DPRK's coordinated cyber ops. The state of Cl0p. NetSupport RAT. HotRAT. The crackable TETRA standard. CISA adds to the KEV.

Summary

By the CyberWire staff

At a glance.

North Korea's increasingly supple cyber offensives.
A look at Cl0p.
NetSupport RAT's fake update vectors.
Crackable radio encryption standard: a bug or a feature?
HotRat, a Trojan that accompanies illegally pirated software and games.
CISA adds two Adobe ColdFusion vulnerabilities to its Known Exploited Vulnerability Catalog.
Sanctioned Russian surveillance tech executive dies at 40.

North Korea's increasingly supple cyber offensives.

Mandiant this morning released research into current activity by Pyongyang's UNC4899, which it describes as "a Democratic People's Republic of Korea (DPRK)-nexus actor, with a history of targeting companies within the cryptocurrency vertical." Mandiant "assesses with high confidence that UNC4899 is a cryptocurrency-focused element within the DPRK's Reconnaissance General Bureau (RGB)," and the researchers also believe it's the same activity tracked and reported elsewhere as TraderTraitor. Mandiant's research was conducted in the course of its investigation of a supply chain attack on one of JumpCloud's customers. North Korean operators have undergone years of refinement and coordination to the point where they represent an agile and sophisticated adversary, with shared tooling and targeting. Mandiant's report concludes, "This seeming “streamlining” of activities by DPRK often makes it difficult for defenders to track, attribute, and thwart malicious activities, while enabling this now collaborative adversary to move stealthily and with greater speed."

Charles Carmakal, Mandiant Consulting CTO, Google Cloud, commented in an email on the improvements his organization has observed in the DPRK's cyber operations. “North Korea-nexus threat actors continue to improve their cyber offensive capabilities in order to steal cryptocurrency. Over the past year, we’ve seen them conduct multiple supply chain attacks, poison legitimate software, and develop and deploy custom malware onto MacOS systems. They ultimately want to compromise companies with cryptocurrency and they’ve found creative paths to get there," he said, qualifying this assessment with some encouraging observations about the RGB's inability to operate fully undetected. "But they also make mistakes that have helped us attribute several intrusions to them.”

First look: mWISE 2023 session catalog

Check out the topics, meet the speakers, and sign up for discount registration.

A look at Cl0p.

Fortinet’s FortiGuard Labs has published a report on the Cl0p ransomware gang. The Cl0p ransomware is associated with the FIN11 cybercrime group, and appears to be a descendent of the CryptoMix ransomware. The gang has been conducting a widespread data theft extortion campaign leveraging a recently disclosed MOVEit Transfer vulnerability (CVE-2023-34362).

The gang recently shifted its monetization strategy, and now focuses on stealing data for extortion rather than executing ransomware: “At some stage in its operations, the FIN11 group revised its strategy of deploying ransomware and shifted to purely exfiltrating information from victims for extortion. In fact, there is no evidence that the Cl0p ransomware was deployed when the MOVEit Transfer vulnerability was recently exploited.”

Cl0p currently has over 400 victims listed on its data leak site, most of which are located in the US and Europe: “According to data collected through Fortinet's FortiRecon service, the Cl0p ransomware group preyed on several industry sectors between January and June 2023, with business services leading the way, followed by software and finance. When victim organizations are classified by country, the United States is in first place by a significant margin.”

The key to beating ransomware? Use a solution built to defeat ransomware.

Halcyon is the first dedicated, adaptive solution that combines multiple advanced proprietary prevention engines focused specifically on detecting and stopping ransomware. With the fastest endpoint recovery capabilities, multiple layers of resiliency, bypass and evasion protection, automated key capture for swift decryption and data exfiltration prevention, the Halcyon Anti-Ransomware and Resilience Platform reverses the impact of ransomware attacks in just minutes. This is why Halcyon is the resilience platform Global 2000 companies rely on to defeat ransomware.

NetSupport RAT's fake update vectors.

Malwarebytes is tracking a new campaign called “FakeSG” that uses compromised websites to trick users into installing the NetSupport RAT under the guise of a phony browser update: “The tactics, techniques, and procedures (TTPs) are very similar to those of SocGholish and it would be easy to think the two are related. In fact, this chain also leads to NetSupport RAT. However, the template source code is quite different and the payload delivery uses different infrastructure. As a result, we decided to call this variant FakeSG.”

Recover from ransomware and disasters the indisputable way. Backup Better.

Be ready for the inevitable with CrashPlan endpoint backup. With 256-bit AES encryption in transit and at rest running automatically every 15 minutes, you can work without friction or fear.

Trusted by organizations worldwide with less than 100 endpoints to more than 100,000, CrashPlan is the undeniable solution to recover all your work and intellectual property at the endpoints from any data calamity. And, see what exactly was compromised to fully understand the risk.

Crackable radio encryption standard: a bug or a feature?

At Black Hat this year Midnight Blue researchers will present the results of their study of the European Telecommunications Standards Institute's TErrestrial Trunked RAdio (TETRA) standard. Vice's Motherboard has an early look at the research. Midnight Blue says the standard, widely used in first responder, infrastructure operator, and (some) military radios, offers an encryption standard that can be broken by readily available techniques. Midnight Blue says a reduction step so reduces the entropy of the initial key that passive decryption of traffic that it amounts to "an intentional backdoor." The vulnerable TEA1 encryption is relatively old but continues to see widespread use. Midnight Blue recommends that users replace it with more recent standards, or adopt additional end-to-end encryption. ETSI said that it welcomes any testing of its standards, noting that TETRA was designed to comply with export standards, and that ETSI has seen no evidence of the vulnerability's exploitation in the wild. Midnight Blue thinks such exploitation, being passive, would have been very difficult to observe, and could have passed unnoticed.

HotRat, a Trojan that accompanies illegally pirated software and games.

Researchers at Avast have discovered a campaign that spreads a newer version of AsyncRAT, this latest iteration called “HotRat.” The RAT (remote access trojan) piggybacks on downloads of illegally pirated games or illicit copies of software applications like Adobe Photoshop or Microsoft Office. Avast writes, “Once it sneaks into your computer, HotRat can swipe your personal info, snap screenshots of what you're up to, and even invite more unwanted guests.” CyberSecurity Connect reports that HotRat has been in circulation since October of last year and has mostly affected users in Africa and Asia. HotRat also has ways to maintain persistence. Investing.com writes, “The malware exhibits persistence by leveraging scheduled tasks, enabling it to maintain a foothold on infected systems. It also can eliminate antivirus programmes, thus endangering the system’s overall security.” As always, experts recommend purchasing or downloading software and applications from verified sellers or sources.

CISA adds two Adobe ColdFusion vulnerabilities to its Known Exploited Vulnerability Catalog.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two Adobe ColdFusion vulnerabilities (CVE-2023-29298 and CVE-2023-38205) to the Known Exploited Vulnerability Catalog. Rapid7 reported on CVE-2023-29298 in detail on their security blog, noting that the patch which fixed CVE-2023-29298 was, in their opinion, incomplete. As of July 19th, however, Adobe seems to have fixed their patch and mitigated the threat from CVE-2023-29298.

Also on July 19th, Adobe released a Security Bulletin regarding CVE 2023-38205 stating, “Adobe has released security updates for ColdFusion versions 2023, 2021 and 2018. These updates resolve critical  and moderate vulnerabilities that could lead to arbitrary code execution and security feature bypass. Adobe is aware that CVE-2023-38205 has been exploited in the wild in limited attacks targeting Adobe ColdFusion.” Adobe recommends that users update ColdFusion 2023, 2021, and 2018 with the most up-to-date version.

Sanctioned Russian surveillance tech executive dies at 40.

Anton Andreevich Cherepennikov, aged 40, has died, reportedly of cardiac arrest. He had been close to President Putin's administration, a tech "millionaire" who supplied key intelligence and surveillance capabilities to Russia's security and intelligence services. His company, Citadel, and its subsidiaries, were also believed to have developed, Radio Free Europe | Radio Liberty reports, "software designed to steal financial and personal information from computer networks." Mr. Cherpennikov's death has been widely viewed as suspicious, for reasons Newsweek summarizes: his friends don't believe the official cause of death, other deaths of prominent figures linked to the Kremlin (mostly by defenestration), and, of course, official Ukraine thinks it was in all likelihood murder. The US State Department had announced sanctions on Mr. Cherpennikov on February 24th of this year. The measures were related to his role in supplying technology the Russian government used to collect intelligence and suppress dissent.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+515: War against grain. (CyberWire) Russian strikes concentrate on grain ports, a prominent mil-blogger is arrested, and a surveillance executive dies.

Russia-Ukraine war: List of key events, day 516 (Al Jazeera) These are the main developments as the Russian invasion of Ukraine enters its 516th day.

Russia-Ukraine war at a glance: what we know on day 516 of the invasion (the Guardian) Russian missile attack on Odesa leaves at least one dead and 22 wounded and damages historic cathedral; Putin says Ukrainian counteroffensive has ‘failed’

Russia says Moscow and Crimea hit by Ukrainian drones while Russian forces bombard Ukraine's south (AP News) Russian authorities have accused Ukraine of launching a drone attack on Moscow during which one of the aircraft fell near the Defense Ministry’s main headquarters.

Russian strike on Ukraine's Odesa badly damages landmark Orthodox cathedral; 1 dead, many wounded (ABC News) Ukrainian officials say Russia again struck the Ukrainian Black Sea city of Odesa, keeping up a barrage that has damaged critical port infrastructure in southern Ukraine

Russian missile strikes on Odesa kill one person and damage cathedral (the Guardian) Ukrainian authorities say children among 22 injured in new wave of attacks on Black Sea port city

Historic Ukrainian cathedral badly damaged in Russian strikes (CNN) Russian missiles badly damaged dozens of Ukrainian architectural landmarks, including a historic Orthodox cathedral in the southern port city of Odesa, sparking outrage and prompting President Volodymyr Zelensky to vow retaliation.

‘This is barbarism’: shock at Russian strike on Odesa cathedral (the Guardian) Congregation rallies to clear rubble and save precious icons as prayers held outside

Russia says Moscow and Crimea hit by Ukrainian drones while Russian forces bombard Ukraine's south (AP News) Russian authorities have accused Ukraine of launching a drone attack on Moscow during which one of the aircraft fell near the Defense Ministry’s main headquarters.

Two drones downed over Moscow, says Russian defence ministry (the Guardian) Officials blame Ukraine for drones that hit non-residential buildings in Russian capital and say there were no casualties

Dispatch from Odesa: Russia escalates its naval war against Ukraine (Atlantic Council) After ending its participation in the Black Sea Grain Initiative, Russia has launched daily missile strikes along the Ukrainian coast from the sea.

UK missiles help to chase Russian navy fleet from Black Sea coast (The Telegraph) Moscow has been forced to change tactics as British weapons have helped Ukraine push Russian ships 60 miles off shore

Crimea Bridge 'Must Be Neutralized,' Zelenskiy Says (RadioFreeEurope/RadioLiberty) Ukrainian President Volodymyr Zelenskiy said on July 21 that the Crimea bridge connecting Russia with occupied Crimea "must be neutralized."

Russia ‘holding humanity hostage’ over Black Sea grain deal, UN hears (the Guardian) Security council session told that world’s poorest and most vulnerable at risk after Russia blocked exports

Putin warns Poland against ‘unleashing aggression’ against Belarus (the Guardian) Russian president reacts angrily after Polish defence minister sends troops to guard eastern border

Lukashenko ‘struggling to keep Wagner troops from attacking Poland’ (The Telegraph) Belarusian leader claims he is doing his best to prevent mercenaries from crossing border into neighbouring country

Prigozhin Registers 'Real Estate Management' Firm In Belarusian Village, Site Of Reported Tent Camp (RadioFreeEurope/RadioLiberty) Wagner mercenary chief Yevgeny Prigozhin has registered a "real estate management" firm in Belarus following his aborted mutiny against Russia's military leadership last month.

Global Sanctions Dashboard: Sanctions alone won’t stop the Wagner Group (Atlantic Council) Existing sanctions against the Wagner Group, limitations around enforcing them, and what more Western allies can do to counter Wagner's influence in Africa.

‘It’s guns versus butter’: Russia on the brink as Putin’s war chest empties (The Telegraph) Kremlin's fortunes crumble as oil profits plunge and the workforce flees conscription

Unilever to allow its 3,000 Russian workers to be conscripted (The Telegraph) Marmite and Dove owner faces continued criticism for selling products in Russia

Weary Soldiers, Unreliable Munitions: Ukraine’s Many Challenges (New York Times) A month of reporting by New York Times journalists found the fighting mostly stalemated and Ukraine facing an array of obstacles against a determined foe.

Bulgarian Lawmakers Approve Shipment Of Soviet-Era Armored Vehicles, Other Support For Ukraine (RadioFreeEurope/RadioLiberty) The Bulgarian parliament voted to send additional military and technical support to Ukraine, including some 100 Soviet-era armored vehicles from the NATO country’s reserves.

US still refusing to send long-range ATACMS missiles to Ukraine (The Telegraph) The US reportedly has a limited stockpile and is concerned about escalation, despite pleas from Volodymyr Zelensky and Congress

Opinion | We’ve Been on the Front Lines. We Know What Ukraine Needs. (New York Times) The war in Ukraine is changing fast. The U.S. must also be ready to pivot in its military assistance.

China secretly sends enough gear to Russia to equip an army (POLITICO) Shipments of military-capable hardware expose a China-sized loophole in Western sanctions.

Erdogan Looks West. What Does It Mean For Putin? (RadioFreeEurope/RadioLiberty) Turkish President Recep Tayyip Erdogan, the only NATO leader in regular contact with Russian President Vladimir Putin, seems to be “rebalancing” his foreign policy and taking steps to improve ties with the West. How long will that last, where does it leave Moscow, and what does it mean for Ukraine?

Putin has become a global bogeyman. Russians must exorcise this ghoul (the Guardian) Accursed, ostracised but heedless of the misery he causes, this accused war criminal is dragging his people into a moral abyss

US seeks to crack Putin power with high-level Russian spies (The Hill) The U.S. and its allies are looking to exploit cracks in Russian President Vladimir Putin’s power base by recruiting high-level Russian officials to spy for the West. The effort is taking on …

Pro-war Russian blogger who called Putin a ‘lowlife’ arrested in Moscow (CNN) A prominent Russian pro-war blogger who has criticized President Vladimir Putin and his military’s mishaps in Ukraine was arrested on Friday, in a move that suggested the Kremlin’s patience with dissent has grown thinner in the wake of the Wagner mercenary rebellion last month.

Russia arrests Igor Girkin, ex-security officer who led operations in Ukraine (Washington Post) Russian authorities on Friday detained Igor Girkin, a former Russian commander in Ukraine and prominent war blogger, reportedly on charges of promoting extremism — marking the first time Moscow has taken action against a fervent supporter of the war in Ukraine but one who voiced loud criticism of Russian leaders and their often botched military strategy.

Russia arrests pro-war Putin critic Igor Girkin, according to reports (the Guardian) FSB agents come to Girkin’s home and escort him away ‘in an unknown direction’

Girkin Associate Briefly Detained In Moscow (RadioFreeEurope/RadioLiberty) Pavel Gubarev, an associate of Igor Girkin, the former military commander of Moscow-backed separatists in Ukraine who was sent to pretrial detention following his criticism of Putin, was detained by security forces in Moscow after picketing the Meshchansky district court to demand Girkin's release.

Russia Seeks 18 Years in Jail for Founder of Cybersecurity Firm (SecurityWeek) A Russian prosecutor requested an 18-year prison sentence for Ilya Sachkov, founder of cybersecurity firm Group-IB.

A murdered writer, his secret diary of the invasion of Ukraine – and the war crimes investigator determined to find it (the Guardian) When he realised the Russians were coming for him, Ukrainian writer Volodymyr Vakulenko buried his journal. Then he was taken away never to return. Now, his chronicle has been unearthed …

Russia uses 'disinformation' to exaggerate military gains in Ukraine, according to the United Kingdom (Morning Express) In the latest UK Ministry of Defense (MoD) intelligence update, British defense chiefs have claimed that Russia's recent military assault on Ukraine's Luhansk

U.S.-Sanctioned Russian Millionaire Found Dead In His Office (RadioFreeEurope/RadioLiberty) Millionaire Russian businessman Anton Cherepennikov, 40, founder of the ICS Holding technology conglomerate and who was subject to U.S. sanctions, was found dead in his Moscow office.

Russian millionaire linked to key Putin ally found dead in Moscow (Newsweek) Anton Cherepennikov, who was head of the IT company ICS Holding, is the second figure linked to Putin's regime to have died in 48 hours.

Founder of Russian IT group involved in user monitoring dies at 40 (Yahoo News) Anton Cherepennikov, who founded ICS Holding (X-Holding), a group of IT companies known for their involvement in tracking Internet users, died at the age of 40, Russian media outlets reported on July 22.

Attacks, Threats, and Vulnerabilities

Norway government ministries hit by cyber attack (Reuters) Twelve Norwegian government ministries have been hit by a cyber attack, the Norwegian government said on Monday, the latest attack to hit the public sector of Europe's largest gas supplier and NATO's northernmost member.

The Chinese groups accused of hacking the US and others (Reuters) Chinese hacking teams have been blamed by Western intelligence agencies and cybersecurity groups for digital intrusion campaigns across the world, targeting everything from government and military organisations to corporations and media groups.

Pro-China influence campaign infiltrates U.S. news websites (Washington Post) A Chinese marketing firm that has counted state police and other government bureaus as clients is leveraging newswire services to place pro-Beijing stories on the websites of almost three dozen news outlets across America in an apparent effort to help Beijing improve its image abroad.

North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack | Mandiant (Mandiant) We responded to a supply chain compromise by a likely DPRK-nexus threat actor, who we believe leveraged JumpCloud.

Researchers Find ‘Backdoor’ in Encrypted Police and Military Radios (Vice) The TETRA standard is used in radios worldwide. Security researchers have found multiple vulnerabilities in the underlying cryptography and its implementation, including issues that allow for the decryption of traffic.

Hackers Use Fake Update Page Mimicking Victim's Browser to Deliver NetSupport RAT (Cyber Security News) Threat actors deliver NetSupport RAT through a new campaign called Fake SG which could rival with SocGholish.

Sophisticated BundleBot Malware Disguised as Google AI Chatbot and Utilities (The Hacker News) Beware of BundleBot, a stealthy malware strain that's stealing sensitive info from compromised hosts! It spreads through Facebook Ads.

New variant of AsyncRAT malware 'HotRat' spreading via free, pirated software (Investing.com India) New variant of AsyncRAT malware 'HotRat' spreading via free, pirated software

You dirty RAT: New HotRat Trojan distributed via cracked software and games (CyberSecurity Connect) Security researchers have uncovered a new malware campaign built around free and cracked versions of popular games and software suites.

New variant of AsyncRAT malware 'HotRAT' spreading via free, pirated software. (PGGurus) HotRAT malware is an advanced version of AsynchRAT.

CERT-In cautions internet users against Ransomware 'Akira' attack (The Economic Times) The agency is the central technology arm to combat cyber attacks and guards the cyber space against phishing and hacking assaults and similar online attacks.

Microsoft Cloud Hack Exposed More Than Exchange, Outlook Emails (SecurityWeek) Cloud security researcher warns that stolen Microsoft signing key was more powerful and not limited to Outlook.com and Exchange Online.

Microsoft disputes report that Chinese hackers could have accessed suite of programs (Record) Microsoft is disputing a new report that claims hackers may have had access to more parts of victims’ systems than previously known in a campaign that targeted dozens of organizations, including government agencies.

Mallox Ransomware Attacking MS-SQL Servers to Compromise Victims' Networks (Cyber Security News) A new ransomware strain dubbed, Mallox (aka TargetCompany, FARGO, and Tohnichi) actively targeting and attacking Microsoft SQL (MS-SQL) servers.

Clop ransomware hacked DHL, summing up 20 million victims & profit of $100 million via MOVEit (Information Security Newspaper | Hacking News) Clop ransomware hacked DHL, summing up 20 million victims & profit of $100 million via MOVEit - Data Security - Information Security Newspaper | Hacking News

DHL investigating MOVEit breach as number of victims surpasses 20 million (Record) The shipping company confirmed that one of its software providers was impacted by the widespread vulnerability affecting MOVEit, a file-sharing tool from Progress Software.

Clop now leaks data stolen in MOVEit attacks on clearweb sites (BleepingComputer) The Clop ransomware gang is copying an ALPHV ransomware gang extortion tactic by creating Internet-accessible websites dedicated to specific victims, making it easier to leak stolen data and further pressuring victims into paying a ransom.

Clop gang to earn over $75 million from MOVEit extortion attacks (BleepingComputer) The Clop ransomware gang is expected to earn between $75-100 million from extorting victims of their massive MOVEit data theft campaign.

Ransomware Roundup - Cl0p (Fortinet Blog) Learn about the Cl0p ransomware group's past activities including using the MOVEit Transfer vulnerability to compromise organizations.…

What Is an SSL Stripping Attack? (Check Point Software) Boost security with SSL/TLS encryption. Learn about HTTPS protection and staying safe from SSL stripping attacks.

Roblox Data Breach: PII of Thousands of Developers Stolen (HackRead) It turns out that Roblox suffered a data breach in 2021, but the company only revealed its details this week.

Roblox Data Leak Resurfaced With The Personal Details Of Nearly 4,000 Employees (MMOs.com) Roblox Corp. employee details resurface on a hacker forum after massive Roblox Developers Conference data breach of 2021.

Rite Aid customers’ personal information accessed in data breach (NewsNation) Rite Aid just announced a breach involving personal customer information. Here’s what we know so far.

Rite Aid customers’ personal information accessed in data breach (The Hill) Rite Aid just announced a breach involving personal customer information. Here’s what we know so far.

Two more breaches involving email gaffes: one by a NZ hospital, one by Fortinet (Databreaches.net) First, we have this “human error” mistake with email to report today. Hamish McNeilly reports: An email containing the names of vulnerable children...

Ransomware attack on rural Mississippi county a ‘cautionary tale’ (al) George County's computer system was hit with a "brute force attack," with hackers demanding payment in cryptocurrency.

Louisiana OMV offers free credit monitoring, identity theft protection after data breach (KTALnews.com) The Louisiana Office of Motor Vehicles will off free credit monitoring and identity theft protection from LifeLock for a year following a data breach announced in June.…

Controversial’ application deferred after council confirms data breach at planning board in Rotherham (Star) A data breach resulted in a ‘controversial’ planning application being deferred as residents who wanted to speak up at the meeting missed out.

Fake Deliverymen Targeting High Net-Worth Crypto Investors To Steal Their Coins: Canada Police (The Daily Hodl) Canadian police are issuing a warning to high-value crypto investors, stating thieves are breaking into homes to forcibly steal digital assets.

CISA warns govt agencies to patch Adobe ColdFusion servers (BleepingComputer) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given federal agencies three weeks to secure Adobe ColdFusion servers on their networks against two critical security flaws exploited in attacks, one of them as a zero-day.

Security Patches, Mitigations, and Software Updates

Atlassian Releases Security Updates | CISA (Cybersecurity and Infrastructure Security Agency CISA) Atlassian has released its Security Bulletin for July 2023 to address vulnerabilities in Confluence Data Center & Server (CVE-2023-22505 and CVE-2023-22508) and Bamboo Data Center (CVE-2023-22506). An attacker can exploit these vulnerabilities to take control of an affected system.

Trends

2023 Cofense Phishing Intelligence Trends Review: Q2 (Cofense) Learn about the latest phishing trends in Q2 of 2023. Get insight on new emerging threats, prominent malware operators and more to keep your data safe.

Few Fortune 100 Firms List Security Pros in Their Executive Ranks (KrebsOnSecurity) Many things have changed since 2018, such as the names of the companies in the Fortune 100 list. But one aspect of that vaunted list that hasn't shifted much since is that very few of these companies list any security…

Businesses Warned to Prepare for AI-Powered Misinformation and Cyberattacks (Fagen wasanni) Businesses Warned to Prepare for AI-Powered Misinformation and Cyberattacks - Fagen wasanni

Marketplace

Cisco says this week’s layoffs were announced last November (Computerworld) But employees say whether the layoffs are fresh or previously announced, they’re still losing their jobs.

NeoSystems Joins The MSP Collective as a Founding Member to Advance Initiatives to Protect Critical Infrastructure in the U.S. (PR Newswire) As one of three founding members, NeoSystems, has joined MSPs for the Protection of Critical Infrastructure (The MSP Collective), a non-profit...

BakerHostetler Welcomes Cybersecurity Specialist Eric B. Gyasi and Continues Strategic Growth (BakerHostetler) Eric B. Gyasi has joined BakerHostetler’s New York office as counsel in the firm’s Digital Assets and Data Management Practice Group, and he will be a member of the Digital Risk Advisory and Cybersecurity team.

Elon Musk says Twitter's blue bird to be replaced by an X (Reuters) Twitter Inc owner Elon Musk on Sunday signaled he would do more to take the social media company in a new direction with a rebranding that will replace its well-known blue bird logo with an X after acknowledging advertisers have been slow to return.

Elon Musk Changes Twitter Logo to an X (New York Times) The tech billionaire replaced the company’s blue bird silhouette with “X,” a term for what he has described as an “everything app.”

Products, Services, and Solutions

The Latest Update to the ReversingLabs A1000 Threat Analysis and Hunting Solution (ReversingLabs) Here are the essential updates to A1000 8.2 that will aid security operations centers (SOCs) as they defend against today’s most pressing cyber threats.

Macnica and Dragos to Deliver OT Cybersecurity to Critical Infrastructure and Manufacturing Control Systems in Japan (StreetInsider.com) HANNOVER, Md. & YOKOHAMA, Japan--(BUSINESS WIRE)-- Dragos, the global leader in cybersecurity for Operational Technology (OT), and Macnica Corporation (Headquarters: Yokohama City, Kanagawa Prefecture, President: Kazumasa Hara, hereinafter referred to as Macnica), have...

CovertSwarm Revolutionizes Attack Surface Management With Launch ff Free Offensive Operations Center (CovertSwarm) Our new platform is the missing link that joins SaaS-identified vulnerabilities and the ability to validate risk through a seamless ‘one click’ submission for ethical hacker testing.

Thales Confirms Its Key Role to Provide Cybersecurity for Galileo Second Generation to Meet Tomorrow's Threats (Business Wire) Thales has been notified by the European Space Agency (ESA), on behalf of the EU Agency for the Space Programme (EUSPA) and the European Union represented by the European Commission, of two major contracts for cybersecurity of Galileo Second Generation (G2G) program.

Akamai launches new sites, services and capabilities (Cloud Computing News) New global sites challenge legacy cloud architecture by opening the door to a modern, distributed design for cloud computing.

Technologies, Techniques, and Standards

Is cyber insurance covered by professional indemnity insurance? (The Law Society) What is cyber insurance? Is it included under the SRA minimum terms and conditions of professional indemnity insurance (PII)?

CISOs are making cybersecurity a business problem (Help Net Security) U.S. enterprises are responding to growing cybersecurity threats by working to make the best use of tools and services.

He Went to Prison for Crypto Crime. Now He’s an Advocate for Compliance. (Wall Street Journal) Charlie Shrem, a co-founder of the defunct BitInstant, was one of the first bitcoin millionaires and one of the first to do time for crypto violations. Today he preaches compliance to startups.

What Is Cyber Resilience? (crowdstrike.com) Cyber resilience describes an organization’s ability to minimize the impact of an adversary and restore their operations to maintain business continuity.

Council Post: Five Things You Should Never Store On Your Computer (Forbes) The average user, and even businesses, cannot account for all the file types and potential content that is stored on electronic devices.

Defending Your Organization from Illegal Data's Wrath (Datadobi) Businesses not only grapple with the management of data but also face the threat of illegal data concealed within their digital repositories.

CREST Releases Groundbreaking Paper on Building Effective Cyber Crime Units, Partnering with The Retired Investigators Guild to Resolve Unsolved Major Crimes Tied to Technology (THE RIG) The First Annual Tactical Challenge Sponsored by CREST Will Take Place October 13 and 14 at the Renaissance Reno

Design and Innovation

ChatGPT can write ransomware, but what about incident response plans? (SiliconANGLE) In a relatively short amount of time, generative artificial intelligence platforms such as OpenAI LP’s ChatGPT have shown immense capabilities in how we can advance the way we use artificial intelligence in our everyday lives – from critical business functions to personal advice and recommendations.

An AI Pause Is Humanity's Best Bet For Preventing Extinction (Time) Constantly improving AI would create a positive feedback loop: an intelligence explosion. We would be no match for it.

Don’t Ask Dumb Robots If AI Will Destroy Humanity (WIRED) Robots like Sophia are impressive to look at, but don’t let their humanlike facial expressions trick you into thinking these machines are intelligent.

Rise of the Machines: A CISO's Perspective on Generative AI (Splunk) Here are three risks leaders should consider — plus, how to mitigate them.

Academia

USNA Cyber Operations Program Granted NSA Designation in Cyber Defense (US Naval Academy) The Naval Academy cyber operations program was recently granted the National Security Agency (NSA) designation as a Center of Academic Excellence in Cyber Defense (CAE-CD) on June 9, 2023.

PAL students dive into cybersecurity studies at Mercyhurst University (WJET/WFXP/YourErie.com) Students part of the Police Athletic League (PAL) are learning about careers in law enforcement other than being an officer. The students visited Mercyhurst University to learn about their intellig…

Legislation, Policy, and Regulation

EU Cyber Resilience Act is a threat to open source in Europe, industry (Computing) Legislation, which passed last week, criticised for a lack of understanding of the open source model

Levin to establish inspection committee for cyber surveillance tools (Jerusalem Post) These changes were prompted by the notorious Pegasus affair, which challenged the public's trust in the government.

Israel to Investigate Police Use of NGO’s Pegasus Spyware (Haaretz) The commission, to be headed by ardent supporter of the government’s judicial coup, will examine Israel Police’s deployment of malware at the center of a global scandal

What is the status of US, Israel cyberwars? ( The Jerusalem Post | JPost.com ) The US and Israel have been and will continue to be in a persistent state of cyberwar with a number of adversaries, such as China, Russia, Iran, North Korea, and Hezbollah.

Solarium Co-Chairs Support New Cybersecurity Certification and Labeling Program (Congressman Mike Gallagher) Representative Mike Gallagher (R-WI) and Senator Angus King (I-ME), Co-chairs of the Cyberspace Solarium Commission (CSC), today released the following statement on the Biden administration’s announcement to institute a cybersecurity certification and labeling program, a policy move that was a key recommendation proposed by the Cyberspace Solarium Commission.

DOD Establishes Assistant Secretaries of Defense in the Office of the Under Secretary for (U.S. Department of Defense) The Defense Department announced the establishment of three new Assistant Secretary of Defense positions, along with eight Deputy Assistant Secretaries of Defense, in the Office of the Under Secretary

CISA sees CDM program entering ‘new era’ with focus on cyber defense operations (Federal News Network) CISA’s Michael Duffy provides an overview of the past, present and future of the landmark CDM program in an exclusive interview.

CISA supply chain task force preps Hardware Bill of Materials product for publication (Inside Cybersecurity) CISA’s supply chain task force is working on a Hardware Bill of Materials product that provides use cases to address different types of risks and common data fields for a proposed taxonomy, according to working group co-chair Chris Oatway of Verizon.

Military cyber intelligence center pushed by Senate panel (SC Media) The U.S. Department of Defense would be required to establish a dedicated cyber intelligence center in the version of the fiscal 2024 National Defense Authorization Act approved by the Senate Armed Services Committee late last month, reports DefenseScoop.

White House Says Amazon, Google, Meta, Microsoft Agree to AI Safeguards (Wall Street Journal) Big tech companies are adopting voluntary guidelines, such as watermarking artificial content.

The crypto industry is embracing self regulation. It’s time Washington gets on board (Fortune Crypto) Proof-of-reserve measures aren't a substitute for standard audits. They make them better.

The movement to limit face recognition tech might finally get a win (MIT Technology Review) A Massachusetts bill restricting police use could set the standard for how the technology is regulated in America. If it fails, it'll be a blow to a once-promising movement.

How face recognition rules in the US got stuck in political gridlock (MIT Technology Review) A national effort to ban police use of face recognition is facing a sobering reality: compromise

Several Arkansas counties race to pass crypto mining limits (Arkansas Online) Several Arkansas counties are moving quickly to pass emergency ordinances allowing them to regulate noise and other issues in advance of a new state law that will take effect Aug. 1 limiting the kinds of regulation local governments can implement on cryptocurrency mining facilities.

Litigation, Investigation, and Law Enforcement

Exclusive: Taiwan probes alleged leak of classified reports, diplomatic cables (Reuters) Taiwan is investigating a possible leak of official documents including diplomatic cables and classified reports on the island's sensitive bid to join a global trade pact, according to two officials familiar with the probe.

FBI searched foreign intelligence database for information on US senator (Reuters) The FBI improperly conducted warrantless searches for information about a U.S. senator and two state officials, a U.S. intelligence agency revealed on Friday, as lawmakers are weighing whether to renew the surveillance power that makes such searches possible.

FBI improperly searched U.S. senator's name in database, court finds (Axios) The FBI improperly used an intelligence database to search for information about a U.S. senator, state senator and a state-level judge, according to documents released Friday.

FBI improperly used warrantless search powers on US senator, others (Record) A state senator and judge also were subject to improper searches in the foreign intelligence database authorized by the federal statute known as Section 702, a newly declassified court ruling shows.

Russian Prosecutors Seek 18 Years In Prison For Cybersecurity Company Chief (RadioFreeEurope/RadioLiberty) Prosecutors have asked the Moscow City Court to convict and sentence Ilya Sachkov, the head of a leading Russian cybersecurity company, to 18 years in prison on a high treason charge.

Russia Seeks 18 Years in Jail for Founder of Cybersecurity Firm (The Moscow Times) A Russian prosecutor on Friday requested an 18-year prison sentence for Ilya Sachkov, founder of one of the country's top cybersecurity firms, on treason charges.

Russian Prosecutor Asks for 18 Years in Jail for Group-IB Founder (Infosecurity Magazine) Ilya Sachkov, the founder of cybersecurity provider Group-IB, is accused of state treason

Irish Circuit Court Awards Damages for ‘Non-Material’ Harm Under GDPR (cyber/data/privacy insights) On 11 July 2023, the Circuit Court of Ireland awarded 2,000 euros in compensation to a plaintiff seeking ‘non-material damage’ under Article 82 of the General Data Protection Regulation, in what is believed to be the first case in the European Union to follow the recent Court of Justice of the Europ

HHS Office for Civil Rights Settles HIPAA Investigation with iHealth Solutions Regarding Disclosure of Protected Health Information on an Unsecured Server for $75,000 (DataBreaches.net) HHS has announced another Security Rule enforcement action. This one involves iHealth Solutions (dba Advantum Health), a business associate. The incident...

Schools Sue Social-Media Platforms Over Alleged Harms to Students (Wall Street Journal) Facebook, TikTok, Snapchat and YouTube seek to dismiss federal suits, citing internet liability shield.

Johns Hopkins sued over May cybersecurity attack (WMAR 2 News Baltimore) Johns Hopkins University and Health System is being sued over a cybersecurity attack in May that affected their networks.

Hacker behind infamous GTA 6 leaks deemed mentally unfit for trial amid ongoing lawsuit (Dexerto) A panel of psychologists have deemed the teenage hacker responsible for last year's GTA 6 hacks unfit to stand trial.

Crypto rapper 'Razzlekhan,' husband reach plea deal over Bitfinex hack laundering (Reuters) An American couple accused of laundering billions of dollars worth of cryptocurrency stolen from the 2016 hacking of virtual currency exchange Bitfinex have entered into a plea agreement, court records showed on Friday.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

AWS Summit New York (New York, New York, USA, Jul 26, 2023) The cloud event for everyone. You’re invited to be part of our free, in-person event that brings together cloud enthusiasts for a day of learning, networking, and collaboration. Attend keynotes, breakout content, and interactive labs led by AWS experts, partners, and customers - and network with other industry professionals about the latest cloud computing technologies.

Critical Infrastructure Security Summit (Alexandria, Virginia, USA, Jul 26 - 27, 2023) Defense Strategies Institute is proud to present the 3rd annual Critical Infrastructure Security Summit. This Summit will convene senior leaders from across DoD, the Cyber Defense community, Federal Agencies, Industry, and Academia to discuss current methods for creating resilient systems to protect US infrastructure from external threats, as well as the defense mechanisms to protect those systems. The Summit will be held July 26-27, 2023 at the Mary M. Gates Learning Center in Alexandria, VA.

2023 International Cybersecurity Championship and Conference (IC3) (San Diego, California, USA, Aug 1 - 4, 2023) The International Cybersecurity Championship and Conference (IC3) event is designed to attract top talent and raise global awareness of the power of games to upskill the cybersecurity industry. Through its exciting, competition-based forum, the IC3 helps individuals...

Insider Threat Program Development / Management - Insider Threat Detection & Data Analysis Training Course (NASA Kennedy Space Center, Florida, USA, Aug 3 - 4, 2023) The training course will be taught at the NASA Kennedy Space Center in Florida on August 3-4, 2023. This highly sought after and very comprehensive 2 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CIO / IT Network Security, CISO, Human Resources, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group. This training will also provide students with an in depth view of how to obtain visibility of potential or malicious employee actions on computer systems and networks, using Insider Threat Detection software. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended this training course and received ITP Manager Certificates.

Black Hat USA (Las Vegas, Nevada, USA, Aug 5 - 10, 2023) Founded in 1997, Black Hat is an internationally recognized cybersecurity event series providing the most technical and relevant information security research. Grown from a single annual conference to the most respected information security event series internationally, these multi-day events provide the security community with the latest cutting-edge research, developments, and trends.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.