Cyberespionage's BoldMove. Credential stuffing of PayPal users. T-Mobile breached. Notes on the hybrid war.

Summary

By the CyberWire staff

At a glance.

Chinese threat actor deploys BOLDMOVE backdoor against FortiOS.
Credential stuffing afflicts PayPal users.
T-Mobile discloses a data breach.
Cyberattack hits Nunavut utility.
Wagner Group sponsors a hackathon.
Gamaredon APT runs Telegraph phishing against Ukrainian targets.
CISA releases one ICS advisory.

Chinese threat actor deploys BOLDMOVE backdoor against FortiOS.

A suspected Chinese threat actor is exploiting a recently patched critical flaw in Fortinet's FortiOS SSL-VPN, according to researchers at Mandiant. The threat actor began exploiting the vulnerability in October 2022, months before the flaw was disclosed publicly. Fortinet issued an advisory on December 12th rating the vulnerability as “critical,” noting that the company was “aware of an instance where this vulnerability was exploited in the wild.” Mandiant says the threat actor targeted “a European government entity and a managed service provider located in Africa.” The researchers discovered a new malware dubbed “BOLDMOVE” that was developed to exploit this vulnerability; the threat actor appears to be sophisticated and well-funded. For more on BoldMove, see CyberWire Pro.

Ready to make the switch to 1Password? It’s easy!

Bank logins. Confidential project files. Your grandma's super-secret shortbread recipe. Everything your team or business stores in 1Password is protected by our industry-leading encryption models – because security isn't just a feature. It's our foundation. And with dedicated onboarding and customer success teams at your disposal, switching is easier than you think.

Credential stuffing afflicts PayPal users.

On January 18, PayPal said in a security incident notice that unauthorized parties accessed thousands of user accounts between December 6 and 8 of last year in a credential stuffing attack. The credential stuffing attack, Bleeping Computer explains, works by utilizing a bot that attempts various user credentials sourced in other leaks to access accounts on other sites. So, it follows that those reusing passwords across accounts with shared usernames and emails, or “password recycling,” would be most likely to fall victim to these attacks. Forbes writes that this incident was reported as of yesterday to have given threat actors access to 34,942 PayPal accounts. In a statement to EcommerceBytes, PayPal asserts that no financial information was accessed and payment systems were not affected, and reports that they are reaching out to those impacted. “We have contacted affected customers directly to provide guidance on this matter to help them further protect their information," the company said. "The security and privacy of our customers’ account information remains a top priority for PayPal, and we sincerely apologize for any inconvenience this may have caused.” For more on the PayPal credential-stuffing incident, see CyberWire Pro.

Doing Threat Intel is Really Difficult - Try a Managed Intel Service

Why are you struggling with interpreting threat intel by yourself? Engage Nisos to achieve better risk insights and outcomes. Rely on the experts with a managed service that gives you the people, process, and technology to control costs while improving your defenses. Nisos leverages automation efficiency and analyst expertise that eliminates noise, identifies risks, and prioritizes your company-specific threats. We help you respond to threats faster and more effectively through assessments, monitoring, and investigations.

T-Mobile discloses a data breach.

Mobile carrier T-Mobile disclosed a data breach yesterday that affects around 37 million postpaid and prepaid customer accounts, SecurityWeek reports. T-Mobile said in a Thursday filing with the US Securities and Exchange Commission (SEC) that the data breach was the work of a malicious actor abusing an API without authorization. The wireless provider claims that the attack, discovered January 5, was stopped within a day of discovery, Bloomberg reports, and that they had pinpointed the source. The carrier says that there is no evidence showing that any other systems were affected, and also did not appear to affect any sensitive data, rather “name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features,” SecurityWeek explains. For more on the T-Mobile breach, see CyberWire Pro.

Cyberattack hits Nunavut utility.

Qulliq Energy Corp (QEC) in Nunavut was hit by a cyberattack on Sunday that took down its IT systems, the CBC reports. QEC disclosed yesterday that the attack took down the systems at its Customer Care and administrative offices. The company has enlisted external cybersecurity experts to investigate the scope of the attack and determine which data were accessed. QEC says it will notify anyone whose information was accessed. Premier P.J. Akeeagok said in a statement that various Provincial and Federal agencies are assisting with the recovery, and that the Royal Canadian Mounted Police are investigating the incident. The attacks didn’t affect power plant operations, just business systems (and customers are presently unable to pay their bills via credit card). While it’s still unclear whether the attackers accessed customer information, the company says customers should be vigilant just in case. For more information on the Nunavut incident, see CyberWire Pro.

Wagner Group sponsors a hackathon.

Russia's Wagner Group private military corporation hasn't neglected information technology, sponsoring a hackathon last month designed to contribute to the "development of IT projects to protect the interests of the Russian army." The hackathon offers another example of the ways in which criminals serve as cyber auxiliaries for the Russian organs. The Atlantic Council reports that the winners were, from first to third place, GrAILab Development, SR Data-Iskander, and Artistrazh. Artistrazh's co-founder is one Igor Turashev, wanted by the US FBI for his involvement with, among other things, Dridex banking malware. Mr. Turashev was indicted in the Western District of Pennsylvania on November 13, 2019. The charges he faces, if the US ever gets its hands on him, include "Conspiracy, Conspiracy to Commit Fraud, Wire Fraud, Bank Fraud, and Intentional Damage to a Computer."

Gamaredon APT runs Telegraph phishing against Ukrainian targets.

BlackBerry researchers reported yesterday that they'd observed Gamaredon operators running phishing attacks against Ukrainian targets. The phishbait consists of spoofed Ukrainian government or corporate documents. "The Gamaredon Group’s network infrastructure relies on multi-stage Telegram accounts for victim profiling and confirmation of geographic location," BlackBerry says, "and then finally leads the victim to the next stage server for the final payload. This kind of technique to infect target systems is new." The final payload is an information stealer first observed in September of this past year. Gamaredon, also known as Primitive Bear or Actinium, is generally believed to be an FSB operation run out of occupied Crimea. This particular operation seems to be hands-on, and not heavily automated.

The CyberWire's continuing coverage of the unfolding crisis in Ukraine may be found here.

CISA releases one ICS advisory.

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an industrial control system (ICS) advisory affecting Hitachi Energy PCU400.

Notes.

Today's issue includes events affecting Bulgaria, Canada, China, the Czech Republic, Denmark, Estonia, the European Union, Germany, Iran, Ireland, Latvia, Lithuania, NATO/OTAN, the Netherlands, Poland, Russia, Slovakia, Sweden, Ukraine, the United Kingdom, and the United States.

Dateline

Ukraine at D+330: Russian private militias on the rise. (CyberWire) If the dissolution of Russia is an "existential threat" to the world, as the Kremlin has it, to what extent does incipient warlordism contribute to such dissolution?

Ukraine-Russia war latest: Germany says decision on tanks to take a month (The Telegraph) Germany has dashed hopes for a quick delivery of tanks to Ukraine by saying the decision could take "a month.

Russia-Ukraine war: List of key events, day 331 (Al Jazeera) As the Russia-Ukraine war enters its 331st day, we take a look at the main developments.

Zelenskiy pleads with Germany and allies to send tanks to Ukraine (the Guardian) President tells defence ministers that war with Russia is a fight between freedom and autocracy

CIA Director Visits Kyiv, Meets with Ukraine's Zelenskyy (Military.com) The CIA director has briefed Zelenskyy repeatedly before and since Russia launched its invasion of Ukraine last February.

Austin, Zelenskyy Call on Contact Group to Redouble Efforts (U.S. Department of Defense) Now is not the time to slack off. Now is the time to dig deep and aid Ukraine in its existential struggle against Russian invaders, Secretary of Defense Lloyd J. Austin III told members of the Ukraine

Britain to send 600 Brimstone missiles to Ukraine (Telegraph) Britain plans to send 600 Brimstone missiles to Ukraine to support the country in its fight against Russia, Ben Wallace has said.

Dutch prime minister talks Leopard 2 tanks and other assistance to Ukraine: ‘The ask from Kyiv is completely clear’ (Atlantic Council) Prime Minister Mark Rutte spoke at an Atlantic Council Front Page event on Tuesday, where he discussed Ukraine, the Caribbean, China, and more.

Germany must stop stalling Ukraine tanks deal, say Nato allies (The Telegraph) Britain and US lead high-pressure campaign, warning Berlin that Putin could gain upper hand if Kyiv doesn’t receive weaponry soon

Germany must send Ukraine its armour (The Telegraph) The moment for serious engagement has arrived; German reluctance to act must to be resolved at Ramstein on Friday

Bulgaria to the rescue: How the EU’s poorest country secretly saved Ukraine (POLITICO) Sofia provided fuel and vital Soviet specification arms to Kyiv, but had to keep supplies secret because of pro-Moscow politicians in government.

How Europe can help Ukraine defeat Russia and win the peace in 2023 (Atlantic Council) Continued European support for Ukraine will be crucial in 2023 and must feature a combination of intensification and innovation if Vladimir Putin's invasion is to be decisively defeated, writes Andreas Umland.

Biden Administration Announces Additional Security Assistance for Ukraine (U.S. Department of Defense) The Department of Defense announced the authorization of a presidential drawdown of security assistance to meet Ukraine's critical security and defense needs.

Austin meets new German defense minister over Ukraine tank support (Defense News) All eyes are on a Jan. 20 meeting of Ukraine donor countries in Germany, where the question of Kyiv's support with main battle tanks tops agenda.

Defense chiefs try to resolve dispute over tanks for Ukraine (AP NEWS) Defense leaders gathered at Ramstein Air Base in Germany heard an impassioned plea for more aid Friday from Ukrainian President Volodymyr Zelenskyy as they struggled to resolve divisions over who will provide battle tanks and other military aid to his embattled country.

Secretary of Defense Lloyd J. Austin III Remarks With German Defense Minister Boris Pisto (U.S. Department of Defense) Secretary of Defense Lloyd J. Austin III and German Defense Minister Boris Pistorius delivered remarks in Germany.

US has given $113B in aid to help Ukraine in its war with Russia, oversight report says (Stars and Stripes) The report elaborated on where aid dollars authorized by federal lawmakers went during most of 2022 after Russia invaded Ukraine at the end of February.

US still holds back long-range ATACMS missiles from Ukraine (Defense News) The long-range weapons are seen by the Pentagon as needless for the conflict, and possibly escalatory – at least for now.

U.S. Warms to Helping Ukraine Target Crimea (New York Times) The Biden administration is considering the argument that Kyiv needs the power to strike at the Ukrainian peninsula annexed by Russia in 2014.

Inside the urgent push to arm Ukraine for a spring offensive (Washington Post) Over the past few weeks, Ukraine’s Western allies have committed massive packages of mechanized armor to break the stalemate with Russia. But is it enough to change the tide of the war?

Medvedev warns of nuclear war if Russia defeated in Ukraine (Al Jazeera) Former Russian leader and Putin ally warns Ukraine’s Western allies ahead of a key meeting in Germany.

Putin ally warns NATO of nuclear war if Russia is defeated in Ukraine (Reuters) An ally of President Vladimir Putin warned NATO on Thursday that a defeat of Russia in Ukraine could trigger a nuclear war, while the head of the Russian Orthodox Church said the world would end if the West tried to destroy Russia.

Putin’s nuclear blackmail must not prevent the liberation of Crimea (Atlantic Council) Putin's nuclear threats have led some analysts to argue against attempts to liberate Crimea but bowing down to the Russian dictator's nuclear blackmail would have dire consequences for global security, writes Andriy Zagorodnyuk.

Boris Johnson likens Vladimir Putin to ‘the fat boy in Dickens’ with his ‘nonsense’ nuclear threats (The Telegraph) Speaking at Davos, the former PM also said he backed a plan to use seized Russian assets to rebuild Ukraine

German tanks are key to a Ukraine victory - but is that what the West really wants? (The Telegraph) World leaders are tiptoeing around the question of how this war ends and how far back to push the Russians

For Putin and Russia, Wagner’s Outspoken Boss Is Becoming a Problem (World Politics Review) Prigozhin and the Wagner Group are threatening Russia’s security establishment, raising the question of whether Putin can control him.

Russian War Report: Russian hacker wanted by the FBI reportedly wins Wagner hackathon prize (Atlantic Council) In December 2022, Wagner Group organized a hackathon that was won by a man wanted by the FBI for his connection to computer malware.

Russian Cybercriminals Seek Access to OpenAI ChatGPT (Gridinsoft Blogs) Check Point analysts noticed that access to OpenAI ChatGPT is being actively discussed on Russian-speaking hacker forums.

Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations (Blackberry) The Gamaredon Group has been actively targeting the Ukrainian government lately, relying on the infrastructure of the popular messaging service Telegram to bypass traditional network traffic detection techniques without raising obvious flags. This new report from BlackBerry provides an analysis.

Gamaredon Group Launches Cyberattacks Against Ukraine Using Telegram (The Hacker News) Russian state-sponsored cyber espionage group Gamaredon is back and targeting Ukraine's military and law enforcement entities through Telegram.

The World Economy No Longer Needs Russia (Foreign Policy) With alternative sources in place, Putin’s attempt at blackmailing Europe on energy has failed.

Russian Ruble Gyrates as Western Sanctions Squeeze Moscow’s Energy Exports (Wall Street Journal) The currency began to slide recently after the U.S. and the EU put in place new limits on oil sales.

European Support Grows for Sanctioning Iran’s Revolutionary Guards (Wall Street Journal) The European Parliament urged member states to list Iran’s Islamic Revolutionary Guard Corps as a terrorist organization, in a sign of growing support for new measures against Tehran.

Opinion Russians are living in a frightening, distorted reality (Washington Post) Among the most stressful aspects of Russian prison life is exposure to government propaganda. Every cell I’ve been in has a television that is constantly turned on — and, with brief respites such as soccer matches during the recent FIFA World Cup, most of the airtime across all major networks is taken up by relentless pro-regime and pro-war messaging not dissimilar to the “Two Minutes Hate” from George Orwell’s 1984. Except that, in Vladimir Putin’s Russia, televised hate goes on for hours.

Russia’s intel agency opens criminal case against US citizen accused of ‘biological espionage’ (New York Post) Russia’s Federal Security Service announced Thursday that an unnamed American citizen was being investigated for “collecting intelligence on biological topics.”

Swedish intel agent gets life for spying for Russia (RFI) A judge on Thursday handed a life sentence to a former Swedish intelligence official convicted of spying for Russia for a decade and jailed his brother for 10 years.

Attacks, Threats, and Vulnerabilities

Costa Rica’s Ministry of Public Works and Transport crippled by ransomware attack (The Record from Recorded Future News) Costa Rica’s government has suffered another ransomware attack just months after several ministries were crippled by the Conti ransomware.

China-based threat group targeting public cloud - Radware (SecurityBrief Australia) Radware has issued a threat advisory about a for-profit threat group from China known as the 8220 Gang, who has emerged in the New Year targeting public cloud environments.

Chinese 8220 Gang Targets Public Clouds And Vulnerable Applications (Scoop News) Today, Radware issued a threat advisory about a for-profit threat group from China called the 8220 Gang. The gang, also known as 8220 Mining Group, has rolled into the New Year targeting public cloud environments and poorly secured applications, ...

Hackers exploiting vulnerability affecting Zoho ManageEngine products: Rapid7 (The Record from Recorded Future News) Rapid7 said they have seen exploitation of CVE-2022-47966 – a vulnerability affecting 24 ManageEngine products from software company Zoho.

Cybercriminals Target Telecom Provider Networks (Dark Reading) The growing use of mobile devices for MFA and the proliferation of 5G and VoIP in general could result in more attacks in future, experts say.

PayPal accounts breached in large-scale credential stuffing attack (BleepingComputer) PayPal is sending out notices of a data breach to thousands of users who had their accounts accessed by credential stuffing actors, resulting in the compromise of some personal data.

PayPal Confirms Over 34,000 Customer Accounts Were Breached (EcommerceBytes) Thousands of PayPal accounts were breached in December through a credential stuffing attack PayPal has confirmed

35,000 PayPal accounts hacked, and users could've prevented it (PCWorld) PayPal is notifying nearly 35,000 users that their were accounts were breached. But PayPal wasn't hacked; users weren't using unique passwords or two-factor authentication.

Thousands Of PayPal Accounts Hacked—Is Yours One Of Them? (Forbes) It has been confirmed that thousands of PayPal accounts were accessed by credential stuffing attackers between December 6 and 8, 2022.

Nearly 35,000 PayPal users had SSNs, tax info leaked during December cyberattack (The Record from Recorded Future News) PayPal is sending out breach notification letters to 34,942 customers after a December 6 credential stuffing attack exposed SSNs and more.

T-Mobile Says Hacker Stole Data for 37 Million Customers (Bloomberg) Information stolen includes name, address and account number. Credit card data and networks weren’t affected, company said,

T-Mobile Says Hackers Stole Data on About 37 Million Customers (Wall Street Journal) The carrier says addresses, birth dates and other personal records were exposed, but not financial records.

T-Mobile Says Hackers Used API to Steal Data on 37 Million Accounts (SecurityWeek) T-Mobile fessed up to another massive data breach affecting approximately 37 million current postpaid and prepaid customer accounts.

Yum Brands says nearly 300 restaurants in UK impacted due to cyber attack (Reuters) Yum Brands Inc said late on Wednesday a ransomware attack impacted certain information technology systems of the company which led to the closure of nearly 300 restaurants in the United Kingdom for a day.

Cisco fixes SQL Injection flaw in Unified CM (Security Affairs) A high-severity flaw (CVE-2023-20010) was found in Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition. Cisco fixed a high-severity SQL injection flaw, tracked as CVE-2023-20010 (CVSS score of 8.1), in Unified Communications Manager and Unified Communications Manager Session Management Edition. Unified Communications Manager solutions provide reliable, secure, scalable, and manageable call control […]

Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475) (Mandiant) A suspected China-nexus campaign exploiting a vulnerability in Fortinet's FortiOS.

Attackers Crafted Custom Malware for Fortinet Zero-Day (Dark Reading) The "BoldMove" backdoor demonstrates a high level of knowledge of FortiOS, according to Mandiant researchers, who said the attacker appears to be based out of China.

Chinese hackers used recently patched FortiOS SSL-VPN flaw as a zero-day in October (Security Affairs) An alleged Chinese threat actor was observed exploiting the recently patched CVE-2022-42475 vulnerability in FortiOS SSL-VPN. Researchers from Mandiant reported that suspected Chinese threat actors exploited the recently patched CVE-2022-42475 vulnerability in FortiOS SSL-VPN as a zero-day. According to the security firm, the vulnerability was exploited in attacks against a series of targets, including a […]

HC3 warns of Clop ransomware targeting medical images (Healthcare IT News) The agency says bad actors are sending infected files disguised to look like medical documents and requesting medical appointments. Telemedicine increases the likelihood that malicious images and information would be reviewed ahead of telehealth visits.

QUT confirms personal data of thousands of staff compromised in cyber attack (ABC) Thousands of staff and 67 students at one of Queensland's largest universities have had their personal data compromised in a cyber attack last month.

Cyberattack hits Nunavut's Qulliq Energy Corp. (CBC News) Computer systems at Qulliq Energy Corp. are still down after a cybersecurity attack on Sunday. Nunavut customers are urged to check their bank accounts and credit cards for any breaches.

Nunavut power utility’s servers hit by cyber attack | IT World Canada News (IT World Canada) The territorial utility that provides power to Nunavut can't say yet if customer data was copied after a cyber attack earlier this week. Qulliq Energy Corporation (QEC) was targeted in a cyberattack on last weekend, the firm said on Thursday. "QEC’s network was breached, and the corporation took immediate actions to contain the situation." Outside

Council Post: The FBI's Source Of Trust Just Got Hacked (Forbes) Successful attacks may not happen all that often, but that doesn’t mean the threats aren’t there. In fact, there are millions of attempted attacks—both physical and cyber—against the country’s CI each year.

More than 19,000 records released in B.C. school district data breach (Prince George Citizen) After 19,126 records were released by a school district in Maple Ridge, B.C., staff warn of potential phishing scams.

Canada's largest alcohol retailer infected with card skimming malware twice since December (The Record from Recorded Future News) Canada’s largest alcohol retailer was infected with customer payment-skimming malware two separate times over the last month.

Regional Carrier For United Airlines Accidentally Leaked The FBI's Terrorist 'No-Fly' List, According to Hacker (Paddle Your Own Kanoo) A major regional carrier that operates flights on behalf of United Airlines under the United Express brand has accidentally leaked the federal terrorist ‘no-fly’ list after leaving the file on an unsecured public server, according to a Swiss hacker who discovered the data. The No-Fly List is maintained by the Terrorist Screening Center and administered…

Update On LastPass Security Breach: Hackers Stole Encrypted Password Vaults (Business2Community) Password manager LastPass encountered a security breach in August this year, which led to the loss of confidential technical data and a part of the company’s source code. Hackers later used the stolen information to hack LastPass again at the end of November.

LastPass faces mounting criticism over recent breach | TechTarget (Security) LastPass disclosed last month that a recent breach involved the theft of significant, personally identifiable customer information.

The lights have been on at a Massachusetts school for over a year because no one can turn them off (NBC News) Blame it on the pandemic and "supply chain problems," says the school district's assistant superintendent of finance.

Security Patches, Mitigations, and Software Updates

Exploit released for critical ManageEngine RCE bug, patch now (BleepingComputer) Proof-of-concept exploit code is now available for a remote code execution (RCE) vulnerability in multiple Zoho ManageEngine products.

Hitachi Energy PCU400 (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: PCU400 Vulnerabilities: Reliance on Uncontrolled Component 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in a denial-of-service condition on both the logging function of the device and its associated server.

Trends

Ransomware victims refuse to pay up (Register) Near 50% drop in extorted dosh ... or so it says here

2023 Threat Intelligence Guide (Critical Start) Stay one step ahead of emerging threats with our threat intelligence guide, including top 5 threats and how to protect your organization.

Tech support scammers are still at it: Here’s what to look out for in 2023 (WeLiveSecurity) Tech support scams are still alive and kicking – here's how fraudsters want to help you fix a computer problem you never had in the first place.

Report: Cloud-based networks under growing attack (Register) Thanks for putting all your data in one basket

NCC Group Monthly Threat Pulse - December 2022 (Mynewsdesk) December’s Threat Pulse sees a small increase in ransomware attacks – 2%, compared to November but still a high number recorded for the traditionally quieter...

Marketplace

Defense technology startup Vannevar Labs raises $75M in funding (SiliconANGLE) Defense technology startup Vannevar Labs raises $75M in funding - SiliconANGLE

The =nil; Foundation Raises $22M to Build Marketplace for Zero-Knowledge Proofs (Yahoo) The funding round led by Polychain Capital aims to make zero knowledge projects more decentralized, and easier to build.

Cemtrex Announces Reverse Split to Regain NASDAQ Compliance (GlobeNewswire News Room) Cemtrex Inc. (NASDAQ: CETX, CETXP), an advanced security technology and industrial services company,...

Google Parent Alphabet to Cut 12,000 Jobs (Wall Street Journal) The company’s largest-ever round of layoffs follows a wave of reductions at other technology companies in recent months, including Microsoft, Amazon and Meta.

McLean's Capital One cutting more than 1,000 tech jobs (Washington Business Journal) The credit card giant has invited impacted employees to apply for other jobs with the company.

Versa Networks is Industry’s First SASE Provider to Earn Compliance with ‘Make in India’ Initiative (Business Wire) Versa Networks, the recognized leader of single-vendor Secure Access Service Edge (SASE), today announced it is the first and only SASE provider which

Crypto Lender Genesis Files for Bankruptcy, Ensnared by FTX Collapse (Wall Street Journal) The firm and two of its lending subsidiaries filed for bankruptcy protection in New York, marking the end of an era in which the lending of crypto assets fueled trades by investors chasing high yields.

Global cybersecurity firm McAfee announces new regional headquarters at The Star in Frisco (Dallas Business Journal) The company said it will move into space at The Star in Frisco by mid-2023.

CybeReady Appoints Jonathan Stone as Vice President of Sales to Accelerate Growth in North America (EIN Presswire) CybeReady, provider of the world’s fastest security awareness solution, today announced that Jonathan Stone has joined the executive team as Vice President of Sales for North America. In this role, Stone will expand the North American sales operations to boost adoption of the company’s award-winning cybersecurity awareness training platform.

Quest Software Strengthens Operational & Market Expertise with Appointment of New Executives (GlobeNewswire News Room) New leadership bolsters Quest’s ability to manage strategic enterprise IT functions while addressing customer computing challenges...

[redacted] Taps Adam Flatley to Lead [rTIC Ghost Group (Business Wire) Redacted, the mission-driven cybersecurity company that levels the playing field against attackers, today announced that Adam Flatley has been promote

Vic Macias Vice President, National Strategy (TeamWorx Security) Vic has over 20 years of executive-level leadership across the Department of Defense, National Security space, Cyber Security Operations, Domestic Operations, Emergency Management, and the role cyber security plays in protecting our nation’s critical infrastructure.

Products, Services, and Solutions

ThreatModeler First to Democratize DevSecOps with Launch of Threat Model Marketplace (News Direct) Pre-built, vetted threat models are now available to kick-start secure and compliant development with a single click

Carrier SI and Xcitium Partner to Expand Affordable Endpoint Security (GlobeNewswire News Room) Xcitium, the cybersecurity industry's leading provider of state-of-the-art endpoint protection...

Satori Expands Support to NoSQL Databases; Streamlines Secure Data Access for MongoDB (GlobeNewswire News Room) Data security leader provides modern self-service data access, PII discovery, and protection to MongoDB users...

International Council of E-Commerce Consultants Launches Cybersecurity Essentials Professional Certificate Program on edX (PR Newswire) The International Council of E-Commerce Consultants (EC-Council), a developer of world-class cybersecurity education programs and...

CyberGRX Leverages MITRE Techniques to Uncover Security Gaps in Third Parties (Business Wire) CyberGRX today announced the availability of a Predictive Data tool to the Exchange platform's Attack Scenario Analytics feature.

WISeKey Joins Forces with The Hashgraph Association to Offer Trusted NFT Solutions via its WISe.ART Platform Built on Hedera (GlobeNewswire News Room) WISeKey Joins Forces with The Hashgraph Association to Offer Trusted NFT Solutions via its WISe.ART Platform Built on Hedera. GENEVA / Davos – 19 January...

Former U.S. Cybercom Officer Launches The World's First Threat Exposure Management Platform, Sightgain, To Address The Challenge Of Balancing Cybersecurity Investments And Cyber Risk. (Longview News-Journal) Quantify business risk exposure, prove ROI of your security investments, and automate across compliance reporting frameworks.

Technologies, Techniques, and Standards

NIST Releases Potential Updates to Its Cybersecurity Framework (Nextgov.com) The National Institute of Standards and Technology wants to expand the cybersecurity guidance’s scope and foster more international collaboration, among other proposed changes.

NSA Releases Security Guidance for IPv6 Implementation (Executive Gov) Looking for the latest Government Contracting News? Read about NSA Releases Security Guidance for IPv6 Implementation.

NSA red team will attack JWCC providers to test zero trust security (Breaking Defense) Set to start this spring, the test is not a requirement for the Joint Warfighting Cloud Capability contract, but an “independent” experiment by the Pentagon CIO’s Zero Trust office, said director Randy Resnick.

Artificial Intelligence and Cloud Security: Remediating Cloud Risks using GPT3 (Orca Security) Orca Security has integrated OpenAI's GPT3 API into our cloud security platform to enhance generating accurate remediation plans for security alerts.

Design and Innovation

Don’t Sleep on Google in AI Battle with OpenAI and Microsoft, Says a Key Former Engineer (The Information) OpenAI has sparked an explosion of funding and software development around artificial-intelligence software that understands human language. While the technology still makes plenty of mistakes, new applications are coming out in droves, from tools that help marketers write copy to audio chatbots ...

Research and Development

DHS awards $1.1M for seven federal labs researching technology commercialization (Homeland Preparedness News) The United States Science and Technology Directorate (S&T) split $1.1 million between seven federal laboratories this week for federal research that could benefit Department of Homeland Security (DHS) missions and homeland security stakeholders – and, potentially, find a market. The … Read More »

Academia

Daytona State College redesignated as a National Center of Academic Excellence in Cyber Defense (Ormond Beach Observer) The Center of Academic Excellence in Cyber Defense at DSC was created in 2013 through a grant.

KnowBe4 to Offer $10,000 Women in Cybersecurity Scholarship and (ISC) 2 Certification Education Package (Dark Reading) KnowBe4 partners with the Center for Cyber Safety and Education to bolster women in cybersecurity for the fourth consecutive year.

Legislation, Policy, and Regulation

EU cyber resilience regulation could translate into millions in fines (Help Net Security) EU cyber resilience regulation is intended to close the digital fragmentation problem surrounding systems with network connections.

Better late than never: Slovenia last EU Member State to adopt GDPR implementing act (Lexology) On 15 December 2022, the Slovenian Parliament finally adopted the Data Protection Act (Zakon o varstvu osebnih podatkov, ZVOP-2, "ZVOP-2"), a…

Litigation, Investigation, and Law Enforcement

Irish privacy regulator to take European Union body to court over unlawful interference (The Record from Recorded Future News) The Republic of Ireland’s privacy regulator announced on Thursday that it would be taking the European Union’s data protection board to court to challenge what it says is unlawful interference.

China's cyberspace authorities continue standardizing online law enforcement; 420 apps shut down in 2022 (Global Times) Last year, the Chinese cyberspace authorities continued to intensify and standardize online law enforcement based on the principle of combining punishment with education, during which 8,608 websites and platforms were investigated, with 6,767 receiving warnings and 420 apps being shut down.

HUMAN Orchestrates Unprecedented Private Takedown, VASTFLUX (HUMAN) At its peak, VASTFLUX accounted for more than 12 billion fraudulent ad requests a day, impacting nearly 11 million devices

How the VASTFLUX Takedown Benefits Programmatic Players (HUMAN) HUMAN released new research into a sophisticated ad fraud operation dubbed VASTFLUX and its subsequent private takedown. What does all of this mean to the programmatic ecosystem?

WSJ News Exclusive | New FTX Chief Says Crypto Exchange Could Restart (Wall Street Journal) In his first public interview since taking over the failed cryptocurrency exchange, John J. Ray III said that he is open to the idea of rebooting operations.

FTX Founder Gamed Markets, Crypto Rivals Say (New York Times) Sam Bankman-Fried found ways to control the prices of digital coins to benefit his companies, FTX and Alameda, according to cryptocurrency investors.

In Africa, FTX Posed as Haven From Tumbling Currencies, Inflation (Wall Street Journal) The cryptocurrency exchange’s ambassadors recruited new customers through glitzy events, $5 sign-up bonuses and giveaways.

Biden on classified docs discovery: 'There's no there there' (AP NEWS) A frustrated President Joe Biden said Thursday there is “no there there” when he was persistently questioned about the discovery of classified documents and official records at his home and former office.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

3rd Annual Nunn School Symposium: Lessons from Russia’s War in Ukraine for the West (Atlanta, Georgia, USA, Feb 28, 2023) This half-day program explores what lessons the West should draw a year after Russia’s invasion of Ukraine. It will consider both what can be learned about warfighting and about the broader role of statecraft. While what has happened and what might happen are clearly relevant, the focus will be on what lessons can be drawn from what has happened thus far.

Events

Insider Threat Program Development - Management Training Course (Laurel, Maryland, USA, Jan 30 - 31, 2023) The training course will be taught at the Johns Hopkins University Applied Physics Laboratory, in Laurel, Maryland. This highly sought after and very comprehensive 2 day training course will ensure the Insider Threat Program (ITP) Manager/ Senior Official (Insider Threat Analyst, FSO, CSO, CISO, Etc.), and others who support the ITP (Human Resources, IT, Network Security, Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended this training course and received ITP Manager Certificates.

CybertechGlobal Tel Aviv (Tel Aviv, Israel, Jan 30 - Feb 1, 2023) Cyber is all around us—it is one of the most trending topics in the tech and business arenas. It is a whole-encompassing industry that is not only about threats, but also covers the scope of digitalization and opportunities in the realm of innovation. From Tel Aviv and Rome, to Tokyo, Singapore, Panama, and more, Cybertech is the cyber industry’s foremost B2B networking platform conducting industry-related events all around the globe. Our conferences and exhibitions serve as the go-to place to make business happen and learn all about the latest technological innovations, challenges, and solutions to combating threats within the global cyber arena. Cybertech events feature top executives, government officials, leading decision-makers from a wide range of sectors including critical infrastructure, insurance, retail, health and government, defense, R&D, manufacturing, automotive, and more! Multinational corporations, startups, private and corporate investors, venture capital firms, experts, and clients—come and meet all the key players from the cyber industry and be immersed in everything there is to offer. Cyber. We live it. Breathe it. All at the forefront of global innovation.

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Feb 6 - 10, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps. Learn more and register now.

Chicago Cybersecurity Conference (Chicago, and virtual, Illinois, USA, Feb 8, 2023) FutureCon Events brings high-level Cyber Security Training discovering cutting-edge security approaches, managing risk in the ever-changing threat of the cybersecurity workforce. Join us as we talk with a panel of C-level executives who have effectively mitigated the risk of Cyber Attacks. Educating C-suite executives and CISOs (chief information security officers) on the global cybercrime epidemic, and how to build Cyber Resilient organizations. Gain the latest knowledge you need to enable applications while keeping your computing environment secure from advanced Cyber Threats. Demo the newest technology, and interact with the world’s security leaders and gain other pressing topics of interest to the information security community. The FutureCon community will keep you updated on the future of the Cyberworld and allow you to interact with your peers and the world’s security leaders.

Tech Days (Barcleona (and virtual), Spain, Feb 13 - 15, 2023) The PKI and cryptography landscape is in a state of constant evolution. Emergence of post-quantum cryptography, new PKI and IoT use cases, and rapid growth of machine identities are all serious challenges. At Tech Days 2023, we say “Game On.”

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.