companies get compliant and stay compliant with frameworks like SOC 2, ISO 27001, HIPAA, GDPR and PCI-DSS without breaking a sweat.

Save hundreds of hours with streamlined compliance and dedicated support, remain compliant all year round with automated monitoring and alerts, and most importantly, boost sales by providing proof of information security to your customers.

Microsoft Threat Intel report: Midnight Blizzard, a Russian SVR threat actor.

Microsoft has released a new intelligence profile on a Russian Foreign Intelligence Service (SVR) threat actor it now calls Midnight Blizzard (formerly NOBELIUM). This threat actor targets government agencies, non-governmental organizations, and diplomatic personnel in an intelligence gathering operation. Microsoft writes, “They utilize diverse initial access methods ranging form stolen credentials to supply chain attacks, exploitation of on-premise environments to laterally move to the cloud, exploitation of service providers’ trust chain to gain downstream customers, as well as ADFS malware known as FOGGYWEB and MAGICWEB. Midnight Blizzard is tracked by partner security companies as APT29, UNC2452, and Cozy Bear.” Midnight Blizzard uses a “cyber fire-and-maneuver” technique, moving between low-reputation IP addresses that are used for only a short period of time. This helps them obfuscate their operations. In response to this threat actor Microsoft announced that it has added protections to Defender Antivirus, Defender for Endpoint, Defender for Cloud Apps, and Azure Active Directory.

Ukraine experiencing a "wave" of cyberattacks during its counteroffensive.

US Deputy National Security Advisor Anne Neuberger told the FT Cyber Resilience Summit yesterday, “We know Ukraine is currently experiencing a significant surge in cyberattacks in parallel to the kinetic aspects.” The Record reports that she specified neither the scope of the attacks nor the sectors that were receiving hostile attention.

"Anonymous Sudan" is neither.

There's a growing consensus that Anonymous Sudan, which represents itself as a hacktivist organization with Islamist sympathies operating in Sudan, is neither an Anonymous affiliate nor Sudanese. Cybernews summarizes the evidence that points to the group's status as a KillNet affiliate, which means in turn that it's working for the Russian intelligence services. Much of the evidence leading to the conclusion that Anonymous Sudan is a Russian front group comes from research by Australian security firm CyberCX, and Anonymous Sudan wasn't happy about being outed. The group yesterday said it had conducted a distributed denial-of-service (DDoS) attack against CyberCX's website (no signs of disruption this morning), explaining, "The reason for the attack: stop spreading rumors about us, and you must tell the truth and stop the investigations that we call the investigations of a dog." The "dog" insult is a nice but too obvious gesture toward the culture of the Sahel, but, really, few will be deceived. Straight up, Anonymous Sudan is Russian.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Proof-of-concept: Microsoft Teams as potential attack vector.

Researchers at Jumpsec have discovered a way to use Microsoft Teams as a vector for malware delivery, BleepingComputer reports. Researcher Max Corbridge explains, “Exploitation of the vulnerability was straightforward using a traditional IDOR technique of switching the internal and external recipient ID on the POST request.” Corbridge adds, “When sending the payload like this, it is actually hosted on a Sharepoint domain and the target downloads it from there. It appears, however, in the target inbox as a file, not a link.”

Microsoft acknowledged the vulnerability, but told Jumpsec that it “did not meet the bar for immediate servicing.”

Dror Liwer, co-founder of Coro, stated, “While we normally hear about email as the most common entry point for attackers, we see Teams, Slack, and other messaging platforms as a quickly developing vector. Attackers will always look for a path of least resistance, and while email has been a very lucrative method, less people expect an attack through Teams, and as such are more easily targeted.”

Notes.

Today's issue includes events affecting Australia, Canada, China, Japan, Romania, Russia, Taiwan, Ukraine, the United Kingdom, and the United States.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+484: Missile strikes, cyberattacks, and (allegedly) wicked counselors. (CyberWire) 36,000 Western-trained Ukrainian troops prepare to enter battle.

Russia Detains Five It Claims Tried To Buy Nuclear Material To Discredit Moscow (RadioFreeEurope/RadioLiberty) Moscow says it has detained several people it claims are linked to Ukraine who were trying to buy radioactive material and smuggle it out of the country to cause an incident "to discredit Russia."

Zelensky says Russia is planning to sabotage Zaporizhzhia nuclear plant (Washington Post) Ukrainian President Volodymyr Zelensky warned Thursday that Russian forces were preparing a “terrorist act” at the Zaporizhzhia nuclear plant, Europe’s largest atomic power station, as officials in Moscow said the head of the U.N. nuclear watchdog agency, Rafael Mariano Grossi, would travel to Russia to meet with nuclear authorities on Friday.

Ukraine Says It Fends Off Missile Strike On Airfield Amid 'Massive' Wave Of Russian Attacks (RadioFreeEurope/RadioLiberty) An attempted Russian air strike on a Ukrainian airfield was parried by Ukraine's air defenses, the military said on June 23, as Moscow launched more swarms of missiles and Iranian-made drones in what the General Staff said was another "massive" overnight wave of attacks.

Russia accuses Ukraine of using UK-supplied missiles to strike bridge to Crimea (the Guardian) Chonhar Bridge is one of a handful of infrastructures linking Crimea with the mainland

Russia says it downed 3 drones outside Moscow, suspects it was attack by Ukraine (AP NEWS) Russian authorities say two drones have crashed outside Moscow as they were approaching the warehouses of a local military unit. Russian media reported Wednesday that the wreckage of a third drone was found about 12 miles away. Russia’s Defense Ministry says the drones were brought down using radio-electronic means. No damage or casualties are being reported. The drones could be the latest attempt by Ukraine to strike targets inside Russia as their war approaches its 17th month. Ukrainian officials have made no comment. Russian media are also reporting that rail lines have been blown up on the Crimean Peninsula in apparent sabotage operations.

Ukraine’s Western-Trained Brigades Begin to Enter the Fight (New York Times) The arrival of new units could be pivotal. But progress has been slow for Ukraine in the early stage of its counteroffensive.

Official Says Ukraine Well Prepared to Liberate Russian-Occupied Territory (U.S. Department of Defense) DOD's objective regarding Ukraine is to ensure the existence of a free, prosperous and democratic Ukraine that can defend itself and deter further Russian aggression, the deputy assistant secretary of

Ukraine intensifies pressure in long-shot push for NATO membership (The Hill) Ukrainian officials are pounding the drumbeat for full NATO membership, putting unrelenting pressure on the U.S. and allies to give in and view as precedent their success in receiving F-16 fighter …

Ukrainian President Fires Ambassador To Belarus (RadioFreeEurope/RadioLiberty) Ukrainian President Volodymyr Zelenskiy has dismissed Ihor Kyzym from the post of ambassador to Belarus.

Wagner chief accuses Russian top brass of lying to Putin (The Telegraph) Total trash is being put on the president’s desk, claims Yevgeny Prigozhin

Neuberger: Ukraine experiencing a ‘surge’ in cyberattacks as it executes counteroffensive (Record) Moscow has ramped up its digital assault on Ukraine as a result of Kyiv’s long-awaited counteroffensive to retake Russian-occupied territory, according to a senior White House official.

Microsoft warns of rising NOBELIUM credential attacks on defense sector (HackRead) The NOBELIUM hackers have been linked to Russia and are known for targeting the SolarWinds hack in 2021.

Anonymous Sudan: neither anonymous nor Sudanese (Cybernews) Microsoft Outlook, UPS, and Scandinavian Airlines all fell victim recently to attacks by the group known as Anonymous Sudan. However, experts we’ve spoken to believe the group is most likely a pro-Kremlin pet project for spreading a pro-Russian agenda.

Sachkov's Revenge: Jailed On Treason Charges, A Russian Cybersecurity Exec Goes On The Offensive (RadioFreeEurope/RadioLiberty) Jailed for nearly two years on treason charges that surprised Russia’s IT community, cybersecurity executive Ilya Sachkov throws an unusual public punch, with a "name-and-shame" video accusing the Federal Security Service of a destructive, misguided campaign targeting the wrong people.

Attacks, Threats, and Vulnerabilities

Beyond the Horizon: Traveling the World on Camaro Dragon’s USB Flash Drives (Check Point Research) Executive summary Introduction In early 2023, CPIRT investigated an incident at a European hospital. The investigation showed that the malicious activity observed was likely not targeted but was simply collateral damage from Camaro Dragon’s self-propagating malware infections spreading via USB drives. Camaro Dragon is a Chinese-based espionage threat actor whose operations are actively focused on […]

Chinese malware accidentally infects networked storage (Register) Hides itself from popular Asian AV, also uses games to do its dirty work

Microsoft Teams bug allows malware delivery from external accounts (BleepingComputer) Security researchers have found a simple way to deliver malware to an organization with Microsoft Teams, despite restrictions in the application for files from external sources.

Akamai SIRT Security Advisory: CVE-2023-26801 Exploited to Spread Mirai Botnet Malware (Akamai) Akamai researchers identified an active exploitation of CVE-2023-26801, a critical command injection vulnerability discovered in March 2023 (CVSS 9.8).

Mirai botnet targets 22 flaws in D-Link, Zyxel, Netgear devices (BleepingComputer) A variant of the Mirai botnet is targeting almost two dozen vulnerabilities aiming to take control of D-Link, Arris, Zyxel, TP-Link, Tenda, Netgear, and MediaTek devices to use them for distributed denial-of-service (DDoS) attacks.

Microsoft 365 users report Outlook, Teams won't start or freezes (BleepingComputer) Network and IT admins have been dealing with ongoing Microsoft 365 issues this week, reporting that some end users cannot use Microsoft Outlook or other Microsoft 365 apps.

10 banks alleged victims of ransomware attacks on file transfer software (American Banker) Ransomware gang Cl0p is currently threatening 50 companies with releasing data it stole from them late last month.

Japan’s digital ID gets emergency review amid data leaks (Register) PM wants response as urgent as that mustered for COVID-19

Massive data breach impacts CalPERS and CalSTRS, the nation’s biggest public pensions funds (KCRA) The vendor helps CalPERS identify member deaths and make sure that correct payments go to retirees and their beneficiaries.

BlackCat gang threatens to leak plastic surgery photos (Register) Sharing a cancer patient's nude snaps earlier wasn't enough for these scumbags

Hospital’s Cyber Attack Shows What Disruption Looks Like (GovTech) After the attack, the staff at Johnson Memorial suddenly had to revert to low-tech ways of patient care. They relied on pen and paper for medical records and notes, and sent runners between departments to take orders and deliver test results.

US Military Personnel Receiving Unsolicited, Suspicious Smartwatches (SecurityWeek) The US army says soldiers says unsolicited, suspicious smartwatches are being sent to soldiers, exposing them to malware attacks.

Security Patches, Mitigations, and Software Updates

CISA Releases Four Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency CISA) CISA released four Industrial Control Systems (ICS) advisories on June 22, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

Apple Releases Security Updates for Multiple Products | CISA (Cybersecurity and Infrastructure Security Agency CISA) Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected device.

Juniper Networks Releases Security Advisory for Junos OS and Junos OS Evolved (Cybersecurity and Infrastructure Security Agency CISA) Juniper Networks has released a security advisory that addresses a vulnerability in Junos OS and Junos OS Evolved. A remote attacker could exploit this vulnerability to cause a denial-of-service condition.

ISC Releases Security Advisories for Multiple Versions of BIND 9 (Cybersecurity and Infrastructure Security Agency CISA) The Internet Systems Consortium (ISC) has released security advisories that address vulnerabilities affecting multiple versions of the ISC’s Berkeley Internet Name Domain (BIND) 9. A remote attacker could exploit these vulnerabilities to potentially cause denial-of-service conditions.

Trends

The bored teenagers who can disrupt the world (The Spectator Australia) Most of us live a strange double life when it comes to hacking. We read headlines saying that our toaster might spy on us, that Russia is trying to hack into our social media, and that society as a…

Marketplace

NYC's First Cyber Academy Cohort Looks Back (GovTech) The cybersecurity upskilling program is educating its second cohort, tweaking the material with lessons learned from the first go-round. Graduates spoke highly of the trainings — and the offers of more.

Devo Names Trevor Crompton Area Vice President of EMEA (PR Newswire) Devo Technology, the cloud-native security analytics company, today announced the leadership appointment of Trevor Crompton as Area Vice...

Barracuda welcomes Siroui Mushegian as CIO (PR Newswire) Barracuda Networks, Inc., a trusted partner and leading provider of cloud-first security solutions, today announced Siroui Mushegian as its new...

Forcepoint Appoints Ryan Windham as Senior VP of Business Transformation, Driving Data-first SASE Adoption (Business Wire) Windham brings 20+ years of cyber and AI leadership experience to accelerate Forcepoint ONE technology innovation and global growth through customer-first operational excellence

Products, Services, and Solutions

New infosec products of the week: June 23, 2023 (Help Net Security) The featured infosec products this week are from: Cymulate, Edgescan, ESET, iStorage, and Netskope.

Dasera Introduces Free 'Ski Lift,' Elevating Data Security and Governance for Snowflake Users (Business Wire) Automated, Self-Service Data Security and Governance Now Available for Snowflake Users – At No Cost

LastPass Unveils its Channel Partner Program and Commitment to a Partner-Centric Community (Business Wire) Allegiance Partner Program designed to help LastPass partners boost profitability and improve password management for their small, medium and enterprise-sized customers

Enrich More With Splunk 4.4 - DomainTools | Start Here. Know Now. (DomainTools) Updates to the DomainTools app for Splunk provide deeper insights into network infrastructure to proactively identify security threats

[News] Bitdefender Expands Cybersecurity Partnership with Ferrari (Bitdefender) Bitdefender has expanded its partnership with Ferrari S.p.A., to provide Bitdefender Advanced Threat Intelligence to the company’s worldwide operations. Ferrari S.p.A. will integrate Bitdefender Advanced Threat Intelligence into its security operations center (SOC) to help Ferrari security analysts more quickly validate and triage alerts, improve threat hunting and speed incident response.

EnGenius Empowers Businesses with Safety and Controls with its New Power Distribution Line of Products (PR Newswire) EnGenius Technologies Inc., a leading provider of cutting-edge connectivity solutions, expands its product ecosystem with a new Power...

Inspira Enterprise Launches State-of-the-art Cyber Fusion Center in Dallas (PR Newswire) Inspira Enterprise, Inc. announced today the opening of its fourth Cyber Fusion Center (CFC) and Customer Experience Center (CEC) to expand its...

Introducing The Modern CISO Network: Board Book (Lacework) Lacework has officially launched the first edition of The Modern CISO Network: Board Book, a directory of cybersecurity leaders who are ready and willing to provide their expertise to organizations and boards.

Caveonix Strengthens Organizations’ Defense Against MOVEit Vulnerabilities (GlobeNewswire News Room) Caveonix, the industry’s leading unified platform for hybrid multicloud governance, compliance, and...

Tanium Platform Advances Threat Identification Capabilities and Enhances Endpoint Reach (Tanium) Award-winning XEM Platform Introduces advanced SBOM capabilities, expanded ARM support, and additional Risk & Compliance improvements

Silobreaker unveils new geopolitical cyber threat intelligence capabilities (CSO Online) Silobreaker integrates RANE geopolitical intelligence to warn security teams of world events that could heighten the risk of cyberattacks.

Zscaler unveils cybersecurity innovations for its zero trust platform (SecurityBrief Australia) These new services transform secure branch connectivity and provide continuous monitoring and threat detection for identity-based attacks.

Next up for AI: cybersecurity (TechHQ) AI cybersecurity technology was unveiled by Zscaler at Zenith Live Las Vegas 2023. Here's our rundown of the solutions on offer.

Celerium Announces Compromise Defender™ Solution with Defensive Support Against Cl0p/MOVEit Ransomware Threats (PR Newswire) Celerium Inc., a leading cyber defense company, today announces the release of its latest cybersecurity solution, Compromise Defender™. As an...

Group-IB signs distribution agreement with Tech First Gulf to bolster MEA cybersecurity offering (Group-IB) Group-IB, a global cybersecurity leader, is pleased to announce the signing of a distribution agreement with Tech First Gulf, a leading value-added distributor in the Middle East and Africa (MEA) region.

Orange Business leads team to deliver cloud-native managed SASE to enterprises (ComputerWeekly.com) Enterprise division of the global telco taps in-house cybersecurity practice and leading cybersecurity technology provider to offer simpler operational model for customers with end-to-end accountability improves agility, efficiency, performance and security.

Drata Debuts Future of Automated GRC at Drataverse (PR Newswire) Drata, a continuous security and compliance automation platform, today unveiled the first look at several new offerings for 2023 at the...

Technologies, Techniques, and Standards

NSA shares tips on blocking BlackLotus UEFI malware attacks (BleepingComputer) The U.S. National Security Agency (NSA) released today guidance on how to defend against BlackLotus UEFI bootkit malware attacks.

SSDF and IoT Cybersecurity Guidance: Building Blocks for IoT Product Security (NIST) NIST’s IoT cybersecurity guidance has long recognized the importance of secure software development (SSDF) practices, highlighted by the NIST IR 8259 series—such as the recommendation for documentation in Action 3.d of NIST IR 8259B, that manufacturers have considered and documented their “secure software development and supply chain practices used.”

Secure Technology Alliance Celebrates 30 Years of Cross-Industry Achievement Spanning Identity, Payments, Access Control and Beyond (GlobeNewswire News Room) Milestones include contributions to U.S. adoption of EMV chip cards, advancements in PIV cards, passports and mobile driver’s licenses (mDLs)...

How Government Contractors & Agencies Should Navigate New Cyber Rules (Dark Reading) The impending regulations highlight the increasing importance of enhanced network security and regulatory compliance across the government sector.

The Log4j vulnerability – how can we all do better next time (Register) Accept there are some risks you don’t control but which nonetheless you can’t ignore

Meta's Oversight Board asks Facebook owner to evaluate election integrity efforts (Reuters) Meta Platforms' Oversight Board has asked the social media firm to evaluate efforts to prevent promotion of political violence on its platforms, after it allowed a video calling for violence post the 2022 Brazilian election to stay online.

Research and Development

Eight teams of hackers will compete to breach U.S. satellite in space (Newsweek) Protecting satellites from hacks is becoming more important as industries from agriculture to banking and insurance rely on space-based capabilities.

Corsha Announces $1.8 Million AFWERX TACFI Grant Award (Corsha) Corsha launches pilot to determine how to enable AFSC to securely move data from additive manufacturing, data aggregation, and analysis devices into DE platforms

Academia

Boise State partners with MARS Suite Corporation to address cyber threats, demand for talent (Boise State News) Boise State University’s Institute for Pervasive Cybersecurity is partnering with cybersecurity platform provider MARS Suite...

Support for cybersecurity clinics across the U.S. (Google) Our new $20 million collaboration with the Consortium of Cybersecurity Clinics will expand and create cyber clinics across the US.

Legislation, Policy, and Regulation

Why is it so rare to hear about Western cyber-attacks? (BBC News) Could a cyber-attack on a Russian technology company provide a rare insight into a Western hack?

Romanias Cybersecurity Chief Proposes Banning TikTok (UrduPoint) TikTok should be banned in Romania as it may send data to the Chinese government, Anton Rog, the head of National Cyberint Center within the Romanian Intelligence Service, said on Thursday.It would be nice, for example, to ban TikTok, if you ask me. According to the technical analysis I have publis ..

US cyber ambassador says China can win on AI, cloud (Register) Calls on governments to combat 'playbook' that propelled Huawei to prominence

Nation's first cyber security coordinator appointed, as government reckons with hack affecting big four banks (ABC) As law enforcement agencies respond to a data breach at a law firm that kept the big four banks and the Health Department as clients, the federal government announces it has finally filled the role of the nation's first cyber security coordinator.

Shadow Cyber Security Minister James Paterson responds to cyber security coordinator appointment (Cyber Security Connect) Shadow cyber security minister James Paterson has responded to the government’s appointment of the nations first cyber security coordinator, saying that it comes too little too late. Whilst the sh

Got a Warrant? FBI May Need One to Search U.S. Data in Foreign Spy Database (Wall Street Journal) Lawmakers are considering whether to require the FBI to obtain warrants before searching data accumulated under the Foreign Intelligence Surveillance Act.

Bipartisan Bill Proposes Cybersecurity Funds for Rural Water Systems (SecurityWeek) A new bill proposes to increase cybersecurity funding for rural water systems by $7.5 million dollars per year

House defense bill adds special Ukraine IG, Taiwan cyber cooperation (Defense News) The House's FY24 National Defense Authorization Act sets up a Special Inspector General for Ukraine and requires cooperation on Taiwan cybersecurity.

Readout from CISA’s 2023 Second Quarter Cybersecurity Advisory Committee Meeting (Cybersecurity and Infrastructure Security Agency) Today, the Cybersecurity and Infrastructure Security Agency (CISA) held its second quarter Cybersecurity Advisory Committee (CSAC) meeting.

Lawmaker calls for the creation of Georgia Cyber Command (Jackson Progress-Argus) (The Center Square) — A state lawmaker says Georgia needs to create a state cyber command and should be hastened in the wake of a Russian cyber-attack that hit the

A cyber-focused candidate is running for president. Does he have a chance? (Washington Post) Former congressman Will Hurd, with a deep cyber background, enters GOP presidential field

Litigation, Investigation, and Law Enforcement

Crypto malware ring targeting Canada busted in Ukraine (Cybernews) The criminals operated in a rented office space and demanded that new staff members take a polygraph test, Ukrainian authorities claim.

Twitter may face fines in Australia over hate speech (Axios) Australia's online safety regulator sent a legal notice to Twitter demanding the social network explain the steps it is taking to combat online hate or risk being slapped with fines.

Former FBI analyst who kept classified records in home sentenced to prison (The Hill) Correction: Former FBI analyst Kendra Kingsbury is a resident of Kansas. The information was incorrect in an earlier version of this story. A former intelligence analyst with the FBI’s Kansas City …

The Hunt For A Russian Spy: How The FSB Used A Mexican Man To Target A Defector In Miami (RadioFreeEurope/RadioLiberty) A Russian-trained Mexican microbiologist will soon be released from a U.S. prison, a year after pleading guilty for his role in a bungled job surveilling a government informant. Turns out the informant was a Russian defector whose betrayal of a spy network in the U.S. infuriated Vladimir Putin.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

CYBERJUTSU CON 4.0 and the 10th Annual Cyberjutsu Awards (TBD, Jun 24, 2023) Join us on June 24th as we learn, grow, and build together. Cyberjutsu Con will consist of Hands-on Workshops, Capture The Flag (CTF) Competitions, Professional Headshots, Recruiting Opportunities, Celebration, and more. Participants will walk away with hands-on knowledge that can be applied immediately on the job.

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Jun 26 - 30, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps. Learn more and register now!

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Jul 10 - 14, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps. Learn more and register now!

SANSFIRE 2023 (Washington, DC, USA, Jul 10 - 15, 2023) Hands-on cyber security training taught by world-renowned practitioners. Attend in Washington, DC or Live OnlineAt SANSFIRE 2023, choose from 40 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications.

Cyber Security for Critical Assets World Summit (Virtual, Jul 11, 2023) CS4CA World will return virtually as a unique large-scale event to keep the critical asset community connected across the globe. As a worldwide 24-hour event, it will follow the sun by starting with speakers from the APAC region through to MEA, Europe, LatAm, finishing in North America. This unique format allows sponsors, speakers, and attendees to engage & connect with peers through a wide range of interactive content & networking formats much like a physical event. Cyber attacks and cyber crime are increasing in number and sophistication across the world, leaving critical infrastructure organisations busy with reassessing their cyber risk while striving to maintain business continuity. The summit offers dedicated sessions, allowing delegates to hone in on their specialist areas of interest, as well as topics addressing the issues that bind both IT & OT professionals, with a focus on cyber resilience in a post-covid world. The agenda is curated by a group of industry-leading experts to be as relevant, cutting-edge, and as in-depth as possible over the 24-hour period.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.