"Ethics-free AI" in the C2C market. TeamTNT's return? British MPs targets of Chinese intelligence services. Gamaredon's fast theft, and other notes from the hybrid war.

Summary

By the CyberWire staff

At a glance.

WormGPT, an AI threat.
TeamTNT seems to be back.
Chinese intelligence actively pursues British MPs.
Gamaredon's fast optempo.
FSB bans Apple devices.
Internet Research Agency may return.
Anonymous Sudan claims "demonstration" attack against PayPal.
Typo leak to Mali.

WormGPT, an "ethics-free" text generator.

Researchers at SlashNext describe a generative AI cybercrime tool called “WormGPT,” which is being advertised on underground forums as “a blackhat alternative to GPT models, designed specifically for malicious activities.” The tool can generate output that legitimate AI models try to prevent, such as malware code or phishing templates.

SlashNext asked WormGPT to write an email “intended to pressure an unsuspecting account manager into paying a fraudulent invoice.” The researchers state, “The results were unsettling. WormGPT produced an email that was not only remarkably persuasive but also strategically cunning, showcasing its potential for sophisticated phishing and BEC attacks. In summary, it’s similar to ChatGPT but has no ethical boundaries or limitations. This experiment underscores the significant threat posed by generative AI technologies like WormGPT, even in the hands of novice cybercriminals.” For more on WormGPT, see CyberWire Pro.

First look: mWISE 2023 session catalog

Check out the topics, meet the speakers, and sign up for discount registration.

TeamTNT seems to be back.

Researchers at SentinelOne and Permiso Security released joint reports suggesting that TeamTNT, a threat actor notorious for attacking Amazon Web Services (AWS), may be gearing up to attack Microsoft Azure and Google Cloud Platform. “Throughout June 2023, an actor behind a cloud credentials stealing campaign has expanded their tooling to target Azure and Google Cloud Platform (GCP) services. Previously, this actor focused exclusively on Amazon Web Services (AWS) credentials... These campaigns share similarity with tools attributed to the notorious TeamTNT cryptojacking crew. However, attribution remains challenging with script-based tools, as anyone can adapt the code for their own use,” writes Alex Delamonte from SentinelOne.

Permiso brought some attribution to the threat actors by correlating usernames and passwords used and keyboard layouts writing, “Both the username and password are indicative of a keyboard run - the username on the home row keys and the password on the upper row keys. However, with all other characters being Latin the likely scenario that would produce a single ü is the usage of a virtual keyboard. Since the ü immediately follows the letter p in the password, the only two virtual keyboard layouts that contain an ü adjacent to the p character are for the Estonian and German languages.”

Both SentinelOne and Permiso note that the actor has retooled its code to target Azure and Google Cloud Platform. Additionally, they have made changes to the file hosting as SentinelOne explains, “The actor no longer hosts files in an open directory, which complicates efforts to track and analyze these campaigns. Instead, C2 activity relies on a hardcoded username and password combination that are passed as arguments to the curl command.”

Aqua Security reported on the early stages of this incipient campaign. While it seems to be in its development and testing phase, the campaign could turn into a massive threat targeting cloud infrastructure. “Aqua Nautilus researchers identified an infrastructure of a potentially massive campaign against cloud native environments. This infrastructure is in early stages of testing and deployment, and is mainly consistent of an aggressive cloud worm, designed to deploy on exposed JupyterLab and Docker APIs in order to deploy Tsunami malware, cloud credentials hijack, resource hijack and further infestation of the worm. We strongly believe that TeamTNT is behind this new campaign.”

Wish you had a cheat sheet for AWS investigations? Expel created one!

We remediate loads of cyber incidents in Amazon Web Services (AWS), and some common themes have emerged re: attacker use of APIs. We’ve noticed they map nicely to MITRE ATT&CK tactics.

So we captured them in a mind map of possible attack paths once hackers are inside an AWS environment. This resource should be helpful if you ever find yourself chasing a baddie through the cloud and want to catch them sooner than later.

Chinese intelligence services target British MPs.

The British Parliament’s Intelligence and Security Committee (ISC) has published a report outlining China’s interest in the UK. The report states, “In relation to the cyber approach, whilst understanding has clearly improved in recent years, China has a highly capable cyber – and increasingly sophisticated cyberespionage – operation: however, this is an area where the ‘known unknowns’ are concerning. Work on continuing coverage of its general capabilities must be maintained alongside further work on Chinese offensive cyber and close-proximity technical operations.” The report also found that “China frequently targeted Parliamentarians in their cyber operations.”

Third-Party Risk: More Third Parties + Limited Supply-Chain Visibility = Big Risks for Organizations

With cyber attacks on the rise, managing the risk originating from external vendors and partners is critical. Learn how security and IT leaders are using and managing third parties, the prevalence of data breaches, and their most common third-party risk management challenges in this CyberRisk Alliance Business Intelligence report, sponsored by AuditBoard.

Gamaredon's quick-strike cyberespionage.

CERT-UA released an official threat summary of UAC-0010. UAC-0010 (more commonly “Gamaradon,” or “Armageddon”) is a Russian persistent threat actor operated by the FSB. CERT-UA attributes the success Gamaredon has enjoyed to several defectors from Ukraine’s SBU who went over to the FSB in 2014. The threat group uses email and messenger apps like Signal, WhatsApp, and Telegram as an initial attack vector, sending corrupted Microsoft Word documents with malicious macros to the victim. UAC-0010 then uses an infostealer, “GAMMASTEEL,” which steals files between thirty and fifty minutes of the initial infection. GAMMASTEEL also works to replicate itself by infecting all Microsoft documents on the infected computer to propagate the malware when those files themselves are exported. GAMMASTEEL also corrupts any USB drive plugged into the computer.

FSB bans Apple devices.

Russia's FSB has banned the use of Apple devices by government officials, effective today. Apple Insider traces the decision to Russian claims that Apple has been colluding with the US National Security Agency (NSA) to intercept Russian communications. Apple has denied any such cooperation with NSA.

Reports of the Internet Research Agency's demise now seem premature.

It appears that the blackout of Mr. Prigozhin's own media properties was both temporary and exaggerated. One of those properties, the notorious troll farm doing business as the Internet Research Agency, is among those that have remained in business, earlier reports to the contrary.

Anonymous Sudan claims "demonstration" attack against PayPal.

Anonymous Sudan, which, its name notwithstanding, is a cat's paw for Russian intelligence services, mounted a brief distributed denial-of-service (DDoS) attack against PayPal. TechMonitor reports that the attack lasted only thirty seconds, but that Anonymous Sudan described it as a "demonstration" of the ways in which it will use PayPal to attack targets in the United Arab Emirates and the United States.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Hey, everybody: it's "dot mil," not "dot ml."

Dot mil is the US military top-level domain. Dot ML belongs to Mali. If you were trying to reach the sergeant major in Picatinny, don't blame him if your email went off to Timbuktu instead. The Financial Times has the story of how a common typographical error is misrouting a lot of email. The wayward communications are said to include "highly sensitive information, including diplomatic documents, tax returns, passwords and the travel details of top officers." And it's not a new problem, either: "Despite repeated warnings over a decade, a steady flow of email traffic continues to the .ML domain, the country identifier for Mali, as a result of people mistyping .MIL, the suffix to all US military email addresses." You tell them and you tell them....

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+508: Preparatory attrition in the counteroffensive. (CyberWire) Ukraine wages a war of attrition, the Kerch Strait Bridge is dropped again, and Russia seems to be purging its general officers. The FSB's Gamaredon is showing renewed activity.

Russia-Ukraine war: List of key events, day 509 (Al Jazeera) These are the main developments as the Russian invasion of Ukraine enters its 509th day.

Russians bombard centre of Kharkiv hours after earlier fatal attack (the Guardian) Latest missile strike part of series of attacks that began at 2am on Sunday, with one dead and four wounded reported

Bridge Between Crimea and Russia Disabled in Presumed Ukrainian Attack (Wall Street Journal) The presumed Ukrainian strike marked the second time the bridge had been hit, potentially constraining Russian supplies to the front lines in southern Ukraine.

Explosions on Crimean Bridge Disrupt Crucial Connection to Russia (New York Times) Russia said Ukraine attacked the Kerch Strait Bridge, killing two people. Kyiv has not claimed responsibility. On the diplomatic front, Monday was the last day to renew the Black Sea grain deal.

Russia blames Ukraine for attack on key Crimea military supply bridge that kills 2 (AP News) Traffic on the key bridge connecting Crimea to Russia’s mainland has been halted after one of its sections was blown up in what Russian officials say was a Ukrainian attack that also killed a married couple and injured their daughter.

Two dead after explosions on Kerch Bridge linking Crimea and Russia (the Guardian) Only direct overland link damaged as Russia says it will pull out of UN-brokered grain deal

Ukraine bides its time in its counteroffensive, trying to stretch Russian forces before striking (AP News) The first phase of Ukraine's counteroffensive to recapture Russian-occupied territory after more than 16 months of war began weeks ago without fanfare.

The underground Crimean Tatar group taking up arms against Russia (the Guardian) The Atesh guerrilla group is active behind Russian lines, and leaders of the Indigenous movement say there are ready if they can get the weapons

Russia-Ukraine war: List of key events, day 508 (Al Jazeera) As the Russian invasion of Ukraine enters its 506th day, these are the main developments.

East Ukraine fighting ‘intensifies’ as Putin dismisses offensive (Al Jazeera) Kyiv says fighting in eastern Ukraine ‘intensified’ as Moscow warns it has a ‘sufficient stockpile’ of cluster bombs.

Ukrainian Military Reports Intense Fighting Along Front As Putin Threatens 'Reciprocal Action' Against Cluster Munitions (RadioFreeEurope/RadioLiberty) The Ukrainian military says intensive fighting is taking place in several areas, noting success near Berdyansk in southeastern Ukraine and attacks by Russian forces in the direction of Kupyansk and Kharkiv in the northeast.

Small, Hidden and Deadly: Mines Stymie Ukraine’s Counteroffensive (New York Times) To gain ground, Ukrainian forces have to make their way through a variety and density of Russian land mines they never imagined.

Ruined, Empty, Mined and Overgrown: Ukraine’s Forgotten Villages (New York Times) Settlements along Ukraine’s eastern steppe were reduced to wreckage as the war passed through them. Now choked with weeds and with few residents, they are at risk of disappearing.

Putin says Russia has ‘sufficient stockpile’ of cluster bombs as Ukraine gets its own supply from US (Washington Post) Russian President Vladimir Putin said in an interview published Sunday that Moscow has a “sufficient stockpile” of cluster munitions, and warned that Russia “reserves the right to take reciprocal action” if Ukraine uses the controversial weapons.

Russia-Ukraine war live: Russian military leaders increasingly criticised by subordinates, says UK (the Guardian) UK intelligence says sacking of Russian general over critical comments likely indicative of wider trend

Another Russian General Reportedly Fired In Latest Military Shakeup Post-Mutiny (RadioFreeEurope/RadioLiberty) Another Russian general has reportedly been fired in the latest shakeup in the military since Wagner mercenary group founder Yevgeny Prigozhin launched a short-lived mutiny three weeks ago.

Prigozhin pictured half-naked as Putin says ‘Wagner does not exist’ (The Telegraph) Embarrassing photograph adds to campaign discrediting ex-mercenary, with Russian president claiming he never led the group

Prigozhin's Media Companies May Resume Work As Mutiny Fallout Dissipates, FT Reports (RadioFreeEurope/RadioLiberty) Some news outlets belonging to Yevgeny Prigozhin’s media holding may resume their work as the fallout from his mutiny last month dissipates, the Financial Times (FT) reported.

Wagner Troops Reportedly Enter Belarus As Mercenary Group's Future Still Uncertain (RadioFreeEurope/RadioLiberty) A long convoy transporting Wagner troops entered Belarus from Russia on July 15, the independent Belarusian military monitoring project Belaruski Hayun reported.

How Ukrainians Living at the Front View the War, Victory, and Peace (Wilson Center) In an earlier piece we discussed how Ukrainians living in front-line areas, the great majority of whom are Russian speakers, see their own nation and how they perceive Russia and Russian citizens. This blog addresses their opinions regarding war and a path to victory and peace.

Exclusive: Belarus abducts thousands of Ukrainian children (The Telegraph) Alexander Lukashenko implicated in alleged war crime as boys and girls as young as six are taken to camps in 'forced deportation'

Britain Sanctions 14 Russian Officials Involved In Forced Relocation Of Ukrainian Children (RadioFreeEurope/RadioLiberty) Britain has sanctioned 14 Russian officials, including two government ministers, for what it says is their role in Russia's forced relocation of tens of thousands of Ukrainian children since the start of Moscow's unprovoked invasion of Ukraine in February last year.

Kyiv Says More Than 50 Russian Soldiers Have Been Convicted Since Russia's Full-Scale Invasion (RadioFreeEurope/RadioLiberty) Ukrainian courts have convicted and sentenced more than 50 Russian soldiers for crimes committed in Ukraine since Russia’s massive military invasion in February 2022.

NATO Vilnius Summit 2023: A Summit For Implementation (Wilson Center) The historic NATO Summit in Vilnius, the summit for implementation, produced a lengthy 90-point joint communiqué. With a trove of new announcements, it's worth examining the key outcomes of the Vilnius Summit, as NATO is gearing up to the 75th anniversary of the Alliance in 2024.

Nato will come calling to Ukraine when staring at a humiliated Russia | Defence in Depth (The Telegraph) Video analysis: Ukraine is revolutionising the future of warfare and has been the testing ground for the world's most advanced weapons

NATO Vilnius Summit could have been historic. Instead, it mostly kicked the can down the road. (Breaking Defense) Author John Deni argues that at the NATO Summit, "there was little significant movement on several key issues, leaving much on the table for the alliance’s 75th birthday summit next year in Washington, DC."

Old Pentagon battles over provoking Russia relent with new European Command mission (Stars and Stripes) The Pentagon announced EUCOM’s 9-year-old Atlantic Resolve mission that has deployed thousands of troops over the years to defend NATO’s eastern flank was reclassified as a contingency operation.

Israel as a Security Model for Ukraine (Wilson Center) Many Ukrainians and Ukraine supporters have described the NATO summit that concluded this past week in Vilnius, Lithuania, as disappointing. Ukraine did not get a formal invitation to join the alliance or an exact timeline for accession. Yet security prospects are much brighter for Ukraine than it might seem.

Ukraine’s NATO Push Hit a Bump. Joining the EU Will Also Be Tough. (Wall Street Journal) Adding such a big country to the bloc will be hard for Europe, not just Kyiv.

Opinion | Europe Keeps Acting Like It Can’t Defend Itself Against Russia (New York Times) The Russian military’s lackluster performance in the war in Ukraine has shown that Europe can, and should, defend itself.

Giving Ukraine Cluster Munitions is Necessary, Legal and Morally Justified (RUSI) Cluster munitions would be valuable in breaking through Russian trenches, while the threat to civilians is negligible amid Russia’s mass emplacement of unmarked minefields.

Зведена інформація щодо діяльності угрупування UAC-0010 станом на липень 2023 року (CERT-UA) Урядова команда реагування на комп’ютерні надзвичайні події України, яка функціонує в складі Державної служби спеціального зв’язку та захисту інформації України.

Gamaredon hackers start stealing data 30 minutes after a breach (BleepingComputer) Ukraine's Computer Emergency Response Team (CERT-UA) is warning that the Gamaredon hacking operates in rapid attacks, stealing data from breached systems in under an hour.

Russia-linked APT Gamaredon starts stealing data from victims between 30 and 50 minutes after the initial compromise (Security Affairs) Ukraine’s Computer Emergency Response Team (CERT-UA) states that Russia-linked APT Gamaredon starts stealing data 30 minutes after the initial compromise. Ukraine’s Computer Emergency Response Team (CERT-UA) is warning that the Russia-linked APT group Gamaredon (aka Shuckworm, Actinium, Armageddon, Primitive Bear, UAC-0010, and Trident Ursa) use to steal data from victims’ networks in less than an hour after the initial compromise. Gamaredon has […]

Armageddon in Ukraine – how one Russia-backed hacking group operates (CyberSecurity Connect) In 2014, when Russia annexed the Crimean Peninsular, the local security forces faced quite a dilemma. Stand, fight, run, or give up?

Russian hacking group Armageddon increasingly targets Ukrainian state services (Record) The Moscow-linked hacking group Armageddon remains one of the most active and dangerous threat actors targeting Ukraine during its war with Russia, according to recent research.

Russia bans officials from using iPhones in U.S. spying row (Apple Insider) Russia's Federal Security Service has encouraged thousands of officials in the country to stop using iPhones and Apple products over U.S. surveillance claims, but the officials aren't happy about the order.

Anonymous Sudan claims it hit PayPal with 'warning' DDoS cyberattack (Tech Monitor) Hacktivists Anonymous Sudan claim they will use PayPal to take on organisations in the US and United Arab Emirates.

The pro-Ukraine internet 'fellas' using Shiba Inu memes to fight Russian propaganda (CNN) It looked like a normal tweet by Estonian Prime Minister Kaja Kallas, posted days before NATO’s summit in Vilnius, Lithuania. But instead of referring to the military alliance’s acronym, she congratulated the “fellas” on their “first-ever NAFO summit.”

Putin Noncommittal On Grain Deal Extension During Call with South African Leader (RadioFreeEurope/RadioLiberty) Russian President Vladimir remained noncommittal on extending a UN-backed grain deal, claiming in a call with his South African counterpart that Moscow's demands have not been met.

Russia Takes Control Of Shares In Local Danone Subsidiary (RadioFreeEurope/RadioLiberty) The Russian state has taken control of shares in the Russian subsidiary of French food producer Danone, according to a decree signed by President Vladimir Putin on July 16.

Zelensky’s Fight After the War (Foreign Affairs) What peace will mean for Ukraine’s democracy.

Attacks, Threats, and Vulnerabilities

“Quoi...? feur” from meme to malware – PyPI package targets Windows with ‘NullRAT’ info-stealer (Sonatype) A malicious PyPI package called ‘feur’ which was caught by Sonatype’s automated malware detection systems

China (Intelligence and Security Committee of Parliament) China’s national imperative continues to be the continuing dominance and governance of the Chinese Communist Party (CCP). However, it is its ambition at a global level – to become a technological and economic superpower, on which other countries are reliant – that represents the greatest risk to the UK

Chinese government hackers ‘frequently’ targeting MPs, warns new report (Record) The document from the Intelligence and Security Committee warns that China-based cyber operations have had “considerable success” in penetrating foreign government and private sector IT systems.

Sullivan: Hackers ‘did not get any classified federal information’ from agencies (The Hill) National security adviser Jake Sullivan said Sunday that the Chinese hackers who breached email accounts of multiple U.S. government agencies did not get any classified federal information. “The …

Microsoft Email Hack Shows Greater Sophistication, Skill of China’s Cyberspies (Wall Street Journal) Hackers adapt to the U.S.’s growing cyber defenses, learn to tread lightly and avoid detection.

Microsoft takes pains to obscure role in 0-days that caused email breach (Ars Technica) Critics also decry Microsoft's "pay-to-play" monitoring that detected intrusions.

Chinese APT Favorite Backdoor Found in Pakistani Government App (Infosecurity Magazine) Trend Micro found a backdoor previously exploited by various Chinese threat actors in a popular application used by Pakistan’s government agencies

Hackers target Pakistani government, bank and telecom provider with China-made malware (Record) An unknown hacker group compromised a Pakistani government app in order to infect victims with the China-linked Shadowpad malware, researchers have found.

50 Million Bangladeshis Impacted by Government Website Data Leak (CPO Magazine) A Bangladeshi government website data leak has exposed the personal information of millions of eGovernment portal users.

Cyber Attack Hits South Korean Government Institution, Resulting in Loss of 135,000 USD to Phishing Scam - KoreaTechDesk | Korean Startup and Technology News (KoreaTechDesk) In an unprecedented incident, a South Korean government-affiliated institution has fallen victim to a phishing scam, resulting in a substantial loss of funds. According to Korean media reports, the Institute for Startup Promotion, operating under the Ministry of SMEs and Startups, transferred 175 million won (135,000 USD) to an overseas criminal group after being tricked

TeamTNT's Cloud Credential Stealing Campaign Now Targets Azure and Google Cloud (The Hacker News) A malicious actor expands their target beyond AWS. Azure and Google Cloud Platform (GCP) services are now at risk.

TeamTNT gang may go after Azure and Google Cloud users (Register) Why limit yourself to only stealing AWS credentials?

Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP (Sentinel Labs) Throughout June 2023, an actor behind a cloud credentials stealing campaign has expanded their tooling to target Azure and Google Cloud Platform (GCP) services. Previously, this actor focused exclusively on Amazon Web Services (AWS) credentials.

Agile Approach to Mass Cloud Credential Harvesting and Crypto Mining Sprints Ahead (Permiso) Permiso p0 Labs and SentinelLabs team up to tackle the latest mass cloud credential harvesting and crypto mining campaign "SilentBob".

New SOHO Router Botnet AVrecon Spreads to 70,000 Devices Across 20 Countries (The Hacker News) Alert! A new malware strain called AVrecon has quietly targeted over 70,000 small office/home office (SOHO) routers worldwide.

Google Removes Swing VPN Android App Exposed as DDoS Botnet (HackRead | Latest Cybersecurity and Hacking News Site) The developer behind the malicious app, Limestone Software Solutions, has also been banned from the Google Play Store.

AIOS WordPress Plugin Faces Backlash for Storing User Passwords in Plain Text (The Hacker News) Over a million WordPress sites are affected by a critical bug in the All-In-One Security (AIOS) plugin.

Honeywell, CISA warn of ‘Crit.IX’ vulnerabilities affecting manufacturing tools (Record) Operational technology giant Honeywell joined the Cybersecurity and Infrastructure Security Agency (CISA) Thursday in warning of several serious vulnerabilities affecting a line of industrial control tools used widely within the manufacturing industry.

Rockwell Automation ControlLogix Bugs Expose Industrial Systems to Remote Attacks (The Hacker News) U.S. CISA warns of critical vulnerabilities in Rockwell Automation ControlLogix ENIP modules, allowing remote code execution and DoS attacks.

WormGPT - The Generative AI Tool Cybercriminals Are Using to Launch BEC Attacks (SlashNext) In this blog post, we'll look at the use of generative AI, including OpenAI's ChatGPT, and the cybercrime tool WormGPT, in BEC attacks.

Crimeware tool WormGPT: AI for BEC attacks (SC Media) Cybercriminals are cashing in on the generative AI hype with a dedicated version of the technology catering to crooks

WormGPT Cybercrime Tool Heralds an Era of AI Malware vs. AI Defenses (Dark Reading) A black-hat alternative to GPT models specifically designed for malicious activities like BEC, malware, and phishing attacks is here, and will push organizations to level up with generative AI themselves.

WormGPT: New AI Tool Allows Cybercriminals to Launch Sophisticated Cyber Attacks (The Hacker News) A new generative AI cybercrime tool called WormGPT is making waves in underground forums. It empowers cybercriminals to automate phishing attacks.

WormGPT - The Malicious ChatGPT Alternative Empowering Cybercriminals (HackRead) WormGPT is being offered for sale on a popular hacking forum, enabling malicious actors to exploit its capabilities for nefarious purposes.

WormGPT, the generative AI tool to launch sophisticated BEC attacks (Security Affairs) The WormGPT case: How Generative artificial intelligence (AI) can improve the capabilities of cybercriminals and allows them to launch sophisticated attacks. Researchers from SlashNext warn of the dangers related to a new generative AI cybercrime tool dubbed WormGPT. Since chatbots like ChatGPT made the headlines, cybersecurity experts warned of potential abuses of Generative artificial intelligence (AI) […]

Satellites lack standard security mechanisms found in mobile phones and laptops (Help Net Security) Researchers assessed satellite security mechanisms from an IT perspective and found a lack of modern security implementation.

Thousands of images on Docker Hub leak auth secrets, private keys (BleepingComputer) Researchers at the RWTH Aachen University in Germany published a study revealing that tens of thousands of container images hosted on Docker Hub contain confidential secrets, exposing software, online platforms, and users to a massive attack surface.

The source code of the BlackLotus UEFI Bootkit was leaked on GitHub (Security Affairs) The source code for the BlackLotus UEFI bootkit has been published on GitHub and experts warn of the risks of proliferation of custom versions. Researchers from ESET discovered in March a new stealthy Unified Extensible Firmware Interface (UEFI) bootkit, named BlackLotus, that is able to bypass Secure Boot on Windows 11. Secure Boot is a security feature of the […]

Cyber Extortion Trends: Lessons from CL0P and MOVEit (GovTech) The attack highlights risks around holiday weekend attacks, targeted software supply chains and the growing popularity of data-theft-based extortion. Still, zero-day exploits comprise only a small slice of extortion attacks.

Who are the ransomware gangs wreaking havoc on the world’s biggest companies? (the Guardian) It’s the defining cyber crime of the 2020s, and hackers are only just beginning to exploit its potential to make money and sow mayhem, says technology reporter Renee Dudley

The Path to 2024's Election Is Engulfed With Novel Threats (The Cipher Brief) A multiplicity of novel threats confront the 2024 U.S. elections. But a core group of cyber security experts are plotting a course forward.

Data breach exposes students' and faculty's sensitive information at Idaho colleges and universities (BoiseDev) Students’ and staff’s personal information at seven Idaho colleges and universities was compromised after a hacker breached third-party software. The software is used by the National Student Clearinghouse — which provides enrollment and degree data for institutions — and the Teachers Insurance Annuity Association of America — which administers retirement plans. Students and faculty at […]

Moveit Data Breach Hits Fidelity via Vendor PBI | PLANSPONSOR (Plan Sponsor) More than 371,000 retirement plan participants had data exposed in a breach in late May, according to PBI.

About 20% of Washington State Population's Personal Information Exposed due to Data Breach (Big Country News) Anyone who’s worked in food service in Washington state prior to 2019 may have had their personal data exposed due to unauthorized access to the Washington State Food Worker Card

Personal information of almost 172,000 Tennessee retirees and beneficiaries included in security breach (WBIR) The Tennessee Consolidated Retirement System said the security breach was confirmed on June 26.

Dating App That Claims 50 Million Users Suffered a Data Breach (vpnMentor) Cybersecurity Researcher, Jeremiah Fowler, discovered and reported to vpnMentor about a non-password protected database that contained approximately 2.3 million records. Upon

Human error to blame for data breach involving more than 5,600 people in P.E.I. (Atlantic) More than 5,600 clients of a provincial employment program on Prince Edward Island may have had their personal information compromised after a privacy breach.

City of Hayward declares local emergency after ransomware attack (ABC7 San Francisco) A Hayward city spokesperson says the emergency declaration allows the city's executive functions to work more efficiently to direct staffing, acquire expertise and equipment faster.

Trends

More Than A Quarter Of UK Adults Have Used Generative AI, Says Deloitte (Security Informed) More than a quarter of UK adults have used generative artificial intelligence such as chatbots, according to research from accounting group Deloitte.

In Defense of Parasocial Relationships (Time) Decades of research suggest that they’re good for the majority of people who engage in them.

Marketplace

If cybersecurity isn't recession-proof, what is? (TechCrunch) If cybersecurity isn't recession-proof, generative AI and animal agriculture might be.

MicroStrategy sees two C-suite departures as it continues investing in bitcoin (Washington Business Journal) The Tysons business software firm is also a huge cryptocurrency investor.

Products, Services, and Solutions

New infosec products of the week: July 14, 2023 (Help Net Security) The featured infosec products this week are from: Fidelis Cybersecurity, Hubble, NETSCOUT, Regula, and WatchGuard.

Titaniam Responds to Surging Demand with New Generative AI Governance Suite, Advisory Board, and Strategic Go-to-market Partnerships (Benzinga) Award-winning data security company, Titaniam, expands product suite with launch of two AI governance offerings, establishes high-powered GenAI advisory board, and partners with Optiv, Persistent Systems SAN FRANCISCO

Endor Labs Recognized as a Cool Vendor in the 2023 Gartner® Cool Vendors™ in Platform Engineering for Scaling Application Security Practices (Endor Labs) Endor Labs is committed to providing cutting-edge solutions that address the challenges faced by platform engineering and DevSecOps teams in meeting application security needs.

Plurilock Announces Strategic Focus to Address Growing AI Cybersecurity Threats (Yahoo Finance) Plurilock, founded on cybersecurity and AI, has announced a company-wide focus on addressing the cybersecurity threats represented by AI and generative AI toolsThe generative AI market is currently seeing historically unprecedented growth, yet presents significant risks to the global economy due to data safety issuesThe Company is actively consulting with its customers on business AI governance and adoption and providing free governance resources as a public serviceThe Company's AI focus present

Sophos Intercept X Wins Best Endpoint Security in CRN® Tech Innovator Awards (GlobeNewswire News Room) Sophos Managed Detection and Response (MDR) Honored as Top MDR Security Offering...

High Wire Networks Introduces Next-Gen, Industry-Disruptive Cybersecurity Technology Utilizing New Overwatch Universal Secure Enterprise Browser Extension (GlobeNewswire News Room) Introduces industry’s first identity-based securitization of employee and third-party access to enterprise resources using any modern web browser of choice...

Technologies, Techniques, and Standards

Maritime Cyber Attack Database launched (Smart Maritime Network) Researchers at NHL Stenden University of Applied Sciences in the Netherlands have launched the Maritime Cyber Attack Database (MCAD), a database of incidents involving the worldwide maritime sector. Created by a team led by Dr Stephen McCombie, Professor of Maritime IT Security, the database cont

How to Use Generative AI Tools While Still Protecting Your Privacy (WIRED) Here's how to take some control of your data while using artificial intelligence tools and apps.

Senators eye electronic warfare capability demonstration in western US (C4ISRNet) Sen. Mark Kelly, an Arizona Democrat, said the interstate demonstration would "better replicate some real-world threat conditions."

EV Charging Networks Prepare for Cyberattacks (Wall Street Journal) Mandates for electric-vehicle sales have raised concerns over poorly defended charging stations—and the possibility for spillover hacks of wider power grids.

Object Management Group Paper Debunks Cloud Myths (Object Management Group) Creating a cloud strategy based on reliable information.

Design and Innovation

ChatGPT Is Reshaping Crowd Work (WIRED) Although some workers shun chatbot help, platforms are adopting policies or technology to deter use of AI—potentially making crowd work more difficult.

Elon Musk's xAI Might Be Hallucinating Its Chances Against ChatGPT (WIRED) Elon Musk’s new venture aims to create AI that can “understand the universe” and challenge OpenAI. Right now it’s 11 male researchers with a lot of work to do.

The Last Word on AI and the Atom Bomb (WIRED) I’m old enough to have cowered under my school desk. Decades later I learned physics from the bomb guys. What I’m mainly hearing now is echoes.

The inventor who fell in love with his AI (The Economist) Artificial intelligence will increasingly sound like us as it grows more sophisticated. Will we be able to resist falling for our computer programs?

Can Twitter Alternatives Escape the Enshittification Trap? (WIRED) People have flocked to Bluesky and Threads. But the new platforms risk repeating a pattern that has caused social media giants to turn against their own users.

WISeKey to Develop an Ultra-Secure Picosatellite Solution for Quantum-Ready IoT Communications (The Tech Outlook) WISeKey to Develop an Ultra-Secure Picosatellite Solution for Quantum-Ready IoT Communications WISeSat & SEALSQ subsidiaries join forces to create the new generation of WISeSat-ready satellites that incorporate revolutionary post-quantum solutions; microchips and devices designed to withstand the evolution of computational power. GENEVA – July 14, 2023: WISeKey International Holding Ltd. (“WISeKey”) (SIX: WIHN, NASDAQ: WKEY), …

Academia

UC prepares to host statewide cybersecurity exercise (EurekAlert!) Experience gained at the largest Department of Defense (DOD) unclassified cyber defense exercise is helping the Ohio Cyber Range Institute (OCRI) at the University of Cincinnati develop the nation's premier civilian cybersecurity operation in Ohio.

Legislation, Policy, and Regulation

Korea to join US-led multinational cyber exercise (Korea Times) Korea's Cyber Operations Command will participate in a U.S.-led multinational cyber exercise this month to strengthen its capabilities to counter threats in the increasingly crucial security domain, Seoul's defense ministry said Monday.

It’s time to scrap our ridiculous privacy laws (The Telegraph) Article 8 of the ECHR has become a means to censor public interest journalism – it was never meant for that purpose

FBI Surveillance Fears Are Uniting a Badly Broken Congress (WIRED) The FBI has collected sensitive data on millions of Americans without warrants, drawing intense scrutiny from Congress and turning the agency into a punching bag across the political divide.

Exclusive: Worried about obscenity, India asks streamers for content checks (Reuters) India has told Netflix, Disney and other streaming services that their content should be independently reviewed for obscenity and violence before being shown online.

Urgency Needed in Carrying Out Cybersecurity Plan, GAO Says (FEDweek) The GAO has called for urgency in fleshing out and carrying out the updated National Cybersecurity Strategy issued in March, saying “it is critical that

Experts warn of financial challenges and gaps in cyber implementation plan (Nextgov.com) From a crucial lack of federal funding to longstanding issues with the cyber workforce, experts told Nextgov/FCW that the new cybersecurity implementation plan features major “financial potholes.”

White House Maps Out National Cybersecurity Strategy (Decipher) The White House has dropped the long-awaited plan for executing its National Cybersecurity Strategy, which involves 65 initiatives and 18 government agencies.

Bipartisan FISMA update looks to tweak cyber incident reporting rules for agencies (Nextgov.com) The legislation proposes new requirements for disclosing cyberattacks, assigns guidance for A.I.-enabled cyber, codifies the Federal CISO role and more.

Personal debts said to scuttle nomination of Biden’s acting cyber director (Washington Post) The rationale for not permanently nominating Kemba Walden to be national cyber director has stunned colleagues

What to make of the acting national cyber director not getting the full-time job (Washington Post) Reaction to the administration’s decision on leadership of the national cyber director’s office

After computer shutdown, a Maryland county buys cyber protection. Is that enough? (Herald-Mail) A holiday cyber attack threw one Western Maryland county for a loop, altering some police operations, slowing down the office of the state’s attorney, and preventing online payments. Other jurisdictions in the state could learn lessons from the holiday hack of Washington County.

Litigation, Investigation, and Law Enforcement

5th Circuit pauses order restricting Biden administration’s tech contacts (Washington Post) The stay follows a request from the Justice Department, which warned the sweeping order could chill law enforcement activity

A win for the First Amendment, and a loss for partisans who want to weaponize censorship (Reason.com) One thing is clear about Missouri v. Biden: The decision cannot be understood by viewing it through a polarized lens.

EPA says court decision to ban new rule ‘undercuts’ cybersecurity efforts (Record) A spokesperson told Recorded Future News that the EPA is committed to the new rule as part of its mission to protect the public.

Genesis Market sold to anonymous buyer despite FBI disruption (Register) The criminal group behind the cyber fraud platform Genesis Market claimed on Thursday that it had been sold to an unidentified buyer a few months after U.S. authorities sanctioned the platform and seized some of its domains.

Alleged Hacker Behind $200m Euler Finance Exploit Arrested $EUL (Crypto Daily) While currently facing charges related to money laundering in France, his potential involvement in the $200 million exploit could lead to more serious repercussions.

BreachForums' Pompompurin Pleads Guilty to Holding Child Abuse Content (HackRead) According to court documents, devices owned by Pompompurin contained 600 explicit images of child abuse, which led him to plead guilty in court.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Splunk’s .conf23 (Las Vegas, Nevada, USA, Jul 17 - 20, 2023) For more than a decade, Splunk users and leaders have come together at .conf® to share knowledge, see inspiring speakers and nab the punniest t-shirts in tech. This year, explore how Splunk can help you overcome today’s toughest digital challenges. Want to respond faster to threats? Pivot better when the unexpected arises? Prevent incidents from becoming major issues? Join fellow experts in security, IT and engineering at .conf23 to learn, network and grow.

The Cyber Threat Intelligence Summit (Virtual, Jul 18, 2023) In today's ever-evolving threat landscape, organizations face numerous challenges in securing their businesses from cyber threats and malicious activities. The effective utilization of threat intelligence has emerged as a crucial aspect of modern security strategies. How can threat intelligence be used in today’s dynamic threat landscape? How are businesses making intelligence actionable? Can intelligence change the way we secure and protect our businesses - replacing legacy solutions with new intelligence-powered innovations? Why is it so important for every organization to use intelligence actionably, not just forensically? What does the future look like? Join thought leaders and experts from the threat intelligence community as they share valuable insights, discuss current trends, and showcase innovative approaches to leverage threat intelligence effectively. Gain practical knowledge, real-world experiences, and tactical direction to fortify your organizations against emerging threats, and explore the multifaceted role of threat intelligence in enhancing cybersecurity measures and revolutionizing the way businesses protect their assets.

Uniting Women in Cyber 2023 (Arlington, VA, US, Oct 3, 2023) Uniting Women In Cyber convenes a powerful and diverse network of leaders, experts and practitioners from across sectors and industries to discuss lessons learned, emerging trends and practices, and to determine actionable strategies.

Events

Splunk’s .conf23 (Las Vegas, Nevada, USA, Jul 17 - 20, 2023) For more than a decade, Splunk users and leaders have come together at .conf® to share knowledge, see inspiring speakers and nab the punniest t-shirts in tech. This year, explore how Splunk can help you overcome today’s toughest digital challenges. Want to respond faster to threats? Pivot better when the unexpected arises? Prevent incidents from becoming major issues? Join fellow experts in security, IT and engineering at .conf23 to learn, network and grow.

The Cyber Threat Intelligence Summit (Virtual, Jul 18, 2023) In today's ever-evolving threat landscape, organizations face numerous challenges in securing their businesses from cyber threats and malicious activities. The effective utilization of threat intelligence has emerged as a crucial aspect of modern security strategies. How can threat intelligence be used in today’s dynamic threat landscape? How are businesses making intelligence actionable? Can intelligence change the way we secure and protect our businesses - replacing legacy solutions with new intelligence-powered innovations? Why is it so important for every organization to use intelligence actionably, not just forensically? What does the future look like? Join thought leaders and experts from the threat intelligence community as they share valuable insights, discuss current trends, and showcase innovative approaches to leverage threat intelligence effectively. Gain practical knowledge, real-world experiences, and tactical direction to fortify your organizations against emerging threats, and explore the multifaceted role of threat intelligence in enhancing cybersecurity measures and revolutionizing the way businesses protect their assets.

AWS Summit New York (New York, New York, USA, Jul 26, 2023) The cloud event for everyone. You’re invited to be part of our free, in-person event that brings together cloud enthusiasts for a day of learning, networking, and collaboration. Attend keynotes, breakout content, and interactive labs led by AWS experts, partners, and customers - and network with other industry professionals about the latest cloud computing technologies.

Critical Infrastructure Security Summit (Alexandria, Virginia, USA, Jul 26 - 27, 2023) Defense Strategies Institute is proud to present the 3rd annual Critical Infrastructure Security Summit. This Summit will convene senior leaders from across DoD, the Cyber Defense community, Federal Agencies, Industry, and Academia to discuss current methods for creating resilient systems to protect US infrastructure from external threats, as well as the defense mechanisms to protect those systems. The Summit will be held July 26-27, 2023 at the Mary M. Gates Learning Center in Alexandria, VA.

2023 International Cybersecurity Championship and Conference (IC3) (San Diego, California, USA, Aug 1 - 4, 2023) The International Cybersecurity Championship and Conference (IC3) event is designed to attract top talent and raise global awareness of the power of games to upskill the cybersecurity industry. Through its exciting, competition-based forum, the IC3 helps individuals...

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.